Lili Online Privacy Policy

Effective Date: November 28, 2024

Protecting the privacy of your personal information (“PI”) is important to Lili App Inc. and our employees (collectively, “Lili”, “we”, “us” and “our” as appropriate). This Privacy Policy (“Policy”) explains how we may collect, use and disclose information we obtain through the Lili website or the Lili App (collectively, “Lili Service”).The words “you” and “your” mean each individual who accesses the Lili Service.

PI means any data that classifies as personal information, personal data, personally identifiable information, or similar terms under applicable data privacy and security laws and regulations. This includes any “personally identifiable financial information” that a financial institution collects about an individual in connection with providing a financial product or service, unless that information is otherwise “publicly available.” It does not include data excluded or exempted from those laws and regulations, such as aggregated, anonymized, or deidentified data.

1. How We Collect Your Information

We collect information, including PI when you:

• Apply for a Lili business deposit account (“Lili Account”);
• Register to use the Lili Service;
• Process transactions through your Lili Account;
• Use one or all of Lili’s services;
• Interact with us by sharing information on a blog or a social media platform that we manage;
• Request Lili Account access for others; and     
• Communicate with us.

We may also collect PI from the following sources:

• Information we receive about your transactions from our service providers;
• Information we receive about your transactions with nonaffiliated third parties;
• Information we receive from any devices that interface with us;
• Information you give us access to, such as other financial services accounts; and
• Information we receive about you from vendors, third party service providers, or consumer reporting agencies, such as credit bureaus.

1.1. Our Security Procedures.

We take all necessary steps to safeguard PI. We restrict access to PI and account information to those employees who need to know that information to provide products or services to you. We maintain physical, electronic, and procedural safeguards that comply with federal standards to guard PI.

1.2. Creating a Lili Account.

You must register to use the Lili Service. When you choose to create a Lili Account, we are required to collect information including your name, address, date of birth, and social security number if you are a sole proprietor, or the same information for ultimate beneficial owners of legal entities. To further verify identity and prevent fraud, we collect additional information about you, such as biometric information, device information, IP address, email address and phone number, as well as information about your business. You may decline to provide this information, however, doing so may prevent you from engaging with and using the Lili Service.

1.3. Using the Lili Service.

We collect information from you as you use the Lili Service; when you initiate a transaction, when you send payments or otherwise engage with or use the Lili Service. Lili may offer additional financial and non-financial products and services via the Lili Service which are governed by this Privacy Policy.

1.4. Customer Support.

We may collect information, including PI from you through your communications with our customer support or other team members.

1.5. Mobile Device Information.

We collect information about the computer, tablet, or mobile device you use to access the Lili Service which may include the hardware model, operating system and version, unique device identifiers and mobile network information. We may also collect other device identification information for the purposes of detecting and preventing fraud.

1.6. Location Data.

If you have ‘background location’ turned on, the Lili App will, from time to time, tell us about your mobile device’s location even if you are not directly interacting with the application.

When we have location information, we use it to tailor the Lili Service for you and others, like helping reduce debit card fraud by matching your card activity with your location.

1.7. Cookies, Automatic Data Collection, and Related Technologies.

When you visit the Lili website, we and third parties that provide certain functionality on the Lili Service may engage, receive and record information from your use of the Lili Service and server logs from your browser, including your IP address, cookies, and similar technology. This information is used for security purposes to authenticate your identity and improve the quality of our services, such as storing your account preferences.

Cookies are commonly used on websites and do not harm your system. By configuring your preferences or options in your browser, you determine if and how a cookie will be accepted. Most browsers allow you to block and delete cookies however by blocking cookies on our site it may impact the services we can provide you.

2. How We Use Your Information

We use the information we collect, including PI to:

• Facilitate and improve the Lili Service;
• Communicate with you;
• Provide and deliver the products and services you request, process transactions and send you related information, including confirmations;
• Verify your identity and prevent money laundering, fraud, and other wrongful conduct;
• For Lili and our bank partners to offer other products and services available on the Lili App that you may qualify for or might be interested in; and
• Monitor and analyze trends, usage, and activities in connection with the Lili Service

2.1. Internal and Service-Related Usage.

We use information, including PI, for internal and service-related purposes and may provide it to third parties to allow us to facilitate the Lili Service. We may use and retain any data we collect to provide and improve our services.

We share information, including PI, with service providers who may share it with a credit reference or fraud prevention agency for the purposes of verifying identity, assessing the risk of giving credit, preventing fraud, and tracing debtors. For more information, please see the Credit Reference Agency Information Notice (“CRAIN”) notice located here.

