Upside Privacy Policy
Effective as of September 27, 2023
This “Privacy Policy” describes the privacy practices of Indy Financial, Inc. (d/b/a Upside Financial, Inc.) (“Upside”) and our subsidiaries and affiliates, including Indy Capital, LLC, Indy Loans, LLC, and Indy Community, LLC (collectively, “Indy Financial,” “we,” “us” or “our”) in connection with the upsidefi.com website and the Upside application and any other website or application that we own or control and which posts or links to this Privacy Policy (collectively, the “Service”), and the rights and choices available to individuals with respect to their information.
Table of Contents
Personal Information We Collect
How We Use Your Personal Information
How We Share Your Personal Information
Other Sites, Applications and Services
Changes to this Privacy Policy
Personal Information We Collect
Information you provide to us.
Personal information you provide to us through the Service or otherwise includes:
Personal contact information, such as your first and last name, email and mailing addresses, phone number.
Content you choose to upload to the Service, such as text and images, along with the metadata associated with the files you upload.
Registration information, such as your username and password that you may set to establish an online account with us.
Feedback or correspondence, such as information you provide when you contact us with questions, feedback, or otherwise correspond with us online (e.g., communicate with one of our customer service representatives).
Demographic information, such as your city, state, country of residence, postal code, and age.
Financial information, such as your stated income, economic standing, information about your financial assets and liabilities, employment history, credit scores and other information necessary to perform a credit check, determine your eligibility or verify your student loans.
Loan information, if you are required to manually enter such information, such as loan account numbers, information related to any open and closed credit accounts, late payments and collection actions occurring on such open and closed credit accounts, credit inquiries and any other transaction history.
Education information, such as your undergraduate and graduate university, type of degree, field of study and graduation status, and university transcript.
Government-issued identification numbers, such as a national identification number (e.g., Social Security Number, tax identification number), state or local identification number (e.g., driver’s license of state ID number), and/or an image of the relevant identification card.
Usage information, such as information about how you use the Service and interact with us, including information associated with any content you upload to the Service or otherwise submit to us, and information you provide when you use any interactive features of the Service.
Marketing information, such as your preferences for receiving communications about our publications, and details about how you engage with our communications.
Other information that we may collect which is not specifically listed here, but which we will use in accordance with this Privacy Policy or as otherwise disclosed at the time of collection.
Information we obtain from third-party platforms and social media networks. We may maintain pages for our company on social media platforms, such as Facebook, LinkedIn, Twitter, Google, YouTube, Instagram, and other third party platforms. Third-party platforms and social media networks are operated by third parties. We do not control, endorse, or take any responsibility for the actions of or any services made available through these third-party platforms and social media networks. When you visit or interact with our pages on those platforms, the platform provider’s privacy policy will apply to your interactions and their collection, use and processing of your personal information. You or the platforms may provide us with information through the platform, and we will treat such information in accordance with this Privacy Policy.
If you choose to connect your account on a third-party platform, such as Plaid Technologies, Inc. ( “Plaid”), your student loan provider or any similar verification service, to your account through the Service, we may collect information from that platform. For example, this information may include your transaction history, education history, student loan characteristics and other financial information related to your student loans. You may also have the opportunity to provide us with additional information via the third-party platform, such as the amount left on your student loans. You can read more about your privacy choices in the “Third party platforms” portion of the “Your Choices” section.
Information we obtain from consumer reports. As a company engaged in lending, Indy Financial both receives and transmits data to consumer reporting agencies. These agencies assist us to assess your creditworthiness and to prevent fraud and identity theft. This is done as part of our regular underwriting, fraud prevention and loan servicing processes.
Information we collect in these reports includes, but is not limited to:
Information about open and closed credit accounts, including the date opened, the date closed (if applicable), the latest reported monthly balance and monthly payment
Information about credit inquiries
Information about late payments and collection actions occurring on open and closed credit accounts
Information regarding public records of bankruptcy, judgements, tax liens, and other payment statuses
The credit score produced by the consumer reporting agency providing the report
Information about your transaction history, assets, and account balances
We may regularly and in the ordinary course of business furnish information, including negative information, about you to a consumer reporting agency regarding any loan or other services that you receive.
