Last Revised: August 8, 2025

California Consumer Privacy Act Disclosure

At Trovy, we are committed to safeguarding your privacy.

This California Consumer Privacy Act Disclosure (the “Disclosure”) explains how Trovy Technologies, Inc., together with its subsidiary Trovy Lending Co. (collectively, “Trovy,” “we,” “our,” or “us”), collects, uses and discloses personal information relating to California residents (“you” or “your”) who are subject to the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations (collectively, the “CCPA”). It also describes the categories of personal data we collect, the purposes for which that information is collected, a summary of the rights you have and how to exercise those rights. This Disclosure should be read in conjunction with Trovy’s Privacy Policy and Terms of Service, which are incorporated herein by reference.

What Personal Information is Covered by the CCPA?

Under the CCPA, “personal information” is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. It does not include publicly available information that has been aggregated or de-identified.

The CCPA does not apply to certain information such as information subject to the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, and certain other state or federal privacy laws. For example, this CCPA Disclosure does not apply to information that we collect about individuals who seek, apply for, or obtain our financial products and services for personal, family or household purposes, which is subject to our GLBA Notice, or other financial privacy notice applicable to the Trovy sites or services that you visit or use.

This CCPA Disclosure does not apply to information we collect in the context of a person’s role as a job applicant, employee, associate, or contractor.

Types of Personal Information We Collect
Most of the personal information that we maintain has been collected in the context of providing financial products and services for personal, family, or household purposes, and therefore is not subject to the CCPA. However, we also collect personal information relating to California residents in other contexts, including in connection with our marketing activities, our websites and mobile applications.

We may collect the following categories of personal information, as defined by the CCPA, relating to California residents. The categories of personal information that we collect, use, and disclose about a California resident will depend on our specific relationship. We may disclose categories of personal information for business purposes to our third-party service providers, our affiliates and business partners, and regulators / government agencies. We may also continue to collect these categories of personal information. The examples provided in each category below are for illustrative purposes only.

Categories of Information	Examples
Address and other identifiers	Name, postal address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers
Characteristics of protected classifications	Age, gender, and marital status
Unique and online identifiers	IP address, device IDs, browsing history, search history, and information on consumer’s interaction with a website
Commercial information	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies
Internet or other electronic network activity information	Browsing history, search history, settings, and information regarding an individual’s interaction with an internet website, application, AI chatbot service, or advertisement, device information, including name of device and operating system, cookies and pixel tags, city of login, and other data that your browser automatically sends
Audio or video footage or other visual information	Service calls, voicemails and other audio recordings, photographs
Professional or Employment Information	Employer, years of employment

While some of the information that we collect may be considered sensitive personal information, Trovy uses and discloses sensitive personal information for those purposes that are authorized by law. For example, Trovy may process sensitive personal information to perform the services or provide the goods you request from us or to verify customer information. California law does not afford you rights to limit the use or disclosure of your sensitive personal information for these purposes. In addition, we may draw inferences about you based on the information you provide, such as individual preferences or characteristics, and we may collect and use information as described to you when collecting the information. We may also receive Personal Data that individuals provide to us or store on our systems.

Categories of Sources of Personal Information
We may collect personal information relating to California residents from the following sources:

Sources	Examples
Directly from you	HELOC or other types of applications, interactions with our website or mobile apps, and calls to our call center
Affiliates	Companies related by common ownership or control
Business Partners	Commercial or small business customers
Service Providers	Software providers, marketing companies, communication services, fraud prevention services, data analytics providers, data providers
Third parties that you have authorized or directed to share information with us	Authorized agents or others on your behalf

Why We Collect Personal Information and How We Use It
The purposes for which we may collect and use personal information depend on, among other things, our relationship or interaction with a specific California resident. The table below lists the purposes for which we may collect and use personal information in different contexts.

