Placid Inc. Privacy Policy

(Last revised September 27, 2026)

This Privacy Policy (the “Policy”) describes the information Placid Inc., a Delaware corporation doing business as Gauss, its subsidiaries, affiliates, agents and assigns (the “Gauss”, “we”, “our” or “us”) collects about you, how we use and share that information, and the privacy choices we offer. This Policy applies to information we collect when you visit our website at https://www.gauss.money/ (the “Site”), use related websites, downloadable software, mobile applications (including tablet applications), and products and services provided by us or through the third-party arrangements described here (collectively, our “Services”), or otherwise interact with us.

We believe trust, transparency and fairness are the most important values for finance. We are committed to maintaining the confidentiality, integrity and security of personal information about our current, past and prospective customers. These values guide our decisions, including how and what information we gather. We have written this Policy to explain our information practices and your choices while you use our Services.

IMPORTANT: THIS POLICY EXPLAINS HOW WE HANDLE PERSONAL INFORMATION. WHERE A PARTICULAR ACTIVITY REQUIRES YOUR CONSENT OR AUTHORIZATION, WE WILL REQUEST IT SEPARATELY. ACCESSING THE SITE DOES NOT, BY ITSELF, PROVIDE THAT CONSENT.

BEFORE USING THIS SITE, YOU SHOULD READ CAREFULLY:

1. PRIVACY POLICY, WHICH NOTIFIES YOU WHAT DATA WE COLLECT, WHY DATA INCLUDING YOUR PERSONAL DATA IS COLLECTED, THE COOKIE POLICY, HOW DATA COLLECTED WILL BE USED AND TO WHOM DATA ACCESS REQUESTS ARE TO BE ADDRESSED; AND
2. THE TERMS OF USE OF WEBSITE.

SITE INFORMATION, MATERIAL AND CONTENT MAY CHANGE. WE WILL PUBLISH POLICY UPDATES WITH A NEW REVISION DATE, NOTIFY YOU OF MATERIAL CHANGES THROUGH THE SERVICES OR ANOTHER APPROPRIATE METHOD, AND OBTAIN CONSENT OR PROVIDE CHOICES WHERE REQUIRED BY LAW. CONTINUED USE DOES NOT REPLACE REQUIRED CONSENT. GOOGLE DATA REMAINS SUBJECT TO “GOOGLE ACCOUNT ACCESS”.

Our Data Privacy Principles

1. We will only collect information that we believe to be relevant and required to understand your financial needs and to conduct our business;
2. We use your information to provide you with better customer services and products;
3. We collect and process data for specified, lawful purposes described in this Policy, on the basis of your consent where required or another applicable legal authorization. We will not use it for an incompatible purpose without any notice and consent required by law; Google user data is always subject to the narrower “Google account access” limits;
4. We will maintain appropriate standards of data quality and integrity, and we will implement policies in respect of data retention and data accuracy, including taking steps to ensure that your data on our records remain accurate and up to date, where appropriate;
5. We disclose information to external organizations only for the purposes and to the categories of recipients described in this Policy, with your consent where required, or as otherwise permitted or required by applicable law;
6. We may be required from time to time to disclose your information to governmental or judicial bodies or agencies or our regulators, but we will only do so under proper authority;
7. We may pass your information to other companies or agents to provide you with better customer services and products, where within your consent, permitted or required by law;
8. We maintain strict security systems designed to prevent unauthorized access to your information by anyone, including our staff;
9. We will ensure that appropriate processes are put in place so only those acting on our behalf with a business requirement to access such data are authorized to do so;
10. Our staff and service providers with permitted access are subject to confidentiality obligations and appropriate restrictions on use. Other recipients, such as lenders you contact and public authorities, process information under their own applicable legal duties and privacy practices.

Collection of Personal Data

Our Services include consumer financial management, membership subscriptions, credit building and credit-report tracking, lending and cash advances where available, payment-related services, and user-directed assistance with debt negotiation, credit offers, subscription cancellation and bill reduction. The information used depends on the Service you select. We provide additional notice and obtain consent where required before introducing materially different processing.

For credit-building, lending, cash-advance and payment Services, relevant information includes application and identity information, income, connected-account and transaction information, payment instructions and repayment history. We use and disclose that information for the requested product, eligibility or account review where permitted, funding, payments, servicing and legally permitted consumer reporting. Collection and reporting depend on the product.

For credit-report tracking and personalized credit guidance, we use credit-report information only with a permissible purpose, including your written instructions where required. Any authorization for recurring access identifies the authorized purpose and duration. For partner credit offers, a lender or application provider receives information you direct us to submit for the particular request and applies its own privacy practices.

We obtain, use and disclose consumer-report information only for purposes permitted by the Fair Credit Reporting Act. This Policy does not replace any separate consumer instructions or authorization required for the particular Service or disclosure.

For debt negotiation, subscription cancellation and bill reduction, relevant information includes your instructions, the provider and account involved, bills or account terms, and communications concerning the request. Information is shared with the lender, biller, merchant, utility or processing provider involved in the action you request. These Services do not expand the separate Gmail confirmation permission, which applies only to the approved lender message described under “Google account access”.

For rewards, loyalty programs and promotional offers, the applicable offer identifies the eligibility conditions and any information needed to administer participation or deliver a benefit. We provide any additional notice and consent choices required for a financial incentive involving personal information.

