BankSocial Privacy Policy

Effective Date: January 2026

This Privacy Policy applies to you, the User of the BankSocial website, mobile application, and services, and Fivancial Inc. ("BankSocial," "we," "us," or "our"), the owner and provider of these services. This Policy describes how we collect, use, store, and protect your personal information in connection with your use of our financial services.

BankSocial is a financial institution subject to federal and state privacy laws, including the Gramm-Leach-Bliley Act (GLBA). We are committed to protecting the confidentiality and security of your personal financial information. For users outside the United States, additional privacy rights may apply under the General Data Protection Regulation (GDPR), UK GDPR, or Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Important Information

1.1 Service Availability

BankSocial's services are primarily intended for United States residents. Certain components of the BankSocial website and services are not available or intended for: (a) residents of jurisdictions where BankSocial is not licensed to serve, who are prohibited from using certain services—the system will automatically detect your locale and adjust your experience based on your location; and (b) children under the age of 18, and we do not knowingly collect data relating to minors.

1.2 Policy Relationship

This Privacy Policy supplements our Terms and Conditions and other policies. In the event of any conflict, the Terms and Conditions prevail unless this Privacy Policy expressly states otherwise.

1.3 Data Controller

Fivancial Inc., doing business as BankSocial, is the controller responsible for your personal data under this Privacy Policy. For EU/EEA and UK residents, we are the data controller as defined under GDPR and UK GDPR respectively.

1.4 Contact Information

We have appointed a Compliance Officer to oversee privacy matters. If you have any questions about this Privacy Policy or wish to exercise your legal rights, please contact us:

By email: [email protected]

By mail: 5910 N Central Expressway, Suite 1400, Dallas, TX 75206, USA

1.5 Data Accuracy

It is important that the personal information we hold about you is accurate and current. Please keep us informed of any changes to your personal information.

1.6 Third-Party Links

Our website may include links to third-party websites, plug-ins, and applications. We have no control over these third-party sites and are not responsible for their privacy practices. You should review their privacy policies before providing any personal information.

2. Privacy Notice Under U.S. Federal Law (U.S. Residents)

This section applies to U.S. residents. As a financial institution, BankSocial is required to provide you with this privacy notice explaining our information collection and sharing practices under the Gramm-Leach-Bliley Act.

2.1 Categories of Information We Collect

We collect the following categories of nonpublic personal information about you:

Information from you: identity information, contact information, financial account details, Social Security number, date of birth, and government-issued identification
Information about your transactions: payment history, transaction amounts, account balances, and usage patterns
Information from third parties: credit bureaus, identity verification services, fraud prevention agencies, and our service providers

2.2 Categories of Information We Share

We may share your nonpublic personal information with:

Affiliates: Companies related by common ownership or control (we currently do not share with affiliates for marketing purposes)
Service providers: Companies that perform services on our behalf, including payment processors, identity verification providers, cloud hosting services, and customer support platforms
Regulators and law enforcement: Government agencies as required by law, including FinCEN, state banking regulators, and law enforcement
Other third parties: With your consent or as permitted by law

2.3 Your Opt-Out Rights

You have the right to opt out of certain information sharing practices. Currently, BankSocial does not share your information with nonaffiliated third parties for their own marketing purposes in a manner that would trigger opt-out rights under GLBA. If our practices change, we will provide you with a clear method to opt out of such sharing.

3. How We Protect Your Information

To protect your personal information from unauthorized access and use, we maintain physical, electronic, and procedural safeguards that comply with federal standards, including the FTC Safeguards Rule. Our comprehensive information security program includes:

Encryption of data in transit and at rest
Multi-factor authentication for account access
Regular security testing and vulnerability assessments
Employee training on data security practices
Access controls limiting data access to authorized personnel only
Contractual requirements for service providers to maintain appropriate safeguards

We have procedures in place to respond to suspected data breaches and will notify you and applicable regulators as required by law.

4. The Personal Data We Collect About You

We collect, use, store, and transfer various types of personal data about you, including:

Contact Data: billing address, delivery address, email address, and telephone number
Financial Data: bank account details, payment card information, transaction history, and account balances
Identity Data: first name, last name, maiden name, username, Social Security number (U.S.) or national identification number, date of birth, gender, and government-issued identification
Mobile Contact Data (SMS): mobile telephone numbers collected solely for SMS messaging purposes
Marketing and Communications Data: your preferences for receiving marketing from us and your communication preferences
Profile Data: username and password, purchases or orders, preferences, feedback, and survey responses
SMS Consent Data: records of SMS opt-in, opt-out, timestamps, and messaging preferences
Technical Data: IP address, login data, browser type and version, time zone and location, device information, operating system and platform
Transaction and Usage Data: details about payments to and from you, services purchased, and usage patterns
Blockchain Data: wallet addresses and transaction records on distributed ledger systems

We also collect and use aggregated data for statistical analysis. Aggregated data may be derived from your personal data but does not directly or indirectly reveal your identity.

