River Privacy Policy

RiverFinance, Inc. (referred to as “River”) and its affiliates and subsidiaries (collectively, “River”) respect your concerns about privacy. This Privacy Policy describes the types of personal information we collect, how we use the information, with whom we may share it, and the choices available to you regarding our use of the information. We also describe measures we take to protect the security of the information and how you can contact us about our privacy practices.

This Privacy Policy applies to all the products and services offered by River (including on our website (“Site”) and mobile application (“App”) (collectively, the “Services”)) to U.S. consumers, except where a product or service has a separate privacy notice that does not incorporate this Privacy Policy. Certain individuals also may be provided with additional privacy notices, as described below:

We obtain personal information about you in various ways, such as when you use our Services, communicate with us, or interact with our member services representatives. In addition, we may obtain information about you when you send or receive payments to or from one of our members.

The types of personal information we may obtain about you include:

   -  Identifiers such as name, Social Security number, date of birth, postal and email address, and phone number;  
   -  Government-issued photo ID, such as a driver’s license or passport, photograph, proof of address documentation (such as a utility bill) and proof of identity documentation(such as a marriage document);  
   -  Login credentials for your River account;  
   -  Financial information, including your account number from our Bank Partners, River account transaction history, account information about your linked non-River bank accounts (such as transaction information and balances), and payment card information;  
   -  Direct deposit status (whether you electronically deposit a portion of your regular paycheck or benefit payment above a minimum threshold);  
   -  Information included on a tax return you provide;  
   -  Credit score and other credit history data from a credit reporting agency, if you enroll in certain features of the Services;  
   -  Employment information, including occupation, information about your employer, and income details (such as source of income, approximate annual income and how frequently you are paid);  
   -  Physical characteristics, demographic information and similar details (such as sex, gender, race, color, marital or family status, citizenship status, military or veteran status, signature, language preference and national origin) present in documents (e.g., IDs, tax returns) you provide;  
   -  Commercial information, including interest in a product or service, purchasing or consuming tendencies, and receipts or records of purchase or enrollment in products or services;  
   -  Voice recordings (such as when you call River’s member services);  
   -  Biometric information (such as a facial image collected for identity verification, if you use certain features of our App);  
   -  Social media handles;  
   -  Information you provide through member services interactions and that you provide about your experience with River, including via questionnaires, surveys, participation in user research or other feedback;  
   -  Geolocation data;  
   -  Information provided by marketers and other websites on which River advertises;  
   -  Information you provide through contacts integration, including a list of contacts from your phone’s operating system; and  
   -  Other information you choose to provide, such as through our “Contact Us” feature, emails or other communications (such as with member services), referrals, on social media pages, or in registrations and sign-up forms.

When you visit our Site, we may obtain certain information by automated means, such as cookies, web beacons, webserver logs and other technologies. A “cookie” is a text file that websites send to a visitor’s computer or other internet-connected device to uniquely identify the visitor’s browser or to store information or settings in the browser. A “web beacon,” also known as an internet tag, pixel tag or clear GIF, links web pages to web servers and cookies and may be used to transmit information collected through cookies back to a web server. The information we collect in this manner may include your device IP address, unique device identifier, web browser characteristics, device characteristics, operating system, language preferences, referring URLs, clickstream data, and dates and times of website visits.

When you use our App, we also may collect certain information by automated means, such as through device logs, server logs and other technologies. The information we collect in this manner may include the device type used, the mobile operating system, device identifiers and similar unique identifiers, device settings and configurations, IP addresses, battery and signal strength, usage statistics, referring emails and web addresses, dates and times of usage, actions taken on the App, and other information regarding use of the App. In addition, as indicated above, we may collect your device’s geolocation information. Your device’s operating platform may provide you with a notification when the App attempts to collect your precise geolocation. Please note that if you decline to allow the App to collect your precise geolocation, you may not be able to use all of the App’s features or the offers available through the App. We may use these automated technologies on our Services to collect information about your equipment, browsing actions and usage patterns. These technologies help us (1) remember your information so you do not have to re-enter it; (2) track and understand how you use and interact with our Services, including our online forms, tools or content; (3) tailor the Services around your preferences; (4) measure the usability of our Services and the effectiveness of our communications; and (5) otherwise manage and enhance our products and services, and help ensure they are working properly. Your browser may tell you how to be notified about certain types of automated collection technologies and how to restrict or disable them. Please note, however, that without these technologies, you may not be able to use all of the features of our Services. For mobile devices, you can manage how your device and browser share certain device data by adjusting the privacy and security settings on your mobile device.