2.2. Communications.

We may send emails or text messages to the email address and phone number you provide to us to verify your account and for informational and operational purposes, such as account management, customer service, or system maintenance. We may store your email address and phone number, your message and our response for quality assurance. We may also do this to meet legal and regulatory requirements.

2.3. Marketing.

We do not rent, sell, or share PI about you with other individuals or non-affiliated companies for their direct marketing purposes, unless we have your permission. We also do not provide any PI to any third-party advertising networks. We may use your PI and other information to communicate with you by email to provide you with information and services we think may be of interest to you.

2.4. Aggregate Data.

We may cleanse and aggregate data collected through the Lili Service and use it for any purpose. Information that has been aggregated or deidentified under applicable laws is not PI.

We may share your information, including aggregated or deidentified PI, with our third-party service providers, vendors and other partners:

• To comply with legal obligations;
• To protect and defend our rights and property; and
• With your permission.

3. How We May Disclose Your Information.

We are permitted under law to disclose PI about you to other third parties in certain circumstances. For example, we may disclose PI about you to third parties, such as service providers and vendors, to assist us in servicing your account with us and to prevent wrongful conduct. We do not disclose any PI about you to anyone, except as permitted by law.

If you decide to close your account(s) or become an inactive customer, we will continue to adhere to the privacy policies and practices described in this notice.

3.1. Vendors and Service Providers.

We may share any information we receive with vendors and service providers retained in connection with the provision of the Lili Service. Our vendors and service providers may compare your identifiers (such as email address, IP address, and phone number) and PI with consortia information to assist us in preventing fraud, money laundering and other wrongful conduct. Conversely, this information may be used by the consortia to prevent fraud, money laundering and other wrongful conduct at other financial institutions.

3.2. As Required By Law and Similar Disclosures.

We may disclose your PI, other account information, and content if we believe doing so is required or appropriate to: comply with law enforcement requests and legal process, such as a court order, levy, garnishment, or subpoena; respond to your requests; or protect yours, ours or others’ rights, property, or safety.

3.3. Merger, Sale, or Other Asset Transfers.

If we are involved in a merger, acquisition, reorganization, sale of company assets, or transition of service to another provider, your information may be sold or transferred as part of such a transaction as permitted by law and/or contract. We cannot control how such entities may use or disclose such information.

4. Security of Your Information.

We take steps to ensure that your information is treated securely and in accordance with this Policy. Unfortunately, the Internet cannot be guaranteed to be 100% secure, and we cannot ensure or warrant the security of any information you provide to us. We do not accept liability for unintentional disclosure.By using the Lili Service or providing PI to us, you agree that we may communicate with you electronically regarding security, privacy, and administrative issues relating to your use of the Lili Service. If we learn of a security system breach, we may attempt to notify you electronically by posting a notice on the Lili Service or sending an email to you. You may have a legal right to receive this notice in writing. To receive free written notice of a security breach (or to withdraw your consent from receiving electronic notice), please notify us at [email protected].

5. Links to Third Party Services.

The Lili Service may allow you to access third party services to provide information about you, including PI, to the Lili Service. This Policy applies only to the information collected by the Lili Service. When logging into a third party service or following a link to third party websites from the Lili Service, please be aware that the privacy practices of those services may differ. We encourage you to carefully read the privacy policy for each website you visit. We are not responsible for the privacy policies or practices of linked third party sites or services.

6. International Users.

If you are visiting from outside the United States, please note that you are agreeing to the transfer of your information to the United States and processing globally. By providing your information you consent to any transfer and processing in accordance with this Policy.

6.1. Australian Users’ Rights. 

This section of our Privacy Policy is applicable to persons located in Australia.  If you are an Australian resident, you may have certain rights to access the PI we hold about you and to correct personal information we hold about you (if applicable).  To exercise those rights, or if you have any questions about this Policy please reach out using the information in the “Contact Information” section below.  Additionally, PI about you that you provide while in Australia may be transferred to the United States. 

More information about privacy law and privacy principles is available from the Office of the Australian Information Commissioner (“OAIC”) and from their website.  You may contact the OAIC using their contact details set out here.

6.2. Canadian Users’ Rights.

Residents of Canada have certain rights with respect to their data under Canada’s Personal Information protection and Electronic Documents Act (“PIPEDA”) and related provincial privacy laws, including Law 25 that applies specifically to residents of Quebec. 

As required under applicable law, Lili has appointed a Data Protection Officer (“DPO”) to uphold compliance with these laws. Our designated DPO may be contacted by email at [email protected].

