Privacy

Your privacy is important to Upgrade and its bank partners.

Privacy Policy

California Privacy Policy

Federal Privacy Notices

Upgrade Privacy Notice

Cross River Bank Privacy Notice

Blue Ridge Bank Privacy Notice

Privacy Policy

Effective date: 12/01/2021

Protecting your privacy is important to Upgrade, Inc. (DBAs include Universal Credit, and the names here (https://www.upgrade.com/landing/dba), collectively “Upgrade,” “we,” “us,” and “our”). Please
read this Privacy Policy (the “Privacy Policy”) before using the Site. The “Site” refers to any website or mobile application operated by Upgrade, including www.upgrade.com (https://www.upgrade.com),
or any other online or mobile service that links to or otherwise presents this Privacy Policy to you.

This Privacy Policy describes the type of information we collect from you, what we do with the information we collect, and how we protect the information we collect. This Privacy Policy applies to all
prospective, current, and former Upgrade customers.

By accessing or using the Site, you consent to this Privacy Policy and the Terms of Use (https://www.upgrade.com/funnel/borrower-documents/TERMS_OF_USE). We may periodically update or revise
this Privacy Policy as indicated by the effective date at the top of this page. Your continued use of our Site is deemed to be acceptance of those changes. If you have questions about our Privacy Policy
or practices, please contact us at privacy@upgrade.com.

Information Upgrade Collects About You

Upgrade collects information about you directly from you and your use of the Site, including when you apply for and use our products or services. We collect information from your computer, mobile
phone, or other access device that is automatically reported by your browser or device each time you access the Site. We may also collect information about you from third parties, such as credit
bureaus, our partners, and service providers.

We may collect the following information about you:

Name, address, phone number, Social Security number, and date of birth;

COPY
Your credit score, credit history, and other information from consumer reporting agencies;

Information about your payments or transaction history;

Information about your employment, salary, and income;

Your bank information, including your bank name, account number, and routing number;

Information for verification (fraud) checks, including verification of your identity and other information you provide;

Information about your internet activity, including access device, Internet Protocol (“IP”) address, geolocation data, browser type and platform, referral source, domain names, landing pages,
length of visit, number of clicks and page views, and how you interact with links on the Site, domain names, landing pages, pages viewed, your use of third party applications, and other
information related to your experience on the Site; and

Other information that you voluntarily provide to us or that we may collect as permitted by law.

Upgrade and third party referral partners and service providers also collect information using tracking technologies such as cookies, beacons, tags, and scripts. This information is used to analyze
trends, administer the Site, understand your use of the Site, and gather demographic information about you. If you create an account on the Site, we use cookies when you sign in to your account to
keep track of your personal session, help authenticate your account, and detect fraud. Upgrade and other third parties may collect personally identifiable information about your online activities over
time and across different websites when you use our Site. For example, we use third parties like Google Analytics to collect information so we can understand how users interact with the Site. To learn
more about Google Analytics and how to opt-out, click here (https://tools.google.com/dlpage/gaoptout).

Your browser may have settings that allow you to control the use of cookies. However, if you reject cookies, your ability to use some features of the Site may be limited.

We do not respond to “do not track” signals from your browser at this time.

How Upgrade Uses Your Information

In general, Upgrade uses information we collect through the Site to:

Provide products and services you request;

Improve our offerings to you, including to develop new products and services;

Communicate with you or provide notices in connection with such products and services;

Process and respond to customer inquiries and provide support;

Detect security incidents and prevent fraud and illegal activities;

Fulfill our legal requirements and enforce our agreements;

Improve Site content, functionality, and usability;

Communicate with you, either directly or through our service providers, including for marketing and promotional purposes;

Improve our marketing and promotional activities; and

For our other legitimate business purposes permitted by law.

Upgrade is a service provider to its bank partners (https://www.upgrade.com/bank-partners/), and all loans or accounts facilitated through the Site are provided by a bank partner. If you apply for a
loan or account using the Site, we will use your information to facilitate your loan or account with a bank partner.