We do not collect special categories of sensitive personal data (such as health information, biometric data for identification, or information about sexual orientation) or information about criminal convictions and offenses, except as required for regulatory compliance.

5. How Personal Data Is Collected

We collect personal data through:

Direct interactions: When you complete online forms, request products or services, create a user account, subscribe to our services, join our email list, or correspond with us by mail, phone, email, or live chat
Automated technology: We automatically collect technical and usage data when you browse or interact with our website using cookies, server logs, and similar technologies
Third parties: We receive data from analytics providers (such as Google), identity verification services, fraud prevention agencies, credit bureaus, payment providers, and other service providers
Publicly available sources: We may collect certain information from publicly available sources where permitted by law
Blockchain networks: We collect transaction data from public blockchain networks when you use our stablecoin services

6. How We Use Your Personal Data

We will only use your personal data when the law allows us to. Most commonly, we use your personal data in the following circumstances:

To perform our contract with you or to take steps to enter into a contract
To comply with legal or regulatory obligations
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests
Where you have given consent (which you can withdraw at any time)

Marketing Communications

We rely on consent as the legal basis for sending email and SMS marketing communications. You have the right to withdraw your consent at any time by contacting us at [email protected].

You will only receive marketing communications from us if you have requested information, purchased services, consented to marketing, or if we have another lawful basis to send communications. You can opt out at any time.

7. SMS Messaging and Consent

7.1 SMS Message Types

BankSocial may use SMS/text messaging to send transactional, informational, and security-related messages, including verification codes, account alerts, fraud notifications, service updates, and support communications.

7.2 Marketing Messages

SMS messages are not marketing by default. Marketing messages are only sent where you have provided separate, explicit written consent specifically for SMS marketing messages.

7.3 Separate Consent

SMS consent is separate from email consent and all other marketing preferences. Opting in to SMS messages does not constitute consent to receive email marketing, push notifications, or other forms of communication.

7.4 No Third-Party Sharing

SMS opt-in data, mobile numbers collected for SMS, and SMS consent records will not be shared, sold, rented, transferred, or disclosed to any third party under any circumstances, except as strictly necessary to deliver SMS messages through our messaging service provider acting solely on our behalf.

7.5 Limited Use

SMS consent is used only for the specific messaging purpose disclosed at the time of opt-in and is not reused, repurposed, or combined with other data for advertising, analytics, or marketing profiling.

7.6 Opt-Out

You may withdraw your SMS consent at any time by replying STOP, QUIT, END, CANCEL, UNSUBSCRIBE, REVOKE, or OPT-OUT to any SMS message, or by contacting BankSocial support. Withdrawal of consent does not affect the lawfulness of messages sent prior to withdrawal.

8. Disclosure of Your Personal Data

We may share your personal data with third parties in the following circumstances:

Service Providers: Companies that provide IT services, payment processing, identity verification, fraud prevention, customer support, data analytics, and other business services
Professional Advisors: Lawyers, accountants, auditors, and insurers who provide professional services to us
Regulators and Law Enforcement: Government agencies, regulators (including FinCEN, CFPB, FTC, and state banking regulators), law enforcement, and courts as required by law or to protect our rights
Business Transfers: Third parties in connection with a sale, merger, acquisition, or transfer of our business or assets

All third parties are required to respect the security of your personal data and treat it in accordance with applicable law.

SMS Data Protection:

Text messaging opt-in data, mobile numbers collected for SMS, and SMS consent records will not be shared with any third parties under any circumstances, including in business transfers, mergers, or acquisitions.

9. Regulatory Compliance and Mandatory Data Retention

As a regulated money services business, BankSocial is subject to the Bank Secrecy Act (BSA) and related anti-money laundering (AML) regulations administered by FinCEN. These regulations require us to:

Collect and verify customer identity information
Maintain records of financial transactions for five years
Report suspicious activity to FinCEN
File Currency Transaction Reports for transactions over $10,000
Share information with law enforcement and regulators when required

The Office of Foreign Assets Control (OFAC) requires us to:

Screen all customers and transactions against Specially Designated Nationals (SDN) lists
Maintain records of sanctions screening for ten years
Retain documentation of blocked or rejected transactions for ten years
Keep records of OFAC compliance procedures for ten years after program termination

Because these obligations are mandated by federal law, we cannot delete or restrict processing of certain information even if you request deletion under state or international privacy laws. We will inform you if we are unable to comply with a deletion request for this reason.

10. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for legal, accounting, and reporting requirements.

BSA/AML Records:

We are legally required to retain certain customer identification, transaction, and due diligence records for five years after the account is closed or the transaction occurs, as required by the Bank Secrecy Act.

Tax Records:

We retain basic customer information (including contact, identity, financial, and transaction data) for six years after you cease being a customer for tax purposes.

Blockchain Data:

Transaction data recorded on blockchain networks is immutable and cannot be deleted. Wallet addresses and transaction records may remain permanently on the distributed ledger.

OFAC Sanctions Records:

We are legally required to retain all sanctions screening records, blocked or rejected transaction records, and OFAC compliance documentation for ten years as required by OFAC regulations (31 CFR 501.601 and program-specific requirements).

Other Records:

Marketing data, technical data, and non-required information is retained according to our data retention schedule, which you can request by emailing [email protected].

We may anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes. Anonymized information may be used indefinitely.

11. Your Legal Rights (General)

Under applicable data protection laws, you may have certain rights regarding your personal data. The specific rights available to you depend on your location and are detailed in the sections below.

Access: You can request access to and a copy of your personal data
Correction: You can request correction of incomplete or inaccurate personal data
Deletion: You can request deletion of your personal data in certain circumstances (subject to legal retention requirements and blockchain immutability)
Objection: You can object to processing of your personal data for direct marketing purposes
Restriction: You can request restriction or suspension of processing in certain circumstances
Data Portability: You can request transfer of your personal data in a machine-readable format
Withdraw Consent: You can withdraw consent for processing based on consent at any time

You will not be charged a fee to exercise your rights. However, we may charge a reasonable fee or refuse to comply if your request is clearly unfounded, repetitive, or excessive.

We will respond to legitimate requests within the timeframe required by applicable law (typically one month). To exercise any of these rights, please contact our Compliance Officer using the contact information in Section 1.4.

12. Additional Rights for EU/EEA Residents (GDPR)

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):

12.1 Legal Basis for Processing

Under GDPR, we process your personal data on the following legal bases:

Contract performance: Processing necessary to provide our services to you
Legal obligation: Processing required by law (AML/KYC, tax reporting, regulatory compliance)
Legitimate interests: Fraud prevention, system security, business analytics (where not overridden by your rights)
Consent: For marketing communications and certain optional features

12.2 Your GDPR Rights

Right of access: Request confirmation of whether we process your data and obtain a copy
Right to rectification: Request correction of inaccurate or incomplete data
Right to erasure ("right to be forgotten"): Request deletion where we have no legal grounds to retain your data. IMPORTANT LIMITATION: This right does not apply to data we must retain for regulatory compliance (BSA/AML, tax) or data recorded on immutable blockchain ledgers, which cannot be deleted.
Right to restrict processing: Request suspension of processing in certain circumstances
Right to data portability: Receive your data in a structured, machine-readable format
Right to object: Object to processing based on legitimate interests or for direct marketing
Right not to be subject to automated decision-making: Challenge decisions made solely by automated means that significantly affect you

12.3 Right to Lodge a Complaint

You have the right to lodge a complaint with your local supervisory authority if you believe we have violated your GDPR rights. A list of EU data protection authorities is available at https://edpb.europa.eu/about-edpb/board/members_en.

13. Additional Rights for UK Residents (UK GDPR)

If you are located in the United Kingdom, you have rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. These rights are substantially similar to those described in Section 12 for EU/EEA residents.

The same limitations apply to deletion rights regarding regulatory retention requirements and blockchain immutability.

You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at https://ico.org.uk if you believe we have violated your privacy rights. We would appreciate the opportunity to address your concerns before you approach the ICO.

14. Additional Rights for Canadian Residents (PIPEDA)

If you are located in Canada, your personal information is protected by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

Under PIPEDA, you have the right to:

Know why we collect your personal information, how we use it, and to whom we disclose it
Access your personal information and request corrections
Withdraw consent for certain uses or disclosures (subject to legal and contractual restrictions)
Challenge our compliance with PIPEDA

You may file a complaint with the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca if you believe we have violated your privacy rights under PIPEDA.

15. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share information.
Right to Delete: You may request deletion of personal information we have collected, subject to exceptions including regulatory retention requirements and blockchain immutability.
Right to Correct: You may request correction of inaccurate personal information.
Right to Opt-Out of Sale/Sharing: We do not "sell" or "share" personal information as defined by the CCPA.
Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes requiring an opt-out right under the CCPA.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

Note: Certain information collected and used in connection with financial services may be exempt from CCPA under the Gramm-Leach-Bliley Act. California residents may also designate an authorized agent to make requests on their behalf.

16. Other U.S. State Privacy Rights

If you are a resident of Virginia, Colorado, Connecticut, Utah, Oregon, Minnesota, Montana, or other states with comprehensive privacy laws, you may have additional rights similar to those described in Section 11 and Section 15. The extent of these rights may vary based on exemptions for financial institutions under the Gramm-Leach-Bliley Act. Please contact us using the information in Section 1.4 to exercise your rights.

17. International Data Transfers

BankSocial's services are primarily based in the United States. If you access our services from outside the United States, your personal data will be transferred to, stored, and processed in the United States.

17.1 Transfers from the EU/EEA

When we transfer personal data from the EU/EEA to the United States, we rely on the following mechanisms:

EU-U.S. Data Privacy Framework: We may rely on the EU-U.S. Data Privacy Framework for certain data transfers (subject to ongoing legal developments)
Standard Contractual Clauses: We use European Commission-approved Standard Contractual Clauses (SCCs) with our service providers to ensure adequate protection of your data

17.2 Transfers from the UK

When we transfer personal data from the UK to the United States, we use the UK International Data Transfer Agreement (IDTA) or UK-approved Standard Contractual Clauses to ensure appropriate safeguards.

17.3 Transfers from Canada

When we transfer personal data from Canada to the United States, we ensure appropriate safeguards through contractual provisions that require service providers to maintain standards comparable to PIPEDA.

Please contact us if you would like further information on the specific mechanisms we use for international data transfers.

18. Important Limitations Regarding Blockchain Data

BankSocial operates stablecoin services using blockchain technology. It is important to understand the following limitations regarding blockchain data:

Immutability: Blockchain transactions are permanent and cannot be deleted, modified, or reversed. Once data is recorded on a blockchain, it remains there indefinitely.
Public Accessibility: Blockchain networks are typically public and decentralized. Transaction data, including wallet addresses and amounts, may be visible to anyone with access to the blockchain.
Pseudonymization: While wallet addresses do not directly reveal your identity, they may be linked to you through our KYC records, blockchain analysis, or other methods.
Impact on Deletion Rights: Because blockchain data cannot be deleted, we cannot fully comply with deletion requests under GDPR, UK GDPR, CCPA, or other privacy laws for data stored on blockchain networks. We will delete off-chain personal data linking blockchain transactions to your identity where legally permissible.

By using our stablecoin services, you acknowledge and accept these technical limitations of blockchain technology.

19. Cookies and Similar Technologies

We use cookies and similar tracking technologies to collect and use personal data about you. Cookies are small text files placed on your device when you visit our website.

Types of Cookies We Use:

Essential cookies: Required for website functionality, including security and authentication
Analytics cookies: Help us understand how visitors use our website (e.g., Google Analytics)
Functional cookies: Remember your preferences and settings

You can control cookies through your browser settings. However, disabling certain cookies may affect website functionality. We will request your consent before setting non-essential cookies where required by law.

Third-party cookies (such as Google Analytics) are governed by the respective third party's privacy policy. We do not control these third-party cookies.

20. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Changes will be posted on our website with an updated effective date. Your continued use of our services after changes are posted constitutes acceptance of the modified policy. For material changes that significantly affect your rights, we will provide additional notice as required by law.

21. Questions and Complaints

If you have questions about this Privacy Policy or wish to exercise your rights, please contact our Compliance Officer:

Email: [email protected]

Mail: 5910 N Central Expressway, Suite 1400, Dallas, TX 75206, USA

Regulatory Complaints

U.S. Residents: You may file a complaint with your state Attorney General or, for California residents, the California Privacy Protection Agency
EU/EEA Residents: You may file a complaint with your local data protection authority (list available at https://edpb.europa.eu/about-edpb/board/members_en)
UK Residents: You may file a complaint with the Information Commissioner's Office at https://ico.org.uk
Canadian Residents: You may file a complaint with the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca