Welcome to Aureon Financial LLC (“Aureon,” “we,” “us,” or “our”).

Aureon respects your privacy and is committed to protecting the personal information entrusted to us.

This Privacy Policy explains how we collect, use, process, disclose, retain, and protect information when you access or use:

• aureonfinancial.com ;
• Aureon websites and online portals;
• Aureon-powered application and prequalification forms;
• Links or QR codes provided by Aureon or participating merchants;
• Aureon tools or services embedded in third-party websites;
• Mobile websites and applications;
• Financial-product matching and referral services; and
• Other online content, tools, platforms, or services that link to this Privacy Policy

(collectively, the “Services”).

This Privacy Policy applies to individuals who visit or use the Services, including individuals who submit information to explore, prequalify for, apply for, or obtain information regarding financial products.

Please read this Privacy Policy carefully before providing personal information through the Services.

By using the Services or submitting information through them, you acknowledge the practices described in this Privacy Policy.

Where applicable law requires affirmative consent for particular collection, uses, disclosures, or communications, Aureon will obtain such consent separately.

This Privacy Policy should be read together with Aureon's Terms of Service and Electronic Consent (E-Consent).

Aureon operates a technology platform designed to connect consumers with potential financial products and independent third-party financial institutions and financial-service providers.

Information about you may be necessary to:

• Provide the Services;
• Identify potentially relevant financial products;
• Match you with Financial Providers;
• Process requests and applications;
• Determine preliminary eligibility;
• Verify identity;
• Prevent fraud;
• Communicate with you;
• Improve our Services; and
• Comply with applicable laws and regulatory obligations.

Our objective is to collect information reasonably related to these purposes and to use it in accordance with this Privacy Policy and applicable law.

Aureon provides financial-product information, technology, matching, referral, and related services.

Aureon Financial LLC is not a bank, lender, or credit card issuer and does not itself make credit decisions, establish underwriting standards, determine interest rates, issue loans or credit cards, or guarantee approval unless expressly disclosed otherwise in connection with a particular product.

Financial products available through the Services may be provided by independent third parties, including:

• Banks;
• Credit unions;
• Lenders;
• Credit card issuers;
• Home-equity providers;
• Business-financing providers;
• Financial technology companies;
• Non-bank financial institutions; and
• Other financial-service providers

(collectively, “Financial Providers”).

If you apply for or obtain a financial product from a Financial Provider, your relationship with that provider is subject to that provider's own terms, agreements, disclosures, and privacy practices.

The information Aureon collects depends upon how you use the Services and the financial products you request.

You may provide information when you:

• Complete an online form;
• Request financial-product information;
• Submit a prequalification request;
• Submit an application;
• Create an account;
• Contact customer support;
• Communicate with Aureon;
• Participate in a survey;
• Provide feedback; or
• Otherwise interact with the Services.

Information we may collect includes the following.

Identity and Contact Information

This may include:

• Full name;
• Mailing address;
• Residential address;
• ZIP or postal code;
• Email address;
• Telephone number;
• Date of birth; and
• Other information used to identify or contact you.

Government and Identification Information

Depending upon the Service or financial product, this may include:

• Social Security number;
• Social Insurance Number;
• Taxpayer identification information;
• Government-issued identification information; and
• Other information required for identity verification, fraud prevention, or financial-product processing.

Aureon will request sensitive identification information only where reasonably necessary for the Services being provided.

Financial and Credit-Related Information

Depending upon the financial product requested, information may include:

• Estimated credit score or credit range;
• Credit history information;
• Income;
• Employment status;
• Employer information;
• Housing status;
• Homeownership or rental information;
• Mortgage information;
• Existing debt obligations;
• Requested financing amount;
• Intended use of financing;
• Banking or financial-account information where necessary;
• Debt-to-income information; and
• Other financial information relevant to a Financial Provider's eligibility requirements.

Account Information

If you create an Aureon account or use a login-enabled portion of the Services, we may collect:

• Username;
• Email address;
• Account identifiers;
• Authentication information; and
• Other account-related information.

Passwords should be stored using appropriate security safeguards and should never be shared with Aureon employees or third parties except through authorized authentication systems.