The information collected in connection with a loan or account may be used (as applicable) to:

Generate your borrower profile or process your loan or account application on behalf of the bank partner providing the loan or account;

Enable automatic payments and fund transfers with other financial institutions; and

Communicate with you concerning your account and transactions.

Information Upgrade Shares

Upgrade may use and disclose your information to provide our product and services to you and in accordance with applicable law. We do not share or sell your personal information with any third
party other than as described in this Privacy Policy.
We may share your information with the following third parties in the following instances:

Service providers as part of our products and services, such as for fraud prevention, servicing, bill collection, debt collection, marketing and technology services, product development, and with
nonaffiliated financial institutions that we partner with to market or provide the products or services to you;

Credit reporting agencies to report account information as authorized by you or otherwise permitted by law;

Investors who may purchase your loan directly from us or as part of servicing of your loan or account;

Law enforcement, government officials, or other third parties as required by law and when we believe that such disclosure is necessary to protect our rights and/or comply with a judicial
proceeding, court order, regulatory request or other legal process;

Third parties when we have a legitimate business purpose as permitted by law; or

Other third parties with your consent or authorization.

We also partner with third parties to manage our advertising on other sites and to evaluate the Site performance.

Third Party Websites

This Site may contain links to other websites operated by third parties, including social media providers. Upgrade cannot and does not control the privacy practices of these third party websites.
Upgrade does not endorse the content or information of any third-party website or resource and, further, Upgrade does not warrant that such websites or resources will not contain viruses or other
malicious code or will not otherwise affect your computer. By using any link on our Site to connect to a third-party website, you agree and understand that Upgrade shall not be responsible or liable,
directly or indirectly, for any damages or losses caused or alleged to be caused by or in connection with the privacy practices of any third party websites.

How Upgrade Protects Your Information

Our goal is to protect the security of your information. We have implemented technical, organizational, and physical measures designed to protect against loss or unauthorized access, disclosure,
alteration, or destruction of the information you provide on the Site. For example, technical safeguards that we use to achieve data security include a combination of firewalls, intrusion detection
system, malware detection system, and data loss prevention systems. Upgrade also conducts vulnerability scans of applications and systems regularly.

Additional Steps You Should Take to Ensure the Security of Your Information
Upgrade does not and cannot guarantee the security of your information submitted through the Site, and we encourage you to take steps to secure your information.

You should not include any personal identifying information in your account ID. You should always choose a password that is difficult for others to guess and change your password frequently. At a
minimum, we require the use of both numbers and letters in your password. You should never share your password with anyone. Your password is not known to Upgrade, and we will never ask for your
password.

Upgrade sends important communications regarding your account via email. You should take steps to secure and restrict access to your email account. You should also be aware of fraudulent emails
known as “phishing,” from companies claiming to be Upgrade and requesting your login information or other account information. Upgrade will never ask for your login information.

We also recommend you avoid using public computers and networks and delete browser cache files after using the Site.

If you believe the security of your account is compromised or to report any concerns, please contact us at security@upgrade.com.

Children’s Privacy

COPY
This Site is not intended for children or minors under the age of 18. We do not knowingly collect personal information from, or market to, children under the age of 13. If we become aware that a child
under the age of 13 has provided us with personal information, we will take steps to comply with applicable legal requirements to remove such information.

California Privacy Notice

If you are a California resident, the California Consumer Privacy Act of 2018 (the “CCPA”) requires us to provide you with certain notices prior to our collection and use of your personal information.

This notice for California residents under the CCPA supplements the information provided in the rest of this Privacy Policy, which also applies to you. Any terms defined in the CCPA have the same
meaning when we use them here.

We collect personal information about prospective, current, and former Upgrade customers. In particular, we have collected the following categories of personal information from consumers in the last
twelve (12) months:

Identifiers;

Characteristics of protected classifications under California or federal law;

Customer records;

Commercial Information;

Internet or other similar network activity;

Geolocation data; and

Professional or employment-related information.

Upgrade does not “sell” any personal information we collect. We share personal information with the categories of third parties described in the “Information Upgrade Shares” section above.

