Privacy Policy

1. INFORMATION WE COLLECT

Personal Data We Collect

We collect Personal Data from you through your use of the Site and Services. “Personal Data” or “Personal Information” is any information linked or linkable to an identified or identifiable natural person or household, or as otherwise defined by privacy laws applicable to us with respect to your data. Data that is not Personal Data under applicable law is not subject to any restrictions on our collection, use, processing, retention or disclosure under this Privacy Policy or otherwise. In addition, depending on the applicable law, Personal Data once de-identified (i.e., the removal or modification of the personally identifiable elements, or the extraction of non-personally identifiable elements or the procedure by which Personal Data cannot be associated with an individual or allow, due to its structure, content or degree of disaggregation, an individual's identification) also may not be considered Personal Data and may be used and disclosed without obligation to you, except as prohibited by applicable law. To the extent that any non-Personal Information is combined by or on behalf of us with Personal Data, we will treat such combined data as Personal Data under this Privacy Policy.

We collect the following types of Personal Data:

Information You Provide

We may collect the following Personal Data that you voluntarily provide to us in using our Site and Services:

• Contact Us. When you choose to contact us through our online form or when you call customer support. For example, we collect your first and last name, email address, phone number, state of residence, and any Personal Data that you choose to submit in the free text fields.
• Pre-Qualification. When you apply to be pre-qualified for a financial service with us, we collect your first and last name, middle initial, suffix, home address, email address, telephone number, social security number, and date of birth.
• Applying for a Line of Credit. When you complete a full credit application, in addition to the information you provided to pre-qualify, we collect your bank account information, employment information, and information about your assets, debts, and income. We may also collect a copy of your valid U.S. Government-issued or State-issued photo ID, such as a driver’s license. We may additionally collect documentation to verify your income and/or bank account, such as a pay stub, personal bank statement, or voided check. We may provide you with the option (and in some cases require you) to connect your bank account(s) using a third-party processor. You may choose to utilize our third-party processor to verify your bank and income information. For more information, please see the “Third Party Processors” section below.
• Online Account Access. To create and sign into an online Elastic account, we collect your username and password. Certain types of payments completed through your online account may be processed by our third-party payment processor. For more information, please see the “Third Party Processors” section below.

Information as You Navigate Our Site

We automatically collect certain Personal Data through your use of the Site and Services, such as the following:

• Usage Information.  For example, pages on the Site you access, the frequency and times of access, what you click or view on while on the Site, crashes and other system activity, type of browser, and third-party sites or service you were using before interacting with our Services. In some cases, we collect this information through cookies, pixel tags, SDKs, and similar technologies that create and maintain unique identifiers. To learn more about these technologies, please see the “Cookies and Other Tracking Technologies” section below.
• Device Information. For example, hardware model, device IP address, unique device identifiers, operating system, application version number, software, file names and versions, preferred languages, advertising identifiers, serial numbers, device motion information, and mobile network information, and browser.
• Mobile Device Information. Aggregated information about whether the Site is accessed via a mobile device or tablet, the device type, and the carrier.
• Location Information. Location information from Site visitors on a city-regional basis. Depending on your app settings or device permissions, we may collect your approximate location information as determined through data such as IP address and Wi-Fi.

Information Collected from Other Sources

We may obtain Personal Data from other sources, such as lead generators and information about your credit profile or other information from credit reporting agencies (including but not limited to, Experian, TransUnion, Experian, Equifax, Lexis Nexis), as well as from non-credit reporting agency data providers and other vendors. We also use third-party providers to obtain contact information in order to market certain of our Services via email or on social media platforms.

We may combine the information collected from other sources with other information in our possession.

Third Party Information from You

In some cases, we may receive certain Personal Data from you about a third party. If you submit any Personal Data about another individual to us, you are responsible for making sure that you have the authority to do so and to allow us to use their Personal Data in accordance with this Privacy Policy.