1. We may from time to time collect the data of prospective and current customers, other connected/relevant individuals in connection with the purposes set out in this Policy. These prospective and current customers, other connected/relevant individuals may include without limitation the following or any of them (collectively the “data subject(s)” "you", "your"):
   1. prospective and / or current customers applying for / using financial services, credit facilities, insurance, securities, investment, wealth management and related services, products and facilities (collectively “Services”) provided by us;
   2. persons giving or proposing to give security or guarantees for obligations owed to us;
   3. persons and / or organizations linked to prospective and current customer, including the shareholders, directors, controlling persons, officers and managers, partners or members of a partnership, an agent or nominee of a prospective and / or current customer, or in the case of a trust, including the trustees, settlors, protectors and beneficiaries of the trust;
   4. other persons who are relevant to prospective and / or current customers relationship with us;
   5. former customers, visitors to our websites and people who use our applications or contact us; and
   6. people acting on a customer’s behalf or involved in a transaction or communication that the customer requests, to the extent relevant and lawfully provided.
2. The collection of your personal data may be in connection with various matters, such as:
   1. applying for and / or continuing using our Services;
   2. the provision or the continued provision of various Services by us; or
   3. complying with applicable United States federal, state and local laws, court orders and lawful requests from regulators or law-enforcement authorities with jurisdiction.
3. If data necessary for a particular Service is not provided, we may be unable to approve or continue that Service for you or a relevant customer linked to you. Optional information and permissions are identified in context. Declining the optional Gmail connection prevents use of that sending feature, without granting us access to your mailbox or authorizing unrelated processing.
4. Data may be collected from you in the course of your relationship with Gauss, from a person authorized to act on your behalf, from your use of our websites and apps, and from other sources such as consumer reporting agencies where a permissible purpose exists. Data may also be generated or combined with other information available to Gauss for the purposes described in this Policy.

We obtain information directly from you and your authorized representatives; from your use of the Services and devices; from financial institutions and data providers you connect; from consumer reporting agencies where a permissible purpose exists; from payment, identity-verification and fraud-prevention providers; and from lenders or other recipients involved in your requested Services. Information about another person must be provided with appropriate authority. Google account access is optional and is governed solely by the specific limits below.

Purpose of use of Personal Data

Disclosures to advertising partners may constitute a “sale” or “sharing” under applicable state privacy laws even without monetary payment for the information. Those disclosures and your choices are described under “Collection and Use of Information Collected Automatically” and “For California Consumers”. We do not sell Google user data or use it for advertising.

A request to submit information to a particular lender or partner authorizes only the disclosed transfer needed for that request. It does not authorize advertising use or onward sale of that information. Financial-information disclosures remain subject to the financial privacy notice, applicable law and any required consent. Those restrictions apply to information sent through tracking technologies and software development kits as well as through other methods.

We use information for the following purposes only to the extent relevant to the Services you use, legally permitted, and consistent with your choices. These purposes do not expand the separate limitations on Google user data:

1. considering and processing applications for our Services, and the daily operation of Services provided to you or the relevant customer linked to you (i.e. the data subject) including, but not limited to:
   1. To verify that you meet the minimum age and other eligibility requirements applicable to the particular Service, including any higher minimum age required by that product or applicable law;
   2. To verify your identity and guard against potential fraud;
   3. To pull a credit report from a credit bureau, such as Equifax, to help determine your creditworthiness;
   4. To determine eligibility for a line of credit, cash advance or another credit product, where applicable to that product;
   5. To enable our financial services partners to implement automatic payments and fund transfers;
   6. To respond to your questions;
   7. To authenticate your access to Gauss;
2. conducting credit checks at the time of application for Services and when we conduct any credit reviews which normally takes place one or more times each year;
3. creating and maintaining our credit, anti-money-laundering (“AML”) and fraud risk assessment models or equivalent models using information we are permitted to use for those purposes; Google user data and information derived from it are excluded;
4. assisting other financial institutions to conduct credit checks and collect debts;
5. assessing ongoing creditworthiness and account standing where relevant to an existing credit relationship and permitted by law;
6. designing and providing Services for data subjects' use (including verifying data subjects' identities in connection with the use of any such Services such as to execute instructions or effect transactions);
7. analyzing how data subjects access and use the Gauss Services, including services available on the Gauss websites, mobile apps or through any other means from time to time;
8. marketing services, products and other subjects (including in connection with direct marketing, which is explained further below in “Direct marketing” section of this document);
9. determining the amount of indebtedness owed to or by data subjects;
10. the enforcement of data subjects' obligations, including without limitation the collection of amounts outstanding from data subjects and those providing security or guarantee for data subjects' obligations owed to us;
11. meeting obligations imposed by applicable United States federal, state and local laws, regulations, judgments and court orders (the “Laws”), and responding to lawful requests from regulators, courts, tax authorities and law-enforcement agencies with jurisdiction (the “Authorities”);
12. maintaining controls and records required for applicable anti-money-laundering, sanctions, fraud-prevention and other legal obligations;
13. detecting, investigating and preventing money laundering, terrorist financing, bribery, corruption, tax evasion, fraud, sanctions violations and other unlawful activities in accordance with applicable Laws;
14. responding to lawful demands or requests from Authorities with appropriate authority and limiting disclosures as required by applicable law;
15. enabling an actual or proposed assignee of Gauss, or participant or sub-participant of the Gauss rights in respect of the data subject to evaluate the transaction intended to be the subject of the assignment, participation or sub-participation;
16. exchanging information with merchants, business partners and co-branding partners (collectively, “Partners”) for a Service, application, payment or offer you request, subject to applicable authorization, contractual and legal restrictions;
17. performing any functions and activities related to Services provided by the Gauss including, marketing, display content based upon your interests, offer products and services of third parties that we think you might find of interest, auditing, reporting, market research, and general servicing and maintenance of its products and/or services, subject to the specific marketing, financial-information and Google-data restrictions in this Policy;
18. carrying out related purposes that are compatible with, and reasonably necessary for, the specific purposes listed above, subject to applicable law and your choices; and
19. carrying out a new purpose described in a separate, clear notice provided to you before that processing begins, with your consent or additional choices where required. General policies, circulars or terms do not authorize undisclosed, incompatible use or override “Google account access”.

