Privacy Statement

This Privacy Statement describes how Greenlight Financial Technology, Inc., its affiliates, and its subsidiaries (“Greenlight,” “we,”  “us,” and “our”) use information about you and your family. It applies to everyone who: visits our websites that link to this Privacy Statement (the “Site”); uses our mobile applications, physical devices, financial accounts and cards offered through our partner financial institutions (collectively, the “App”); uses our platforms - including touch technologies, Greenlight devices, electronic services, social networking sites, interactive features, online services or any of our described online activities we own or control that link to this Privacy Statement (collectively, our “Platforms”) - or otherwise uses the services we provide. We refer to our Site, App, Platforms and other services collectively as the “Service”. For more information regarding the Service, please review our Terms of Service (the “Terms”).

Key terms: In this Privacy Statement, we refer to “you” as a visitor to our Site, user of our App/Platforms, and/or the individual, parent or guardian who is responsible for the account(s) you create using our Service (the “primary accountholder” as defined in our Terms). We use “your family” to refer to anyone affiliated with your account on the Service, such as any child or children you sign up for the Service. If you designate any other individual to be responsible for the Service, such as your spouse, or authorized user (as defined in the Terms) or other secondary approver or supported adult (defined in the Terms), “your family” also includes that individual.

We use “personal information” to refer to any information about an identifiable individual, which may include your name, contact details, account information or other information that can be used to identify you as an individual.

Types of Information We Collect and How

We collect the following categories of personal information:

• Identifiers and contact details: such as name, postal addresses, email addresses, social networking website user account names, telephone numbers, or other addresses at which you are able to receive communications.

• Official identification information: such as Social Security number, government issued Driver’s License, State ID Card, passport and/or any related information that is necessary to comply with legal obligations.

• Demographic information: such as age, date of birth, gender, and pronouns.

• Transaction information: such as purchases made with the Service, transaction history, trading history, and account balances for any accounts you link to the Service.

• Financial information: such as transaction information, account balance, account numbers, and credit card information pertaining to financial accounts you choose to link to the Service.

• Device and network information: such as computer or mobile device operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., Wi-Fi, LTE, 3G), and general location information associated with IP address, such as city, state or geographic area.

• Usage information: such as the pages or screens you viewed, how long you spent on a page or screen, the website you visited before browsing to the Service, navigation paths between pages and screens, information about your activity on a page or screen, access times and duration of access, and whether you have opened our emails or clicked links within them.

• Communications with us and information provided: such as any customer service requests or social media interactions you or your family initiate and other information you or your family choose to provide to us through the Service, such as any images or photographs submitted or posted, or information submitted through the available chat features.

• Preferences: such as marketing preferences and inferences about any Service you may be interested in. 

• Location and motion (for location- and motion-enabled features): if you choose to use our location- or motion-enabled features and/or devices, such as safety features offered under the Greenlight Infinity Plan, place alerts, usage-based insurance, our physical device under Safe Family, or other location- or motion-enabled features, we may (according to your settings) collect precise location data, including GPS coordinates, and activity data through sensor and motion detectors on your and your family’s mobile devices or Greenlight Safe Family devices. To use location- or motion-based services, you may be required to authorize the collection of location and activity data in the background, including when you and your family members are not using the App.

• Greenlight Family Hub: If you use the Greenlight Family Hub, we may collect information such as your and your family’s calendar, grocery lists, task and chore lists, photos and videos, voice interactions with our AI voice assistant, and other similar information from your interaction with the Greenlight Family Hub.

Notwithstanding any other provision of this Privacy Statement, data obtained through Google APIs (including Google Calendar data and Google Photos) is subject to the following restrictions: such data will be used solely to provide and improve the features of the Greenlight Family Hub that are directly visible to and requested by you, and will not be used for advertising or marketing purposes (including interest-based, targeted, personalized, or retargeted advertising), to train or fine-tune AI or machine learning models, to create user profiles or databases for purposes unrelated to the Family Hub service, or for any other purpose not directly related to operating the Greenlight Family Hub on your behalf. Greenlight will not transfer or share Google user data with third parties except as necessary to provide the Family Hub service to you or as required by law.