Correcting information maintained by the credit bureaus
Information related to your creditworthiness is maintained by the credit bureaus. If you find that there is an error or you want to dispute the information found in your credit report, please contact the credit reporting bureaus.
Experian
https://www.experian.com/disputes
Transunion
https://dispute.transunion.com
Equifax
https://www.ai.equifax.com
Information we obtain from other third parties. We may receive personal information about you from third-party sources. For example, a business partner may share your contact information with us if you have expressed interest in learning specifically about our products or services, or the types of products or services we offer. We may obtain your personal information from other third parties, such as Persona (our identity-verification provider), marketing partners and publicly available sources.
Cookies and Other Information Collected by Automated Means
We, our service providers, and our business partners may automatically log information about you, your computer or mobile device, and activity occurring on or through the Service, including but not limited, your computer or mobile device operating system type and version number, manufacturer and model, device identifier (such as the Google Advertising ID or Apple ID for Advertising), browser type, screen resolution, IP address, the website you visited before browsing to our website, general location information such as city, state or geographic area; information about your use of and actions on the Service, such as pages or screens you viewed, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, access times, and length of access; and other personal information. Our service providers and business partners may collect this type of information over time and across third-party websites and mobile applications.
On our webpages, this information is collected using cookies, browser web storage (also known as locally stored objects, or “LSOs”), web beacons, and similar technologies, and our emails may also contain web beacons.
A “cookie” is a text file that websites send to a visitor‘s computer or other Internet-connected device to uniquely identify the visitor’s browser or to store information or settings in the browser. Browser web storage, or LSOs, are used for similar purposes as cookies. Browser web storage enables the storage of a larger amount of data than cookies. A “web beacon,” also known as a pixel tag or clear GIF, is typically used to demonstrate that a webpage was accessed or that certain content was viewed, typically to measure the success of our marketing campaigns or engagement with our emails and to compile statistics about usage of our websites.
Web browsers may offer users of our websites or mobile apps the ability to disable receiving certain types of cookies; however, if cookies are disabled, some features or functionality of our websites may not function correctly.
How We Use Your Personal Information
We use your personal information for the following purposes and as otherwise described in this Privacy Policy or at the time of collection:
To operate the Service.We use your personal information to:
provide, operate and improve the Service;
provide information about our products and services;
help us verify your identity and guard against potential fraud;
perform a credit check and/or pull a credit report from a credit bureau, such as Experian, to help determine your creditworthiness;
verify your employment, student loan information or other debt and assets;
communicate with you during and after the approval process,
review and render decisions regarding your loan application, determine an appropriate loan rate,
service your loan over time;
establish and maintain your account on the Service;
facilitate your to login to the Service via third-party identity and access management providers, such as AWS Cognito or Facebook;
communicate with you about the Service, including by sending you announcements, updates, security alerts, and support and administrative messages;
understand your needs and interests, and personalize your experience with the Service and our communications;
provide support and maintenance for the Service;
for any other legitimate business purposes as determined by us in our sole discretion; and
o respond to your requests, questions and feedback.
For research and development. We analyze use of the Service to analyze and improve the Service and to develop new products and services, including by studying user demographics and use of the Service.
To send you marketing and promotional communications. We may send you Indy Financial-related marketing communications as permitted by law. You will have the ability to opt-out of our marketing and promotional communications as described in the “Opt out of marketing” section below.
To comply with law. We use your personal information as we believe necessary or appropriate to comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities.
For compliance, fraud prevention, and safety. We may use your personal information and disclose it to law enforcement, government authorities, and private parties as we believe necessary or appropriate to: (a) protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims); (b) enforce the terms and conditions that govern the Service; and (c) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.
With your consent. In some cases we may specifically ask for your consent to collect, use or share your personal information, such as when required by law.