2. HOW WE USE YOUR INFORMATION

We use the Personal Data we collect to provide the Services to you, to improve our Site and Services, and to protect our legal rights. In addition, we may use the Personal Data we collect to:

• Process your account activation and creation;
• Process transactions, such as your prequalification or line of credit application(s);
• Underwrite your prequalification application and/or line of credit;
• Verify your identity and prevent fraud;
• Contact you regarding surveys, product or customer experience reviews, and customer research sessions;
• Contact you regarding our products and services that we feel may be of interest to you;
• Communicate with you about our Site or Services or to inform you of any changes to our Site or Services;
• Communicate with you about your transactions;
• Communicate with you about your account and collect amounts you owe;
• Provide support;
• Maintain and improve our Site and Services;
• To train and improve our models or other third-party models we may use, and in limited circumstances, global models;
• To enhance the customer experience, including through personalization;
• To facilitate our marketing programs including offers, targeted advertisements, promotions or contests;
• For research, development, and analytical purposes;
• For customer support, such as responding to your questions and concerns (which may include use of transcripts or recordings collected from chats or customer service calls, third-party customer service vendors, and may employ artificial intelligence or other automated technology);
• To enhance the safety and security of our users, Site, and Services;
• Investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person or violations of any applicable terms governing our Site or Services, and to otherwise fulfill our legal obligations;
• Sell or otherwise transfer your account and/or our interest in contracts we have with you;
• Monitor compliance with and enforce this Privacy Policy and any applicable agreements and other policies;
• Fulfill any other purposes for which you provide it, or any other purpose we deem necessary or appropriate;
• Defend our legal rights and the rights of others;
• Efficiently maintain our business;
• Handle and respond to complaints or credit disputes;
• Comply with applicable law;
• As otherwise disclosed at collection; and
• For other purposes not inconsistent with this Privacy Policy or applicable law.

3. HOW WE DISCLOSE/TRANSFER YOUR INFORMATION

We may disclose/transfer the information that we collect about you in the following ways:

• With our parent company, subsidiaries and affiliates;
• With vendors who perform data or Site-related services on our behalf (e.g., email, hosting, maintenance, backup, analysis, etc.);
• With vendors who perform surveys, product or customer experience reviews, or customer research studies on our behalf;
• With vendors who service your account on our behalf;
• With vendors who provide customer support and/or communicate with you (such as via email, text message, phone call, mail, or other means) on our behalf about your account, our Site or Services, offers, promotions, or your eligibility for certain programs;
• For identity verification and fraud prevention;
• With credit bureaus/credit reporting agencies to obtain credit reports, provide credit reporting information, or respond to credit disputes;
• With third-party payment processors to process payments;
• To vendors to prepare, deploy and analyze advertising content, including for joint marketing with other companies;
• To non-affiliates for their marketing purposes;
• To the extent that we are required to do so by law;
• In connection with any legal proceedings or prospective legal proceedings;
• To establish, exercise, or defend our or a third party’s legal rights, including providing information to others for the purposes of fraud prevention;
• To help maintain the safety, security and integrity of our Site, Services, or users.
• With any person who we reasonably believe may apply to a court or other competent authority for disclosure of that Personal Data where, in our reasonable opinion, such court or authority would be reasonably likely to order disclosure of that Personal Data;
• With any other person or entity as part of any business or asset sale, equity transaction, merger, acquisition, other transaction, bankruptcy, liquidation, or similar proceeding, or in preparation for any of these events;
• With any other person or entity where you consent to the disclosure; and
• For any other purpose disclosed by us when you provide the Personal Data or for any other purpose we deem necessary, including to protect the health or safety of others.

We also use third-party processors, for example, to prevent fraud, for cloud storage services, to conduct surveys, and to provide other Services to you.

We may also de-identify, anonymize, or aggregate Personal Data to disclose to third parties for any purpose, as legally permitted.

The vendors or other third parties that we disclose/transfer Personal Data to may employ artificial intelligence or other automated technology to process such Personal Data.

4. INFORMATION RETENTION

Absent contractual obligations and/or legal retention requirements to the contrary, we may retain certain Personal Data, including transaction, location, usage and other Personal Data for approximately 10 years, or as otherwise allowed or required under the applicable law, in connection with regulatory, tax, insurance or other requirements and for other legitimate business purposes in the places in which we operate, or for as long as necessary to fulfill the purposes for which the Personal Data was collected. Depending on the applicable law, once such Personal Data is no longer necessary to provide our Services, enable customer support, enable identification and enhancements to the user experience, or other operational purposes, we take steps to prevent access to or use of such Personal Data for any purpose other than compliance with these requirements or for purposes of safety, security and fraud prevention and detection or as required by law. Depending on the applicable law, we subsequently securely delete, de-identify, or anonymize such Personal Data in accordance with applicable laws.

