Upstart Privacy Policy

This Privacy Policy is effective as of January 1, 2023

PLEASE READ THIS PRIVACY POLICY CAREFULLY. This policy describes the ways Upstart Network, Inc. and its affiliates ("**UNI**"), and, if applicable, Upstart Network Trust (collectively, "**Upstart**", "**we**", "**us**", "**our**") are committed to your privacy and security online. We take your privacy and the security of information about you seriously. This privacy policy describes the ways we collect, use, share and protect your personal information in connection with your use of [www.upstart.com](www.upstart.com) and any of its subdomains, and the products and services offered on the Site by UNI, Upstart Network Trust (the “**Services**”). If you are a California resident, please also see "Your Privacy Rights" section below. If you have an account with us, or have taken steps to register for an account, you can also review our "Upstart Privacy Notice" at the end for a summary of our practices regarding the personally identifiable financial information we collect about you. This policy covers: 1. Our Services 2. Categories of Information We Collect and How We Use It
a. What Information We Collect
b. How We Use the Information We Collect
c. What Information We Disclose 3. How We Use Cookies and Other Tracking Technology to Collect Information 4. How We Protect Your Information 5. Links to or from Other Websites and Services 6. How You Can Access or Change Your Personal Information 7. Children’s Privacy 8. Your Privacy Rights 9. Changes to Our Privacy Policy 10. How You Can Contact Us 11. Privacy Notice *** #### Our Services Upstart collects, uses, stores and shares information in connection with its products and services including: - the referral and loan comparison services we offer when you visit the Site and request conditional offers from Upstart, banks, and other third party licensed lenders ("**Creditors**") for whom we may act as marketer, service provider, and/or loan servicer of their loan; - as servicer and administrator to Upstart Network Trust and certain other third party loan investors on whose behalf it is acting; - when you authorize Upstart to send or receive your information to third parties to access certain additional products or services on the Site; and - when Upstart’s business contacts authorize Upstart to receive information regarding its enterprise contacts. *** #### Categories of Information We Collect and How We Use It We collect information about you through the following sources: information you provide directly to us (such as when you register for our services, fill out a form or communicate with us), information we collect from third parties (such as Internet Protocol (“**IP**”) address and geolocation data) and information we generate (such as through inferences or when you use the Services). *** #### What Information We Collect The types of personal information we collect depends on the products and services you use. The information includes: - Your name, address, phone number, email, date of birth, social security number and documents or other media that verifies your identity such as your driver’s license, passport and video calls you make at our request. - Information such as your credit history, credit scores and other information provided by consumer reporting agencies. - Information about your loan account and your payment history. - Information we receive from third party data partners for verification purposes including to verify your identity and manage risk. - Information about your education, such as your degree, your college, your major(s), and your grades including your college transcript. - Your bank information such as your bank, your account numbers, bank account credentials, and transaction information. - Information about your employer, current income, assets and certain expenses, including with respect to your current employment, employment offers, bank account credentials and transaction information, tax returns, W-2, brokerage statements, and pay stubs. - Information about your computer, mobile phone or other access device and information about your web request collected through cookies and other related technologies (such as clear gifs). The information we collect includes IP address, geolocation data, browser type, referring / exit pages and URLs, number of clicks and how you interact with links on the Site, domain names, landing pages, pages viewed, your use of third party applications, and other similar device and usage information. - Business information that you provide to us directly or through third-party services. We may receive information about you or your business from public records or from third parties, including information we request from credit reporting agencies, and from other partners. For example, we may also collect this information from your registration application submitted through provider agreement, business loan application, or from a personal loan application if you are self-employed. - The business information may include information about your business, such as legal business name and company practice name, and other information about your company or practice such as fax, telephone number, website, relevant email addresses, physical address, business-related licensing information such as a license number, federal tax identification or social security number, and business or practice bank account information. We may supplement the personal information you submit to use with information from third-party sources. Please note that Upstart only provides its services and offerings to consumers based in the United States and therefore, is not subject to the General Data Protection Regulation (GDPR). *** #### How We Use the Information We Collect We collect and use this information from or about you in order to: - provide you and other customers with access to the products and services offered through the Site; - improve our insights so we can tailor our content and advertising, and provide you with offer recommendations and/or insights that are most relevant to you; - provide notices and other information to you about, or in connection with, these products and services; - provide customer support; - detect security incidents, protect against malicious, deceptive, fraudulent or illegal