Privacy Statement

“Personal Information” means information that identifies, relates to, describes, or could reasonably be associated or linked with an individual or household. The meaning of Personal Information may vary under applicable law.

Crescentic may process Personal Information in different capacities depending on the product, service, and relationship involved.

Direct relationships

When an individual creates an account directly with Crescentic, subscribes to a Crescentic product, visits a Crescentic website, or otherwise interacts directly with Crescentic, Crescentic generally determines why and how the individual’s Personal Information is processed.

Client-directed processing

When Crescentic provides technology or services to a financial institution, issuer, employer, advisor, lender, service provider, or other organizational client, Crescentic may process Personal Information on that client’s behalf and according to its documented instructions.

In those circumstances, the client generally controls the relevant records and determines the purposes for which the information is processed. Individuals should ordinarily direct privacy requests concerning those records to the organization with which they have the underlying account or relationship.

Crescentic will support its clients in responding to privacy requests where required by contract or applicable law.

A Product Privacy Notice may be provided where a Crescentic product has data practices that are materially different from the general practices described in this Privacy Statement.

Product Privacy Notices may address matters such as:

• Connected email accounts and communications
• Financial accounts, assets, liabilities, and transactions
• Tax, cost-basis, portfolio, and performance information
• Estate plans, trusts, beneficiaries, family relationships, and documents
• Investor onboarding and identity verification
• Tokenized assets, wallet addresses, and blockchain transactions
• Loan, borrower, payment, or servicing information
• Behavioral assessments and inferred characteristics
• User-directed web data collection
• Artificial intelligence and automated analysis
• Text-message notifications and consent
• Delegated access by accountants, advisors, attorneys, executors, trustees, family members, and other trusted representatives
• Enterprise data-processing arrangements

Where a Product Privacy Notice conflicts with this Privacy Statement regarding a product-specific practice, the Product Privacy Notice controls for that practice.

Customer agreements, Data Processing Addenda, and other negotiated contracts may also govern Crescentic’s processing of information on behalf of organizational clients.

The Personal Information Crescentic collects depends on the product or service used, the user’s relationship with Crescentic, and the features the user chooses to enable.

Crescentic may collect the following categories of information.

Identity and contact information

Name, email address, mobile or other telephone number, mailing address, organization, job title, professional role, account identifiers, and similar contact information.

Account and authentication information

Account identifiers, authentication records, security settings, account-recovery information, session information, login activity, authorization records, and information associated with access to a Crescentic account.

Some Crescentic products may use passwordless authentication or third-party identity providers. Crescentic does not store passwords in plain text.

Product and user-provided information

Information entered, uploaded, created, submitted, stored, or shared through a Crescentic product, including:

• Preferences and configuration settings
• Instructions and selections
• Notes and communications
• Records and forms
• Documents and attachments
• User-generated content
• Support requests and feedback

Connected-account information

When a user chooses to connect an external account, provider, application, or data source, Crescentic may receive information from that provider according to the permissions authorized by the user.

Depending on the product and connection, this may include:

• External account identifiers
• Authorization tokens
• Email content and metadata
• Contact information
• Financial account information
• Holdings and transaction information
• Documents and attachments
• Calendar or notification information
• Other information made available through the authorized connection

Crescentic does not receive information beyond the permissions provided by the connected service and authorized by the user, except where otherwise permitted by law or contract.

Financial and transactional information

Depending on the product, Crescentic may process:

• Financial accounts and balances
• Assets and liabilities
• Securities positions
• Tax lots and cost basis
• Transaction history
• Portfolio and performance information
• Payments and subscriptions
• Estate and trust assets
• Ownership and beneficiary information
• Loan and servicing information
• Tokenized-asset and digital-asset activity
• Other financial or transactional records

Estate, family, and representative information

Certain Crescentic products may process information concerning:

• Family and household relationships
• Beneficiaries and contingent beneficiaries
• Executors, trustees, guardians, agents, and other representatives
• Trusts and estate-planning arrangements
• Documents and instructions
• Delegated access and trusted-party permissions

This information may relate to individuals who do not have their own Crescentic accounts when it is provided by an authorized user, client, fiduciary, or representative.

Communications and support information

Emails, support requests, feedback, complaints, survey responses, and other communications with Crescentic.

Where permitted and disclosed, Crescentic may retain records of customer-support interactions for training, quality, security, dispute-resolution, or compliance purposes.

SMS and notification information

Mobile telephone numbers, notification settings, records of consent, enrollment dates and times, consent-language versions, message-delivery records, and HELP, STOP, or other messaging requests.

