## Upstart Privacy Policy and Notice Upstart Network, Inc. and its affiliates ("UNI"), and, if applicable, Upstart Network Trust (collectively, "Upstart", "we", "us", "our") are committed to your privacy and security online. This policy describes the ways we collect, use, share and protect your personal information in connection with your use of [www.upstart.com] (https://www.upstart.com) and any of its subdomains (the “Site”) and the products and services offered on the Site by UNI, Upstart Network Trust and other third parties that UNI has partnered with. By accessing, using our service, or registering on the Site, you signify that you have read, understood and agree to our collection, storage, use and disclosure of your personal information as described in this Privacy Policy. It covers: 1. Our services 2. What information we collect 3. How we collect information 4. How we use the information we collect 5. What information we share 6. How we protect your information 7. Links to or from other websites and services 8. How you can access or change your personal information 9. Children’s privacy 10. Information for California consumers 11. Changes to our Privacy Policy 12. How you can contact us 13. Privacy Notice

Our services Upstart collects, uses, stores and shares information in connection with its products and services including: - the referral and loan comparison services we offer when you visit the Site and request conditional offers from one or more Creditors; - as an agent and service provider of banks and other third party licensed lenders that we have partnered with (each, a “Creditor”) for whom we may act as marketer, service provider, and/or loan servicer of their loan or credit card program; and - as servicer and administrator to Upstart Network Trust and certain other third party loan investors on whose behalf it is acting; and - when you authorize Upstart to send or receive your information to third parties to access certain additional products or services on the Site. We reserve the right in our sole discretion to make changes to how we operate and provide our services, including adding new services, modifying existing services, or suspending, discontinuing, or terminating your access to any or all portions of our services, as described below.

#### What Information we collect The types of personal information we collect depends on the products and services you use. The information includes: - Your name, address, phone number, email, date of birth, social security number and documents or other media that verifies your identity such as your driver’s license, passport and video calls you make at our request; - Information such as your credit history, credit scores and other information provided by consumer reporting agencies; - Information about your loan account and your payment history; - Information we receive from third party data partners for verification purposes including to verify your identity and manage risk; - Information about your education, such as your degree, your college, your major(s), and your grades including your college transcript; - Your bank information such as your bank, your account numbers, bank account credentials, and transaction information; - Information about your employer, current income, assets and certain expenses, including with respect to your current employment, employment offers, bank account credentials and transaction information, tax returns, W-2, brokerage statements, and pay stubs; - Information about your computer, mobile phone or other access device and anonymous information about your web request, Internet Protocol (“IP”) address, geolocation data, browser type, referring / exit pages and URLs, number of clicks and how you interact with links on the Site, domain names, landing pages, pages viewed, your use of third party applications, and other information that assists us in analyzing and improving the Service. Please note that Upstart only provides its services and offerings to consumers based in the United States and therefore, is not subject to the General Data Protection Regulation (GDPR).

#### How we collect information We collect information about you: - Directly from you when you register on the Site and use the Site and our products and services; fill out forms or fields such as when you request a loan offer, or apply for a loan or to be an investor; through the services you opt in to, such as when you receive third party loan offers or choose automatic bank account verification; from your transactions, including your security purchases, loan repayments, account funding and withdrawals; and your communications with us. - Automatically from you when you visit the Site or use the products and services available on the Site: * We collect certain information from your computer, mobile phone or other access device that is automatically reported by your browser or mobile device each time you access the Site; * We automatically record certain log file information such as IP address, browser type, and what you do on our Site; * We may also employ clear gifs (also known as web beacons) which are used to anonymously track the online usage patterns of our users; * We may also use clear gifs in HTML-based emails sent to you to track which emails are opened and which links are clicked by recipients; * We (or companies we work with) may place small data files called cookies or pixel tags on your computer or other device. * You are free to decline our cookies if your browser or browser add-on permits, but doing so may interfere with your use of the Site. The help legal section of most browsers or browser add-ons provides instructions on blocking, deleting or disabling cookies. - From third party service providers including information we request on your behalf from credit reporting agencies such as TransUnion, Equifax, and/or Experian, information we receive from third party data partners who supplement and/or verify information we collect from you, and information we access from public records or websites. - From third party referral partners that you engage with who may pass certain information about you and your use of their service to us. This information could include any information that you have permitted the third party to share with us, and any information you have made public in connection with that service. You should always review and, if necessary, adjust your privacy settings on third-party websites and services before visiting the Site. - From third-party advertisers that use cookies on the Site for the purposes of targeted behavioral advertising. Although you may not opt out of receiving online advertisements generally, you may control the collection of data by third party advertisers on our Site used for targeted advertising during your visits to other websites. To opt-out of this data collection for targeted advertising on other sites, visit the [Network Advertising Initiative] (http://optout.networkadvertising.org/?c=1)

#### How we use the information we collect We collect this information from or about you in order to: - provide you and other customers with access to the products and services offered through the Site; - improve our insights so we can tailor our content and advertising, and provide you with offer recommendations and/or insights that are most relevant to you; - provide notices and other information to you about, or in connection with, these products and services; - provide customer support; - detect security incidents, protect against malicious, deceptive, fraudulent or illegal activity, fulfill legal requirements and enforce our agreements; - debug to identify and repair errors that impair existing intended functionality; - provide, maintain, develop and improve our services, your experience, and to protect Upstart and its users; and - improve your experience accessing the products and services offered through the Site by recognizing you as a customer and remembering information you previously provided so that you will not have to re-enter it.

