Privacy Policy

1. Introduction

Kikoff, Inc. ("Kikoff") and its lending subsidiary KikOff Lending, LLC (together, "we," "us," or "our") are committed to protecting your privacy. This Privacy Policy describes how we collect, use, share, and protect your personal information when you use the Undo by Kikoff mobile application and related services (collectively, the "Service"). It also explains your rights and choices regarding your information.

This Privacy Policy applies to all users of the Service, regardless of location, and supplements the privacy disclosures in our Terms of Service and Loan Agreement. By creating an Undo account or using the Service, you agree to the collection and use of your information as described here. Additional state-specific disclosures appear in Section 11.

2. Information We Collect

2.1 Information You Provide Directly

When you create an account and use the Service, you provide us with:

• Identity information, including full legal name, date of birth, email address, phone number, and mailing address.
• Government identifiers, including Social Security Number or Individual Taxpayer Identification Number (ITIN), collected for identity verification, fraud prevention, and, if applicable, credit reporting under the FCRA.
• Account credentials, including password and authentication information.
• Communications, including messages you send to our support team, responses to surveys, or other correspondence with us.

2.2 Financial Account Information via Plaid

To provide the lending and spending-analysis features of the Service, we use Plaid Technologies, Inc. ("Plaid") to securely connect to your external financial accounts. With your authorization, we and Plaid collect:

• Bank account and routing numbers.
• Account balances and account type.
• Transaction history, including payees, amounts, dates, and categories, typically 12-24 months.
• Income and payroll data signals.
• Identity information held by your financial institution.

Your use of Plaid is also governed by Plaid's End User Privacy Policy at https://plaid.com/legal. Kikoff does not sell or rent Plaid-sourced financial data to third parties for marketing purposes.

2.3 Information Collected Automatically

When you use our app, we automatically collect device information, network information, usage data, and diagnostic data. This may include device type, operating system version, unique device identifiers, mobile carrier, IP address, general geographic location, features accessed, time spent, navigation paths, button clicks, in-app events, crash reports, error logs, and performance metrics.

2.4 Cookies and Tracking Technologies

When you access our website or marketing pages, we and our third-party partners use cookies, pixel tags, and similar tracking technologies to remember your preferences and authentication state, analyze traffic and measure marketing effectiveness, and detect fraud and security threats.

You can control cookies through your browser settings. Disabling certain cookies may limit some functionality of our website. We honor Global Privacy Control (GPC) signals as opt-out requests under applicable state law. Our app does not respond to browser-based Do Not Track (DNT) signals, as no uniform standard exists.

2.5 Information from Third Parties

We may receive information about you from consumer reporting agencies, identity verification and fraud prevention vendors, analytics providers, and marketing platforms if you arrived through a paid advertisement or referral program.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Account creation and authentication.
• Underwriting and credit decisioning.
• Loan origination, disbursement, repayment collection, and loan account servicing.
• Subscription management, billing, and access to premium features.
• Credit reporting for Premium subscribers who opt in.
• Credit monitoring and spending insights.
• Fraud prevention, account security, and investigation of unauthorized access or illegal activity.
• Transactional and promotional communications, where permitted and with consent where required.
• Legal compliance, including obligations under the Bank Secrecy Act, Anti-Money Laundering rules, FCRA, Regulation E, and applicable state consumer lending and privacy laws.
• Product improvement and marketing.

4. Categories of Personal Information We Collect

The table below summarizes the categories of personal information we collect, our purposes for collecting it, and the categories of third parties with whom we share it. This disclosure is provided in accordance with the California Consumer Privacy Act (CCPA/CPRA).

We do not sell your personal information as defined by the CCPA/CPRA. We do not share your personal information for cross-context behavioral advertising. Financial information collected or disclosed pursuant to the GLBA or FCRA may be exempt from certain CCPA obligations.

5. How We Share Your Information

We do not sell or rent your personal information. We share your information only as described below.

5.1 Service Providers

We share information with third-party service providers who help us deliver the Service. These providers are contractually required to use your information only as necessary to perform services for us and to maintain appropriate security measures. Current service provider categories include bank account connectivity, payment processing and ACH, identity verification and fraud screening, credit reporting for Premium opt-in, cloud infrastructure and storage, analytics, and customer support.

5.2 Credit Reporting Agencies

If you are an Undo Premium subscriber and have opted into credit reporting, KikOff Lending, LLC will furnish records of your on-time installment payments to one or more consumer reporting agencies, such as Experian and/or TransUnion. We furnish positive payment data only. Consistent with our current lending model, we do not furnish negative information, delinquency data, or default records.

5.3 KikOff Lending, LLC

The Undo app is operated by Kikoff, Inc., and loans are originated by KikOff Lending, LLC, a separate but affiliated Delaware limited liability company. Kikoff, Inc. shares the personal information necessary to originate, service, and collect on loans with KikOff Lending, LLC. Both entities are subject to this Privacy Policy.

5.4 Legal and Regulatory Disclosures

We may disclose your information to law enforcement, regulatory authorities, including the CFPB and state financial regulators, courts, or other third parties when required by law, court order, or regulatory demand, or when we reasonably believe disclosure is necessary to protect the rights, safety, or property of Kikoff, our users, or the public.

5.5 Business Transfers

If Kikoff is involved in a merger, acquisition, financing, restructuring, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such transfer and any choices you may have regarding your information, to the extent required by applicable law.

5.6 With Your Consent

We may share your information for purposes not described in this Policy with your prior express consent.

6. Financial Privacy - Gramm-Leach-Bliley Act Notice

Federal law requires financial institutions to explain how they share your personal financial information. This section serves as Kikoff's GLBA annual privacy notice.