Communications and Support

If you contact Aureon, we may collect:

• Your name;
• Email address;
• Telephone number;
• Correspondence;
• Support requests;
• Complaints;
• Feedback; and
• Other information you voluntarily provide.

Surveys and Feedback

If you voluntarily participate in a survey or provide feedback, we may collect your responses and use them to:

• Improve the Services;
• Evaluate user experience;
• Understand consumer preferences;
• Develop new services; and
• Conduct legitimate marketing and business analysis.

Other Information

We may collect additional information disclosed to you at or before the time of collection where reasonably necessary to provide the Services.

When you visit or interact with the Services, certain information may be collected automatically from your browser, computer, smartphone, tablet, or other device.

This information may include:

IP Address

We may collect your Internet Protocol (“IP”) address.

IP address information may be used to:

• Operate the Services;
• Identify general geographic location;
• Customize content;
• Analyze usage;
• Maintain security;
• Detect suspicious activity;
• Prevent fraud; and
• Diagnose technical problems.

Device Information

We may collect information concerning:

• Device type;
• Browser;
• Operating system;
• Device settings;
• Unique device identifiers;
• Network information;
• Screen or display characteristics; and
• Other technical information associated with your device.

Location Information

We may infer your approximate geographic location from information such as your IP address.

Where precise geolocation is collected, we will obtain any consent required by applicable law.

Location information may help us determine whether particular financial products or Services are available in your geographic area.

Usage Information

We may collect information about your interaction with the Services, such as:

• Pages visited;
• Links selected;
• Forms started or completed;
• Features used;
• Dates and times of access;
• Referring websites;
• Session duration;
• Device activity; and
• Other information regarding how the Services are used.

Aureon and authorized service providers may use cookies, pixels, tags, web beacons, software development kits, and similar technologies to operate and improve the Services.

Cookies

A cookie is a small data file stored on or accessed through your device.

Cookies may be used to:

• Remember preferences;
• Maintain sessions;
• Authenticate users;
• Improve functionality;
• Measure website performance;
• Analyze usage;
• Detect fraud;
• Understand traffic sources; and
• Support advertising or marketing where permitted.

Some cookies are necessary for the Services to function properly.

Others may be optional depending upon applicable law and your privacy choices.

Analytics

Aureon may use third-party analytics providers to understand how visitors use the Services.

These providers may collect information through cookies or similar technologies according to their own privacy policies.

Where required by applicable law, users will be given appropriate choices regarding non-essential cookies and tracking technologies.

Managing Cookies

Most browsers allow you to control cookies through browser settings.

Depending upon your browser, you may be able to:

• Block cookies;
• Delete stored cookies;
• Receive a notification before a cookie is stored; or
• Restrict particular types of tracking.

Disabling certain cookies may affect the functionality of the Services.

Aureon may receive information about you from third parties, including:

• Financial Providers;
• Merchants through which you access Aureon;
• Affiliates;
• Marketing partners;
• Identity-verification providers;
• Fraud-prevention providers;
• Consumer reporting agencies, where authorized;
• Data and technology providers; and
• Other service providers.

At your direction, information may also be obtained through third-party services or application programming interfaces (“APIs”).

Where information received from third parties is combined with information collected directly through the Services, Aureon will treat the combined information in accordance with this Privacy Policy and applicable law.

Aureon may use personal information for legitimate business and operational purposes including:

Providing the Services

To:

• Process your request;
• Provide financial-product information;
• Match you with potential Financial Providers;
• Facilitate prequalification or applications;
• Present potential offers or options;
• Communicate application information; and
• Operate the Aureon platform.

Identity Verification and Fraud Prevention

To:

• Verify identity;
• Authenticate users;
• Prevent fraudulent applications;
• Detect suspicious activity;
• Protect consumers;
• Protect Financial Providers; and
• Maintain the security of our systems.

Financial-Product Matching

Information you submit may be compared against criteria supplied by Financial Providers to determine whether financial products may potentially be available to you.