Purposes for Collection and Use	Examples
Provide and manage products and services	Establish and process transactions for our products and services including our HELOC Card, as well as additional products for businesses such as institutional financing and payment services Support the ongoing management and maintenance of our products and services including but not limited to provide account statements, online access, customer service, payments and collections, and account notifications
Support our everyday operations, including to meet risk, legal, and compliance requirements	Perform accounting, monitoring, and reporting Enable information security and anti-fraud operations, as well as credit, underwriting, and due diligence Support audit and investigations, legal requests and demands, as well as exercise and defend legal claims Enable the use of service providers for business purposes Comply with policies, procedures, and contractual obligations
Manage, improve, and develop our business(es)	Market, personalize, develop, as well as improve our products and services Conduct research and analysis, including to drive product and services innovation Support customer relationship management
Support employment, infrastructure, and human resource management	Provide benefits to employees and dependents, including healthcare and retirement plans Manage pay and compensation activities Manage and operate our facilities and infrastructure Process employment applications

Disclosure of Personal Information to Third Parties
We may disclose each of the above-listed categories of personal information concerning California resident for our business purposes to one or more of the following categories of third parties:

Third Parties	Examples
Affiliates	Companies related by common ownership or control
Business Partners	Payment processors, merchants, or other financial institutions
Marketing Partners	Companies that collect information through our online services in order to provide marketing services to us
Service Providers	Software providers, communication services, fraud prevention services, data analytics providers, data providers
Third-Party AI Service Providers	Companies that assist in providing AI chatbot services
Other third parties with your consent or as necessary to provide our products and services	Payment processors, merchants, or other financial institutions
Law enforcement, Regulators, and others whom we share information for legal or necessary purposes	Regulatory and law enforcement agencies or other businesses in the context of a merger or acquisition

We do not sell your Personal Information in exchange for monetary compensation. Under the CCPA, allowing certain third parties to collect personal information via automated technologies on our websites and apps for advertising purposes is considered the “sharing” of your personal information. You have the right to opt out of the sharing of your personal information for advertising purposes. You may do so by clicking the “Your Privacy Options” link in the footer of our website. Please review our Privacy Policy here.

Rights Under the CCPA
Right to Know, Delete, and Correct. If you are a California resident, you may have the right to request that we disclose to you the following information:

• The categories of personal information described above that we have collected about you and the categories of sources from which we collected such personal information
• The business or commercial purposes for collecting or sharing such personal information
• The categories of personal information about you that we have disclosed to or shared with third parties for a business purpose and the categories of third parties to whom we have disclosed or shared such personal information
• The specific pieces (e.g., copies) of personal information we have collected about you

California residents also have the right to submit a request for deletion or correction of their personal information under certain circumstances, although in some instances, we may decline to honor your request. Below are examples where we may decline your request:

1. We cannot verify your identity or confirm that the personal information relates to you
2. We cannot verify that you have the authority to make a request on behalf of another individual
3. An exception applies, such as where disclosure of personal information would adversely affect the rights and freedoms of another consumer
4. An exception applies where the personal information that we maintain about you is not subject to the CCPA, e.g., GLBA

Furthermore, we are not required to delete information that is necessary for us to: complete the transaction for which we collected the information; provide you with a good or service you requested; perform a contract we entered into with you; detect security incidents; maintain the functionality or security of our systems; comply with or exercise rights provided by the law; or use the information internally in ways that are comparable with the context in which you provided the information to us or that are reasonably aligned with expectations based on your relationship with us, among other things. Nevertheless, you are entitled to protection against illegal discrimination when asserting your rights under the CCPA.

How to Make Requests
If you are a California resident and would like to exercise your rights to know, delete, or correct your personal information as described above, please submit your request by:

1. Contacting us at 833-987-6890 (Monday-Friday, 9am - 5pm ET excluding holidays); or
2. Submitting a request via email at privacy@Trovy.com

You will need to submit certain information in order for us to verify your identity or request before we process your request including your name, address, email address, phone number, attestation that you are a California resident and relationship with Trovy. You may also designate an agent to submit a request on your behalf.