Device, usage, and technical information

Internet Protocol address, browser type, device type, operating system, application activity, session information, referring pages, log data, crash information, approximate location derived from an IP address, and security-event information.

Crescentic does not collect precise device location unless a product specifically requests it and the user authorizes that collection.

Cookie and analytics information

Cookie identifiers, preference information, website interactions, analytics information, and information collected through similar technologies, subject to applicable consent and opt-out requirements.

Compliance, security, and risk information

Information used to prevent, identify, investigate, or respond to:

• Fraud
• Unauthorized access
• Misuse
• Security events
• Complaints
• Legal obligations
• Contractual requirements
• Violations of Crescentic terms

Employment and applicant information

Information submitted or collected in connection with recruitment, employment, contracting, workforce administration, or professional engagement with Crescentic.

Certain Crescentic products may process information that is treated as sensitive under applicable law.

Depending on the product, this may include:

• Government-issued identifiers
• Social Security numbers or taxpayer-identification numbers
• Financial account information
• Tax information
• Authentication credentials and authorization tokens
• Estate, trust, beneficiary, and family information
• Information concerning disability or accommodation needs
• Identity-verification information
• Precise location where expressly enabled
• Other information defined as sensitive under applicable law

Crescentic processes sensitive Personal Information only where reasonably necessary to provide an authorized product function, comply with law, protect security, perform client-directed services, or fulfill another disclosed purpose.

Access to sensitive Personal Information is restricted according to role, business need, product permissions, contractual obligations, and applicable law.

A Product Privacy Notice may provide additional information about sensitive information processed by a particular Crescentic product.

Crescentic may collect Personal Information:

• Directly from users
• From a user’s device or browser
• From a Crescentic client or the user’s organization
• From external accounts and services connected at the user’s direction
• From trusted representatives authorized by a user
• From payment, identity, communications, hosting, analytics, support, and security providers
• From business partners where permitted
• From publicly available sources
• Through the operation and use of Crescentic products
• As otherwise permitted by contract or applicable law

Crescentic may use Personal Information to:

• Create and administer accounts
• Authenticate users and protect account access
• Provide, configure, maintain, and support Crescentic products
• Process user instructions and authorized transactions
• Connect to external services selected by the user
• Display, organize, classify, analyze, or summarize information
• Generate alerts, recommendations, reports, and other product outputs
• Administer delegated access and trusted-party permissions
• Process payments and manage subscriptions
• Communicate about accounts, security, service status, and support
• Respond to inquiries, complaints, and privacy requests
• Personalize product settings and experiences
• Improve product quality, performance, accessibility, and reliability
• Conduct testing, analytics, research, and product development
• Detect fraud, misuse, security threats, and unauthorized activity
• Maintain records required for security, audit, compliance, and dispute resolution
• Comply with laws, regulations, legal process, and contractual obligations
• Protect Crescentic, its clients, users, and other persons
• Send marketing communications where permitted and subject to applicable choices

Information controlled by an organizational client is not used for unrelated purposes except as authorized by that client, permitted by the applicable agreement, or required by law.

Certain Crescentic products use artificial intelligence, machine learning, rules engines, algorithms, or other automated methods to:

• Organize and classify information
• Identify patterns or anomalies
• Prioritize content
• Generate summaries
• Extract information
• Support research or analysis
• Produce recommendations
• Assist with workflow and decision support
• Detect fraud, misuse, or security events

Automated outputs may be incomplete, inaccurate, outdated, or inappropriate for a particular purpose. Users should review material outputs and apply independent judgment before acting on them.

Crescentic does not ordinarily use solely automated processing to make decisions that produce legal or similarly significant effects concerning an individual unless the processing is specifically disclosed and permitted under applicable law.

Crescentic products are not intended to replace professional legal, financial, tax, investment, medical, employment, or other regulated advice unless expressly stated in applicable product terms.

A Product Privacy Notice may identify additional information concerning the data, providers, retention, and controls associated with a particular artificial-intelligence feature.

Certain Crescentic products allow an account owner to authorize another person or organization to access selected information or perform permitted actions.

Authorized representatives may include:

• Accountants
• Financial advisors
• Attorneys
• Executors
• Trustees
• Agents
• Family members
• Caregivers
• Other trusted representatives

The account owner determines whom to authorize and, where supported, the scope and duration of that access.

Crescentic may collect and retain information concerning invitations, permissions, authentication events, access activity, and revocation for security, support, compliance, and audit purposes.

Authorized representatives may access information only within the permissions made available through the applicable product.

The account owner is responsible for selecting appropriate representatives and reviewing or revoking access when it is no longer required.

An authorized representative may have independent professional, legal, fiduciary, regulatory, or contractual obligations concerning information accessed through Crescentic.