We collect personal information from a variety of sources, including:

• From you and your family: including identifiers and contact details, demographic information, financial information, location information, communications with us, and preferences.

• Automatically, from your and your family’s devices: including device, interests, and usage information, some of which we collect via cookies and other technologies as described below. Where enabled by you, we may also collect your and your family’s location from your devices as described above.

• Social media networks: including information you and your family provide to us and your communications with us on social media channels, such as Facebook, YouTube, TikTok, Twitter, and Instagram, and any demographic information such platforms provide to us.

• Other third parties: including information we receive from:

  • Financial institutions, including Community Federal Savings Bank (CFSB)and other entities that operate any financial accounts or products that are related to or linked to the Service, such as Alpaca or DriveWealth if you use our Invest Account Services.

  • Financial service providers, including Plaid, which allow us to verify you own the bank account you elect to use as a funding source, verify the amount requested is available to fund your Greenlight account, complete the transfer of funds to your Greenlight account, and to view account information, transaction history and balances for any other linked accounts.

  • Business and advertising partners that provide us with information to allow us to better tailor the Service to you and your family, such as your demographic information and information about services that may interest you.

  • Safety partners including RapidSOS, Sentience and other entities that provide us with information to facilitate safety features and/or devices you or your family members enable. For example, if you sign up for safety features or the Safe Plan, we may receive information to allow us to share your location with selected family members and emergency responders in an emergency situation.

  • Connected services and applications, such as your calendar and photo library, where you authorize access to such services and applications.

  • Other individuals, including where you are included or mentioned in user generated content, text messages within our games or trivia offerings, or if your contact information is provided to us.

Cookies and other similar technologies

We use the term “cookies and other similar technologies” to refer to small data files, including cookies, pixel tags, and/or other technologies provided by your browser or associated applications.

Like many digital platforms, Greenlight, our service providers, and advertising partners may collect device information, device and usage information and other personal information automatically using cookies and other similar technologies to help us enable functionality, analytics and online advertising. These technologies include:

• Cookies. You can learn more about cookies and how to control them at www.allaboutcookies.org and you can set preferences for which cookies you wish to remove or reject in your browser.

• Pixels. We may use pixels (also known as web beacons and clear GIFs) on our Sites and in our HTML formatted emails to track the actions of users on our Sites and interactions with our emails, such as when an email was opened. Pixels are embedded invisibly in image files within webpages or HTML formatted emails. Most browsers and devices allow you to configure your device to prevent images and any pixels embedded in them from loading.

• SDKs. Software Development Kit (SDK) refers to third-party computer code incorporated into our websites or mobile applications to enable functions and tracking similar to those enabled by the other technologies described above, including to enable third party analytics and advertising services. Greenlight allows users to control whether certain SDKs are initialized or permitted to receive data.

• Session Replay. We use services that employ software code to record users’ interactions with the Service in a manner that allows us to watch and analyze visual reconstructions of those user sessions. The replays include users’ clicks, mobile app touches, mouse movements, scrolls, and keystrokes/key touches during those sessions. These replays help us diagnose usability problems and identify areas for improvement.

• Chatbot features. The Service provides users with chatbot features to get information and support. We and any third parties that support these features may access, monitor and record the information you submit to the chat, as well as your device data and usage data described above, to enable the chat and for the other purposes described in this Privacy Statement, including training, quality assurance and service improvement, and, where applicable, to fine-tune and train any AI models we use to provide these features. When you use these features you are not communicating with a human.

You are free to decline optional cookies and similar technologies if permitted by your computer, browser, mobile phone, or other device, although doing so may affect your use of the Service.

Call recording, chatbots and voice assistants

When you call us by phone for support, use the Service’s chat features, or interact with our AI voice assistant features, we and our third-party vendors may monitor and record the conversations for the purposes described in this Privacy Statement, including for quality assurance, training, and service improvement. We and our third-party vendors may also collect your internet and usage information associated with your use of such features for the same purposes. When you use our chatbot features, our interactive voice response features over the telephone, or our AI voice assistant features, you are not communicating with a human.