Artificial intelligence and requested communications

Gauss uses automated tools, including artificial intelligence, to help prepare communications and provide the assistance you request. Depending on the Service, the request may concern debt negotiation, bill reduction or subscription cancellation, and the recipient may be a lender, biller, subscription merchant or utility. These tools process information you provide and relevant account and financial information obtained independently of the Google connection, including your instructions, account details, bills or account terms, requested changes, draft and approved communications, and the status of your request. We disclose relevant information to the recipient you authorize and use processing providers acting on our instructions for the requested functionality. These Services do not expand the Gmail confirmation feature, which remains limited to the specific lender message described under “Google account access”.

We limit information provided to AI service providers to what is needed for the requested functionality and restrict their use through applicable service-provider terms and instructions. We do not provide Google user data or information derived from it to AI providers or use it to develop, improve or train AI or machine-learning models. Before a message is sent through the Gmail confirmation feature, you must review and approve its exact text and recipient.

Direct Marketing

We may use personal data to send you marketing about Gauss products and services as described below. You can unsubscribe from marketing emails at any time using the link in the message or contact support@gauss.money. We obtain consent where required by applicable law and honor your existing marketing preferences and any consent-based restrictions that apply to your information. Google account data and sending records described under “Google account access” are excluded from all marketing uses. A product-specific authorization, including authorization to send a lender confirmation, is not marketing consent. Please note that:

1. Gauss may use the following categories of data for its direct marketing purposes:
   1. the name, contact details, Services portfolio information, transaction pattern and behavior, transaction location and financial background of a data subject held by the Gauss from time to time; and
   2. information relating to the data subject's use of Gauss websites, mobile app from time to time, whether through cookies or otherwise;
2. the following classes of Services may be marketed:
   1. financial, insurance, fiduciary, investment services, credit card, securities, investment and related services, including Gauss financial-management, credit-building, lending, cash-advance and payment Services, and partner credit-card and loan offers you choose to explore;
   2. reward, referral, loyalty or privileges programs and related services;
   3. benefits, promotional offers, services* offered by the Gauss and/or the Partners (the names of such partners can be found in the application form(s) for the relevant services and products, as the case may be);
   4. merchant services, including incentives and offers.

* “Benefits”, “promotional offers”, “services” and “products” refer to products, reward, referral, loyalty or privilege programs and other benefits that Gauss or Partners may offer. Partners and offers can change; examples include welcome gifts for new customers. The relevant offer or notice will identify the participating partner and purpose before information is shared where required. The categories above and below apply only to an actual offering and do not constitute consent to share information with every listed category.

3. the above services, products and offers may be provided by Gauss and/or:
   1. financial institutions, lenders and credit-card providers involved in an offer or application you request;
   2. Partners;
   3. third party reward, loyalty, co-branding or privileges program providers.

You may unsubscribe from marketing emails using the link in the message, withdraw any marketing consent you have given, or ask us to stop sending marketing messages by contacting support@gauss.money or calling (877) 909-1559. We honor requests within applicable legal time limits. These choices do not prevent necessary account, transaction, security or legal communications. We obtain any separate consent required for marketing calls or text messages; this Policy is not such consent.

Choices about receiving marketing messages and withdrawing marketing consent are distinct from an opt-out of information sharing under the financial privacy notice. The notice’s “For our marketing purposes” row addresses information provided to service providers to market Gauss’s own products and services. It does not permit those providers to use your information for their own independent marketing or override your choices about receiving messages.

For sharing that requires affirmative consent, silence, continued use or the passage of time is not consent. You may withhold or withdraw consent for future sharing by contacting support@gauss.money or (877) 909-1559. Withdrawal does not reverse disclosures already made in accordance with your instructions.

Placid Inc. currently has no affiliates. References elsewhere in this Policy to affiliates describe potential recipients, not an existing sharing arrangement. If this changes, we will update the financial privacy notice and obtain your affirmative consent before beginning the affiliate sharing described there, together with any additional notice or choices required by law.

These choices do not prevent disclosures necessary for transactions or Services you request, or other lawful everyday business disclosures described in the financial privacy notice. Google user data remains subject to the stricter “Google account access” limits.

Personal data we collect

1. Personal information you provide when applying for or using our Services, including your name, date of birth, residential and correspondence addresses, phone number, email address, salary, income and assets, credit-related information, Social Security number, and identity-verification documents or media such as a driver’s license, passport, facial images, selfies or video calls, which may involve biometric information if our verification provider performs face matching; where identity-verification technology creates or processes a biometric template or other legally regulated biometric information, we provide the applicable notice and obtain consent where required;
2. Communications data includes your contact and marketing preferences, support communications, instructions, negotiation requests, draft and approved messages and related action records. Google connection data and Gmail sending records are limited to those described in “Google account access”;
3. Financial data includes information about your financial products and accounts with other organizations (e.g. banks, non-banking lenders), account numbers, banking card numbers, transactions conducted through your accounts, credit history, employment information, tax returns, credit scores and other information provided by consumer reporting agencies, and any data on Gauss Services you use;
4. Technical data means details such as navigational and other information transferred when visiting our websites or using our mobile applications, up to and including: operating system, IP address, mobile device IDs, your mobile network, device type, cookies, browsing activity, geo location, browser type, the settings and applications on your mobile phone. General location may be inferred from an IP address. Where a Service collects precise geolocation, we identify the feature, purpose and relevant provider in a notice at or before collection and obtain any required device permission and consent. Precise geolocation is treated as sensitive information. We do not sell precise geolocation data;
5. Usage data includes information about how you use our website, the Gauss app and Services, referring and exit pages and URLs, clicks and interactions with links on the Site, domain names, landing pages and pages viewed, your use of third party applications;
6. General due diligence includes data that the law requires us to process about you in relation to illegal activities involving money laundering;
7. Financial due diligence includes data we receive from consumer reporting agencies to help with responsible lending decisions.