We may use the personal information we obtain for purposes such as the following:  

   -  Provide the Services;  
   -  Process and fulfill transactions;  
   -  Establish and manage River accounts;  
   -  Personalize your experience on our Services;  
   -  Facilitate payroll or other direct deposits (including tax refunds) to your River account;  
   -  Facilitate transfers between your external bank accounts and River accounts;  
   -  Verify your identity, including to facilitate a name change request;  
   -  Respond to inquiries, provide member support and resolve disputes;  
   -  Determine your eligibility for, and administer your participation in, certain features of the Services, including surveys, contests, sweepstakes, promotions and rewards;  
   -  Facilitate and manage referrals from our business partners;  
   -  Advertise and market our products and services, and send information about third-party products and services we think may interest you;  
   -  Provide you targeted offers and notify you of nearby third-party locations where you may use our products and services;  
   -  Provide member support and quality assurance, and conduct customer service training;  
   -  Collect fees and other amounts owed in connection with your River account;  
   -  Operate, evaluate and improve our business (including researching and developing new products and services; enhancing, improving, debugging and analyzing our products and services; managing our communications; establishing and managing our business relationships; and performing accounting, auditing and other internal functions);  
   -  Maintain and enhance the safety and security of our products and services and prevent misuse;  
   -  Protect against, identify and prevent fraud and other criminal activity, claims and other liabilities;  
   -  Exercise our rights and remedies and defend against legal claims; and  
   -  Comply with and enforce applicable legal requirements, relevant industry standards and River policies. We also may use the information in other ways for which we provide specific notice at the time of collection.

We may use third-party analytics services on our Services, such as Google Analytics. The information we obtain through the Services may be disclosed to or collected directly by these services. To learn more about Google Analytics, please visit https://www.google.com/policies/privacy/partners/.

On our Services, we may obtain information about your online activities to provide you with advertising about products and services that may be tailored to your interests. This section of our Privacy Policy provides details and explains how to exercise certain choices.

You may see our ads on other websites because we use third-party ad services. Through these ad services, we can target our messaging to users considering demographic data, users’ inferred interests and browsing context. These services track your online activities over time and across multiple websites and apps by collecting information through automated means, including through the use of cookies, web server logs, web beacons and other similar technologies. The ad services use this information to show you ads that may be tailored to your individual interests. The information ad services may collect includes data about your visits to websites that serve River advertisements, such as the pages or ads you view and the actions you take on the websites or apps. This data collection takes place both on our Services and on third-party websites and apps that participate in these ad services. This process also helps us track the effectiveness of our marketing efforts.

The Services are not designed to respond to “do not track” signals from browsers.

To learn how to opt out of interest-based advertising in the U.S., please visit www.aboutads.info/choices, http://www.networkadvertising.org/choices/ and http://preferences-mgr.truste.com/.

We may share the information we obtain about you with our affiliates and subsidiaries; our Bank Partners; other River users (including in connection with member referrals); other companies in connection with co-branded products, services or programs; joint marketing partners; and consumer reporting agencies. We also may share the information we obtain about you with third-party vendors and other entities we engage to perform services on our behalf, such as payment and check deposit processors, risk detection  and mitigation tools, and modeling and analytics tools.

We also may disclose personal information(1) if we are required to do so by law or legal process (such as a court order or subpoena); (2) in response to requests by government agencies, such as law enforcement authorities; (3) to establish, exercise or defend our legal rights;(4) when we believe disclosure is necessary or appropriate to prevent physical or other harm or financial loss; (5) in connection with an investigation of suspected or actual illegal activity or (6) otherwise with your consent.