We may retain certain Personal Data if necessary for its legitimate business interests, such as fraud prevention and enhancing users' safety and security.

Note: Within the timeframes described above, we will retain your pre-qualification and credit application, and any information you provide (in or as part of your pre-qualification and/or credit application), whether or not you are pre-qualified or approved for a line of credit.

5. COOKIES AND OTHER TRACKING TECHNOLOGIES

How We Use Cookies and Tracking Technologies

Like many other companies, we use Cookies, web beacons, embedded scripts, location-identifying technologies, pixels, tags, session replay tools, software development kits (also called SDKs), and other identification or tracking technologies (collectively, “Tracking Technologies”) in connection with our Site and/or Services for purposes described in this Privacy Policy. “Cookies” are small files of information that are stored by your web browser software on your computer hard drive, mobile or other devices (e.g., smartphones or tablets).

We use Tracking Technologies to: 

• Authenticate users;
• Estimate audience size and usage patterns;
• Understand and save your preferences or settings for future visits, allowing us to customize the Site and Services to your individual needs;
• Determine the popularity of content;
• Advertise new content and services that relate to your interests;
• Deliver and measure the effectiveness of advertising campaigns;
• Keep track of advertisements and search engine results;
• Compile aggregate data about Site traffic and Site interactions to resolve issues and offer better Site experiences or Services in the future;
• Recognize when you return to the Site;
• Analyze Site traffic, interactions, and trends, and generally understand the online behaviors and interests of individuals who interact with our Site or Services.

We set some Tracking Technologies ourselves and others are set by other entities. We use Tracking Technologies set by other entities to provide us with useful information to help us improve our Site and Services, to conduct advertising, and to analyze the effectiveness of advertising. For example, we use Tracking Technologies from Google and other similar companies.

We may also allow others to provide audience measurement and analytics services for us, to serve advertisements on our behalf across the Internet, and to track and report on the performance of those advertisements. These entities may use Tracking Technologies to identify your device when you visit our Site and use our Services, as well as when you visit other online sites and services.

How You Can Opt-Out of Tracking Technologies

Browser Settings

Cookies can be blocked by changing your Internet browser settings to refuse all or some Cookies. If you choose to block all Cookies (including essential Cookies), you may not be able to access all or parts of the Site.

You can find out more about Cookies and how to manage them by visiting www.allaboutcookies.org.

Platform Controls

You can opt out of Tracking Technologies set by specific entities by following the instructions found at these links:

• Google: https://adssettings.google.com
• Facebook: https://www.facebook.com/about/ads
• Microsoft: https://account.microsoft.com/privacy/ad-settings

Advertising Industry Resources

You can understand which entities have currently enabled Tracking Technologies for your browser or mobile device and how to opt-out of some of those by accessing the Network Advertising Initiative’s website or the Digital Advertising Alliance’s website. For more information on mobile specific opt-out choices, visit the Network Advertising Initiative’s Mobile Choices website.

Please note that these opt-out mechanisms are specific to the device or browser on which they are exercised. Therefore, you will need to opt out on every browser and device that you use.

Google Analytics

We use Google Analytics, a web analytics service provided by Google, Inc. Google Analytics uses Tracking Technologies to help us analyze how users interact with the Site and Services, compile reports on their activity, and provide other services related to their activity and usage. The Tracking Technologies used by Google may collect information such as your IP address, time of visit, whether you are a returning visitor, and any referring website. The Tracking Technologies used by Google Analytics do not gather information that personally identifies you. The information generated by Google Analytics will be transmitted to and stored by Google and will be subject to Google’s privacy policies. To learn more about Google’s partner services and to learn how to opt-out of tracking of analytics by Google, click here.

Google reCAPTCHA

We use Google reCAPTCHA, a free service provided by Google, Inc., to protect our Site from spam and abuse. Google reCAPTCHA uses advanced risk analysis techniques to decipher humans and bots. Google reCAPTCHA works differently depending on what version is deployed. For example, you may be asked to check a box indicating that you are not a robot or Google reCAPTCHA may detect abusive traffic without user interaction. Google reCAPTCHA works by transmitting certain types of information to Google, such as the referrer URL, IP address, visitor behavior, operating system information, browser and length of the visit, Cookies, and mouse movements. Your use of Google reCAPTCHA is subject to Google’s Privacy Policy and Terms of Use. More information as to Google reCAPTCHA and how it works is available here.