Your Rights and Choices under the CCPA

Subject to certain exemptions, California residents have the right to request to know details about the categories and specific personal information we collect; to delete their personal information; to
opt out of “sale” of personal information that may be occurring; and be free from unlawful discrimination for exercising these rights under the CCPA.

Financial regulations, including the Fair Credit Reporting Act (“FRCA”) and the Gramm-Leach-Bliley Act (“GLBA”), may prevent us from disclosing or deleting certain information that may be requested
by California residents.

How to Exercise Your Rights under the CCPA

If you are a California resident, you may make a request to exercise your rights under the CCPA by either of the following methods:

Submitting a request via email to ccpa@upgrade.com; or

Calling us toll-free at (877) 418-4547.

Before responding to a request, we will request information from you, which at a minimum will include your full name, date of birth, and email address, and any additional information to verify your
identity. Under the CCPA, you may have an authorized agent submit a request on your behalf, and we will collect certain authorization and verification information from you and your authorized agent.

Federal Privacy Notices

All loans made and accounts obtained through Upgrade are provided by a bank partner.

For applicants and borrowers of the Personal Loan (“PL”) product offered by Upgrade’s bank partners (https://www.upgrade.com/bank-partners) through Upgrade, the following Federal Privacy Notices
apply.
For applicants and borrowers of the Upgrade Card with Personal Credit Line (“PCL”) and applicants and users of the Rewards Checking product, the following Federal Privacy Notices for Upgrade and
Cross River Bank apply.

Upgrade Privacy Notice

Rev. Nov. 2021

FACTS WHAT DOES UPGRADE, INC. DO WITH YOUR PERSONAL INFORMATION?

Why? Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also
requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.

What? The types of personal information we collect and share depend on the product or service you have with us. This information can include:
Social Security Number and Credit History
Account Balances and Transaction History
Payment History and Employment Information
When you are no longer our customer, we continue to share your information as described in this notice.

How? All financial institutions need to share customer's personal information to run their everyday business. In the section below, we list the reasons financial
companies can share their customer's personal information; the reasons Blue Ridge Bank, N.A. chooses to share; and whether you can limit this sharing.

Reasons we can share your personal information Does Company share? Can you limit
this sharing?

For our everyday business purposes— Yes No

such as to process your transactions, maintain your account(s), respond to court
orders and legal investigations, or report to credit bureaus

For our marketing purposes— Yes No

to offer our products and services to you

For joint marketing with other financial companies No We don’t share

For our affiliates’ everyday business purposes— Yes No

information about your transactions and experiences

For our affiliates’ everyday business purposes— No We don’t share

information about your creditworthiness

For nonaffiliates to market to you No We don’t share

Questions? Call 844-319-3909 or go to www.upgrade.com

COPY
Who we are

Who is providing this notice? Upgrade, Inc.

What we do

How does Upgrade protect To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These
my personal information? measures include computer safeguards and secured files and buildings.

How does Company collect
my personal information?
We collect your personal information, for example, when you
Open an account or Provide employment information
Apply for a loan or Provide account information
Give us your contact information
We also collect your personal information from others, such as credit bureaus or other companies.

Why can’t I limit all Federal law gives you the right to limit only
sharing? sharing for affiliates’ everyday business purposes information about your creditworthiness.
affiliates from using your information to market to you
sharing for nonaffiliates to market to you
State laws and individual companies may give you additional rights to limit sharing. See below for more on your rights under state law.

Definitions

Affiliates Companies related by common ownership or control. They can be financial and nonfinancial companies.
Upgrade Tech Canada, Inc.

Nonaffiliates Companies not related by common ownership or control. They can be financial and nonfinancial
companies.
Upgrade shares with nonaffiliates, including other financial services companies and service
providers, to provide products and services to you and to help us market to you.

Joint marketing A formal agreement between nonaffiliated financial companies that together market financial products
or services to you.
Upgrade doesn’t engage in joint marketing.