To create anonymous, aggregated or de-identified data. We may create anonymous, aggregated or de-identified data from your personal information and other individuals whose personal information we collect. We make personal information into anonymous, aggregated or de-identified data by removing information that makes the data personally identifiable to you. We may use this anonymous, aggregated or de-identified data and share it with third parties for our lawful business purposes, including to analyze and improve the Service and promote our business.
How We Share Your Personal Information
We do not share your personal information with third parties without your consent, except in the following circumstances or as described in this Privacy Policy:
Affiliates. We may share your personal information with our corporate parent, subsidiaries, and affiliates, for purposes consistent with this Privacy Policy.
Business transfers. In connection with a business transaction (or potential business transaction) such as a corporate divestiture, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution, we may sell, transfer or otherwise share some or all of our business or assets, including your personal information.
Service providers. We may share your personal information with third party companies and individuals that provide services on our behalf or help us operate the Service (such as customer support, hosting, analytics, email delivery, marketing, and database management services). These third parties may use your personal information only as directed or authorized by us and in a manner consistent with this Privacy Policy, and are prohibited from using or disclosing your information for any other purpose.
Third-party platforms. If you have enabled features or functionality that connect the Service to a third-party platform (such as by linking your account with the Service to a third party’s services), we may disclose the personal information that you authorized us to share. We do not control the third party’s use of your personal information.
In addition, we use certain third party service providers, such as Plaid, to gather your account transaction data from financial institutions regarding your loan application and loan. Any transaction data from financial institutions regarding your loan application and loan is passed directly to such third party service providers from your device. Once the third party service provider has verified the login credentials of your linked account, such third party service provider may transmit to Indy Financial the transaction data available from the relevant financial institution. By using our Service, you authorize Indy Financial and its third party service providers to access and transmit your personal and financial information from the relevant financial institution. You agree to your personal and financial information being transferred, stored, and processed by the third party service provider in accordance with such third party service provider’s privacy policy (e.g., Plaid Privacy Policy). The login credentials of your linked accounts, such as usernames and passwords, are not accessible to anyone at Indy Financial.
Professional advisors. We may disclose your personal information to professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services that they render to us.
To comply with law. We may share your personal information as we believe necessary or appropriate to comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities.
For compliance, fraud prevention and safety. We may share your personal information for the compliance, fraud prevention and safety purposes described above.
Business purposes. We may share your personal information to further our legitimate business purposes as determined by us in our sole discretion.
Google Analytics. We use the web analytics service Google Analytics on our website and mobile app. The data processing serves the purpose of analyzing this website/mobile app and its visitors as well as for marketing and advertising purposes. For this purpose, Google will use the information obtained on our behalf as the operator of this website/mobile app to evaluate your use of the website/mobile app, to compile reports on website/mobile app activity and to provide us with other services related to website/mobile app activity and internet usage. The following information, among other things, can be collected: IP address, date and time of the page view, click path, information about the browser you are using and the device you are using (device), pages visited, referrer URL (website via which you can visit our website), location data, and purchase activities attached or not to your user’s identifier.
Google Analytics uses technologies such as cookies, web storage in the browser, local storage in your device and tracking pixels, which enable an analysis of your use of the website. The information generated in this way about your use of this website is usually transmitted to a Google server in the USA and stored there. The data transmission takes place, among other things, on the basis of standard contractual clauses as suitable guarantees for the protection of personal data, which can be viewed at: https://policies.google.com/privacy/frameworks and https://business.safety.google/adsprocessorterms/ . Both Google and US government agencies have access to your data according to US law. Your data may be linked by Google with other data, such as your search history, your personal accounts, your usage data from other devices and any other data that Google has about you.
You can find more information on terms of use and data protection at https://www.google.com/analytics/terms/de.html or at https://www.google.de/intl/de/policies/ and at https:/ /policies.google.com/technologies/cookies?hl=de . Our website and mobile app also uses Google Analytics reports on performance based on demographic characteristics and interests as well as reports on impressions in the Google Display Network. You can deactivate Google Analytics for display advertising and adjust the ads in the Google Display Network by calling up the ad settings under this link: https://myadcenter.google.com/.
Your Choices
In this section, we describe the rights and choices available to all users.