All financial companies need to share customers' personal information to run their everyday business. The table below lists the reasons financial companies can share their customers' personal financial information, the reasons Kikoff chooses to share, and whether you can limit this sharing.

To limit our sharing, contact us at support@undopower.com. Please note: if you are a new customer, we can begin sharing your information 30 days from the date we sent you this notice. When you are no longer our customer, we continue to share your information as described in this notice. However, you can contact us at any time to limit our sharing.

7. Fair Credit Reporting Act Disclosures

We may obtain consumer reports from consumer reporting agencies for purposes of underwriting and ongoing account management. Your rights under the FCRA include:

• The right to be informed if a consumer report was used in a credit decision that adversely affects you, and to receive the name and address of the consumer reporting agency that provided the report.
• The right to a free copy of your consumer report from the reporting agency within 60 days of an adverse action.
• The right to dispute inaccurate or incomplete information in your consumer report directly with the consumer reporting agency.

If you are a Premium subscriber enrolled in credit reporting and believe any information we have furnished to a credit bureau is inaccurate or incomplete, please contact us at support@undopower.com. We will investigate and, if warranted, correct or delete the information within the timeframes required by the FCRA.

8. Data Retention

We retain your personal information for as long as necessary to provide the Service, fulfill the purposes described in this Policy, and meet our legal obligations. Our general retention periods are:

• Account and identity information: duration of your account plus 5 years after closure, as required by consumer lending and BSA/AML regulations.
• Loan and transaction records: 5-7 years after the loan is repaid or charged off, as required by applicable federal and state law.
• Financial account data from Plaid: retained for underwriting, servicing, and audit purposes; deleted or anonymized after the relevant retention period.
• Communications and support records: up to 3 years after your last interaction with our support team.
• Marketing and analytics data: up to 2 years, or until you opt out.

When retention periods expire, we delete or anonymize your information in accordance with our internal data retention schedule.

9. Data Security

We implement industry-standard technical, administrative, and physical safeguards to protect your personal information, including encryption of data in transit and at rest, role-based access controls and multi-factor authentication for internal systems, regular security audits, employee training, and vendor security assessments for third-party service providers.

No method of transmission over the internet or method of electronic storage is 100% secure. If you believe your account has been compromised or you notice unauthorized activity, contact us immediately at support@undopower.com.

10. Your Rights and Choices

10.1 Access, Correction, and Deletion

You may request access to, correction of, or deletion of your personal information by contacting us at support@undopower.com. We will respond within 45 days, or as extended by applicable law. We may retain certain information to comply with legal obligations, such as AML records and loan records.

10.2 Opt-Out of Marketing Communications

You may opt out of promotional emails by clicking the unsubscribe link in any marketing email. You may opt out of push notifications through your device settings. Transactional messages, including payment confirmations, fee notices, and account alerts, cannot be opted out of while your account is active.

10.3 Credit Reporting Opt-Out for Premium

If you are a Premium subscriber enrolled in credit reporting, you may opt out at any time via app settings under "Credit Reporting." Opting out stops future data furnishing but does not remove information already reported to the bureaus.

10.4 Linked Account Disconnection

You may disconnect a linked bank account through the app or by contacting support. Note that disconnecting your bank account may prevent loan origination or repayment collection.

10.5 Account Closure

You may close your Undo account by contacting support@undopower.com. Account closure does not delete information we are legally required to retain. Any outstanding loan balance must be repaid before or after closure.

11. State-Specific Privacy Rights

Depending on your state of residence, you may have additional privacy rights. To exercise any of the rights described below, contact us at support@undopower.com. We will verify your identity before processing your request and will respond within the timeframe required by applicable law, generally 45-60 days.

California (CCPA/CPRA)

California residents have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to Know: request the categories and specific pieces of personal information we have collected, our purposes, and the third parties we share with.
• Right to Delete: request deletion of personal information, subject to legal exceptions such as records required by law.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: we do not sell your personal information and do not share it for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: request that we limit our use of sensitive personal information, such as SSN and financial account information, to purposes necessary to provide the Service.
• Right to Non-Discrimination: we will not deny, charge different prices, or provide a different quality of service because you exercised your CCPA rights.

To submit a CCPA/CPRA request, contact us at support@undopower.com. We will respond within 45 days, extendable by an additional 45 days with notice. Financial information subject to the GLBA or FCRA may be exempt from certain CCPA obligations.

California residents may direct complaints to the California Department of Financial Protection and Innovation at https://dfpi.ca.gov or the California Privacy Protection Agency at https://cppa.ca.gov.

Colorado, Connecticut, Virginia, Texas, Oregon, and Other States

Residents of states with comprehensive consumer privacy laws, including Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Nevada, and others enacted after the date of this Policy, may have rights similar to those described above, including rights to access, correct, delete, and opt out of certain processing of personal data. To exercise any of these rights, contact us at support@undopower.com. We will respond within the timeframe required by your state's law.

Vermont

We do not share your personal information with non-affiliated third parties for marketing purposes unless you have affirmatively authorized such sharing. Vermont residents may contact us at support@undopower.com to opt out of any other permissible information sharing.

Nevada

Nevada residents may submit a request to opt out of the future sale of certain personal information to third parties. We currently do not sell personal information as defined under Nevada law. For inquiries, contact support@undopower.com.

12. Children's Privacy

The Service is intended for users who are 18 years of age or older. We do not knowingly collect personal information from individuals under the age of 18. If you believe we have inadvertently collected information from a minor, please contact us at support@undopower.com and we will promptly delete such information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated Policy in the Undo app and, where required by applicable law, by email or in-app notification at least 30 days before the changes take effect. The Effective Date at the top of this Policy reflects when it was last revised. Your continued use of the Service after the effective date of any update constitutes your acceptance of the revised Policy.

14. Contact Us