Privacy Policy

Thank you for using River! This Privacy Policy (“Policy”) describes the types of personal information we collect from you when you visit and use river.com or any of our related services or offerings (collectively, the “Services”), and how we collect, use, and share that information. Any reference to “us,” “we,” or “our” in this Policy means River Financial Inc., a Delaware corporation. Any reference to “you” or “your” means any user who accesses the Services.

Our U.S. Financial Privacy Notice is also available here. This notice summarizes certain of our privacy practices related to your financial data, but is not intended to supersede this Policy in any way.

Binding Agreement

Please read this Policy carefully. By accessing or using the Services, you agree to this Policy. If you do not agree with our policies and practices, you may not use our Services.

Changes to this Policy

We may update this Policy from time to time. If you continue using the Services after we make any changes to this Policy, you accept and agree to be bound by those changes. The most updated version of this Policy will always be posted on the Services, so we encourage you to check the Policy periodically. In certain situations, we may notify you about material changes to the Policy. You are responsible for ensuring we have an up-to-date, active, and deliverable email address on file for you, and you agree that your use of the Services will be subject to any updated Policy posted on the Services, whether or not you receive notice of such changes.

Applicability

This Policy applies to personal information we collect on the Services. It does not apply to any non-personal information or any information collected by any third party. As used in this Policy, “personal information” means information that can be used to identify any natural person either directly or indirectly.

Personal Information We Collect

Personal Information You Voluntarily Provide to Us

When you register for an account on the Services, we may require that you provide us with certain personal information about you. This includes, but is not limited to, the following information:

• Name,
• Physical address,
• Email address,
• Telephone number,
• Text-messaging consent information,
• Social security number,
• Date of birth,
• Bank account information; and
• Photo ID.

As part of the account registration and verification process, we may also ask you for certain documents that include personal information about you.

Even if you access and use the Services without registering for an account, you may choose to provide us with certain personal information about you. For example, this may be the case when you subscribe to our newsletter or contact our support team. The collection of this information is necessary to provide the functionality of the Services and/or to comply with applicable laws and regulations related to the Services.

Personal Information We Collect From Third Parties

To comply with our legal obligations and to help detect and fight fraud, we may collect certain information about you from public databases and third party identity verification partners. Such information may include, without limitation, your name, address, job role, public employment profile, credit history, status on any sanctions lists maintained by public authorities, and other relevant data.

Personal Information We Collect Automatically

We collect certain information about you automatically as you access and use the Services. This includes:

• Device information, such as a unique device identifier or browser information;
• Location information, such as your IP address or geo-location; and
• Usage information, such as pages visited and links clicked.

This information does not identify you directly, but may nevertheless be considered personal information.

How We Use Personal Information

We use the personal information that we collect to make the Services available to our users, to comply with our legal obligations under anti-money laundering and related laws, to market and promote the Services, to improve the Services, and to protect our legal rights.

Examples of the ways in which we may use your personal information include:

• Allowing you to register for a user account and use the Services;
• Verifying your identity in compliance with our obligations under applicable law;
• Identifying fraudulent or illegal activity;
• Providing you with information, products or services that you request from us;
• Carrying out our obligations and enforcing our rights arising from any contracts entered into between you and us, including for collection of amounts owed;
• Notifying you about changes to the Services, such as updates to this Policy; and
• Understanding how our users interact with the Services to improve the Services and our product offerings.

In addition to the above, unless you choose to opt out of receiving marketing and promotional communications from us, we may use your personal information to contact you about our products.

Finally, we may also use your personal information for any other purposes with your consent.

How We Share Personal Information

We may disclose personal information that we collect in the following circumstances:

• With our subsidiaries and affiliates;
• With our contractors and vendors who support the following aspects of the Services and our business: payment processing, collections, bank account identity and authentication, email and text message marketing, helpdesk and support, user identity verification, and fraud prevention;
• With our banking partners who enable the processing of transactions via the Services;
• With a buyer or other successor in the event of a merger, reorganization, dissolution or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our users is among the assets transferred;
• When we believe, in good faith, that disclosure is necessary to prevent physical harm or financial loss, to report suspected illegal activity, or to investigate violations of our Terms of Service or any other applicable policies; and
• With your express consent.