activity, fulfill legal requirements and enforce our agreements; - debug to identify and repair errors that impair existing intended functionality; - provide, maintain, develop and improve our services, your experience, and to protect Upstart and its users; - improve your experience accessing the products and services offered through the Site by recognizing you as a customer and remembering information you previously provided so that you will not have to re-enter it; - process your transactions, your loan application or transactions, enable payments, and fund transfers with financial institutions, to improve and expand our Services, and to determine your financial health. If you register with us, we will use this financial information about you to facilitate and service your account; - connect with securitizations and other investment products with an interest in your loan; - determine creditworthiness if you are applicant and/or borrower, assess risks related to your transaction, and to help investors determine whether to commit to or purchase your loan; and - if you consent to have UNI request your financial information directly from your financial institution, we may work with a third party, such as Plaid, to access and collect such information on our behalf. By providing your financial information to the third party, you acknowledge and agree that such information accessed, collected, or transmitted by the third party for this purpose will be governed by the privacy policy of the third party. Plaid's privacy policy is available at [https://plaid.com/legal]( https://plaid.com/legal). *** #### What Information We Disclose All financial companies need to disclose customers’ personal information to run their everyday business. Subject to any applicable legal exemptions including the Gramm-Leach Bliley Act, and/or the California Consumer Privacy Act, we may disclose your personal information, including personally identifiable financial information with: - creditors that you request a conditional loan offers from or who decline to pre-approve you for a loan when you request a loan offer; - UNI companies, our parents, affiliates, subsidiaries, and other companies under common control and ownership; - service providers, vendors, contractors, and consultants who help with parts of our business operations such as fraud prevention, servicing, bill collection, debt collection, advertising, marketing and technology services, product development, and nonaffiliated financial institutions that we partner with to market or provide the products or services to you; - credit reporting agencies to report account information, at your direction and otherwise as permitted by law; - debt collection companies that purchase your loan from a Creditor if it has been charged off; - companies that we plan to merge with or be acquired by, or companies we plan to sell, divest or transfer all or a portion of our products and/or services to, including any back-up service provider or back-up administrator we, or any Creditor engage in the event we stop operating; - law enforcement, government officials, or other third parties when (1) we are compelled to do so by a subpoena, court order or similar legal procedure, (2) we need to do so to comply with law, or (3) if we believe in good faith that the disclosure of your personal information is necessary to prevent physical harm or financial loss or to report suspected illegal activity; and - other third parties but only if you consent or direct us to do so. If you select a loan offer from Cross River Bank, FinWise Bank or Customer’s Bank when you sign your promissory note, your loans may automatically be allocated to investors as follows: - Investors may purchase your loan directly from us. We provide information about you included in your application, including personally identifiable, financial, and credit information, and your loan terms to these investors and their agents and trustees in advance of their purchase of your loan. - As the servicer of your loan we will also share information we obtain in servicing your loan, including about your repayments, to Upstart Network Trust and these investors, who became the Creditor of your loan, any subsequent purchaser of your loan, and each of their agents or trustees. If you have an income share agreement, we will share your name and information about your repayment history with investors in your income share agreement. Please note, information that has been aggregated, anonymized or de-identified so that it does not identify a specific user is not considered personal information. Additionally, federal and state laws allow you to restrict the disclosure of your personally identifiable financial information in certain instances such as disclosing your information so that third parties can market to you. However, because we will not disclose your information in these instances without your express consent, there is no need for you to opt-out from the information we disclose. *** #### How We Use Cookies and Other Tracking Technology to Collect Information We engage others to provide analytics, serve advertisements, and perform related services across the web and in mobile apps. These entities may use cookies, web beacons, device identifiers, and other technologies to collect information about your use of our Services and other websites and mobile apps, including your IP address, web browser, mobile network information, pages viewed, time spent on pages or in mobile apps, links clicked, and conversion information. This information is used to deliver advertising targeted to your interests on other companies’ sites or mobile apps and to analyze and track data, determine the popularity of certain content, and better understand your activity. Some of our advertising partners enable us to translate your email address or phone number into an identifier that can’t be used to identify you personally. Our advertising partners then use that unique identifier to show ads that are more relevant to you across the web and in mobile apps. Some of the activities described in this section may constitute “targeted advertising,” “sharing,” or “selling” under certain laws. To learn more about the choices available to you with respect to these practices, see below "Opting Out of Targeted Advertising, Sharing, and Sales".