Session Replay Technology

We use third-party session replay and user experience analytics tools to help us understand how users interact with our Site and to improve functionality and usability. These tools allow us to record user sessions on our Site and review user interactions such as clicks, scrolling, and navigation between pages. We use tools to analyze interactions on certain pages to improve our Services and user experience.

These technologies use cookies and similar tools to collect information about your device and browsing activity. This may include your IP address (which may be masked or truncated), browser type, device type, screen size, and general location information derived from your IP address.

We may use these tools in connection with certain features of our Site, including pre-qualification application and credit application-related pages. As part of this process, interactions with forms and page content may be included in session recordings. We take reasonable steps to limit the collection of sensitive information through these technologies, such as using masking and similar controls where appropriate.

The information collected is used for internal business purposes, including analyzing and improving the performance and usability of our Site and Services. This information is processed on our behalf by service providers that are contractually restricted from using it for purposes other than providing services to us.

6. THIRD PARTY PROCESSORS

To ensure that your Personal Data receives an adequate level of protection, we have put in place appropriate procedures with the third-party processors we share it with to ensure that it is treated consistent with applicable data security and privacy laws.

For example, we use a third-party payment processor to enable you to make certain types of payments online. We also use third-party processors, for example, to prevent fraud, for identify verification, for cloud storage services, to conduct surveys, to analyze data, and to provide other Services to you.

In addition, we use a third-party processor to enable us to connect with your bank accounts. When you connect your online checking account, all your accounts that are associated with your online login will be visible to us. You will be directing the third-party processor to provide information about your bank accounts to us, including past transactions, account balances, and account holder information, but we will never be able to see your login credentials. We will be able to access this information on a continuing basis until you change your bank login credentials.

When we share Personal Data with third-party processors, we contractually limit the processor’s ability to use the information.

7. UNIVERSAL OPT-OUT MECHANISMS

Our Site recognizes Global Privacy Control (“GPC”) signals. If you are using a browser setting or plug-in that sends an opt-out preference signal to each website you visit, we will treat that as a valid request to opt out of tracking for targeted advertising. To download and use a browser supporting the GPC browser signal, click here: https://globalprivacycontrol.org/orgs. If you choose to use the GPC signal, you will need to turn it on for each supported browser or browser extension you use.

Some internet browsers incorporate a “Do Not Track” feature that signals to websites you visit that you do not want to have your online activity tracked. Given that there is not a uniform way that browsers communicate the “Do Not Track” signal, our Site does not interpret, respond to, or alter its practices when it receives “Do Not Track” signals.

8. CHOICES ABOUT YOUR PERSONAL DATA

Review and Request Changes to Your Personal Data

Keeping your account information accurate and up to date is very important. You may update your account information online by signing in to your account at Elastic.com and selecting Account Settings.

To review or request changes to any of your Personal Data, you may also contact customer support at (888) 225-0080 or support@elastic.com.

Marketing Communications

To unsubscribe from our marketing emails, please click the unsubscribe link included in the footer of our emails. This will not affect subsequent subscriptions, and if your opt-out is limited to certain types of e-mails, the opt-out will be so limited. If you subscribe to text messages from us, you can terminate a particular text message subscription by reply texting “STOP.” Subsequent or different subscriptions will be unaffected. Please note that we reserve the right to send you certain communications relating to your account or use of our Site, such as administrative and service announcements and these transactional account messages may be unaffected if you choose to opt-out from receiving our marketing communications.

Mobile Application Permissions

Push Notifications

Upon download of the mobile application, you are provided the option to opt-in to receiving notifications that may include alerts, sounds, and icon badges. These push notifications or in-app messages consist of operational messages regarding your account(s) and payments, and may also include promotional messages. Push notifications can be configured in settings on your mobile device.

Biometric Login

Rather than entering your username and password, the mobile application supports biometric authentication on certain devices. To set up biometric authentication, go to settings on your mobile device. You can then enable or disable biometric authentication within the settings of the mobile application. We do not have access to your biometric data.