Communication

We may use your information to communicate regarding:

• Your request;
• Application status;
• Financial-product opportunities;
• Transactional matters;
• Security;
• Privacy;
• Customer support;
• Service updates; and
• Other matters relating to your use of the Services.

Improving the Services

We may use information to:

• Evaluate website performance;
• Understand user behavior;
• Develop new features;
• Improve application processes;
• Evaluate Financial Provider matching;
• Identify technical issues; and
• Improve the overall user experience.

Analytics

We may analyze information regarding:

• Consumer trends;
• Product demand;
• Application activity;
• Financial-product preferences;
• Service usage;
• Marketing performance; and
• Other business metrics.

Legal and Compliance Purposes

We may process information to:

• Comply with applicable laws;
• Respond to legal process;
• Maintain required records;
• Exercise or defend legal rights;
• Investigate suspected fraud;
• Protect consumers and Financial Providers; and
• Fulfill regulatory or contractual obligations.

One of the principal functions of the Aureon platform is connecting consumers with Financial Providers.

When you submit information to explore or request financial products, Aureon may share relevant information with one or more Financial Providers to:

• Determine potential eligibility;
• Match you with financial products;
• Generate potential offers;
• Conduct prequalification;
• Verify information;
• Process an application; or
• Otherwise respond to your request.

Information shared may include personally identifiable, financial, and credit-related information where necessary for the applicable product.

Financial Providers receiving your information may process that information according to their own privacy policies, terms, underwriting standards, regulatory obligations, and applicable law.

Once information has been provided to an independent Financial Provider, that provider's use of the information may also be governed by its own privacy policy.

You should review the provider's disclosures before entering into a transaction.

Where you provide authorization and where permitted by applicable law, Aureon and/or participating Financial Providers may use information you provide to determine potential eligibility for financial products.

Financial Providers may obtain consumer reports, credit reports, credit scores, or related information from consumer reporting agencies such as:

• Experian;
• Equifax;
• TransUnion; or
• Other authorized consumer reporting agencies.

The type of credit inquiry performed may vary depending upon the Financial Provider and product.

A prequalification process may use a soft credit inquiry that generally does not affect a consumer's credit score, while proceeding with a particular application or offer may result in a hard credit inquiry.

You should review the specific authorization and disclosures provided during the applicable application process before proceeding.

Aureon does not control the underwriting or credit-reporting practices of independent Financial Providers.

Subject to applicable law and the consent you provide, Aureon and authorized parties may communicate with you about:

• Your request or application;
• Financial products;
• Services potentially relevant to you;
• Promotions;
• Surveys;
• Service announcements; and
• Other Aureon offerings.

Communications may occur by:

• Email;
• Telephone;
• SMS or text message;
• Postal mail; or
• Other permitted communication channels.

Marketing communications will include applicable instructions for opting out.

You may unsubscribe from Aureon marketing emails using the unsubscribe link contained in an email or by contacting:

Opting out of marketing does not necessarily prevent transactional, legal, security, application-related, account-related, or service communications.

Where you provide the applicable consent, Aureon, Financial Providers, and authorized service providers may contact you at telephone numbers you provide.

Depending upon the consent presented to you, communications may include:

• Telephone calls;
• SMS messages;
• MMS messages;
• Automated dialing technology;
• Artificial voice; or
• Prerecorded voice messages.

Message and data rates may apply.

Consent to marketing communications is not a condition of purchasing goods or services where applicable law prohibits such a condition.

You may revoke communications consent in accordance with applicable law and the instructions provided in the relevant communication.

Aureon may create aggregated, statistical, or de-identified information from information collected through the Services.

Such information may be used to:

• Analyze consumer trends;
• Evaluate product demand;
• Improve Services;
• Develop business insights;
• Measure financial-product performance;
• Describe Aureon's business to partners;
• Conduct research; and
• Perform other lawful purposes.

Where information has been appropriately de-identified so that it cannot reasonably be associated with an identifiable individual, Aureon may use and disclose that information as permitted by applicable law.

Aureon may disclose personal information to the following categories of recipients.

Financial Providers

As described above, information may be shared with Financial Providers to respond to your request for financial products.