Access or update your personal information. If you have registered for an account with us, you may review and update certain personal information in your account profile by logging into the account.
Opt out of marketing communications. You may opt out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email, or by contacting us at unsubscribe@upsidefi.com. You may continue to receive service-related and other non-marketing emails.
Cookies and browser web storage. We may allow service providers and other third parties to use cookies and similar technologies to track your browsing activity over time and across the Service and third party websites. Most browsers let you remove or reject cookies. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. Please note that if you set your browser to disable cookies, the Sites may not work properly. Similarly, your browser settings may allow you to clear your browser web storage.
In addition to opting out of cookies directly through your browser, you can view and opt out of some cookies that are currently on your browser by visiting the following websites: http://www.aboutads.info/choices or http://www.networkadvertising.org/choices. Even if you disable tracking, keep in mind that you may still receive interest-based advertising, including from third parties with whom your information had been previously disclosed, or advertising from third parties that is not based on your interests and preferences.
Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.
Choosing not to share your personal information. Where we are required by law to collect your personal information, or where we need your personal information in order to provide the Service to you, if you do not provide this information when requested (or you later ask to delete it), we may not be able to provide you with our services. We will tell you what information you must provide to receive the Service by designating it as required at the time of collection or through other appropriate means.
Third-party platforms. If you choose to connect to the Service via a third-party platform, you may have the ability to limit the information that we may obtain from the third party at the time you login to the Service using the third party’s authentication service or otherwise connect your account. Subsequently, you may be able to control your settings through the third party’s platform. For example, you may access and change your settings, or disconnect your Plaid account, through the Plaid account settings page. If you withdraw our ability to access certain information from a third party platform, that choice will not apply to information that we have already received from that third party.
Other Sites, Applications and Services
The Service may contain links to other websites, applications, and other online services operated by third parties. These links are not an endorsement of, or representation that we are affiliated with, any third party. In addition, our content may be included on web pages or in applications or online services that are not associated with us. We do not control third party websites, applications or online services, and we are not responsible for their actions. Other websites, applications and services follow different rules regarding the collection, use and sharing of your personal information. We encourage you to read the privacy policies of the other websites, applications and online services you use.
Security Practices
The security of your personal information is important to us. We employ a number of organizational, technical and physical safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information.
To protect the security of your information, we may require you to authenticate your identity (i.e., prove that you are who you say you are) to utilize our Services. This may include setting up a user name and password when you register for our Services. You are responsible for ensuring that such access credentials remain confidential and are not shared with anyone. It is also a good idea to protect your security by always closing your web browser when you are not using our Services. If you believe that information that you have submitted has been used without your permission to engage in any unauthorized activity, you must tell us immediately. The best way of keeping your possible losses to a minimum is to call us at (628) 400-5065. If you fail to notify us, you may be liable for all unauthorized activity on your account.
International Data Transfers
We are headquartered in the United States and have service providers in other countries, and your personal information may be transferred to the United States or other locations outside of your state, province, or country where privacy laws may not be as protective as those in your state, province, or country.
Children
Children are not allowed to use the Service, and we strive not to collect personal information from them. We define “children” as anyone under 13 years old. If we learn that we have collected personal information of a child without the consent of the child’s parent or guardian, we will delete it. We encourage parents with concerns to contact us.
Changes to this Privacy Policy
We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the Service. We may, and if required by law will, also provide notification of changes in another way that we believe is reasonably likely to reach you, such as via e-mail (if you have an account where we have your contact information) or another manner through the Service.
Any modifications to this Privacy Policy will be effective upon our posting the new terms and/or upon implementation of the new changes on the Service (or as otherwise indicated at the time of posting). In all cases, your continued use of the Service after the posting of any modified Privacy Policy indicates your acceptance of the terms of the modified Privacy Policy.
How to Contact Us
Please direct any questions or comments about this Policy or privacy practices to privacy@upsidefi.com. You may also write to us via postal mail at:
Indy Financial, Inc.
Attn: Legal – Privacy
1633 W Innovation Way, 5th Floor
Lehi, UT 84043