Revoking Crescentic access prevents future access through the Crescentic platform. It may not delete information that an authorized representative previously downloaded, exported, or otherwise retained outside the platform.

Crescentic may disclose Personal Information to the following categories of recipients.

Service providers

Crescentic may provide information to companies that support:

• Cloud infrastructure and hosting
• Authentication and identity
• Communications and messaging
• Email and external-account connectivity
• Payments and billing
• Analytics
• Artificial intelligence
• Security and fraud prevention
• Customer support
• Document processing
• Professional and operational services

These providers may process information only to provide services to Crescentic, subject to applicable contracts, confidentiality obligations, and legal requirements.

Organizational clients

Where Crescentic processes information on behalf of an organizational client, the information may be accessible to that client and its authorized users according to the applicable agreement and product permissions.

User-authorized recipients

Crescentic may disclose information when a user:

• Invites a trusted representative
• Connects a third-party service
• Directs Crescentic to transmit information
• Shares information with another person
• Otherwise authorizes disclosure

A person or organization invited by a user is not necessarily a Crescentic service provider and may independently determine how it handles information after receiving it.

Professional advisors

Crescentic may disclose information to attorneys, auditors, accountants, insurers, consultants, and other professional advisors where reasonably necessary.

Governmental and legal recipients

Crescentic may disclose information to courts, regulators, law-enforcement agencies, governmental authorities, or other persons when required by law or when reasonably necessary to protect rights, safety, security, or property.

Corporate transactions

Crescentic may disclose information to potential or actual investors, purchasers, lenders, professional advisors, or successors in connection with a financing, reorganization, merger, acquisition, bankruptcy, sale, or transfer of some or all of Crescentic’s business or assets.

Affiliates and related entities

Crescentic may disclose information to a subsidiary, affiliate, or related entity where necessary to provide or support a Crescentic service, subject to this Privacy Statement, applicable Product Privacy Notices, and legal requirements.

Crescentic does not sell individual consumer or account-holder Personal Information for monetary consideration.

Crescentic websites may use analytics, advertising, or similar technologies that applicable privacy laws may define as a sale, sharing, targeted advertising, or cross-context behavioral advertising.

Where applicable, users may exercise available choices through Crescentic’s Cookie & Privacy Preferences page or another opt-out mechanism presented on the relevant website or application.

Information processed on behalf of an enterprise client is not used for unrelated advertising purposes.

Mobile information, text-message originator opt-in data, and SMS consent information will not be sold, rented, purchased, or shared with third parties or affiliates for their marketing or promotional purposes.

Crescentic may provide mobile information to communications providers and other service providers solely to operate, deliver, secure, and support the applicable messaging program.

Those providers may use the information only to perform services for Crescentic and may not use it for their own marketing or promotional purposes.

Message types, message frequency, support information, and opt-out instructions are described in the SMS Policy or SMS Messaging Terms applicable to the relevant Crescentic product.

Users may reply STOP to discontinue applicable SMS messages or HELP for assistance.

Opting out of SMS messages does not necessarily affect other communications or product notifications that the user has separately authorized.

Information Crescentic processes on behalf of an organizational client is treated as the client’s Confidential Information and is used and disclosed according to:

• The applicable client agreement
• The client’s documented instructions
• Product permissions
• Applicable law
• Any relevant Data Processing Addendum

Where Crescentic serves a financial institution subject to the Gramm-Leach-Bliley Act or another financial-privacy framework, Crescentic processes covered information in accordance with its applicable contractual and legal obligations.

This does not mean that every Crescentic product, client, or category of information is subject to the Gramm-Leach-Bliley Act.

Crescentic retains Personal Information for the period reasonably necessary to:

• Provide the applicable product or service
• Maintain the user or client relationship
• Fulfill the purposes disclosed when information was collected
• Follow user and client instructions
• Comply with legal, regulatory, tax, accounting, reporting, and contractual obligations
• Maintain appropriate security, audit, and business records
• Resolve disputes
• Enforce agreements
• Prevent fraud, abuse, and security incidents

Retention periods vary according to:

• The type and sensitivity of the information
• The product or service involved
• The user’s settings and instructions
• The client relationship
• Contractual requirements
• Legal and regulatory obligations
• Security and operational needs

Information may remain in backups, logs, or protected archival systems for a limited period after deletion from active systems.

Disconnecting an external account does not necessarily delete information previously obtained through that connection. The applicable Product Privacy Notice describes any product-specific deletion or retention practices.

Crescentic uses administrative, technical, physical, and organizational safeguards designed to protect Personal Information against unauthorized access, use, alteration, loss, or disclosure.

Depending on the product, safeguards may include:

• Encryption in transit and at rest
• Authentication and session controls
• Role-based access
• Database access controls
• Row Level Security
• Logging and monitoring
• Backups
• Vendor-management procedures
• Security testing
• Incident-response processes
• Employee and contractor access restrictions

No system, transmission method, storage environment, or security measure can guarantee absolute security.

Users are responsible for protecting their devices, email accounts, authentication methods, trusted-party permissions, and account access.

Security questions and suspected vulnerabilities may be reported to: security@crescentic.ai.

Depending on the individual’s location and the context in which Crescentic processes Personal Information, applicable rights may include the right to:

• Request access to Personal Information
• Request correction of inaccurate information
• Request deletion
• Obtain a portable copy
• Restrict or object to certain processing
• Opt out of sale, sharing, or targeted advertising
• Limit certain uses of sensitive Personal Information
• Withdraw consent where processing relies on consent
• Appeal the denial of a privacy request
• Receive information about Crescentic’s collection and disclosure practices

To submit a privacy request, contact: privacy@crescentic.ai.

Crescentic may take reasonable steps to verify the requester’s identity, authority, and relationship to the information before acting on a request.

Crescentic will not discriminate against an individual for exercising an applicable privacy right.

Where Crescentic holds information on behalf of an organizational client, the request should generally be directed to that client. Crescentic will assist the client as required by contract or applicable law.

Authorized agents may submit requests where permitted by law. Crescentic may require evidence of the agent’s authority and may verify the request directly with the individual.

Users may unsubscribe from marketing emails by following the unsubscribe instructions included in the communication.

Users may manage product alerts and notifications through available account or application settings.

Users may opt out of applicable SMS messages by replying STOP.

Certain account, security, transactional, legal, or service-related communications are necessary to provide a Crescentic product and may continue even when a user opts out of marketing communications.

Crescentic websites and applications may use cookies and similar technologies for:

• Authentication
• Security
• User preferences
• Functionality
• Analytics
• Performance
• Advertising, where applicable

The technologies used may vary by product and website.

Additional information and available controls are provided through Crescentic’s Cookie & Privacy Preferences page or the consent-management interface presented on the relevant website or application.

Disabling certain cookies may affect authentication, functionality, preferences, or product performance.

Crescentic is based in the United States and may use service providers located in other jurisdictions.

Personal Information may therefore be transferred to or processed in countries whose privacy laws differ from those of the individual’s location.

Where required, Crescentic uses contractual terms, transfer agreements, or other recognized legal mechanisms intended to protect transferred information.

A Product Privacy Notice or client agreement may provide additional information concerning data location or cross-border processing.

Crescentic products are not directed to children under 13 unless a Product Privacy Notice expressly states otherwise and describes the applicable parental-consent or authorization process.

Crescentic does not knowingly collect Personal Information directly from children under 13 through a general-audience product without appropriate authorization.

Certain Crescentic products may process information about a minor when that information is provided by a parent, guardian, trustee, advisor, client, fiduciary, or other authorized adult for estate, trust, financial, family, or client-directed purposes.

The processing of information about a minor does not necessarily mean that the minor is a Crescentic user or account holder.

Personal Information submitted or collected in connection with employment, recruitment, contracting, or workforce administration may be used to:

• Evaluate qualifications
• Communicate with applicants
• Conduct permitted reference or background checks
• Administer employment or contracting relationships
• Protect Crescentic systems and personnel
• Comply with legal obligations

Additional workforce privacy information may be provided where required.

Crescentic products may contain links to or integrations with websites, services, applications, or platforms operated by third parties.

Crescentic is not responsible for the independent privacy, security, or data-handling practices of those third parties.

Users should review the privacy terms and permissions of a third-party service before authorizing a connection or submitting information to it.

Crescentic may update this Privacy Statement to reflect changes in its products, practices, service providers, technology, or legal obligations.

The version number and revision date will be updated when changes are published.

Where required, Crescentic will provide additional notice or obtain consent before applying a material change to previously collected Personal Information.

Changes to a Product Privacy Notice may be made independently of this Privacy Statement when they affect only the relevant product.

Crescentic LLC — Privacy Office

Privacy questions and privacy-rights requests: privacy@crescentic.ai

Security inquiries and vulnerability reports: security@crescentic.ai

Account, billing, and product support: support@crescentic.ai

Formal legal notices should be delivered according to the notice provisions in the applicable Crescentic or product-specific agreement.

Crescentic’s registered-agent information is reserved for service of process and official legal notices. The registered-agent address is not a customer-support, privacy-request, or security-reporting channel.