Lili Online Privacy Policy

Effective Date: April 29, 2025

Protecting the privacy of your personal information (“PI”) is important to Lili App, Inc. and our employees (collectively, “Lili”, “we”, “us” and “our” as appropriate). This Privacy Policy (“Policy”) explains how we may collect, use and disclose information we obtain through the Lili website or the Lili App (collectively, “Lili Service”).The words “you” and “your” mean each individual who accesses the Lili Service.

PI means any data that classifies as personal information, personal data, personally identifiable information, or similar terms under applicable data privacy and security laws and regulations. This includes any “personally identifiable financial information” that a financial institution collects about an individual in connection with providing a financial product or service, unless that information is otherwise “publicly available.” It does not include data excluded or exempted from those laws and regulations, such as aggregated, anonymized, or deidentified data.

Subject to the provisions of the applicable law, by using the Lili Service and applying for a Lili Account, you consent to this Policy and accept its terms. To the extent that a separate or specific consent is required by applicable law for the processing of PI, Lili will obtain such consent as required.

1.     How We Collect Your PI.

We collect information, including PI when you:

• Apply for a Lili business deposit account (“Lili Account”);
• Register to use the Lili Service;
• Process transactions through your Lili Account;
• Use one or all of Lili’s services;
• Interact with us by sharing information on a blog or a social media platform that we manage;
• Request Lili Account access for others; and     
• Communicate with us.

We may also collect PI from the following sources:

• Information we receive about your transactions from our service providers;
• Information we receive about your transactions with nonaffiliated third parties;
• Information we receive from any devices that interface with us;
• Information you give us access to, such as other financial services accounts; and
• Information we receive about you from vendors, third party service providers, or consumer reporting agencies, such as credit bureaus.

1.1.  Our Security Procedures.

We take all necessary steps to safeguard PI. We restrict access to PI and account information to those employees who need to know that information to provide products or services to you. We maintain physical, electronic, and procedural safeguards that comply with federal and applicable international standards to guard PI.

1.2.  Creating a Lili Account.

You must register to use the Lili Service. When you choose to create a Lili Account, we are required to collect information including your name, address, date of birth, and social security number if you are a sole proprietor, or the same information for ultimate beneficial owners of legal entities. To further verify identity and prevent fraud, we collect additional information about you, such as biometric information, device information, IP address, email address and phone number, as well as information about your business. You may decline to provide this information, however, doing so may prevent you from engaging with and using the Lili Service.

1.3.   Using the Lili Service.

We collect information from you as you use the Lili Service; when you initiate a transaction, when you send payments or otherwise engage with or use the Lili Service. Lili may offer additional financial and non-financial products and services via the Lili Service which are governed by this Privacy Policy.

1.4.  Customer Support.

We may collect information, including PI from you through your communications with our customer support or other team members.

1.5.  Mobile Device Information.

We collect information about the computer, tablet, or mobile device you use to access the Lili Service which may include the hardware model, operating system and version, unique device identifiers and mobile network information. We may also collect other device identification information for the purposes of detecting and preventing fraud.

1.6.  Location Data.

If you have ‘background location’ turned on, the Lili App will, from time to time, tell us about your mobile device’s location even if you are not directly interacting with the application.

When we have location information, we use it to tailor the Lili Service for you and others, like helping reduce debit card fraud by matching your card activity with your location.

1.7.   Cookies, Automatic Data Collection, and Related Technologies.

When you visit the Lili website, we and third parties that provide certain functionality on the Lili Service may engage, receive and record information from your use of the Lili Service and server logs from your browser, including your IP address, cookies, and similar technology. This information is used for security purposes to authenticate your identity and improve the quality of our services, such as storing your account preferences.

Cookies are commonly used on websites and do not harm your system. By configuring your preferences or options in your browser, you determine if and how a cookie will be accepted. Most browsers allow you to block and delete cookies however by blocking cookies on our site it may impact the services we can provide you.