How We Use Personal Information

We use personal information for the following purposes:

• To create, fund, maintain, customize, improve, and secure the Service, or otherwise provide services you request. This includes:

  • Processing and analyzing any account transactions, payments, and balances, and notifying you and your family about them;

  • Providing customer support and delivering Service update notices, answering questions and responding to requests, and otherwise communicating with you and your family;

  • Testing, personalizing, developing and improving the Service, including for analytics, to fine-tune and train AI and machine learning models where permitted by applicable laws, and to create new algorithms or other tools, so we can better cater to your interests;

  • Providing and administering surveys, sweepstakes, quizzes, games, contests, rewards, or any other promotional activities sponsored by us or our partners; and

  • Providing services or features you request, such as, if you choose to participate: enrolling you in trivia and/or games via text messages or AI tools; allowing you to access and use our location- and motion-enabled features, including safety features and/or devices; and making investment recommendations, including via any available chatbots or AI tools, if you participate in Invest Account Services.

• To market our products and services, including:

  • Direct marketing, such as sending direct marketing communications as permitted by law, including by email or text messages;

  • Referrals, such as facilitating, managing and confirming referrals from you, your family, and our business partners; and

  • Interest-based advertising, such as engaging third-party advertising companies and social media companies to display ads promoting our and other services across the web. We do not knowingly target interest-based ads to children under the age of 16.

• To maintain the security and integrity of the Service, our technology, assets and business, including:

  • Detecting, preventing, and investigating fraud, cyberattacks or other unauthorized, unethical or illegal activities;

  • Evaluating, monitoring and auditing the security of the Service, and troubleshooting and debugging;

  • Performing identity verification on our own behalf and on behalf of regulated business partners including CFSB (issuer of Greenlight prepaid card), and Alpaca or DriveWealth (broker dealers for the Invest Account);

  • Enforcing our Terms and the Cardholder Agreement, including to prevent potential breaches; and

  • Protecting our, your or others’ rights, privacy, safety, or property (including by making and defending legal claims).

• To comply with applicable laws, including responding to law enforcement requests and as required by applicable law, court order, or governmental regulations.

How We Share Personal Information

We may share personal information as follows:

• Within your family. Information you or your family provide may be accessible to other members of your family through the Service. For example, you and any authorized approver will be able to see the account activity of your child on the Service, and the authorized approver may be able to see certain information about you, such as your name and accounts. If you sign up for our safety features and/or devices, you will be able to share information such as real-time driving alerts (including information about your and/or your family’s speed, acceleration and deceleration) and your precise location with members of your family or other emergency contacts. The primary accountholder and any authorized approvers will also be able to see your location and other information if you use any of our location - or motion-enabled features. For example, if you are a supported adult and use our Family Shield service, your account activity on the Service will be visible to other members of your family in accordance with your settings.

• Processing transactions. To process payments and other transactions on the Service, we share information with the person you or a member of your family are paying or from whom you or a member of your family are receiving a payment.

• Service Providers. We engage with select service providers who provide services to support our operations such as: open banking interface providers (like Plaid); payment processors (including merchant acquirers and automated clearinghouse (ACH) payment processors); broker dealers (like Alpaca or DriveWealth); insurance providers for mobile phone protection and purchase protection; providers for identity theft and cyber insurance (like Chubb); identity verification services (like Prove Identity); cloud hosting providers (like AWS); chat functionality providers (like Intelepeer); providers of information technology, email/SMS delivery, customer support, marketing, consumer research, analytics, and cybersecurity services; and other service providers pursuant to written agreement with us.

• Business Partners. We may share your personal information with our business partners, including partner financial institutions, as well as with affiliates, to provide you with a product or service you request (such as to facilitate a third-party referral, offer or invitation to use the App and to confirm the same), marketing and advertising purposes, and for our affiliates internal business purposes. We may share with our business partners who provide our App to their customers and/or employees information to confirm registration to use the App.