Authorized Agents
If you are a California resident, you may authorize an agent to make an access or deletion request on your behalf. A California resident’s authorized agent may make a request on behalf of the California resident by contacting us at the toll-free number or email listed above. As part of our verification process, we may request that you provide, as applicable:

• For an individual (“requestor”) making a request on behalf of a California resident:
  • The requestor’s name; contact information; social security or individual taxpayer identification number; date of birth; and Driver’s License or State ID.
  • The name; contact information; social security or individual taxpayer identification number; date of birth; and Driver’s License, State ID, or of the California resident on whose behalf the request is being made.
  • A document to confirm that the requestor is authorized to make the request. We accept as applicable, a copy of a power of attorney, legal guardianship or conservatorship order, or a birth certificate of a minor if the requestor is the custodial parent.
• For a company or organization (“legal entity requestor”) making a request on behalf of a California resident:
  • The legal entity requestor’s active registration with the California Secretary of State.
  • Proof that the California resident has authorized the legal entity requestor to make the request. We accept as applicable, a copy of power of attorney, or legal guardianship or conservatorship order.
  • The name; contact information; social security or individual taxpayer identification number; data of birth; and Driver’s License or State ID of the California resident on whose behalf the request is being made. From the individual who is acting on behalf of the legal entity requestor, proof that the individual is authorized by the legal entity requestor to make the request. We accept a letter on the legal entity requestor’s letterhead, signed by an officer of the organization.

We will respond to requests for access or deletion as soon as practicable and in any event generally not more than within 45 calendar days after receipt of your request. We may extend this period to 90 calendar days in some cases.

Do Not Track Signals
Our Site currently does not respond to “Do Not Track” (“DNT”) signals and operates as described in this Disclosure and Trovy’s Privacy Policy whether or not a DNT signal is received. If we do so in the future, we will describe how we do so in our Privacy Policy.

Non-Discrimination: If you exercise any of the rights explained in this Disclosure, we will continue to treat you fairly. If you exercise your rights under this Disclosure, you will not be denied or charged different prices or rates for goods or services or provided a different level or quality of goods or services than other consumers.

Accessibility: We are committed to ensuring that our communications are accessible to individuals with disabilities. Individuals with disabilities can access this policy in alternative formats by contacting us at the address, phone, or email address below. This website is designed to meet content accessibility guidelines. To submit accessibility-related requests or report barriers to accessibility, please contact us by either:

• Calling us at 833-987-6890
• Emailing privacy@trovy.com

Links to Other Websites
This Disclosure only applies to information collected by Trovy through our Services. Our Services may contain links to other web sites, apps or online services not operated or controlled by Trovy (“Third Party Sites”). The policies and procedures described here do not apply to Third Party Sites. By providing links to Third Party Sites or services we do not imply that we endorse or have reviewed such websites or services. We suggest that you contact those sites directly for information about their data practices and policies and we encourage you to read their privacy policies before providing any information to them.

Security
You use the Services at your own risk. We use reasonable precautions, including technical and administrative measures, to protect your Personal Data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no internet or e-mail transmission is ever fully secure or error free. In particular, e-mail sent to or from us in connection with the Services may not be secure. Therefore, you should take special care in deciding what information you send to us.

Update Your Information
You may be able to update some of your account information through your App settings.

Transparency Report
Our annual transparency report shows the number of data requests we receive and how long it takes us to fulfill those requests.

Changes to This Disclosure
We reserve the right to amend, alter, or otherwise change this Disclosure at our sole and absolute discretion. If we make material changes to this Disclosure, we will post notice that the Disclosure has been updated in the “Last Revised” section of the Disclosure, and the revised version will be effective when it is posted. For material retroactive changes, we will notify you consistent with the law. Further use of the Services following any such changes constitutes your agreement to follow and to be bound by the amended Disclosure, so we encourage you to check for updates.

Contacting Us
If you have any questions, you can contact us at 833-987-6890 or privacy@trovy.com.