You can also learn more about interest-based ads, or opt out of having your web browsing information used for behavioral advertising purposes by companies that participate in the Digital Advertising Alliance, by visiting www.aboutads.info/choices. *** #### How We Protect Your Information We care about the security of your information and take reasonable measures designed to protect your personal information from unauthorized access and use by maintaining physical, electronic and procedural safeguards in compliance with applicable law. These measures include computer safeguards and secured files and buildings. You are responsible for maintaining the secrecy of your unique password and account information, and for controlling access to your email communications from us at all times. However, we cannot ensure or warrant the security of any information you transmit to us or guarantee that information may not be accessed, disclosed, altered or destroyed. In the event that any information under our control is compromised as a result of a breach of security, we will take reasonable steps to investigate the situation and where appropriate, notify those individuals whose information may have been compromised and take other steps, in accordance with any applicable laws and regulations. *** #### Links to or from Other Websites and Services We are not responsible for the practices employed by any third party, or websites or services linked to or from the Site, including any information or content they contain. Please remember that when you use a link from a third party to visit our Site, or use a link to go from the Site to another website, our Privacy Policy does not apply to those third-party websites or services. Your browsing and interaction on any third-party website or service, including those that have a link or advertisement on the Site, are subject to that third party’s own rules and policies, including their terms and conditions and privacy practices. In addition, you agree that we are not responsible and we do not control any third-parties that you authorize to access your user content. If you are using a third-party website or service (like LinkedIn) and you allow such a third-party access to your user content, you do so at your own risk. *** #### How You Can Access or Change Your Personal Information You can review and edit some of your personal information at any time by logging into the Site. *** #### Children’s Privacy We do not knowingly collect or solicit any information from anyone under the age of 13 or knowingly allow such persons to register as users. The Site and its content are not directed at children under the age of 13. If we learn that we have collected personal information from a child under age 13, we will delete that information promptly. If you believe that we might have any information from a child under 13, please contact us at privacy@upstart.com. *** #### Your Privacy Rights This section applies to U.S. state privacy laws (like California’s CCPA) that apply to data we collect about you. Please note, however, that these broadly-applicable privacy laws do not apply to what is referred to as personally identifiable financial information collected by financial institutions (like Upstart), as that information is subject instead to other financial privacy laws (like the Gramm-Leach-Bliley Act (GLBA)). As a result, these laws do not apply to most of the information that Upstart collects. The details below only apply to the more limited personal information we collect that is subject to these broadly-applicable U.S. state privacy laws. **Access, Correction, and Deletion** Depending on where you reside, you may have the right under certain U.S. state privacy laws to (1) request to know more about and access your personal information, (2) request deletion of your personal information, and (3) request correction of inaccurate personal information. To request access, correction, or deletion of personal information that is subject to these privacy laws, please go to [https://www.upstart.com/datarequest](https://www.upstart.com/datarequest) or contact us privacy@upstart.com. If we deny your request, you may appeal our decision by contacting us at privacy@upstart.com. If you have concerns about the results of an appeal, you may contact the attorney general in the state where you reside. **Opting Out of Targeted Advertising, Sharing, and Sales** As described in the “How We Use Cookies and Other Tracking Technology to Collect Information” section above, we process personal information to understand and improve your experience with our Services and to serve you advertisements on other properties. Some of these activities may be considered “sales” or “sharing” of your personal information or “targeted advertising” under the law that applies to you. Depending on where you reside, you may have the right to opt-out of targeted advertising, sharing, and sales of your personal information. You can do so by following the prompts here [https://www.upstart.com/datarequest]( https://www.upstart.com/datarequest). **Data Retention** We store this personal information for as long as necessary to carry out the purposes for which we originally collected it and for other business purposes explained in this Privacy Policy. **Additional Information for California and Colorado Consumers** This section provides additional details about the personal information we collect about California and Colorado consumers and the rights afforded to them under the California Consumer Privacy Act (“**CCPA**”) and the Colorado Privacy Act (“**CPA**”). Please see the chart below for a list of the personal information subject to the CCPA and CPA we have collected about California and/or Colorado consumers in the last 12 months, along with our business and commercial processing purposes and categories of third parties to whom this information may be disclosed. For more details about the personal information we collect, including the categories of sources, please see the "What information we collect" section above. |**Categories of personal information we collect**
| **Business or commercial purposes for which we may use your information**
| **Parties with whom information may be disclosed**
| | :--- | :--- | :--- | :--- | | Identifiers, such as unique identifiers (like IP address) tied to your browser or device.