We may compile aggregate, anonymous or de-identified data from sources including accounts and transactions for purposes permitted by law. Where we treat information as de-identified, we take reasonable measures to prevent it from being associated with an individual or household, commit to maintain and use it in de-identified form without attempting re-identification except as legally permitted to test the safeguards, and impose appropriate contractual restrictions on recipients. Aggregating or de-identifying Google user data does not remove the restrictions in “Google account access”.

Sensitive information, including government identifiers, financial-account information and identity-verification data, is used only as reasonably necessary for the Services, security, fraud prevention, legal compliance and other purposes permitted by applicable law. We explain any additional sensitive-data processing and provide consent or limitation choices when required. Identity-verification information is subject to the retention criteria below and any shorter applicable biometric retention requirements.

We do not consider sex or any other prohibited basis in credit decisions, and we consider age only as the Equal Credit Opportunity Act permits. We request information concerning sex in connection with a credit application only where applicable law permits or requires it.

Children

Our Services are intended for adults. We do not knowingly collect or solicit personal information through the Site or Services from anyone under eighteen (18), or under nineteen (19) in Alabama or Nebraska where that higher age is required by the applicable product’s eligibility rules. The Site and its content are not directed at those individuals. If we learn that we collected personal information from someone below the applicable eligibility age, we will promptly delete it, except to the limited extent retention is legally required or necessary for a lawful protective purpose. Please contact support@gauss.money if you believe we hold such information. We do not knowingly sell or share personal information of consumers under sixteen (16) for cross-context behavioral advertising.

3rd party data providers

To provide the Services, Gauss uses application programming interfaces (“APIs”) supplied by data providers, including Plaid Inc. (“Plaid”), to obtain information from financial institutions you choose to connect. Depending on the connection and Service, this may include account identification, balances, transactions and other financial information described in this Policy. When you choose to connect a financial account through Plaid, you authorize Plaid to access and transmit the information covered by that connection on your behalf and acknowledge and agree to Plaid’s End User Privacy Policy at https://plaid.com/legal/#end-user-privacy-policy and acknowledge and agree that your information shall be treated in accordance with such policy. Gauss’s handling of information it receives remains governed by this Policy. The connection process presents the applicable permissions; this Policy does not replace any separate authorization required for access. Connecting an account does not provide unlimited permission for unrelated uses. You may manage or revoke a connection through the controls made available by the provider or contact support@gauss.money for assistance. Disconnecting may affect the connected Service and does not automatically delete records we must lawfully retain. We apply confidentiality, security and permitted-use restrictions to providers processing information on our behalf, as appropriate to their role.

Google account access

If you choose to send a confirmation message to a lender from your own Gmail account, we request permission to obtain the email address of the Google account you select and to send email on your behalf. We use that address to check that it matches the address the lender has on file, to send your approved message, and to record the sending action. We do not use it as your Gauss account identifier.

We use the sending permission only for the specific message and recipient you have reviewed and approved. This feature does not read, search, download or monitor messages in your Gmail account, and we request no Gmail permission that allows us to do so. We do not retain Google access or refresh tokens after the sending operation. Sending another message through this feature requires you to approve that message and authorize another sending action.

We retain an audit record of the message sent, its recipient, the sending address and the message identifiers returned by Google. We use these records only to document the action you authorized, address problems or disputes concerning that action, and satisfy applicable legal recordkeeping requirements. We assess their retention separately from other customer records, retain them only for as long as necessary for those purposes, and then securely delete them.

The approved message and sending address are transmitted through Gmail to the lender recipient shown to you. Service providers that process information for this feature on our behalf may do so only to operate and secure the feature, subject to confidentiality and data-use restrictions. Any other disclosure of Google user data is limited to what is necessary for security or required by applicable law. Our personnel and service providers may read Google user data only with your affirmative agreement to access specific records, where necessary for security, or where required by applicable law.

We protect Google user data using access controls and encryption in transit and at rest. You may request deletion of records held by Gauss by contacting support@gauss.money. If applicable law requires us to retain particular records, we will explain the limitation. You may also remove Gauss’s access through your Google Account’s third-party connections settings at https://myaccount.google.com/connections. Removing access or deleting records held by Gauss does not recall a message already sent or delete copies held by Google or the recipient.

We do not sell Google user data or use it for advertising, marketing, determining creditworthiness, lending purposes, or developing, improving or training artificial intelligence or machine-learning models. These restrictions also apply to information derived from Google user data. The access, use, sharing and retention limits in this section govern Google user data and the related sending records described above and take precedence over any broader provisions elsewhere in this Policy, including the general retention period and provisions on marketing, model development, disclosure and human access.

Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Collection and Use of Information Collected Automatically

We receive and store certain types of information automatically, such as when you visit our site, read our emails, or download and use our Services. This information does not necessarily reveal your identity directly but may include information about the specific device you are using, such as the hardware model, operating system version, or web-browser software. For example, we may use data collection and tracking tools such as cookies, clear gifs (also known as web beacons), pixel tags, and other similar tracking techniques that may be embedded into HTML-based emails sent to you, be downloaded to your personal computer, tablet, mobile phone or other device (“Device”) when you visit or interact with our website.