Additionally, we may share your personal information as required to comply with any subpoena, court order, similar legal process, including to respond to any government or regulatory request. To the extent permitted by law, we will notify you if we receive government requests about your data.

Finally, we may disclose anonymized, non-personal information about the Services and our users without restriction.

River does not share text messaging consent information with third parties.

Accessing and Correcting Your Information

You are solely responsible for ensuring that any personal information that you provide to us is accurate. You may be able to view and update certain personal information that we have about you by logging into your user account via the Services. Please note that we reserve the right to reject any changes you make to your personal information and to reject any requests to change your personal information submitted through inappropriate channels.

Data Security

We use commercially-reasonable physical, technical, and administrative measures to secure your personal information from accidental loss and from unauthorized access, use, and disclosure. For example, we restrict access to personal information to employees, contractors, and other service providers on a need-to-know basis, and we use industry-standard encryption technology to secure data at rest and in transmission. However, the transmission of information via the Internet is not completely secure. As we cannot guarantee the security of information transmitted to or from us, we are not responsible for any unauthorized access to and disclosure of any information you send to or receive from us. Any transmission of personal information is at your own risk.

Please also keep in mind that the safety and security of your information also depends on you. You are responsible for keeping your account information, including your password, confidential. We ask you not to share your password with anyone. If you have reason to believe that your data is no longer secure, please contact us immediately at support@river.com.

Data Retention

We may retain your personal information for the longer of: (i) five (5) years; (ii) the length of time required by law; (iii) the length of time required by our compliance program; (iv) the length of time required by our fraud prevention program; or (v) the length of time required by our banking partners. Please note that if you delete your user account via the Services, we may still retain your personal information as explained above.

Automated Data Collection Technologies

As you navigate through and interact with the Services, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions and patterns, as further described in this Policy.

Cookies, Web Beacons and Analytics

We may use cookies, web beacons and other technologies to automatically collect information about your use of the Services. You can learn more about these technologies below. We may use this information to provide you with a better user experience, to comply with our legal obligations under anti-money laundering and related laws, to protect you and detect irregular or suspicious account activities, to customize our services and content for you, and to better understand how our users interact with the Services.

Cookies. A cookie is a small file placed on your computer when you visit certain websites. Cookies may be either first-party or third-party cookies, and they may be either permanent or temporary (i.e. session) cookies. It may be possible to refuse to accept cookies by activating the appropriate setting within your browser. However, if you disable or refuse cookies, please note that some parts of the Services may be inaccessible or may not function properly.

Web Beacons. Pages of the Services or emails we send to you may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags and single-pixel gifs) that permit us, for example, to count users who have visited those pages, opened emails, and for other related statistics (for example, recording the popularity of certain content and verifying integrity).

Other Technologies. We may use other third party services that automatically collect information about you to better understand how you use and interact with the Services. These may include, but are not limited to, vendors that provide us with email marketing tools. We may also use third-party services to deliver advertising with such third parties. The information collected through this process by the third party service providers does not enable us or them to identify your name, contact details, or other personal information that directly identifies you unless you choose to provide these.

“Do Not Track” Signals

Some Internet browsers allow you to transmit “Do Not Track” or “DNT” signals. We do not respond to DNT signals.

Third-Party Services

Any third-party services integrated with the Services shall be subject to the policies and practices of such third parties, and we are not responsible for how they collect, use, and share your personal information. We encourage you to review the privacy practices and policies of such third parties.

Restrictions on Use

Children Under 18

The Services are not intended for children under 18 years of age. No one under age 13 may provide any personal information to us via the Services or otherwise. We do not knowingly collect personal information from children under 13. If you are under 13, do not provide any personal information on this Services or on or through any of its features (such as by registering for an account), make any purchases through the Services, or provide any information about yourself to us, including your name, address, telephone number, email address or any screen name or user name you may use. If we learn we have collected or received personal information from a child under 13 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 13, please contact us at the email address listed below.

Use Outside of the United States

Currently, the Services may not be used by those located outside of the United States, including residents of the European Economic Area. If you access and use the Services from outside of the United States, you understand that we may store, transfer, and otherwise process your personal information in a country outside of the country of your residence, including the United States, and access the Services at your own risk.

Contacting Us

To ask questions or comment about this Policy and our privacy practices, contact us at support@river.com.