Approximate geolocation data.

Internet or other electronic network activity, such as browsing behavior and information about your usage and interactions with our Services. | Improving and maintaining our Services, such as by improving our Services and developing new products and services.

Debugging, such as to identify and repair errors and other functionality issues.

Analyze usage, such as by monitoring trends and activities in connection with use of our Services.

Personalize your online experience, such as by tailoring the content and targeting ads you see on our Services and on other platforms based on your preferences, interests, and browsing behavior.

Legal reasons, such as to help detect and protect against security incidents, or other malicious, deceptive, fraudulent, or illegal activity. | Companies that provide services to us, such as those that assist us with customer support, advertising measurement, data analytics, cloud storage, bug fix management and logging.

Government entities or other third parties for legal reasons, such as to comply with law or for other legal reasons described in the “What Information We Share” section above. | We also “share” and “sell” identifiers and electronic network activity with our advertising partners (including social media platforms) so they can show ads that are targeted to your interests on other platforms. We have no actual knowledge of “sharing” or “selling” information about children younger than 16. To opt out, you can use our cookie preferences tool to disable ad trackers on our website and can adjust your mobile device settings to limit ad tracking via the mobile app. You can also opt out by visiting our Services with a recognized universal choice signal enabled (such as the Global Privacy Control). Please note that, depending on which opt-out preference signal you use, our processing of the signal may be limited to the specific browser or device that you are using. You may need to renew your opt-out if you use a different browser or device to access our Services. If we detect an automated opt out preference signal, we will treat it as a request to opt out of “sharing” and “selling” for the browser or device sending the signal. In addition to those rights, California and Colorado consumers have the rights described above under the "Your Privacy Rights" section above. You may also designate an authorized agent to exercise privacy rights on your behalf by providing the authorized agent signed permission to submit the request on your behalf. If an authorized agent submits a request on your behalf, we may need to contact you to verify your identity and protect the security of your personal information. If you are an authorized agent seeking to make a rights request, please contact us at privacy@upstart.com. *** #### Changes to Our Privacy Policy We may amend this policy from time to time to reflect the changes in our business and practices, and so you should review this page periodically. The revised version will be effective at the time we post it. If we make a material change we will notify you of the changes by posting a Privacy Policy Update and update the ‘last modified’ date at the bottom of this page. *** #### How You Can Contact Us If you have questions or concerns regarding this policy, you should contact us by emailing us at privacy@upstart.com, by calling us at (650) 204-1000 during our operating hours 6:00 AM PT to 5:00 PM PT, Monday through Friday, or by writing to us via regular mail at Upstart Network, Inc., PO Box 1503, San Carlos, CA 94070. *** This privacy policy was last modified in December 2022. ***

Upstart Privacy Notice

This Privacy Notice is effective as of January 1, 2023

Upstart Network, Inc. and its affiliates ("**UNI**"), and, if applicable, Upstart Network Trust (collectively, "**Upstart**", "**we**", "**us**", "**our**") are committed to your privacy and security online. We take your privacy and the security of information about you seriously. Our privacy practices are described in more detail below, and we have provided a summary of how we handle non-public personal information below: | **Facts**| What does Upstart do with your personal information?| | :--- | :--- | | Why?|Financial companies choose how they disclose your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do. | |What?|The types of personal information we collect and share depend on the product or service you have with us. This information can include:
• Social Security number and other identity information
• Account balances and payment history
• Credit history, credit scores, education and employment information
• Bank account, financial and income information
• Information about how you access and use our website and other services |How?|All financial companies need to disclose customers’ personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers’ personal information; the reasons Upstart chooses to share; and whether you can limit this sharing.| | **Reasons we share your personal information**