Use of cookies

Cookies are small data files which are placed on your device when you visit certain parts of our website or click on our online advertisements. Cookies and similar technologies are used to identify your device for the following purposes:

1. Strictly necessary cookies. These essential cookies are set throughout our website and are required for the operation of our website to:
   1. determine and remember applicable cookie choices and whether a necessary function can operate; a browser’s acceptance of cookies is not, by itself, consent to tracking or interception that requires separate consent;
   2. temporarily allow you to carry information between pages of our website to avoid having to re-enter that information; or
   3. temporarily identify your device after you have logged in to a secure page on our website so that our web server can maintain a dialogue with your web browser in order for you to carry out certain activities.
2. Analytical/performance cookies. These are used to help us improve our website by tracking your visits to our website and recognizing your web browser when you are a repeat visitor so that we can gather statistics on new and repeat visitors to evaluate site effectiveness.
3. Functionality cookies. These are used to recognize you when you return to our website. This enables us to:
   1. personalize our content for you and remember your preferences (for example, your choice of language and region); or
   2. store your login and other preferences so you do not have to re-enter that information when you return to the website.
4. Targeting / advertising cookies. These cookies record your visit to our website, your response to our online advertisements, track the pages you have visited, and the website links you have followed. We use this information to:
   1. make our website more relevant to your interests;
   2. provide online advertisements or offers on our website or third-party websites which are most likely to interest you; or
   3. evaluate the effectiveness of our online marketing and advertising programs.

Cookies and similar technologies may be placed by us or by third-party service providers or advertising partners. They can collect or disclose personal information, including IP addresses, device or cookie identifiers, browsing and interaction information, and inferences. Third-party advertising partners may collect information about activity over time and across different sites, services and devices. Depending on the arrangement, these disclosures may constitute a sale or sharing under state privacy law. The Google account data covered by “Google account access” is not used for these purposes. We do not disclose information obtained from financial accounts you connect, including through Plaid, or Google user data described under “Google account access,” to advertising partners. Advertising partners may collect information only on our public webpages and app screens before sign-in. We do not permit advertising partners to collect information in signed-in areas, account-application flows or financial-service screens, and we do not provide them with application or account status, consumer-report information, transaction information or information from connected financial accounts.

Most browsers allow you to block or delete cookies. Blocking strictly necessary cookies may prevent some features from working. Browser cookie settings do not replace the privacy choices described here. Select “Your Privacy Choices” on our website or open Settings > Privacy in the Gauss app to opt out of sale or sharing for targeted advertising. You may also contact support@gauss.money or call (877) 909-1559. We apply a Global Privacy Control (“GPC”) signal to the browser or device sending it and to any consumer profile or Gauss account we associate with that browser or device. An account-level opt-out applies to the information associated with that account across our Services and devices. We display confirmation that the opt-out signal has been processed. You do not need to create an account or verify your identity to opt out.

Legacy “Do Not Track” signals are different from GPC. We do not respond to a legacy Do Not Track signal as a general instruction to disable all tracking; this does not affect our handling of legally recognized opt-out signals. Where consent is required for a tracking technology, session recording, access to communication contents or a similar activity, we obtain that consent before the activity begins. This Policy and continued browsing do not substitute for that consent. We limit collection and access to the information needed for the disclosed purpose.

Automated analytics and decisioning

We may use algorithms when considering and processing your application or providing the Services. These tools may produce automated assessments or decisions based on information we are permitted to use for the relevant purpose. We take reasonable steps to support accuracy, reliability and fair treatment and may ask you to clarify information when accuracy is uncertain. You may ask about an assessment, request correction of inaccurate data or request review via the channels which we may designate from time to time, including by contacting support@gauss.money. We provide any access, review, explanation or opt-out rights required by applicable law. When a credit decision requires an adverse-action or other notice, we provide that notice separately; this Policy does not replace it. Google user data is excluded from credit assessment, lending and model-development uses as described in “Google account access”.

Personal data of another person

If you provide another person’s personal information, you must have an appropriate basis to do so, provide that person with this Policy where appropriate, and explain the relevant purpose. Do not provide unrelated or unnecessary information. We remain responsible for our own legal obligations and do not treat your disclosure as unlimited authority to process that person’s information.

Security

The security of your personal information is important to us. We maintain administrative, technical and physical safeguards designed to protect its confidentiality and integrity in transit and storage. Our security program takes account of recognized standards, including relevant NIST guidance such as NIST 800-53, and applicable requirements for financial information. Controls include encryption, access restrictions, appropriate key management, monitoring and service-provider oversight. We use HTTPS with current transport security, rather than relying on obsolete SSL protocols. We require appropriate contractual safeguards from service providers and assess their handling of information according to their role. These measures reduce risk but cannot guarantee that unauthorized access, loss or disclosure will never occur.

Additional steps we are taking to safeguard your personal information through vigorous physical, electronic, and operational policies and practices are:

• Session Time-Outs: We use session expiration and other authentication controls to reduce unauthorized access when an account or device is unattended. Applicable time-out settings depend on the feature and security requirements.
• Protection of Account Numbers: We restrict display of full account numbers and use masking or other controls where appropriate to the function being performed.
• Secure, Off-Site Hosting: We use controlled cloud-hosting environments, including Amazon Web Services, with safeguards for personal and sensitive financial information such as Social Security numbers and bank-account information.
• Defined Service Access Points: We restrict system and data access through authenticated service interfaces, role-based permissions and other appropriate controls. Access is limited to authorized personnel and providers with a legitimate need for the permitted purpose; the stricter Google human-access limits continue to apply.
• Transport Security and Certificates: We use HTTPS, digital certificates and supported Transport Layer Security (“TLS”) to protect communications with our Services.
• Data Encryption: We use encryption and appropriate key-management controls to protect sensitive information in transit and at rest. Browser compatibility and security requirements are communicated through the Services where applicable.
• Network Firewalls: We use network restrictions and firewall or equivalent controls to limit unauthorized access to application and data systems. Necessary authorized communications remain subject to access and security controls.