Other important information

California Residents: We will not share your information with companies outside of Upgrade except for our everyday business purposes, for marketing our products and
services to you or with your consent.
Vermont Customers: We will not disclose information about your creditworthiness to our affiliates and will not disclose your personal information, financial information, credit
report, or health information to nonaffiliated third parties to market to you, other than as permitted by Vermont law, unless you authorize us to make those disclosures.
Additional information concerning our privacy policies can be found at www.upgrade.com/privacy or call 844-319-3909
Nevada Residents: Notice provided pursuant to state law. To be placed on our internal Do Not Call List, call 844-319-3909. If you would like more information about
telemarketing practices, you may contact us at Upgrade. Attn: Nevada Marketing Information, 275 Battery Street, 23rd Floor, San Francisco, CA 94111 or email
support@upgrade.com. For more on this Nevada law, contact Bureau of Consumer Protection, Office of the Nevada Attorney General, 555 E. Washington St., Suite 3900, Las
Vegas, NV 89101; Phone number: 1-702-486-3132; e-mail: BCPINFO@ag.state.nv.us.
Texas Residents: Upgrade is licensed and examined under the laws of the State of Texas and by state law is subject to regulatory oversight by the Office of Consumer Credit
Commissioner. Any consumer wishing to file a complaint against Upgrade should contact the Office of Consumer Credit Commissioner through one of the means indicated
below: In Person or U.S. Mail: 2601 North Lamar Boulevard, Austin, Texas 78705-4207. Telephone No.: (800) 538-1579. Fax No.: (512) 936-7610. E-mail:
consumer.complaints@occc.state.tx.us. Website: www.occc.state.tx.us (http://www.occc.state.tx.us).
Telephone Communications: All telephone communications with us or our authorized agents may be monitored or recorded.

Cross River Bank Privacy Notice
Rev. Nov. 2018

FACTS WHAT DOES CROSS RIVER BANK DO WITH YOUR PERSONAL INFORMATION?

Why? Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also
requires us to tell you how we collect, share and protect your personal information. Please read this notice carefully to understand what we do.

What? The types of personal information we collect and share depend on the product or service you have with us. This information can include:
Social Security number and Account balances
Payment history and Transaction History
Account transactions and Wire transfer instructions
When you are no longer our customer, we continue to share your information as described in this notice.

How? All financial companies need to share customers’ personal information to run their everyday business. In the section below, we list the reasons financial
companies can share their customers’ personal information; the reasons Cross River Bank chooses to share; and whether you can limit this sharing.

Reasons we can share your personal information Does Cross Can you limit
River Bank this sharing?
share?

For our everyday business purposes – Yes No

such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit
bureaus

For our marketing purposes – Yes No

to offer our products and services to you

For joint marketing with other financial companies Yes No

For our affiliates' everyday business purposes – No We don't share

information about your transactions and experiences

For our affiliates' everyday business purposes – information about your creditworthiness No We don't share

For nonaffiliates to market to you No We don't share

Questions? Call toll-free 1-877-55CRB55 or go to www.crossriverbank.com

What we do

How does Cross River Bank
protect my personal information?
COPY
To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These
measures include computer safeguards and secured files and buildings.
We also maintain other physical, electronic and procedural safeguards to protect this information and we limit access to information to
those employees for whom access is appropriate.

How does Cross River Bank
collect my personal information?
We collect your personal information, for example, when you
Open an account or Apply for a loan
Make deposits or withdrawals from your account or Provide employment information
Give us your contact information
We also collect your personal information from others, such as credit bureaus, affiliates, or other companies.

Why can't I limit all sharing?
Federal law gives you the right to limit only
sharing for affiliates' everyday business purposes-information about your creditworthiness
affiliates from using your information to market to you
sharing for nonaffiliates to market to you
State laws and individual companies may give you additional rights to limit sharing. See below for more on your rights under state law.

Definitions

Affiliates Companies related by common ownership or control. They can be financial and nonfinancial companies.
Cross River Bank does not share with our affiliates.

Nonaffiliates Companies not related by common ownership or control. They can be financial and nonfinancial companies.
Nonaffiliates we share with can include loan finance companies

Joint marketing A formal agreement between nonaffiliated financial companies that together market financial products or services to you.
Our joint marketing partner(s) include loan finance companies.