| Does Upstart Share?| Can You Limit This Sharing? | :--- | :--- | :--- | |For our everyday business purposes - such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus|Yes|No| |For our marketing purposes - to offer our products and services to you|Yes|No| |For joint marketing with other financial companies|No|We do not share| |For our affiliates’ everyday business purposes - information about your transactions and experiences|Yes|No| |For our affiliate’s everyday business purposes - Information about your creditworthiness|No| We do not share| |For our affiliates to market to you|No|We do not share| |For our non-affiliates to market to you|No|We do not share| |**To limit our sharing**

| You may limit our sharing with affiliates, unless otherwise required or allowed by law, by contacting us at privacy@upstart.com. We do not share with non-affiliates.

Please note: When you are no longer our customer, we can continue to share your information as described in this notice. | :---| :---| | **Questions?**| **Email us at privacy@upstart.com, call us at (855) 438-8778, or visit us at [www.upstart.com/privacy_policy](https://www.upstart.com/privacy_policy)**. | :--- | :---| |**Who we are**|| |:---| |Who is providing this notice?| You are receiving this notice from Upstart, also known as Upstart Network, Inc. (UNI).| | **What we do**|| | :---| |How does Upstart protect my personal information?|To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings.| |How does Upstart collect my personal information?|We collect your personal information, for example, when you:
• Open an account
• Give us your contact information
• Give us your income information
• Show your government-issued ID
• Request a loan offer or purchase securities

We also collect your personal information from others, such as credit bureaus, affiliates, or other companies.| |Why can’t I limit all sharing?|Federal law gives you the right to limit only:
• sharing for affiliates’ everyday business purposes - information about your creditworthiness
• affiliates from using your information to market to you
• sharing for nonaffiliates to market to you

State laws and individual companies may give you additional rights to limit sharing. See below for more on your rights under state law. |What happens when I limit sharing for an account I hold jointly with someone else?| Your choices will apply individually unless you tell us otherwise. Any account holder may express a privacy preference on behalf of the other joint account holders.| |**Definitions**|| | :---| :---| |Affiliates|Companies related by common ownership or control. They can be financial and nonfinancial companies. |Non-Affiliates|Companies not related by common ownership or control. They can be financial and nonfinancial companies.
• Non-affiliates we can share with include our marketing service providers- can include other financial services companies, lenders, insurance companies, retailers, membership clubs, or other consumer service providers such as data processors, service providers, and companies that help us market our own products and third-party products that we believe may be of interest to you.| |Joint Marketing| A formal agreement between non-affiliated financial companies that together market financial products or services to you.
• Upstart does not jointly market.| |**Other important information**|| | :---| :---| |**For California Residents**|We will not share information we collect about you with non-affiliated third parties, except as permitted by California law, such as to process your transactions or to maintain your account.| |**For Vermont Residents**|We will not share information we collect about you with non-affiliated third parties outside of Upstart, except as permitted by Vermont law or as authorized by you, such as to process your transactions or to maintain your account and with your consent.| |**For Nevada Residents**|We provide you this notice under Nevada state law. If you prefer not to receive marketing calls from us, you may be placed on our internal Do-Not-Call List by calling us at
(855) 438-8778 or sending a message to privacy@upstart.com.

If you would like to review and request changes to any of your covered information that is collected through the Internet website or online service, please contact us at privacy@upstart.com or

Upstart Network Inc.,
Attn: Compliance Department
PO Box 1503, San Carlos, CA 94070

Or contact the

Bureau of Consumer Protection
Office of the Nevada Attorney General
555 E. Washington St., Suite 3900
Las Vegas, NV 89101
Phone number: (702) 486-3132 |**For Alaska, Illinois, Maryland, and North Dakota Customers**|We will not share personal information with non-affiliates either for them to market to you or for joint marketing – without your authorization.| |**For Massachusetts, Mississippi, and New Jersey Customers**|We will not share personal information from deposit or share relationships with non-affiliates either for them to market to you or for joint marketing – without your authorization.|

Personal Loans

Consolidation

Car Loan Refinance

Education

Tools