2.     How We Use Your PI.

We use the information we collect, including PI to:

• Facilitate and improve the Lili Service;
• Communicate with you;
• Provide and deliver the products and services you request, process transactions and send you related information, including confirmations;
• Verify your identity and prevent money laundering, fraud, and other wrongful conduct;
• For Lili and our bank partners to offer other products and services available on the Lili App that you may qualify for or might be interested in; and
• Monitor and analyze trends, usage, and activities in connection with the Lili Service

2.1.   Internal and Service-Related Usage.

We use information, including PI, for internal and service-related purposes and may provide it to third parties to allow us to facilitate the Lili Service. We may use and retain any data we collect to provide and improve our services.

We share information, including PI, with service providers who may share it with a credit bureau or credit reference agency as a credit reference or fraud prevention measure for the purposes of verifying identity, assessing the risk of giving credit, preventing fraud, and tracing debtors. For more information, please see the Credit Reference Agency Information Notice (“CRAIN”) notice located here. 

2.2.  Communications.

We may send emails or text messages to the email address and phone number you provide to us to verify your account and for informational and operational purposes, such as account management, customer service, or system maintenance. We may store your email address and phone number, your message and our response for quality assurance. We may also do this to meet legal and regulatory requirements.

2.3.   Marketing.

We do not rent, sell, or share PI about you with other individuals or non-affiliated companies for their direct marketing purposes, unless we have your permission. We also do not provide any PI to any third-party advertising networks. We may use your PI and other information to communicate with you by email to provide you with information and services we think may be of interest to you.

2.4.  Aggregate Data.

We may cleanse and aggregate data collected through the Lili Service and use it for any purpose. Information that has been aggregated or deidentified under applicable laws is not PI.

We may share your information, including aggregated or deidentified PI, with our third-party service providers, vendors and other partners:

• To comply with legal obligations;
• To protect and defend our rights and property;
• To assist others in preventing and detecting fraud or other criminal conduct; and
• With your permission.

3.     How We May Disclose Your Information.

We are permitted under law to disclose PI about you to other third parties in certain circumstances. For example, we may disclose PI about you to third parties, such as service providers and vendors, to assist us in servicing your account with us and to prevent wrongful conduct. We do not disclose any PI about you to anyone, except as permitted by law.

If you decide to close your account(s) or become an inactive customer, we will continue to adhere to the privacy policies and practices described in this notice.

3.1.   Vendors and Service Providers.

We may share any information we receive with vendors and service providers retained in connection with the provision of the Lili Service. Our vendors and service providers may compare your identifiers (such as email address, IP address, and phone number) and PI with consortia information to assist us in preventing fraud, money laundering and other wrongful conduct. Conversely, this information may be used by the consortia to prevent fraud, money laundering and other wrongful conduct at other financial institutions.

3.2.  As Required By Law and Similar Disclosures.

We may disclose your PI, other account information, and content if we believe doing so is required or appropriate to: comply with law enforcement requests and legal process, such as a court order, levy, garnishment, or subpoena; respond to your requests; or protect yours, ours or others’ rights, property, or safety.

3.3.   Merger, Sale, or Other Asset Transfers.

If we are involved in a merger, acquisition, reorganization, sale of company assets, or transition of service to another provider, your information may be sold or transferred as part of such a transaction as permitted by law and/or contract. We cannot control how such entities may use or disclose such information.

4.     Security of Your Information.

We take steps to ensure that your information is treated securely and in accordance with this Policy. Unfortunately, the Internet cannot be guaranteed to be 100% secure, and we cannot ensure or warrant the security of any information you provide to us. We do not accept liability for unintentional disclosure.

By using the Lili Service or providing PI to us, you agree that we may communicate with you electronically regarding security, privacy, and administrative issues relating to your use of the Lili Service. If we learn of a security system breach, we may attempt to notify you electronically by posting a notice on the Lili Service or sending an email to you. You may have a legal right to receive this notice in writing. To receive free written notice of a security breach (or to withdraw your consent from receiving electronic notice), please notify us at [email protected].