• Safety Partners. We may share your personal information with our safety partners, including emergency response partners (if you enable safety features or the Safe Plan), to provide you with a safety-related product, device or service you request (such as to fulfill an emergency request or display insights into your and/or your family’s driving).

• Other Parties. We share personal information when we have reason to believe that disclosing the information is necessary to prevent fraud, damage to person or property, protect and secure our business, assets, user accounts or enforce legal rights or comply with subpoena, court order, legal process or obligations, including as needed to support auditing, compliance, and corporate governance functions. We also share personal information as needed if that information is requested by law enforcement agencies or if we are required to do so by law or court order.

• Your network. When you use the Service to engage with individuals outside of your family, those individuals will be able to see your name and/or username, profile photo, and any other information you choose to share.

• Advertising Networks and Analytics. We may allow advertising networks to collect information for the purposes of serving ads that are more relevant. We also work with partners that assist us with ad campaign measurement and analytics.

• Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.

• Successor Entities. We may disclose or transfer your personal information to a successor entity (or its representatives) in the event of a corporate merger, divestiture, consolidation, reorganization, sale of assets or other corporate changes respecting Greenlight (including, in connection with a bankruptcy or similar proceedings), and in connection with due diligence and negotiations relating to any such transactions.

We may also share information if the information has been aggregated, de-identified, or otherwise does not identify you personally, and otherwise with your consent or as permitted by law. Where we use and share de-identified information, we do not attempt to re-identify it unless permitted or required by applicable law.

Your Rights and Choices

Your choices

We provide you and your family with the following choices.

• Direct Marketing Preferences. Each recipient of our marketing emails may unsubscribe from the emails from within each marketing email, but please note that you may continue to receive transactional emails with Greenlight account-related information, even if you opt-out of marketing emails.

• Update Your Information. You can edit or update personal information in your account by reviewing the account settings and profile across the family of accounts. Some account information can be updated only by the primary accountholder. It is your responsibility as the primary accountholder to make sure that personal information of everyone in your family is accurate. You should promptly update your and your family’s personal information if it changes or becomes inaccurate.

• Change Location and Motion Detection Settings. You can change what location and/or motion detection information you share within the settings of your device. Please note that by changing these settings we may not be able to provide you with services or features you have requested, such as our safety features.

• Closing Account(s) and Deletion of Personal Information. As the primary accountholder, you can close your account and the account of any member of your family within the settings of the App or by calling Greenlight Customer Service at 1-888-483-2645. If you close an account, the account will no longer be accessible, but we may retain personal information from the account to collect any fees owed, resolve disputes, troubleshoot problems, assist with any investigations, prevent fraud, enforce the Cardholder Agreement and Terms, or take other actions as required or permitted by law.

• Opt-Out Rights. There are a number of ways to limit online tracking on our Site, which we have summarized below:

  • Blocking cookies in your browser. Most browsers let you remove or reject cookies. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit www.allaboutcookies.org.

  • Using privacy plug-ins or browsers. You can block our websites from setting cookies used for interest-based ads by using a browser with privacy features, like Brave, downloading and enabling Global Privacy Control, or installing browser plugins like Privacy Badger, Ghostery, or uBlock Origin, and configuring them to block third party cookies/trackers.

  • Advertising industry opt-out tools. You can also use these opt out options to limit use of your information for interest-based advertising by participating companies:

    • Digital Advertising Alliance for Websites: optout.aboutads.info

    • Network Advertising Initiative: optout.networkadvertising.org

Currently, we do not alter our data collection and use practices in response to “Do Not Track” signals. To find out more about “Do Not Track”, please visit http://www.allaboutdnt.com.

Your privacy rights

Personal information we collect, use, or disclose about consumers who initiate or complete the process of applying for financial products or services is protected by the Gramm-Leach-Bliley Act (GLBA) and, where applicable, certain state financial privacy laws, such as the California Financial Information Privacy Act (CalFIPA). You can learn more about how we handle this information and your choices, by reviewing our Consumer Privacy Disclosure.

If you reside in certain states, such as in California, Oregon and Connecticut, you may have certain additional rights as described below. These rights do not apply to personal information that we collect that is protected by the GLBA or CalFIPA.