9. CALIFORNIA PRIVACY NOTICE

Submit a California Privacy Rights Request

This California Privacy Notice applies solely to visitors, users, and others who reside in the State of California. The California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”) gives California residents certain rights regarding their Personal Information — the Right to Know, the Right to Delete, the Right to Correct, the Right to Opt-Out of the Sale of Personal Information or the Sharing of Personal Information, the Right to Limit the Use of Sensitive Personal Information, and the Right to Non-Discrimination. This section describes your CCPA rights and explains how to exercise those rights, if applicable. Terms used in this Section 9: CALIFORNIA PRIVACY NOTICE have the same meaning as defined in the CCPA.

CERTAIN PERSONAL INFORMATION THAT WE COLLECT IS EXEMPT FROM THE CCPA, INCLUDING INFORMATION GOVERNED BY THE GRAMM-LEACH-BLILEY ACT ("GLBA") AND THE FAIR CREDIT REPORTING ACT ("FCRA"). AS A COURTESY, THIS CALIFORNIA PRIVACY NOTICE MAY DESCRIBE OUR PRIVACY PRACTICES WITH RESPECT TO BOTH CCPA-COVERED AND EXEMPT PERSONAL INFORMATION. HOWEVER, THE RIGHTS DESCRIBED IN THIS CALIFORNIA PRIVACY NOTICE APPLY ONLY TO PERSONAL INFORMATION THAT IS SUBJECT TO THE CCPA. BY PROVIDING THESE ADDITIONAL DISCLOSURES, WE DO NOT WAIVE OR LIMIT ANY RIGHTS OR EXEMPTIONS AVAILABLE UNDER APPLICABLE LAW.

Categories of Personal Information We Collect

We collect the following categories of Personal Information.

• “Sensitive Personal Information” such as social security numbers; driver’s license; state identification card; passport number; account log-in, financial account number in combination with any required security or access code, password, or credentials allowing access to an account; racial or ethnic origin, citizenship or immigration status; biometric data; health data;
• “Identifiers” such as real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers;
• “Other Personal Information” such as name; signature; social security number; physical characteristics or description; address; telephone number; passport number, driver’s license or state identification card number; education, employment, or employment history; bank account and routing number, or any other financial information; medical information. Some Personal Information included in this category may overlap with other categories;
• “Protected Characteristics” under California or federal law for classifications such as age (40 years or older); race; sex; marital status; medical condition; veteran or military status; national origin;
• “Commercial Information” products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies;
• “Internet or Network Activity” such as browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement;
• “Geolocation Data” such as physical location or movements;
• “Sensory Data” such as audio information, photographs included in government identification cards, and video recordings;
• “Professional or Employment Related Information” such as current or past job history;
• “Biometric Information” such as physiological or behavioral characteristics, including an individual’s voice recordings, from which an identifier template, such as a voiceprint, can be extracted, and keystroke or mouse patterns or rhythms that contain identifying information; and
• “Inferences” drawn from other Personal Information such as profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, and attitudes.

How We Use Personal Information

Please see Section 2: HOW WE USE YOUR INFORMATION above for more details.

How Long We Retain Information

Absent contractual requirements and/or legal requirements to the contrary, such as a legal hold, Personal Information is maintained for a specified period of time, as required by legal, regulatory, or industry requirements, as well as for business purposes. For example:

• Sensitive Personal Information - 10 years.
• Identifiers - 10 years.
• Other Personal Information - 10 years.
• Protected Characteristics - 10 years.
• Commercial Information - 10 years.
• Internet or Network Activity - 10 years.
• Geolocation Data - 10 years.
• Sensory Data - 3 years.
• Professional or Employment Related Information - 10 years.
• Biometric Information - 10 years.
• Inferences - 7 years.

How We Disclose Information

Consistent with the disclosures above in Section 3: HOW WE DISCLOSE/TRANSFER YOUR INFORMATION, we may disclose your Personal Information to a service provider, contractor, third party, or co-controller. When we disclose Personal Information to a service provider or contractor, we enter a contract that describes the purpose and requires the service provider to both keep that Personal Information confidential and not use it for any purpose except performing the contract or as otherwise permitted by law. For example:

• With our bank/lending relationships we disclose Sensitive Personal Information, Identifiers, Other Personal Information, Protected Characteristics, Commercial information, Internet or Network Activity, Geolocation Data, Sensory Data, Professional and Employment Related Information, Biometric Information, Inferences;
• With governmental and regulatory agencies we disclose Sensitive Personal Information, Identifiers, Other Personal Information, Protected Characteristics, Commercial information, Internet or Network Activity, Geolocation Data, Sensory Data, Professional and Employment Related Information, Biometric Information, Inferences;
• With credit reporting agencies, credit risk consortiums, and credit dispute vendors we disclose Sensitive Personal Information, Identifiers, Other Personal Information, Protected Characteristics, Professional and Employment Related Information, Inferences;
• With successor entities, we reserve the right to disclose or transfer your Personal Information to a successor entity in the event of a corporate merger, consolidation, sale of assets or other corporate changes respecting our business;
• Service providers and contractors:
  • With our document and data destruction vendors we disclose Sensitive Personal Information, Identifiers, Other Personal Information, Protected Characteristics, Commercial information, Internet or Network Activity, Geolocation Data, Sensory Data, Professional and Employment Related Information, Biometric Information, Inferences;
    • For example, we make these disclosures to comply with our data retention practices and policies;
  • With our account servicing and customer support vendors (including platform providers), fraud prevention vendors, identity verification vendors, and payment processors we disclose Sensitive Personal Information, Identifiers, Other Personal Information, Protected Characteristics, Commercial information, Internet or Network Activity, Geolocation Data, Sensory Data, Professional and Employment Related Information, Biometric Information, Inferences;
    • For example, we make these disclosures to open and service your account, process transactions, communicate with you, provide customer support, improve customer experience, verify identity, prevent fraud, develop and implement underwriting strategies, comply with our legal obligations, maintain and run our business, and handle consumer complaints;
  • With word processing, communication applications, and calendar providers we disclose Sensitive Personal Information, Identifiers, Other Personal Information, Protected Characteristics, Commercial Information, Internet or Network Activity, Geolocation Data, Sensory Data, Professional or Employment Related Information, Biometric Information, Inferences;
    • For example, we make these disclosures to open and service your account, process transactions, communicate with you, provide customer support, improve customer experience, verify identity, prevent fraud, comply with our legal obligations, maintain and run our business, and handle consumer complaints;
  • With marketing providers, surveys, product or customer experience reviews, and customer research vendors we disclose Identifiers, Other Personal Information, Protected Characteristics, Internet or Network Activity, Geolocation Data, Inferences;
    • For example, we make these disclosures to communicate with you, market and our products and services, for research / development / analytical purposes, and improve customer experience;
  • With our advisors such as lawyers, consultants, banks, and insurers we share Sensitive Personal Information, Identifiers, Other Personal Information, Protected Characteristics, Commercial information, Internet or Network Activity, Geolocation Data, Sensory Data, Professional and Employment Related Information, Biometric Information, Inferences; and
    • For example, we make these disclosures to comply with our legal obligations, maintain and run our business, handle consumer complaints, in connection with a transaction, and to defend our legal rights;
  • With our data analytics, network monitoring services, website hosts and content presentation vendors, accessibility and consent vendors, data and systems security vendors, technology providers, and incident response providers we disclose Sensitive Personal Information, Identifiers, Other Personal Information, Protected Characteristics, Commercial information, Internet or Network Activity, Geolocation Data, Sensory Data, Professional and Employment Related Information, Biometric Information, Inferences;
    • For example, we make these disclosures to open and service your account, process transactions, communicate with you, improve customer experience, verify identity, prevent fraud, comply with our legal obligations, maintain and run our business, handle consumer complaints, defend our legal rights, perform data or Site-related services, for research / development / analytical purposes, and to maintain and improve our Site and Services (including their safety, security, and integrity).

Your California Privacy Rights

Subject to the limitations and exemptions under the CCPA, California residents have the following rights regarding their Personal Information:

• Right to Know
• Right to Delete
• Right to Correct
• Right to Limit the Use of Sensitive Personal Information
• Right to Opt Out of the Sale or Sharing of Personal Information
• Right To Opt Out of Automated Decisionmaking Technology
• Right to Non-Discrimination

The below subsections (within this Section 9: CALIFORNIA PRIVACY NOTICE) describe these rights and explain how you may exercise them.