5.     Links to Third Party Services.

The Lili Service may allow you to access third party services to provide information about you, including PI, to the Lili Service. This Policy applies only to the information collected by the Lili Service. When logging into a third party service or following a link to third party websites from the Lili Service, please be aware that the privacy practices of those services may differ. We encourage you to carefully read the privacy policy for each website you visit. We are not responsible for the privacy policies or practices of linked third party sites or services.

6.     International Users.

This section of our Privacy Policy is applicable to persons located outside of the United States, including residents in Argentina, Australia, Brazil, Canada, China, Colombia, the European Union, India, Israel, Mexico, New Zealand, Peru, Switzerland, the United Kingdom, and Uruguay, as well as to persons whose PI is processed in or transferred from such countries.

If you are visiting from outside the United States, please note that you are agreeing to the transfer of your information to the United States and processing globally. By providing your information you consent to any transfer and processing in accordance with this Policy. 

6.1. Your Rights.

You are entitled by law to access, correct, amend, or delete PI about you that we hold. A summary listing these rights appears below. Please note that these rights are not absolute and certain exemptions may apply to specific requests that you may submit to us.

To exercise these rights, please contact us using the information below in the “Contact Information” Sections 12, 13, and 14, as applicable section. For your protection, we may need to verify your identity before responding to your request. In the event that we refuse a request, we will provide you a reason as to why.

6.1.1. Asking Us to Access Your PI.

You have the right to obtain from us confirmation as to whether or not we are processing PI about you, and if so, the right to be provided with the information contained in this Policy. You also have the right to ask us for copies of your PI. When making a request, please provide an accurate description of the PI to which you want access. Where requests are repetitive or manifestly unfounded or excessive, we may charge a reasonable fee based on administrative cost.

6.1.2. Asking Us to Rectify Your PI.

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

6.1.3. Asking Us to Delete Your PI.

You have the right to ask us to erase your PI if: 

• We no longer need it for the purposes for which we collected it; 

• We have been using it with no valid legal basis; 

• We are obligated to erase it to comply with a legal obligation to which we are subject; 

• We need your consent to use the information and you withdraw consent; or 

• You object to us processing your PI where our legal basis for doing so is our legitimate interests and there are no overriding legitimate grounds for the processing.

However, this right is not absolute. Even if you make a request for deletion, we may need to retain certain information for legal or administrative purposes, such as record keeping, maintenance of opt-out requirements, defending or making legal claims, or detecting fraudulent activities. We will retain information in accordance with the “Data Retention” section below.

If you do exercise a valid right to have your PI deleted, please keep in mind that deletion by third parties to whom the information has been provided might not be immediate and that the deleted information may persist in backup copies for a reasonable period (but will not be available to others).

6.1.4. Asking Us to Restrict Our Use of Your PI.

You have the right to ask us to place a restriction on our use of your PI if one of the following applies to you: 

• You contest the accuracy of the information that we hold about you, while we verify its accuracy;

• We have used your information unlawfully, but you request us to restrict its use instead of erasing it;

• We no longer need the information for the purpose for which we collected it, but you need it to deal with a legal claim; or

• You have objected to us using your information, while we check whether our legitimate grounds override your right to object.

6.1.5. The Right to Transfer Your PI to Another Service Provider.

You have the right to ask that we transfer the PI you gave us from one organization to another, or give it to you (i.e., data portability). This applies to PI we are processing to service a contract with you and to PI we are processing based on your consent.

6.1.6. The Right to Withdraw Consent.  

If we obtain your written consent to collect and process your PI, you can subsequently withdraw such consent as to any further processing of such information.

6.1.7. The Right to Lodge a Complaint with a Supervisory Authority.  

If you believe your rights have been violated, applicable law may give you the right to file a complaint with your supervisory authority. A list of relevant supervisory authorities is available below: 

6.1.8. Rights Related to Automated Decision-Making.  

To the extent that we engage in decision-making based solely on automated processing, including profiling, which produces legal effects concerning you or which significantly affects you, you have the right not to be subject to such decision-making.