• Information. You may have the right to obtain information about how we collect, use, and share your personal information. We provide certain information about our processing of your personal information within this Privacy Statement.

• Access, correction and deletion. You may also have the right to request access to your personal information, to correct personal information that is out of date or inaccurate, or to delete personal information that is no longer needed for a permitted purpose. You may also have the right to receive or request the transfer of a copy of your personal information in a structured, commonly used technological format, subject to certain legal limitations, restrictions or exceptions. Where these rights apply, you are entitled to exercise these rights free from discrimination.

• Withdrawal of consent.  If we rely on your consent to process your personal information, you may withdraw your consent at any time by contacting us directly or using the opt-out mechanisms described in this Privacy Statement, subject to legal or contractual restrictions. Please note that withdrawing consent may limit our ability to provide certain services or features that require the processing of your personal information.

• Opt out of selling and sharing personal information for targeted advertising. We use cookies and other similar technologies to help us advertise our Service. We share information we collect through our Service, such as information about the pages you visit and the actions you take on our Site and App, with advertising networks and analytics partners to support our interest-based advertising, which may qualify as a sale or sharing of personal information, or targeted advertising, under applicable law. You can opt-out of our use or sharing of personal information for these purposes by using our “Do Not Sell or Share My Personal Information” tool in the footer of our Site, by enabling the Global Privacy Control setting within the browser that you use to access our Site, and in the Settings tab of the App. Opting out will prevent Greenlight from sharing your App events and identifiers for ad personalization; it may not prevent all advertising. Learn more at the Global Privacy Control website. Please note that your opt-out will be specific to the device and browser (or App) you use when you opt-out. For some App users certain data sharing is off by default and corresponding settings may not be available. If a setting is available in your App or account experience, you may use it to manage your preferences.

The rights described above are not absolute, and, in certain cases, we may decline your request if limitations on these rights apply or as otherwise permitted by law. We cannot process your request if you do not provide us with sufficient detail to allow us to understand and respond to it. If you are unhappy with how we have addressed your request, you can appeal by contacting us as described in the ‘Contact Us’ section below.

How to Submit a Request

You may exercise your rights by filling out the form here.

• Identity Verification. We will require you to verify your identity, including but not limited to verification of your email, in accordance with applicable laws before we provide a substantive response to the request.

• Authorized Agents. California residents, and residents of other jurisdictions with similar rights, can empower an “authorized agent” to submit requests on their behalf. We will require the authorized agent to have a written authorization confirming that authority.

Data Retention

We may retain your personal information for as long as it is reasonably needed in order to maintain and expand our relationship and provide you with our Service; in order to comply with our legal, regulatory and contractual obligations; or to protect ourselves from any potential disputes. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of such data, the potential risk of harm from unauthorized use or disclosure of such data, the purposes for which we process it, and the applicable legal requirements.

We have established a framework for the secure retention and disposal of personal information. Once the retention period has expired or the information is no longer needed, we securely destroy or anonymize it in accordance with our policies and applicable laws.

Security

Our information security program is managed by dedicated information security personnel with commercially reasonable information security measures to protect personal information against loss, misuse, and unauthorized access. These measures include, but are not limited to, data encryption, cyber threat detection, and internal access controls. We regularly have our information security program assessed and validated by independent security audit experts. You and your family are responsible for maintaining the security of your usernames and passwords used to access the Service.

We have also established governance policies and practices that define the roles and responsibilities of our personnel in managing personal information throughout its lifecycle. These policies include procedures for responding to privacy-related concerns or complaints, which can be submitted by contacting us as described in the “Contact Us” section below.

Information from Children

At Greenlight, our goal is to help parents raise financially-smart kids, and we take our responsibility to your children seriously. While many aspects of the Service are similar for children and parents, certain features available to children are limited or operate differently than the parent experience, as described in this ‘Information from Children’ section.