Canadian residents have a right to access, correct, erase, and to restrict processing of personal information that we may hold about you. If necessary, we may request additional information reasonably necessary to authenticate you and your request. To submit a request, you may contact our DPO using the information above, or using the information provided in the “Contact Information” section below.  Residents of Canada can learn more about their rights by clicking here to read about PIPEDA, and here for information on Law 25.

6.3. European Users’ Rights.

This section of our Privacy Policy is applicable to persons located in the European Union (“EU”), an European Economic Area member state (“EEA”), United Kingdom (“UK”), or Switzerland as well as to persons whose personal information is processed in or transferred from the EU, EEA, UK, or Switzerland.  You are entitled under the EU General Data Protection Regulation and UK General Data Protection Regulation (collectively, the “GDPR”), to the information in this section of our Privacy Policy.

6.3.1. Your Rights.

You are entitled by law to access, correct, amend, or delete personal information about you that we hold.  A summary listing these rights appears below.  Please note that these rights are not absolute and certain exemptions may apply to specific requests that you may submit to us.To exercise these rights, please contact us using the information below in the “Contact Information” section.  For your protection, we may need to verify your identity before responding to your request.  In the event that we refuse a request, we will provide you a reason as to why.

6.3.2. Asking Us to Access Your Personal Information.

You have the right to obtain from us confirmation as to whether or not we are processing personal information about you, and if so, the right to be provided with the information contained in this Policy.  You also have the right to ask us for copies of your personal information.  When making a request, please provide an accurate description of the personal information to which you want access. Where requests are repetitive or manifestly unfounded or excessive, we may charge a reasonable fee based on administrative cost.

6.3.3. Your Asking Us to Rectify Your Personal Information.

You have the right to ask us to rectify information you think is inaccurate.  You also have the right to ask us to complete information you think is incomplete.

6.3.4. Asking Us to Delete Your Personal Information.

You have the right to ask us to erase your personal information if: 

• We no longer need it for the purposes for which we collected it; 
• We have been using it with no valid legal basis; 
• We are obligated to erase it to comply with a legal obligation to which we are subject; 
• We need your consent to use the information and you withdraw consent; or 
• You object to us processing your personal information where our legal basis for doing so is our legitimate interests and there are no overriding legitimate grounds for the processing. 

However, this right is not absolute.  Even if you make a request for deletion, we may need to retain certain information for legal or administrative purposes, such as record keeping, maintenance of opt-out requirements, defending or making legal claims, or detecting fraudulent activities.  We will retain information in accordance with the “Data Retention” section below.

If you do exercise a valid right to have your personal information deleted, please keep in mind that deletion by third parties to whom the information has been provided might not be immediate and that the deleted information may persist in backup copies for a reasonable period (but will not be available to others).

6.3.5. Asking Us to Restrict Our Use of Your Personal Information.

You have the right to ask us to place a restriction on our use of your personal information if one of the following applies to you: 

• You contest the accuracy of the information that we hold about you, while we verify its accuracy;
• We have used your information unlawfully, but you request us to restrict its use instead of erasing it;
• We no longer need the information for the purpose for which we collected it, but you need it to deal with a legal claim; or

You have objected to us using your information, while we check whether our legitimate grounds override your right to object.

6.3.6. The Right to Transfer Your Personal Information to Another Service Provider.

You have the right to ask that we transfer the personal information you gave us from one organization to another, or give it to you (i.e., data portability). This applies to personal information we are processing to service a contract with you and to personal information we are processing based on your consent.

6.3.7. Your The Right to Withdraw Consent.

If we obtain your written consent to collect and process your personal information, you can subsequently withdraw such consent as to any further processing of such information.

6.3.8. The Right to Lodge a Complaint with a Supervisory Authority.

If you believe your rights under the GDPR have been violated, the GDPR gives you the right to file a complaint with your supervisory authority. A list of supervisory authorities is available here:  EEA and EU Data Protection Authorities (DPAs); Swiss Federal Data Protection and Information Commissioner (FDPIC); UK Information Commissioner’s Office (ICO).

6.3.9. Rights Related to Automated Decision-Making.

To the extent that we engage in decision-making based solely on automated processing, including profiling, which produces legal effects concerning you or which significantly affects you, you have the right not to be subject to such decision-making.

6.3.10. Right to Object to Processing.

You have the right to object to the processing of your personal information that is based on legitimate interests or your consent (rather than when the reason for using it is to perform an obligation due to you under a contract with us).  If you make such an objection, we will cease to process the personal information unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or we can demonstrate the processing is for the establishment, exercise, or defense of legal claims.  You can object to the processing of your personal information by contacting us using the information in the “Contact Information” section below.  

