GLBA Privacy Notice

Counsel note: This notice is modeled on the federal agencies' GLBA Model Privacy Form structure (the "Facts / What / How / Why" format and the standard sharing table) to position Plumb for the safe harbor. It is separate from the general Privacy Policy and is intended to be delivered as the initial notice at the establishment of the customer relationship (at signup, before sharing NPI) and as required thereafter. Confirm: (1) whether Plumb qualifies for the annual-notice exception; (2) that the sharing table reflects Plumb's actual, signed-contract practices; and (3) delivery via the E-SIGN consent flow. The horizontal Model Form layout should be reproduced faithfully in the final delivered version; the table below adapts it for markdown.

Why?

Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.

What?

The types of personal information we collect and share depend on the product or service you have with us. This information can include:

• Account balances and transaction history
• Income and assets

When you are no longer our customer, we continue to share your information only as described in this notice.

How?

All financial companies need to share customers' personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers' personal information; the reasons Plumb chooses to share; and whether you can limit this sharing.

Sharing table — Plumb's actual practices

Because Plumb does not share your information for marketing, joint marketing, or with affiliates or nonaffiliates to market to you, there is little or nothing to opt out of. We share your information only to run the everyday business of providing the financial-wellbeing services you signed up for.

Questions?

Call or email us — see Contact below, or write to Plumb Finance Inc., 30 N Gould St Ste N, Sheridan, WY 82801.

What we do

How does Plumb protect my personal information?

To protect your personal information from unauthorized access and use, we use security measures that comply with federal law, including the FTC Safeguards Rule. These measures include computer safeguards; encryption of data in transit and at rest; access controls and multi-factor authentication; secured files and buildings/systems; and oversight of the service providers who work on our behalf. We maintain a written information security program and an incident-response plan.

How does Plumb collect my personal information?

We collect your personal information, for example, when you:

• Open an account or sign up for a subscription
• Connect your bank or financial accounts (through our open-banking aggregator, Array)
• Tell us about your income, household, or financial goals
• Use the AI money coach or human counseling

We also collect your personal information from others, such as our open-banking aggregator (Array), when you direct us to.

Why can't I limit all sharing?

Federal law gives you the right to limit only:

• Sharing for affiliates' everyday business purposes — information about your creditworthiness;
• Affiliates from using your information to market to you; and
• Sharing for nonaffiliates to market to you.

State laws and individual companies may give you additional rights to limit sharing. Plumb does not do any of the sharing listed above, so these limits do not change anything in practice — we already don't share for those purposes.

Definitions

• Affiliates — companies related by common ownership or control. They can be financial and nonfinancial companies. Plumb does not currently share your nonpublic personal information with affiliates for the purposes listed above.
• Nonaffiliates — companies not related by common ownership or control. They can be financial and nonfinancial companies. Plumb does not share your nonpublic personal information with nonaffiliates so they can market to you. We do use service providers (such as Array, our payment processor, and our AI vendor) to run our everyday business under written services agreements that limit their use of your information to what we have asked them to do; service providers act on our behalf and are not permitted to use your information to market to you.
• Joint marketing — a formal agreement between nonaffiliated financial companies that together market financial products or services to you. Plumb does not engage in joint marketing.
• Nonpublic personal information (NPI) — personally identifiable financial information we collect in connection with providing a financial product or service to you, such as your bank-account and transaction data.

Other important information

• We will never sell your financial data, and we do not use your financial data for advertising. Our subscription is our business model.
• Plumb is not a bank or lender.
• You must be 18 or older to use Plumb.
• This notice applies to U.S. consumers. For information that is not GLBA nonpublic personal information (such as website analytics and marketing data), please see our general Privacy Policy and Cookie Policy.

Contact

• Privacy questions: privacy@plumbfinance.com
• General support: support@plumbfinance.com
• Legal notices: legal@plumbfinance.com
• Mailing address: Plumb Finance Inc., 30 N Gould St Ste N, Sheridan, WY 82801

Plumb Finance Inc. is a corporation formed in Wyoming.