6.1.9 Right to Object to Processing.

You have the right to object to the processing of your PI that is based on legitimate interests or your consent (rather than when the reason for using it is to perform an obligation due to you under a contract with us). If you make such an objection, we will cease to process the PI unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or we can demonstrate the processing is for the establishment, exercise, or defense of legal claims. You can object to the processing of your PI by contacting us using the information in the “Contact Information” section below.  

6.2 Legal Basis for Processing Your PI. 

We collect your PI to provide our products and services to you; otherwise, we may not be able to process the transactions you request. We will only process your PI when we have a lawful basis for doing so. Depending on where you live, you may be entitled to an explanation of the legal basis we rely on to process your PI. The legal basis for collecting and using the PI described above will depend on the PI concerned and the specific context in which we collect it, which is discussed below.

• Consent. We may process your PI based on your consent such as when you purchase a service or ask us to send you certain kinds of marketing communications. You have the right to withdraw your consent at any time without affecting the lawfulness of the processing based on consent before its withdrawal.  

• Children’s Consent. We do not knowingly process data of anyone under the age of 18; and specifically for EU, EEA, UK, or Switzerland residents, we do not knowingly process data of anyone under the age of 16 without reasonably verified parental consent. 

• Our Legitimate Interests. We may process your PI if doing so is necessary for our legitimate interests relating to our business purposes arising from your relationship with us, and your rights as an individual do not override those legitimate interests. For example, our legitimate interests include but are not limited to when we process your PI to carry out fraud prevention activities and activities to increase network and information security, identify usage trends, determine the effectiveness of promotional campaigns, expand our business activities and improve our services and the content and functionality of our services. Our legitimate interests also include: providing you with the products and services you request, view, engage with, or purchase; and communicating with you regarding your account or transactions with us.

• To Perform a Contract. We may process your PI to administer and fulfill contractual obligations to you. We will also collect and process your PI as necessary for the performance of a contract to which you are a party.

• To Enable Us to Comply With a Legal Obligation. We may process your PI to comply with legal obligations to which we are subject. This may include any requirement to produce audited accounts, any legal obligation to share information with law enforcement agencies, public or governmental authorities, and to comply with legal process.

• Necessary for the Exercise or Defense of Legal Claims. If you bring a claim against us or we bring a claim against you, we may process your PI in relation to that claim.

Depending on the situation, we may be the controller or the processor for PI collected from you. If you have any questions about or need further information concerning the legal basis on which we collect and use your PI for any specific processing activity, please contact us using the “Contact Information” section below.

7. Where Your PI Is Held.

We process PI on our servers in the United States of America, and may do so in other countries. If you use our services or otherwise provide us with information from outside of the United States, you expressly consent to the transfer of your data to the United States, the processing of your data in the United States, and the storage of your data in the United States. 

We may transfer your information outside of your jurisdiction for processing. While your PI is held outside of your jurisdiction, it may be accessed by the courts, law enforcement, and national security authorities of the processing jurisdiction.

8. Update Your PI or Pose a Question.

If you have any questions or concerns about this Policy or the use of your information, or to modify or update any information we have received, please contact us at [email protected]. 

 8.1. Modifying Your PI.

If you are a registered user of the Lili Service, you may modify your account settings and information through the Settings portal within the Lili Service.

 8.2. Terminating Your Lili Account.

If you wish to terminate your account, we will be sad to see you go, but you can contact customer support at the email address below to do so. When you terminate your Lili Account, or if we terminate it, you will no longer be able to view your Lili Account or profile information, but we may continue to have access to your information for a period of time in order to comply with applicable legal or service obligations. We suggest that you download all your monthly statements before contacting customer support to close your Lili Account.

 8.3. Data Retention.

We will retain your Lili Account and associated information for as long as your account is active or as needed to provide you the Lili Service. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

9. Changes to Our Policy and Practices.

We may update this Policy to reflect changes to our information practices. If we make any change in how we use PI, we will notify you by means of a notice on the Lili Service prior to the change becoming effective. We encourage you to periodically review this page for the latest information on our privacy practices. By continuing to use the Lili Service, you agree to any changes made to this Policy.