6.3.11. Legal Basis for Processing Your Personal Information.

We collect your personal information to provide our products and services to you; otherwise, we may not be able to process the transactions you request.  We will only process your personal information when we have a lawful basis for doing so.  If you are in a country in the EU, EEA, UK, or Switzerland, you are entitled to an explanation of the legal basis we rely on to process your personal information.  The legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it, which is discussed below. 

• Consent.  We may process your personal information based on your consent such as when you purchase a service or ask us to send you certain kinds of marketing communications.  You have the right to withdraw your consent at any time without affecting the lawfulness of the processing based on consent before its withdrawal.  

• Children’s Consent. We do not knowingly process data of EU, EEA, UK, or Switzerland residents under the age of 16 without reasonably verified parental consent. 

• Our Legitimate Interests.  We may process your personal information if doing so is necessary for our legitimate interests relating to our business purposes arising from your relationship with us, and your rights as an individual do not override those legitimate interests.  For example, our legitimate interests include but are not limited to when we process your personal information to carry out fraud prevention activities and activities to increase network and information security, identify usage trends, determine the effectiveness of promotional campaigns, expand our business activities and improve our services and the content and functionality of our services.  Our legitimate interests also include providing you with the products and services you request, view, engage with, or purchase; and communicating with you regarding your account or transactions with us.

• To Perform a Contract.  We may process your personal information to administer and fulfill contractual obligations to you.  We will also collect and process your personal information as necessary for the performance of a contract to which you are a party.

• To Enable Us to Comply With a Legal Obligation.  We may process your personal information to comply with legal obligations to which we are subject.  This may include any requirement to produce audited accounts, any legal obligation to share information with law enforcement agencies, public or governmental authorities, and to comply with legal process.

• Necessary for the Exercise or Defense of Legal Claims.  If you bring a claim against us or we bring a claim against you, we may process your personal information in relation to that claim.

Depending on the situation, we may be the controller or the processor for personal information collected from residents of the EU, EEA, UK or Switzerland.  If you have any questions about or need further information concerning the legal basis on which we collect and use your personal information for any specific processing activity, please contact us using the “Contact Information” section below.

6.4. New Zealand Users’ Rights.

This section of our Privacy Policy is applicable to persons located in New Zealand.  If you are a New Zealand resident, you may have certain rights to access the PI we hold about you, to correct personal information we hold about you (if applicable), and to request deletion of the PI we hold about you (if applicable).  To exercise those rights, or if you have any questions about this Policy please reach out using the information in the “Contact Information” section below.  Additionally, PI about you that you provide while in New Zealand may be transferred to the United States. 

More information about privacy law and privacy principles is available from the Office of the Privacy Commissioner and from their website.

6.5 Mexico Users’ Rights.

This section of our Privacy Policy is applicable to persons located in Mexico.  When creating a Lili Account we will collect certain information that may be considered Sensitive Information as defined under Mexico law. This information includes signature and financial or asset-related information. We will not collect or process this information without your prior written consent.

In addition, if you are a Mexico resident, you may have certain rights to access the PI we hold about you, to correct personal information we hold about you (if applicable), and to request deletion of the PI we hold about you (if applicable).  To exercise those rights, or if you have any questions about this Policy please reach out using the information in the “Contact Information” section below.  Additionally, PI about you that you provide while in Mexico may be transferred to the United States.

More information about privacy law and privacy practices is available from the Federal Institute for Access to Information and Data Protection and from their website.

6.6 India Users’ Rights.

This section of our Privacy Policy is applicable to persons located in India. If you are a resident of India, you may have certain rights under India’s Digital Personal Data Protection Act (“DPDPA“) which may include a right to access the PI we hold about you, to request information regarding the parties with whom your information has been shared, to correct personal information we hold about you, and to request deletion of the PI we hold about you.  To exercise those rights, or if you have any questions about this Policy please reach out using the information in the “Contact Information” section below.  Additionally, PI about you that you provide while in India may be transferred to the United States.

More information about privacy law and privacy practices is available from the Ministry of Electronics and Information Technology and from their website.

6.7 China Users’ Rights.

This section of our Privacy Policy is applicable to persons located in China. If you are a resident of China, you may have certain rights and protections under China’s Personal Information Protection Law (“PIPL“), Data Security Law (“DSL“), and Cybersecurity Law (“CSL“). When creating a Lili Account, we will collect certain information that may be considered Sensitive Information as defined under Chinese law. This information includes information related to financial accounts, governmental identification information, and biometric information necessary to verify your identity, prevent fraud, and protect your Lili Account. We will not collect or process this information without your prior written consent.These rights may include a right to access the PI we hold about you, to correct personal information we hold about you (if applicable), and to request deletion of the PI we hold about you (if applicable).  To exercise those rights, or if you have any questions about this Policy please reach out using the information in the “Contact Information” section below. Additionally, PI about you that you provide while in China may be transferred to the United States.