You should also be aware that the Internet (including applications which use the Internet for data transfer) may not be a secure form of communication and sending us personal data over the Internet may carry with it risks including the risk of access and interference by unauthorized third parties. Information passing over the Internet may be transmitted internationally (even when the sender and recipient are located in the same country) via countries with weaker privacy and data protection laws than your country of residence.

Disclosure of Personal Data

We keep personal information confidential and disclose it only for the purposes described under “Purpose of use of Personal Data”, to the recipient categories below where relevant to the actual Service or relationship, and subject to applicable legal restrictions and your choices. Recipients may be located within or outside the United States. The specific limits in “Google account access”, the financial privacy notice and applicable state law control over any broader description here:

1. subsidiaries or affiliates, if such relationships exist, and authorized agents, contractors, subcontractors, service providers, associates and professional advisers acting for Gauss. As stated in the financial privacy notice, Placid Inc. has no affiliates as of this Policy’s revision date; any future affiliate sharing requires applicable notice and your affirmative consent before it begins;
2. providers of administration, mailing, telecommunications, information technology, cloud hosting, customer support, identity verification, fraud prevention, payments, authorized AI processing, debt collection, marketing on our behalf, data processing and other services necessary for Gauss’s operations, with access limited to their authorized function and no independent marketing use;
3. Authorities with jurisdiction, where disclosure is lawfully required or permitted;
4. persons subject to confidentiality obligations who also have a specific authorized role and lawful need for the information; confidentiality alone does not authorize disclosure;
5. persons authorized to act on your behalf, payment recipients and financial institutions or payment providers involved in a transaction you request;
6. consumer reporting agencies where reporting or access is permitted by the Fair Credit Reporting Act and applicable law, and debt-collection agencies where necessary for lawful collection or servicing;
7. persons to whom disclosure is lawfully required or permitted for the purposes in items 11, 12 or 13 of “Purpose of use of Personal Data”, with appropriate authority and safeguards;
8. financial institutions, lenders, payment providers, data providers or other Services you authorize to connect through an API or similar interface, limited to the data and purpose of the authorized connection;
9. any actual or proposed assignee of the Gauss or participant or sub-participant or transferee of the Gauss rights in respect of the data subject;
10. parties involved in a merger, acquisition or transfer of Gauss’s business or assets, subject to confidentiality, applicable law and any required notice or consent. This provision does not expand the permitted transfers of Google user data described under “Google account access”; and
11. other organizations you authorize for a specifically disclosed Service, application or offer, including:
    1. financial institutions, lenders, credit-card providers and application providers involved in your request;
    2. reward, loyalty, co-branding or privileges program providers; and
    3. Partners.

For lenders, billers, merchants and utilities contacted through the assistance you request, we disclose only the information needed for the action you authorize. The Gmail confirmation feature remains limited to lender messages. The recipient handles received communications under its own obligations and privacy practices. Providers processing information on our behalf must comply with applicable confidentiality, security, retention and use restrictions. We do not treat independent recipients as our service providers merely because they receive information from us.

Information You Share Socially

Our Services may allow you to connect and share your actions, comments, content, and information publicly or with friends. We are not responsible for maintaining the confidentiality of any information you share publicly or with friends.

Our Services may also allow you to connect with us on, share on, and use third-party websites, applications, and services. Please be mindful of your personal privacy needs and the privacy needs of others, as you choose whom to connect with and what to share and make public. We cannot control the privacy or security of information you choose to make public or share with others. We also do not control the privacy practices of third parties. Please contact those sites and services directly if you want to learn about their privacy practices.

Retention of personal data

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide a Service you request, and to meet applicable legal or regulatory obligations or a documented legitimate retention need. We consider the type and sensitivity of information, the duration of the relationship, applicable recordkeeping and limitation periods, security needs, disputes and legal holds. Certain lending, payment, accounting, compliance or dispute records may be retained for up to seven (7) years after the relationship ends where those requirements or justified needs apply; some records require a different period. Seven years is not a blanket minimum for every category. You may request earlier deletion of some or all information. Subject to applicable law, we may retain particular information where:

1. a legal or regulatory obligation, legal hold or other applicable retention exception requires or permits us to keep the particular record; or
   1. the information remains necessary for a Service you still request or another specific purpose permitted by applicable law. We assess each applicable ground; deletion is not permitted where a binding retention obligation remains.

If we cannot delete particular information in response to your request, we will explain the applicable limitation unless prohibited by law, restrict further use as required, and delete it when the retention ground ends. Closing an account, disconnecting a data provider or revoking a permission does not automatically eliminate outstanding obligations or lawfully retained records. We process deletion requests within applicable deadlines; no general seven-year rule overrides an earlier deletion obligation.