Registration

During the registration process, we ask for your mobile phone number and date of birth, which we use to determine your age and eligibility for the Service. Children under the age of 18 must register for our Service with their parent or guardian as follows:

• Children under 13. Parents or guardians must initiate the registration process on behalf of children under the age of 13. We request, via digital consent during the registration process, that you represent that you are the parent or legal guardian of any child under the age of 13 for whom you register an account and that you consent to our collection and use of the child’s personal information in accordance with this Privacy Statement. If a child under 13 initiates the registration process without a parent or guardian the registration session will end and we will inform the child that the child will need a parent or guardian to create an account. In those cases, we delete the personal information from children under 13 until a parent or guardian initiates a new registration.

• For those younger than 18, a parent’s mobile phone number is required so that we can provide the parent with information about how to download the App and finish registering an account.

Parental Choices and Controls

You can update or change the personal information of a child at any time through the account settings.

At any time, you can refuse to permit us to collect further personal information of a child by closing that sub-account by calling Greenlight Customer Service at 1-888-483-2645. If you close an account, we will mark the account in our database as “Closed,” but may retain personal information from the account to deactivate the account with our service providers, allow you to reactivate the Greenlight account for some period in the future, collect any fees owed, resolve disputes, troubleshoot problems, assist with any investigations, prevent fraud, enforce the Cardholder Agreement and Terms, or take other actions as required or permitted by law.

If you request that we delete your child’s personal information, we will delete as much information as we are legally permitted. Due to regulatory recordkeeping obligations, we may be required by law to retain some information associated with a closed account.

If we learn that we have inadvertently collected the information of a child without parental consent, as required by law, we will delete this information.

Data Collection on our Site

While we provide a Service for families, our Site is for promotional purposes only and is not intended for children under the age of 13. We do not knowingly collect any information from children under the age of 13 on our Site. If we learn that we have collected personal information from a child under 13 without the consent of the child’s parent or guardian as required by law, we will delete it.

Data Collection on our App and Platforms

Our App and Platforms are intended for use by families, including children. We collect, use and share children’s personal information through the App and Platforms as necessary to provide the Service requested by the child and/or the child’s parent or legal guardian as described in this Privacy Statement, including to maintain, customize, improve, and secure the Service. We may also use or share children’s personal information to comply with legal and regulatory requirements. We do not knowingly collect personal information from a child under the age of 13 without the consent of the child’s parent or legal guardian. If we learn that we have collected personal information from a child under the age of 13 without the consent of the child’s parent or legal guardian, we will delete that information. We do not sell children’s personal information, and we do not knowingly share personal information from children for targeted advertising purposes.

Location of Service and Cross-Border Data Transfers

We are headquartered in the United States. We and our service providers may access, store or otherwise process your personal information outside of your country, province or region of residence, including the United States. For residents of Quebec, this includes jurisdictions outside of Quebec. As a result, your personal information may be subject to access by government authorities, courts and law enforcement in those jurisdictions, in accordance with local laws.

Changes to Privacy Statement

If we make any material changes to this Privacy Statement, we will change the Effective Date above. We encourage you to review this Privacy Statement to stay informed. If we make material changes and we need to provide additional notice, we will notify you via the email specified in your account or through the Service or Site.

Contact Us

If you have questions about this Privacy Statement or our information practices, please contact us or our Privacy Officer by email at caprivacy@greenlight.com or call 1-888-483-2645.

Our mailing address is:

303 Peachtree St. NE, Suite 4300

Atlanta, GA 30308

Notice at Collection

While you should read this Privacy Statement in its entirety, the following summarizes our practices currently and during the past 12 months regarding the categories of personal information that we collect and how we use them.

Collection and disclosure. The list below describes at a high level the personal information we collect by reference to the categories of personal information specified in the CCPA and the categories of third parties to whom we disclose it. The terms in the list refer to the categories of information and third parties detailed above in the sections entitled Types of Information We Collect and How We Share Personal Information. Information you voluntarily provide to us, such as in emails or free form webforms, may contain other categories of personal information (including sensitive personal information) not described below. We may also disclose personal information to the categories of third parties described above in the How We Share Personal Information section of this Privacy Statement.

All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.