7. Where Your Personal Information Is Held.

We process personal information on our servers in the United States of America, and may do so in other countries.  If you use our services or otherwise provide us with information from outside of the United States, you expressly consent to the transfer of your data to the United States, the processing of your data in the United States, and the storage of your data in the United States. 

We may transfer your information outside of your jurisdiction for processing. While your personal information is held outside of your jurisdiction, it may be accessed by the courts, law enforcement, and national security authorities of the processing jurisdiction.

8. Update Your Information or Pose a Question.

If you have any questions or concerns about this Policy or the use of your information, or to modify or update any information we have received, please contact us at [email protected]. 

8.1. Modifying Your Information.

If you are a registered user of the Lili Service, you may modify your account settings and information through the Settings portal within the Lili Service.

8.2. Terminating Your Lili Account.

If you wish to terminate your account, we will be sad to see you go, but you can contact customer support at the email address below to do so. When you terminate your Lili Account, or if we terminate it, you will no longer be able to view your Lili Account or profile information, but we may continue to have access to your information for a period of time in order to comply with applicable legal or service obligations. We suggest that you download all your monthly statements before contacting customer support to close your Lili Account.

8.3. Data Retention.

We will retain your Lili Account and associated information for as long as your account is active or as needed to provide you the Lili Service. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

9. Changes to Our Policy and Practices.

We may update this Policy to reflect changes to our information practices. If we make any change in how we use PI, we will notify you by means of a notice on the Lili Service prior to the change becoming effective. We encourage you to periodically review this page for the latest information on our privacy practices.

10. Biometric Information.

Through our vendor or directly, we collect certain biometric data from individuals for the purpose of verifying their identity. We recognize the sensitivity of Biometric Data (defined below) and take seriously our obligation to maintain the confidentiality and protect security of such data. To promote these efforts, we have adopted the following biometric information privacy policy.

10.1. Definitions.

“Biometric Data” means any biological characteristics of a person, or information based upon such a characteristic, including characteristics such as those defined as “Biometric Identifiers” and “Biometric Information” under laws regulating the processing of biometric identifiers or information.

“Biometric Identifier” means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, or any additional characteristics defined as such under laws regulating the processing of biometric identifiers or information.

“Biometric Information” means any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual, or any additional characteristic or measurement defined as such under laws regulating the processing of biometric identifiers or information.

10.2. Purpose for Collection of Biometric Data.

We (or our service provider) use facial recognition software to compare an individual’s driver’s license photograph against that individual’s self-taken picture to verify the identity of the individual.

10.3. Disclosure and Authorization.

We will not disclose or disseminate any Biometric Data to anyone other than our service providers (who would be acting on our behalf and subject to contractual obligations) without/unless:

• First obtaining your written consent to such disclosure or dissemination;
• The disclosed Biometric Data completes a financial transaction requested or authorized by you;
• Disclosure is required by state or federal law or municipal ordinance;
• or Disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction

10.4. Security of Biometric Data.

We will use a reasonable standard of care to store, transmit and protect from disclosure any paper or electronic Biometric Data collected.

10.5. Retention Schedule.

We will retain Biometric Data only until, and shall request that any service providers that may have access to the Biometric Data destroy such data when, the first of the following occurs:

• The initial purpose for collecting or obtaining such Biometric Data has been satisfied, such as the identity of the individual has been verified; or
• Within 3 years of your last interaction with us.
• If legal obligations require us to retain Biometric Data for longer than the above, we will destroy such data not later than the first anniversary of the date the data is no longer required to be maintained by law.

11. Children’s Privacy.

The Lili Service is not intended for businesses only. It is not intended for individuals (except sole proprietorships). In connection with verifying the identity of businesses, we do collect information on the sole proprietor or on the control person and other ultimate beneficial owners of legal entity customers. The Lili Service is not intended for children under 18 years of age, and we do not knowingly collect personal information from children under 18. In the event that we learn that we have collected personal information from a child under age 18 without verification or parental consent, we will immediately delete that information. If you believe that we might have any information from or about a child under 18, please contact us at the email address provided below.

12. Contact Information.

If you have any questions about this Privacy Policy, please contact us at [email protected].