10. Biometric Information.

Through our vendor or directly, we collect certain biometric data from individuals for the purpose of verifying their identity. We recognize the sensitivity of Biometric Data (defined below) and take seriously our obligation to maintain the confidentiality and protect security of such data. To promote these efforts, we have adopted the following biometric information privacy policy.

10.1. Definitions.

“Biometric Data” means any biological characteristics of a person, or information based upon such a characteristic, including characteristics such as those defined as “Biometric Identifiers” and “Biometric Information” under laws regulating the processing of biometric identifiers or information.

“Biometric Identifier” means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, or any additional characteristics defined as such under laws regulating the processing of biometric identifiers or information.

“Biometric Information” means any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual, or any additional characteristic or measurement defined as such under laws regulating the processing of biometric identifiers or information.

 10.2. Purpose for Collection of Biometric Data.

We (or our service provider) use facial recognition software to compare an individual’s driver’s license photograph against that individual’s self-taken picture to verify the identity of the individual.

 10.3. Disclosure and Authorization.

We will not disclose or disseminate any Biometric Data to anyone other than our service providers (who would be acting on our behalf and subject to contractual obligations) without/unless:

• First obtaining your written consent to such disclosure or dissemination;
• The disclosed Biometric Data completes a financial transaction requested or authorized by you;
• Disclosure is required by state or federal law or municipal ordinance;
• or Disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction

 10.4. Security of Biometric Data.

We will use a reasonable standard of care to store, transmit and protect from disclosure any paper or electronic Biometric Data collected.

10.5. Retention Schedule.

We will retain Biometric Data only until, and shall request that any service providers that may have access to the Biometric Data destroy such data when, the first of the following occurs:

• The initial purpose for collecting or obtaining such Biometric Data has been satisfied, such as the identity of the individual has been verified; or
• Within 3 years of your last interaction with us.
• If legal obligations require us to retain Biometric Data for longer than the above, we will destroy such data not later than the first anniversary of the date the data is no longer required to be maintained by law.

11. Children’s Privacy.

The Lili Service is not intended for businesses only. It is not intended for individuals (except sole proprietorships). In connection with verifying the identity of businesses, we do collect information on the sole proprietor or on the control person and other ultimate beneficial owners of legal entity customers. The Lili Service is not intended for children under 18 years of age, and we do not knowingly collect PI from children under 18. In the event that we learn that we have collected PI from a child under age 18 without verification or parental consent, we will immediately delete that information. If you believe that we might have any information from or about a child under 18, please contact us at the email address provided below.

12. Contact Information.

If you have any questions about this Privacy Policy, please contact us at [email protected].

13. European Contact Information.

VeraSafe has been appointed as Lili’s representative in the European Union for data protection matters, pursuant to Article 27 of the General Data Protection Regulation of the European Union. If you are in the European Economic Area, VeraSafe can be contacted (in addition to our support team as indicated in Section 12 above) only on matters related to the processing of personal data. To make such an inquiry, please contact VeraSafe using this contact form: 

https://verasafe.com/public-resources/contact- data-protection-representative or via telephone at:

+420 228 881 031.

Alternatively, VeraSafe can be contacted at:

VeraSafe Ireland Ltd.

Unit 3D North Point House

North Point Business Park

New Mallow Road

Cork T23AT2P

Ireland

14. UK Contact Information.

VeraSafe also has been appointed as Lili’s representative in the United Kingdom for data protection matters, pursuant to Article 27 of the United Kingdom General Data Protection Regulation. If you are located within the United Kingdom, VeraSafe can be contacted (in addition to or instead of our support team) only on matters related to the processing of personal data. To make such an inquiry, please contact VeraSafe using this contact form:

https://verasafe.com/public-resources/contact-data-protection-representative or

via telephone at: +44 (20) 4532 2003.

Alternatively, VeraSafe can be contacted at:

VeraSafe United Kingdom Ltd.

37 Albert Embankment

London SE1 7TL

United Kingdom