Retention by data category

• Lending, payments and compliance: application, underwriting, servicing, transaction, reporting and legally required records are retained for applicable recordkeeping periods or a documented legitimate need, including the seven-year period described above where justified.
• Identity verification and fraud prevention: identity documents, verification results and any biometric information are kept only for the verification, security and legal purposes that require them, subject to any shorter applicable retention or destruction requirements.
• Website, device, analytics and marketing data: information is retained only for the disclosed operational or marketing purpose and applicable consent or opt-out records, subject to minimization and deletion requirements. It is not automatically retained for seven years after account closure.
• Support and negotiation information: instructions, relevant account information, drafts and correspondence are retained as necessary to provide the requested assistance, document completed actions and address applicable disputes or legal obligations.
• Google authorization tokens and sending records: access and refresh tokens are not retained after the sending operation. Message audit records are assessed separately and retained only for the narrow purposes in “Google account access”. The general seven-year period does not apply automatically to these records.

We periodically review retention and securely dispose of information no longer needed. Where the FTC Safeguards Rule applies, we dispose of customer information no later than two years after its last use in providing the relevant product or service, unless necessary for business operations or another legitimate business purpose, required by law, or targeted disposal is not reasonably feasible. Retained backup information is protected and excluded from ordinary use until overwritten or deleted under the applicable backup schedule, subject to legal holds and stricter requirements for particular data.

Accessing your personal data

You may contact us to request access to, correction or deletion of personal information and information about our practices. Available rights depend on the information, relationship and applicable law; lawful limits may protect security, others’ information or required records. For example, you may:

1. check whether we hold data about you and/or access to such data;
2. require us to correct any data relating to you which is inaccurate;
3. ascertain our policies and procedures in relation to data and to be informed of the kind of personal data held by us and/or you have access to; and
4. be informed on request which items of data are routinely disclosed to consumer reporting agencies or debt collection agencies, and be provided with further information to enable the making of an access or correction request to the relevant consumer reporting agency or debt collection agency.

To exercise these rights, contact support@gauss.money or (877) 909-1559. We use proportionate verification where necessary and explain any applicable limitation. Do not send a full Social Security number, account password or identity document by ordinary email. If additional information is necessary, we will provide appropriate instructions.

If you dispute information Gauss furnished to a consumer reporting agency, contact support@gauss.money or write to Placid Inc., 200 Vesey Street, 24th Floor, New York, NY 10281, identify the account and disputed information, explain the basis and provide relevant supporting information through a secure method. We will investigate qualifying direct disputes and make required corrections or notifications under applicable law. You may also dispute information with the consumer reporting agency. A privacy correction or deletion request does not erase an accurate credit history or replace applicable FCRA procedures.

Other

1. Nothing in this Privacy Policy shall limit the rights of data subjects.
2. Where legally permitted, Gauss may record or monitor communications you have with us for the disclosed service, security, quality or compliance purpose. We provide any required notice and obtain any required consent before recording or access begins. This does not permit monitoring your Gmail mailbox or expand the “Google account access” permissions.
3. This Policy accompanies the contracts, agreements, credit applications, account-opening documents and other arrangements you enter into with us. It does not waive statutory rights, replace separately required notices or authorizations, or constitute blanket consent to every described activity.

For California Consumers

The California Consumer Privacy Act (“CCPA”), effective January 1, 2020 and amended by the California Privacy Rights Act and subsequent law, provides California residents rights concerning their personal information where the CCPA applies to the business, information and activity. Personal information includes information that identifies, relates to, describes or could reasonably be linked, directly or indirectly, with a California resident or household. Subject to applicable exceptions, rights include access to categories and specific pieces of information in a readily usable format, correction, deletion, and applicable opt-outs and limitations.

This section applies to information and activities subject to the CCPA. Certain information collected, processed or disclosed under the Gramm-Leach-Bliley Act (“GLBA”) or California Financial Information Privacy Act is exempt from specified CCPA requirements. Certain activities regulated by the Fair Credit Reporting Act (“FCRA”) also qualify for an exemption. These are not blanket exemptions for all information held by Gauss, and they do not eliminate applicable security-breach rights. Other legal obligations, including applicable financial-recordkeeping and Bank Secrecy Act requirements, may require retention or limit disclosure of particular records. We explain limitations where required without disclosing information that law prohibits us from disclosing.

We do not discriminate or retaliate against you for exercising applicable privacy rights. We will not deny services, charge different prices or provide a different level or quality of service because you exercise those rights, except as expressly permitted by law. Some requested Services cannot operate without information reasonably necessary to provide them; we will explain any such consequence.

Categories, sources and purposes

During the preceding 12 months, depending on the Services used, the categories of information described in this Policy include: identifiers and contact details; customer records such as financial-account and payment information; demographic or legally protected characteristics such as age; commercial and transaction information; internet and other network activity; geolocation; audio, electronic, visual or similar information such as support communications and identity images; employment or income information; credit information; and inferences such as preferences or relevant financial assessments. These categories include sensitive personal information where applicable, such as Social Security numbers, account credentials, precise geolocation where collected, and any biometric information processed to identify you. Optional Google connection data is collected only when the feature is used and is subject to “Google account access”. The categories of sources are you and your authorized representatives; your interactions with the Site, app and devices; connected financial institutions and data providers; consumer reporting agencies; payment, identity and fraud-prevention providers; and lenders or other participants in Services you request. The purposes are providing and administering requested Services, identity and security checks, legally permitted credit and risk assessment, payments and reporting, support and user-directed negotiations, analytics, permitted marketing and compliance, as detailed in “Purpose of use of Personal Data”. Google data is excluded from the broader purposes specified in its separate section.

Disclosures, sale and sharing

For business purposes, identifiers, contact, customer-record, financial, transaction, employment/income and credit information may be disclosed to relevant financial institutions, consumer reporting agencies, payment and servicing providers, identity/fraud providers and authorized operational providers. Communications, audio/visual information and relevant financial information may be disclosed to support, identity-verification, AI or negotiation providers and the recipients you authorize, as applicable to the requested action. Technical, internet-activity, general location and inference information may be disclosed to hosting, security and analytics providers. Professional advisers, authorities and transaction counterparties receive relevant categories only for a lawful, disclosed purpose. This describes the recipient relationships during the preceding 12 months to the extent the corresponding Service or activity was used; a prospective feature is not represented as historical collection.