Other important information

For Alaska, Illinois, Maryland and North Dakota Customers. We will not share personal information with nonaffiliates either for them to market to you or for joint marketing-
without your authorization.
For California Customers. We will not share personal information with nonaffiliates either for them to market to you or for joint marketing-without your authorization. We will
also limit our sharing of personal information about you with our affiliates to comply with all California privacy laws that apply to us.
For Massachusetts, Mississippi and New Jersey Customers. We will not share personal information from deposit or share relationships with nonaffiliates either for them to
market to you or for joint marketing-without your authorization.
For Vermont Customers. We will not disclose information about your creditworthiness to our affiliates and will not disclose your personal information, financial information,
credit report, or health information to nonaffiliated third parties to market to you, other than as permitted by Vermont law, unless you authorize us to make those disclosures.
Additional information concerning our privacy policies can be found at www.crossriverbank.com or call 1-877-55CRB55.

Blue Ridge Bank Privacy Notice
Rev. July 2021

FACTS WHAT DOES BLUE RIDGE BANK, N.A. DO WITH YOUR PERSONAL INFORMATION?

Why? Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also
requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.

What? The types of personal information we collect and share depend on the product or service you have with us. This information can include:
Social Security number and employment information
Account balances and transaction history
Credit history and investment experience

How? All financial institutions need to share customer's personal information to run their everyday business. In the section below, we list the reasons financial
companies can share their customer's personal information; the reasons Blue Ridge Bank, N.A. chooses to share; and whether you can limit this sharing.

Reasons we can share your personal information Does Blue Can you limit
Ridge Bank, this sharing?
N.A. share?
For our everyday business purposes – Yes No
Such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit
bureaus

For our marketing purposes – Yes No

to offer our products and services to you

For joint marketing with other financial companies No We don't share

For our affiliates' everyday business purposes – Yes No

information about your transactions and experiences

For our affiliates' everyday business purposes – Yes Yes

information about your creditworthiness

For our affiliates to market to you Yes Yes

For nonaffiliates to market to you No We don't share

To limit Call 888-331-6521 to speak with a customer service representative

our Please note:
sharing If you are a new customer, we can begin sharing your information 30 days from the date we sent this notice. When you are no longer our customer, we continue

COPY
to share your information as described in this notice.

Questions? Call 888-331-6521 or go to www.mybrb.com

Who we are

Who is providing this notice? Blue Ridge Bank, N.A.

BRB Financial Group, Inc.

Businesses listed in the other section below provide their own privacy notices.

What we do

How does Blue Ridge Bank, N.A. To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These
protect my personal information? measures include computer safeguards and secured files and buildings.

How does Blue Ridge Bank, N.A.
collect my personal information?
We collect your personal information, for example, when you
Open an account or apply for a loan
Use your credit or debit card or seed advice about investments
Make deposits or withdrawals from your account
We also collect your personal information from other, such as credit bureaus, affiliates or other companies.

Why can't I limit all sharing?
Federal law gives you the right to limit only
Sharing for affiliates’ everyday business purposes—information about your creditworthiness
Affiliates from using your information to market to you
Sharing for nonaffiliates to market to you
State laws and individual companies may give you additional rights to limit sharing.

What happens when I limit Your choices will apply to everyone on your account.
sharing for an account I hold
jointly with someone else?

Definitions

Affiliates Companies related by common ownership or control. They can be financial and nonfinancial companies
Hammond Insurance
Moneywise Payroll Solutions
Exchangers LTD

Nonaffiliates Companies not related by common ownership or control. They can be financial or nonfinancial companies.
Blue Ridge Bank, N.A. does not share with nonaffiliates so they can market to you.

Joint marketing A formal agreement between nonaffiliated financial companies that together market financial products or services to you.
Blue Ridge Bank, N.A. does not jointly market.

Other important information

The following entities are not covered by this notice and have separate notices:
Monarch Mortgage, a division of Blue Ridge Bank, N.A.
Lender Select Mortgage Group, a DBA of Blue Ridge Bank, N.A.

Original Document hash: ExR1n1/P/Ad06IsK6nzk7Kvu/3nnUg7v2qJ1WbCj2y8=

COPY