We reserve the right to transfer any personal information we have about you in the event we sell or transfer all or a portion of our business or assets (including in the event of a merger, acquisition, joint venture, reorganization, divestiture, dissolution or liquidation).

We offer you certain choices in connection with the personal information we collect from you.  To update your preferences, limit the communications you receive from us, or submit a request, please contact us as by emailing us at support@getriver.co. You can also unsubscribe from our marketing mailing lists by following the “Unsubscribe” link in our emails. If you are a River member, you may update certain of your account details and settings by logging into your account on our Services or by emailing us at support@GetRiver.co.

We maintain administrative, technical and physical safeguards designed to protect the personal information you provide against accidental, unlawful or unauthorized access, destruction, loss, alteration, disclosure or use.

Our Services are designed for a general audience and are not directed to children. In connection with the Services, we do not knowingly solicit or collect personal information from children under the age of 13 without parental consent. If you believe that a child under age 13 may have provided us with personal information without parental consent, please contact us as by contacting support@getriver.co.

For your convenience and information, our Services may provide links to other online services, and may include third-party features such as apps, tools, widgets and plug-ins. These online services and third-party features may operate independently from us. The privacy practices of the relevant third parties, including details on the information they may collect about you, are subject to the privacy statements of these parties, which we strongly suggest you review. To the extent any linked online services or third-party features are not owned or controlled by River, we are not responsible for these third parties’ information practices.

If you are a River member and elect to use the Plaid Technologies, Inc. (“Plaid”) feature in the Services, Plaid may collect your information from financial institutions.  By using the Plaid service, you acknowledge and agree that Plaid will collect and use your personal information in accordance with Plaid’s privacy policy, which is available at https://plaid.com/legal.

We may update this Privacy Policy from time to time and without prior notice to you to reflect changes in our personal information practices. We will indicate at the top of the policy when it was most recently updated.

You can update your preferences, ask us to remove your information from our mailing lists, submit a request or ask us questions about this Privacy Policy by writing to us at support@GetRiver.co.

This California Consumer Privacy Statement(“Statement”) supplements the River Privacy Policy and applies solely to California consumers. This Statement does not apply to River personnel or job applicants.

This Statement uses certain terms that have the meaning given to them in the California Consumer Privacy Act of 2018 and its implementing regulations (the “CCPA”).

   1.  Notice of Collection and Use of Personal Information: We may collect (and may have collected during the 12-month period prior to the effective date of this Statement) the following categories of personal information about you:      
         -  Identifiers: Identifiers such as a real name, postal address, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; customer number, unique pseudonym, or user alias; telephone number and other forms of persistent or probabilistic identifiers), online identifier, internet protocol address, email address, account name, Social Security number, driver’s license number, passport number, and other similar identifiers
         -  Additional Data Subject to Cal. Civ. Code § 1798.80: signature, physical characteristics or description, state identification card number, education, bank account number, credit card number, debit card number, and other financial information
         -  Protected Classifications: characteristics of protected classifications under California or federal law, such as race, color, national origin, age, sex, gender, marital status, citizenship status, and military and veteran status 
         -  Commercial Information: commercial information, including records of personal property, products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies 
         -  Biometric Information 
         -  Online Activity: Internet and other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications or advertisements 
         -  Geolocation Data
         -  Sensory Information: audio, electronic, visual, and similar information 
         -  Employment Information: professional or employment-related information
         -  Inferences: inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

We may use (and may have used during the 12-month period prior to the effective date of this Statement) your personal information for the purposes described in our River Privacy Policy and for the following business purposes specified in the CCPA: 
‍
   -  Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing advertising or marketing services, providing analytics services, or providing similar services  
   -  Auditing related to a current interaction with you and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance 
   -  Short-term, transient use, including, but not limited to, the contextual customization of ads shown as part of the same interaction
   -  Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity 
   -  Debugging to identify and repair errors that impair existing intended functionality  
   -  Undertaking internal research for technological development and demonstration  
   -  Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us.    