We allow advertising partners to collect or receive online identifiers, internet or device activity, general location and related advertising inferences for advertising across sites, services and devices. These disclosures are sharing for cross-context behavioral advertising under California law and may also constitute a sale under that law. They are subject to your opt-out rights and recognized preference signals. The restrictions under “Collection and Use of Information Collected Automatically” apply to these disclosures. We do not disclose Google user data, consumer-report information, transaction information or information from connected financial accounts to advertising partners. We do not sell precise geolocation data. We provide required notice and choices before beginning a materially different sale or sharing practice.

We use sensitive personal information as reasonably necessary to provide requested Services, verify identity, protect security, prevent fraud, meet legal requirements and carry out other purposes permitted without a limitation right under applicable law. If we use or disclose it for a purpose that triggers a right to limit, we provide the required notice and means to exercise that right before that use. Retention periods or criteria are described under “Retention of personal data”. Contact support@gauss.money or call (877) 909-1559 to make a request. For sale or sharing opt-outs, select “Your Privacy Choices” on our website or open Settings > Privacy in the Gauss app. We update the disclosures in this section at least annually and provide applicable notices at or before collection. If an exception applies, we explain the limitation as required; an exception is not a blanket refusal of all rights.

• Right to Know and Access: You may request the categories and specific pieces of personal information we collect, use, disclose, sell or share, and obtain an available portable copy. This includes:
  • The categories of personal information we’ve collected about you;
  • The categories of sources from which the personal information is collected;
  • The business or commercial purpose for collecting, selling or sharing the information; and
  • The categories of third parties to whom information is disclosed, the categories disclosed for a business purpose, and the categories sold or shared, as applicable.
• Right to Delete: You may request deletion of personal information we collected from you, subject to legal exceptions. We direct service providers and contractors, and notify other recipients where required by law, to delete relevant information. We verify identity where required and explain any permitted refusal or partial deletion.
• Right to Correct: You may request correction of inaccurate personal information, taking account of its nature and the purpose of processing. We verify identity where required and use reasonable efforts to correct information as required by law.
• Right to Opt Out of Sale or Sharing: You may direct us not to sell or share personal information as those terms are defined by the CCPA, including sharing for cross-context behavioral advertising. Select “Your Privacy Choices” on our website or open Settings > Privacy in the Gauss app, send a recognized opt-out preference signal such as GPC, email support@gauss.money or call (877) 909-1559. We process opt-out requests as soon as feasibly possible and no later than 15 business days after receipt. We do not require account creation or identity verification. We apply and confirm preference signals as described under “Collection and Use of Information Collected Automatically”.
• Right to Limit Sensitive Information: Where our use or disclosure of sensitive personal information triggers this right, you may direct us to limit it to purposes permitted by the CCPA. We provide the required controls and process a valid limitation request as soon as feasibly possible and no later than 15 business days after receipt, without requiring identity verification.
• Other Rights: You may designate an authorized agent to submit a request at support@gauss.money or through another available request method. We may request proof of the agent’s authority and verify your identity where the type of request and law permit, but do not require identity verification for sale/sharing opt-outs or sensitive-information limitation requests. You have the right not to be discriminated or retaliated against for exercising applicable rights. We honor additional applicable rights and procedures as they become effective and apply to the relevant information and processing.

For requests to know, correct or delete personal information subject to the CCPA, we acknowledge receipt within 10 business days and respond within 45 calendar days after receiving the request. If a permitted extension is reasonably necessary, we notify you within the initial 45-day period, explain the reason and respond within a maximum of 90 calendar days after receipt. Verification does not extend these deadlines.

Where identity verification is required, we use information already associated with your account when feasible and request additional information only when reasonably necessary for the sensitivity of the data and request. We do not routinely require a full taxpayer identification number or government identification when less intrusive verification will suffice. Do not send sensitive identity documents or full Social Security numbers by ordinary email. We provide a secure method if additional verification is necessary. Requests are handled without charge unless applicable law permits a fee or refusal for an excessive or manifestly unfounded request, which we will explain.

Residents of other states may have rights to access, correct, delete or obtain a copy of information, opt out of certain sales, targeted advertising or profiling, or appeal a denial, depending on the applicable law, thresholds and exemptions. Submit a request or an appeal to support@gauss.money, identifying your state and the request. We apply the relevant verification, response deadlines and appeal procedures, explain decisions as required, and provide regulator-contact information where applicable. This statement does not imply that every state statute applies to all Gauss information or activities.

Where Connecticut law applies, your access right includes inferences about you and whether your data is used for profiling to make decisions with legal or similarly significant effects. You may request a list of the third parties to which we have sold your personal data, or all third parties to which we have sold personal data if we do not maintain a consumer-specific list. Where feasible, you may question a qualifying profiling decision, obtain its reasons and review the data used. Submit requests and appeals to support@gauss.money. We respond to requests within 45 days, with a further 45 days where permitted and timely explained. We decide appeals within 60 days and provide a method to contact the Connecticut Attorney General if an appeal is denied.

If you have questions about this Policy, would like to request access, correction or deletion, or want information about our practices and the kinds of data held, contact support@gauss.money, call (877) 909-1559, or write to Placid Inc., 200 Vesey Street, 24th Floor, New York, NY 10281.

Gauss Gramm-Leach Bliley Privacy Notice

rev. September 2026