Merchants and Business Partners

Where you access Aureon through a participating merchant or business partner, certain information may be shared as necessary to provide the requested service, track an application or transaction, administer the business relationship, or otherwise provide Services that you have requested.

Financial information or application details will only be disclosed as permitted by applicable law and the applicable relationship.

Service Providers

Aureon may engage third-party companies to perform functions on its behalf, including:

• Website hosting;
• Cloud storage;
• Data processing;
• Cybersecurity;
• Identity verification;
• Fraud prevention;
• Communications;
• Customer support;
• Analytics;
• Marketing technology;
• Database management;
• Document management; and
• Other business functions.

These providers may receive personal information only as reasonably necessary to perform their functions and are subject to applicable contractual and legal obligations.

Affiliates and Related Companies

Aureon may disclose information to affiliated or related companies for purposes consistent with this Privacy Policy and applicable law.

Corporate Transactions

If Aureon is involved in:

• A merger;
• Acquisition;
• Reorganization;
• Financing;
• Sale of assets;
• Corporate restructuring;
• Bankruptcy; or
• Similar transaction,

personal information may be disclosed to potential counterparties, professional advisors, lenders, investors, or other participants and may become part of the transferred business assets.

Legal Requirements

Aureon may disclose personal information where reasonably necessary to:

• Comply with applicable law;
• Respond to a subpoena, warrant, court order, or other lawful process;
• Respond to a governmental or regulatory request;
• Investigate fraud;
• Enforce agreements;
• Protect Aureon's rights or property;
• Protect Financial Providers;
• Protect users;
• Address an emergency involving safety; or
• Establish, exercise, or defend legal claims.

Aureon does not sell personal information to third parties for monetary consideration as part of its ordinary financial-product matching Services.

Aureon does, however, disclose information to Financial Providers and other parties as described in this Privacy Policy when necessary to provide requested Services.

Certain privacy laws define terms such as “sale” or “sharing” more broadly than an ordinary sale for money.

For example, some advertising, analytics, or cross-context behavioral advertising activities may be considered a “sale” or “sharing” under applicable privacy law even when no money is exchanged for personal information.

Where Aureon's activities constitute a sale or sharing under applicable law, Aureon will provide applicable notices and opt-out mechanisms.

Aureon does not knowingly sell or share personal information of individuals under 16 in circumstances requiring affirmative authorization under applicable law.

Certain information processed in connection with financial services may be considered sensitive personal information under applicable law.

This may include:

• Social Security numbers;
• Social Insurance Numbers;
• Government identification;
• Financial-account information;
• Credit-related information;
• Authentication credentials;
• Precise geolocation, where collected; and
• Other information legally classified as sensitive.

Aureon uses sensitive personal information only for legitimate purposes associated with providing the Services, verifying identity, preventing fraud, facilitating requested financial products, maintaining security, complying with law, or other purposes permitted by applicable law.

Aureon retains personal information for periods reasonably necessary to:

• Provide the Services;
• Maintain business and transaction records;
• Satisfy legal or regulatory requirements;
• Comply with contractual obligations;
• Resolve disputes;
• Prevent fraud;
• Maintain security;
• Enforce agreements; and
• Exercise or defend legal rights.

Retention periods may vary based on:

• The type of information;
• The Service involved;
• Applicable laws;
• Financial-industry requirements;
• Contractual requirements; and
• Legitimate business needs.

Deactivating an account does not necessarily result in immediate deletion of all associated information.

Aureon may retain information after account closure where retention is reasonably necessary or legally required.

When information is no longer reasonably required, Aureon may delete, anonymize, or securely dispose of it in accordance with applicable requirements and retention practices.

Aureon uses reasonable administrative, organizational, technical, and physical safeguards designed to protect personal information against:

• Unauthorized access;
• Loss;
• Theft;
• Misuse;
• Disclosure;
• Alteration; and
• Destruction.

Because financial and identity information can be particularly sensitive, Aureon seeks to apply safeguards appropriate to the sensitivity of the information being processed.

However, no Internet transmission, electronic communication, computer system, cloud service, or data-storage system can be guaranteed to be completely secure.

You should use caution when transmitting sensitive information electronically.