   2.  Sources of Personal Information: During the 12-month period prior to the effective date of this Statement, we may have obtained personal information about you from the following categories of sources:      
         -  Directly from you, such as when you sign up for an account or contact member services      
         -  Our Bank Partners     
         -  Your devices, when you use our Site or App      
         -  Your family or friends, such as when they provide us with your contact information by
choosing to share their phone contacts with River      
         -  Payment processors      
         -  External banks (i.e., banks other than our Bank Partners) if you link a non-River bank account      
         -  Credit reporting agencies      
         -  Our affiliates and subsidiaries      
         -  Vendors who provide services on our behalf      
         -  Our joint marketing partners      
         -  Our business partners (such as referring websites)      
         -  Online advertising services and advertising networks      
         -  Data analytics providers      
         -  Government entities      
         -  Operating systems and platforms      
         -  Social networks      
         -  Data brokers    

   3.  Sale of Personal Information: We do not sell personal information.    

   4.  Sharing of Personal Information: During the 12-month period prior to the effective date of this Statement, we may have shared your personal information with certain categories of third parties, as described below. When we share personal information with our Bank Partners, we do so as their service provider. The privacy practices of our Bank Partners are subject to their privacy notices, which we strongly suggest you review. River is not responsible for our Bank Partners’ information practices or privacy notices. We may have disclosed the following categories of personal information about you for a business purpose to the following categories of third parties:

         -  Identifiers: Our Bank Partners, other River users, our marketing  partners, and your employer
         -  Additional Data Subject to Cal. Civ. Code § 1798.80 Law: Our Bank Partners, our marketing partners, and your employer
         -  Protected Classifications: Our Bank Partners
         -  Commercial Information: Our Bank Partners and our marketing partners
         -  Biometric Information: Our Bank Partners
         -  Online Activity: Our Bank Partners and our marketing partners
         -  Geolocation data: Our Bank Partners
         -  Sensory Information: Our Bank Partners
         -  Employment Information: Our Bank Partners

   5.  In addition to the categories of third parties identified above, during the 12-month period prior to the effective date of this Statement, we may have shared personal information about you with the following additional categories of third parties: government entities; other persons to whom we have a legal obligation to disclose personal information (including, for example, in response to a duly issued subpoena or search warrant); and other persons to whom you authorize River to disclose your personal information.    

   6.  California Consumer Privacy Rights: You have certain choices regarding your personal information, as described below.

Access: You have the right to request, twice in a12-month period, that we disclose to you the personal information we have collected, used, disclosed and sold about you during the past 12 months.

Deletion: You have the right to request that we delete certain personal information we have collected from you.

Shine the Light Request: You also may have the right to request that we provide you with (a) a list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year and (b) the identity of those third parties.

‍How to Submit a Request. To submit an access or deletion request, please email support@GetRiver.co. To submit a Shine the Light request, email us at support@GetRiver.co. If you designate an authorized agent to make an access or deletion request on your behalf using one of the channels described above, we may require you to provide the authorized agent written permission to do so and to verify your own identity directly with us.

Verifying Requests. To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request. We may require you to provide any of the following information: your name, date of birth, the last four digits of your Social Security number, the email and physical addresses associated with your River account, one or more recent transactions, and the last four digits of one or more River-branded cards associated with your account. If you have never had an account with us and you request access to or deletion of your personal information, there is no reasonable method by which we can verify your identity to the level of certainty required by the CCPA. The reason for this is that River does not maintain information about non-accountholders in a way that is linked to named actual persons (and historically has not linked IP addresses, device identifiers or other information collected by automated means to named actual persons). In addition, if you ask us to provide you with specific pieces of personal information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.

‍Additional Information. If you choose to exercise any of your rights under the CCPA, you have the right to not receive discriminatory treatment by us. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.

This Agreement is effective 12/2021

‍