#### What information we share All financial companies need to share customers’ personal information to run their everyday business. Subject to any applicable legal exemptions including the Gramm-Leach Bliley Act, and/or the California Consumer Privacy Act, we may share your personal information, including non-public personal information with: - Creditors that you request a conditional loan offers from or who decline to pre-approve you for a loan when you request a loan offer; - Service providers who help with parts of our business operations such as fraud prevention, servicing, bill collection, debt collection, marketing and technology services, product development, and nonaffiliated financial institutions that we partner with to market or provide the products or services to you; - Credit reporting agencies to report account information, at your direction and otherwise as permitted by law; - Debt collection companies that purchase your loan from a Creditor if it has been charged off; - Companies that we plan to merge with or be acquired by, or companies we plan to sell, divest or transfer all or a portion of our products and/or services to, including any back-up service provider or back-up administrator we, or any Creditor engage in the event we stop operating; - Law enforcement, government officials, or other third parties when (1) we are compelled to do so by a subpoena, court order or similar legal procedure, (2) we need to do so to comply with law, or (3) if we believe in good faith that the disclosure of your personal information is necessary to prevent physical harm or financial loss or to report suspected illegal activity; and - Other third parties but only if you consent or direct us to do so. If you select a loan offer from Cross River Bank or FinWise Bank then when you sign your promissory note, your loans may automatically be allocated to one of two investment channels based on allocation methodology determined by us: - The first allows investors on the Upstart site to purchase loans through Upstart Network Trust. We share some of your information with investors. This is limited to your loan terms, loan grade, repayment history and loan status, and your credit score. - The second allows investors to purchase 100% of your loan directly from us. We provide information about you included in your application, including personally identifiable, financial, and credit information, and your loan terms to these investors and their agents and trustees in advance of their purchase of your loan. - As the servicer of your loan we will also share information we obtain in servicing your loan, including about your repayments, to Upstart Network Trust and these investors, who become the Creditor of your loan, any subsequent purchaser of your loan, and each of their agents or trustees. If you have an income share agreement, we will share your name and information about your repayment history with investors in your income share agreement. Upstart will not sell or rent any of your personal information to third parties and only shares your personal information with third parties as described above. Information that has been deidentified so that it does not identify a specific user is not considered personal information. Federal and state laws allow you to restrict the sharing of your personal information in certain instances such as sharing your information so that third parties can market to you. However, because we will not share your information in these instances without your express consent, there is no need for you to opt-out from the information we share.

#### How we protect your information We care about the security of your information and take reasonable measures designed to protect your personal information from unauthorized access and use by maintaining physical, electronic and procedural safeguards in compliance with applicable law. These measures include computer safeguards and secured files and buildings. You are responsible for maintaining the secrecy of your unique password and account information, and for controlling access to your email communications from us at all times. However, we cannot ensure or warrant the security of any information you transmit to us or guarantee that information may not be accessed, disclosed, altered or destroyed. In the event that any information under our control is compromised as a result of a breach of security, we will take reasonable steps to investigate the situation and where appropriate, notify those individuals whose information may have been compromised and take other steps, in accordance with any applicable laws and regulations.

#### Links to or from other websites and services We are not responsible for the practices employed by any third party, or websites or services linked to or from the Site, including any information or content they contain. Please remember that when you use a link from a third party to visit our Site, or use a link to go from the Site to another website, our Privacy Policy does not apply to those third-party websites or services. Your browsing and interaction on any third-party website or service, including those that have a link or advertisement on the Site, are subject to that third party’s own rules and policies, including their terms and conditions and privacy practices. In addition, you agree that we are not responsible and we do not control over any third-parties that you authorize to access your user content. If you are using a third-party website or service (like LinkedIn) and you allow such a third-party access to your user content, you do so at your own risk.

#### How you can access or change your personal information You can review and edit some of your personal information at any time by logging into the Site.

#### Children’s privacy We do not knowingly collect or solicit any information from anyone under the age of 13 or knowingly allow such persons to register as users. The Site and its content are not directed at children under the age of 13. If we learn that we have collected personal information from a child under age 13, we will delete that information promptly. If you believe that we might have any information from a child under 13, please contact us at privacy@upstart.com.