If Aureon becomes aware of a data-security incident involving personal information, Aureon will investigate and provide notices to affected individuals, regulators, law enforcement, or others as required by applicable law.

Depending upon your location and applicable law, you may have choices regarding how your personal information is processed.

These may include the ability to:

• Request access to personal information;
• Request correction of inaccurate information;
• Request deletion of certain information;
• Withdraw consent where processing is based upon consent;
• Opt out of certain marketing communications;
• Opt out of certain sales or sharing of personal information;
• Limit certain uses of sensitive personal information;
• Request information concerning disclosures;
• Request portability of certain information; or
• Exercise other applicable privacy rights.

These rights are subject to applicable legal exceptions.

For example, Aureon may be required or permitted to retain information relating to financial transactions, fraud prevention, security, compliance, litigation, or legal obligations even after a deletion request.

Aureon may need to verify your identity before processing a privacy request.

To submit a privacy request, contact:

Please include sufficient information for us to identify you and understand your request.

If you are a California resident and Aureon is subject to the applicable provisions of the California Consumer Privacy Act, as amended (“CCPA”), you may have specific rights concerning your personal information.

Subject to applicable exceptions, these rights may include:

Right to Know and Access

You may have the right to request information concerning:

• Categories of personal information collected;
• Specific pieces of personal information collected;
• Sources of personal information;
• Business or commercial purposes for collection, use, sale, or sharing;
• Categories of third parties receiving information; and
• Categories of personal information sold, shared, or disclosed.

Right to Delete

You may have the right to request deletion of personal information collected from you, subject to applicable exceptions.

Right to Correct

You may have the right to request correction of inaccurate personal information.

Right to Opt Out of Sale or Sharing

Where Aureon engages in conduct legally defined as selling or sharing personal information, you may have the right to opt out.

Right to Limit Use of Sensitive Personal Information

Where applicable, you may have rights concerning certain uses or disclosures of sensitive personal information.

Right to Non-Discrimination

Aureon will not unlawfully discriminate against you for exercising applicable privacy rights.

Aureon may be required to verify your identity before processing a request.

An authorized agent may submit certain requests on your behalf where permitted by law and where appropriate authorization can be verified.

Residents of certain U.S. states may have additional rights under applicable state privacy laws.

Depending upon your jurisdiction and whether the applicable law applies to Aureon, these rights may include:

• Access;
• Correction;
• Deletion;
• Data portability;
• Opt-out rights;
• Rights regarding targeted advertising;
• Rights regarding sale of personal information;
• Rights regarding profiling;
• Rights regarding sensitive data; and
• Appeal rights if a privacy request is denied.

Aureon will honor applicable rights as required by law.

Where Canadian privacy laws apply to Aureon's handling of personal information, Aureon will process personal information in accordance with applicable requirements.

These principles generally include:

• Accountability for personal information under Aureon's control;
• Identifying the purposes for collection;
• Obtaining meaningful consent where required;
• Limiting collection to information reasonably necessary;
• Limiting use, disclosure, and retention;
• Maintaining reasonable accuracy;
• Protecting information using appropriate safeguards;
• Maintaining transparency regarding privacy practices;
• Providing applicable access and correction rights; and
• Providing a process for raising privacy concerns.

Subject to applicable law, Canadian individuals may request access to personal information held about them and may challenge its accuracy and completeness.

Where processing relies upon consent, individuals may generally withdraw consent subject to legal or contractual restrictions and reasonable notice.

Withdrawal of consent may prevent Aureon from continuing to provide Services that require the relevant information.

Requests may be submitted to:

Some browsers and devices provide privacy signals such as:

• Global Privacy Control (“GPC”); or
• “Do Not Track” (“DNT”).

Where applicable law requires Aureon to recognize a legally valid browser-based opt-out preference signal, Aureon will process that signal as required.

Because there is not a single universally applicable standard governing all DNT signals, Aureon's response to other DNT signals may depend upon the technology and applicable law.

Where Aureon provides account functionality, you are responsible for maintaining accurate and current account information.

If you allow another person to access your account, that person may be able to access information associated with the account.

You should protect your credentials and promptly notify Aureon if you believe your account has been compromised.

If you wish to close or deactivate an account, contact:

Account deactivation does not necessarily require Aureon to delete information that must or may lawfully be retained.

The Services are intended for adults seeking financial products and are not directed to children.

You must be at least 18 years of age , or the applicable age of majority where required, to submit a financial-product request through Aureon.

Aureon does not knowingly solicit financial-product applications from children.

If Aureon learns that it has collected personal information from a child in violation of applicable law, Aureon will take reasonable steps to delete or otherwise address that information as required.

The Services may contain links to websites, platforms, applications, or services operated by Financial Providers, merchants, or other third parties.

This Privacy Policy does not govern independent third-party websites or services.

Aureon is not responsible for the privacy practices of those third parties.

You should review the privacy policy of a Financial Provider or other third party before submitting information directly to that party.

Aureon may maintain or interact with pages, accounts, advertising, or other features on third-party social-media platforms.

Information you provide directly to a social-media service is governed by that service's terms and privacy policies.

Social-media platforms may provide Aureon with aggregated analytics or other information regarding interactions with Aureon content or advertising.

Your privacy settings with a social-media platform may affect how that platform collects and discloses information.

Aureon and its service providers may process or store personal information in jurisdictions other than the jurisdiction where you reside.

As a result, information may be subject to the laws of the jurisdiction in which it is processed or stored and may be accessible to courts, law-enforcement agencies, regulators, or government authorities according to applicable law.

Where required, Aureon will use appropriate safeguards for cross-border transfers of personal information.

By using the Services, you acknowledge that information may be processed outside your state, province, territory, or country, subject to applicable privacy laws.

Aureon relies upon you to provide accurate and current information.

You may request that Aureon correct inaccurate personal information in its possession, subject to applicable law.

Financial Providers receiving your information may maintain their own records. Requests relating to information controlled by a Financial Provider should generally be directed to that provider.

If Aureon proposes to use previously collected personal information for a materially different purpose that is incompatible with the purposes described when the information was collected, Aureon will provide additional notice and obtain consent where required by applicable law.

Aureon may update this Privacy Policy periodically to reflect:

• Changes to the Services;
• Changes in technology;
• Changes in business operations;
• Changes in Financial Provider relationships;
• New legal or regulatory requirements; or
• Changes in privacy practices.

When the Privacy Policy is updated, Aureon will revise the Date of Last Revision at the top of this document.

Where required by law, Aureon will provide additional notice regarding material changes.

You should review this Privacy Policy periodically.

Your use of the Services is also subject to Aureon's:

• Terms of Service;
• Electronic Consent (E-Consent);
• Credit authorization disclosures;
• Communications consents; and
• Any additional notices or agreements presented in connection with a particular Service.

Financial Providers may provide separate privacy notices, applications, consents, agreements, and disclosures.

If a separate privacy notice applies to a specific financial product or transaction, that notice will govern the information covered by that notice to the extent required by applicable law.

If you have questions, concerns, complaints, or requests relating to this Privacy Policy or Aureon's handling of personal information, please contact:

Aureon Financial LLC

4700 Millenia Blvd Suite 500 Orlando FL 32839

Website: aureonfinancial.com Email:

Please include sufficient information to identify yourself and describe your request.

Aureon may require verification of your identity before providing access to personal information or completing certain privacy requests.

PRIVACY ACKNOWLEDGMENT

BY USING THE AUREON SERVICES OR SUBMITTING PERSONAL INFORMATION THROUGH THE SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE BEEN PROVIDED WITH THIS PRIVACY POLICY AND HAVE HAD AN OPPORTUNITY TO REVIEW HOW AUREON COLLECTS, USES, PROCESSES, DISCLOSES, AND PROTECTS PERSONAL INFORMATION.

WHERE APPLICABLE LAW REQUIRES CONSENT FOR A SPECIFIC COLLECTION, USE, DISCLOSURE, OR COMMUNICATION, THAT CONSENT WILL BE OBTAINED THROUGH THE APPLICABLE FORM, APPLICATION, DISCLOSURE, CHECKBOX, OR OTHER CONSENT MECHANISM.