#### Information for California consumers This section provides additional details about the personal information we collect about California consumers and the rights afforded to them under the California Consumer Privacy Act (“CCPA”). In the last 12 months, we collected the following categories of personal information: identifiers (such as name and contact information), demographic information (such as age and gender), commercial information (such as products purchased), internet or other electronic network activity information (such as browsing behavior), geolocation data, audio, electronic, visual or similar information (such as customer support calls), and inferences we make (such as preferred activities). For more details about the personal information we collect, including the categories of sources, please see the “What information we collect” section above. We collect this information for the business and commercial purposes described in the “How we use information” section above. We share this information with the categories of third parties described in the “What information we share” section above. Subject to certain exemptions, the CCPA provides California consumers the right to request to know more details about the categories and specific pieces of personal information we collect, to delete their personal information, to opt out of any “sales” that may be occurring, and to not be discriminated against for exercising these rights. If your information falls into one of the legal exemptions included in the CCPA, we may be unable to fulfill your request. We do not “sell” the personal information we collect (and will not sell it in the future without providing a right to opt out). We do allow third parties to collect personal information through our services and share personal information with third parties for the business purposes described in this Privacy Policy, including without limitation advertising and marketing on our services and elsewhere based on users’ online activities over time and across different sites, services, and devices. California consumers may make a rights request by visiting [this page] (https://www.upstart.com/datarequest).

#### Changes to our Privacy Policy We may amend this policy from time to time to reflect the changes in our business and practices, and so you should review this page periodically. The revised version will be effective at the time we post it. If we make a material change we will notify you of the changes by posting a Policy Update and update the ‘last modified’ date at the bottom of this page.

#### How you can contact us If you have questions or concerns regarding this policy, you should contact us by emailing us at privacy@upstart.com, by calling us at (650) 204-1000 during our operating hours 9:00 AM PST to 5:00 PM PST, Monday through Friday, or by writing to us via regular mail at Upstart Network, Inc., P.O. Box 1503, San Carlos, CA 94070.

#### Privacy Notice Our privacy practices are described in more detail above, and we have provided a summary of how we handle non-public personal information below: | FACTS| What does Upstart do with your personal information?| | :--- | :--- | | Why? |Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing.Federal law also requires us to tell you how we collect, share, and protect your personal information.Please read this notice carefully to understand what we do. | |What?|The types of personal information we collect and share depend on the product or service you have with us. This information can include:
• Social Security number and other identity information;
• Account balances and payment history;
• Credit history, credit scores, education and employment information;
• Bank account, financial and income information;
• Information about how you access and use our website and other services. |How?|All financial companies need to share customers’ personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers’ personal information; the reasons Upstart chooses to share; and whether you can limit this sharing.| | Reasons we can share your personal information| Does Upstart share?| Can you limit this sharing?| | :--- | :--- | :--- | |For our everyday business purposes - such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus|Yes|No| |For our marketing purposes - to offer our products and services to you|Yes|No| |For joint marketing with other financial companies|No| We don't share| |For our affiliates’ everyday business purposes - information about your transactions and experiences|No| We don't share| |For our affiliate’s everyday business purposes - Information about your creditworthiness|No| We don't share| |For our affiliates to market to you|No| We don't share| |For our non-affiliates to market to you|No| We don't share| |Questions?| Email us at privacy@upstart.com or call us at 1-855-438-8778.| | :--- | :--- | | Other important information|| | :--------- | |For California residents|We will not share information we collect about you with nonaffiliated third parties, except as permitted by California law, such as to process your transactions or to maintain your account. We do not share with our affiliates.| |For Nevada residents|If you would like to review and request changes to any of your covered information that is collected through the Internet website or online service, please contact us at privacy@upstart.com.| |For Vermont residents|We will not share information we collect about you with nonaffiliated third parties, except as permitted by Vermont law, such as to process your transactions or to maintain your account and with your consent.| | Who we are|| |:------------------| |Who is providing this notice?| You are receiving this notice from Upstart, also known as Upstart Network, Inc.| | What we do|| |How does Upstart protect my personal information?|To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings.| |How does Upstart collect my personal information?|We collect your personal information, for example, when you:
• Open an account
• Give us your contact information
• Give us your income information
• Show your government-issued ID
• Request a loan offer or purchase securities
We also collect your personal information from others, such as credit bureaus, affiliates, or other companies.| |Why can’t I limit all sharing?|Federal law gives you the right to limit only:
• sharing for affiliates’ everyday business purposes—information about your creditworthiness
• affiliates from using your information to market to you
• sharing for nonaffiliates to market to you
Definitions|| |Affiliates|Companies related by common ownership or control. They can be financial and nonfinancial companies.
• Upstart does not share with our affiliates.| |Nonaffiliates| Companies not related by common ownership or control. They can be financial and nonfinancial companies.
• Nonaffiliates we can share with include our marketing service providers.| |Joint marketing| A formal agreement between nonaffiliated financial companies that together market financial products or services to you.
• Upstart doesn't jointly market.| This privacy policy was last modified on December 20, 2019.