Right To Know

You have the right to request that we disclose certain information to you about our collection, use, and disclosure of your Personal Information (“Request to Know”). Once we receive and verify your Request to Know, we will disclose to you either:

1. The specific pieces of Personal Information we collected about you; or
2. Categories of Personal Information collected, disclosed, sold, and/or shared for any of the following for the period that is 12 months prior to the request date:
   • The categories of Personal Information we have collected about you.
   • The categories of sources from which we collected your Personal Information.
   • The business or commercial purposes for our collecting, selling, or sharing your Personal Information.
   • The categories of Personal Information disclosed to service providers and contractors and the corresponding business or commercial purpose.
   • The categories of Personal Information sold or shared about you and, for each, the categories of third party recipients, and the business or commercial purpose for selling or sharing; or alternatively, that no sale or share occurred.

Right To Delete

You have the right to request that we delete your Personal Information (“Request to Delete”). Once we receive and verify your Request to Delete, we will delete your Personal Information from our records, unless an exemption or exception applies.

Right To Correct

You have the right to request that we correct your inaccurate Personal Information (“Request to Correct”). Once we receive and verify your Request to Correct, we will use commercially reasonable efforts to correct your inaccurate Personal Information in our records.

Right To Limit the Use of Sensitive Personal Information

You have the right to limit the use of your Sensitive Personal Information to uses which are necessary to perform the services or provide the goods reasonably expected. However, we only use Sensitive Personal Information for purposes that are exempt from consumer choice under the CCPA.

Right To Opt Out of the Sale or Sharing of Personal Information

You have the right to opt-out of the “selling” or “sharing” of your Personal Information.

The CCPA defines “selling” as disclosing Personal Information to a third party for monetary or other valuable consideration. “Sharing” is defined as renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer’s Personal Information by the business to a third party for cross‐context behavioral advertising, whether or not for monetary or other valuable consideration.

We do not sell Personal Information for monetary compensation. However, we use third-party online advertising providers and similar partners to help deliver advertisements that may be relevant to your interests, measure the effectiveness of our advertising, and improve our marketing efforts. In connection with these activities, we may disclose certain Personal Information to advertising providers, permit them to collect information through Tracking Technologies, or disclose certain Identifiers or Other Personal Information to support customer matching, audience creation, and similar advertising services. Under the CCPA, these activities may constitute a “sale” or “sharing” of Personal Information.

Depending on your interactions with us and the Services you use, we may “sell” or “share” certain Personal Information with our online advertising providers. For example:

• With our online advertising providers, we may “sell” or “share” Identifiers, Other Personal Information, Internet or Network Activity, Geolocation, and Inferences.

How to Opt Out of Online Selling or Sharing

You may opt out of the online “selling” or “sharing” of your Personal Information for cross-context behavioral advertising by either:

• Using Global Privacy Control. We recognize GPC signals as a valid request to opt out of online selling or sharing for the browser and device from which the signal is sent. You should enable GPC separately for each supported browser and device you use. To learn more about GPC and how to enable it, visit www.globalprivacycontrol.org.
• Using our Privacy Preference Center. You can manage your preferences for Tracking Technologies through the Privacy Preference Center available on our website. Similar privacy controls are available in our mobile app through the Settings menu.

Your privacy preferences may be browser and device specific. You should update your preferences separately for each browser, device, and, where applicable, our website and mobile app. If you clear your browser cookies, your preferences may be removed and will need to be set again. Ad-blocking software may also interfere with the operation of our Privacy Preference Center.

How to Opt Out of Offline Selling or Sharing

To opt out of “selling” or “sharing” for cross-contextual behavioral advertising through offline channels, visit our California Privacy Rights Request form to submit an Offline Opt Out Request.

Our Site is not intended for or directed to minors. As to both online and offline activities, we do not knowingly sell or share the Personal Information of minors under 16 years of age.

Right To Opt Out of Automated Decisionmaking Technology

You have the right to opt-out of the use of automated decisionmaking technology, including profiling, when it is used to make significant decisions about your employment opportunities or compensation, financial or lending services, housing, education enrollment or opportunities, or healthcare services. However, we only use automated decisionmaking technology with Personal Information that is exempt from CCPA.

Right To Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, if you exercise any of your CCPA rights, we will not deny you goods or services; charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties; provide you a different level or quality of goods or services; or suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

How To Submit a Request to Know, Request to Delete, Request to Correct, or Request to Opt Out of Offline Sales or Shares

To make a Request to Know, Request to Delete, Request to Correct, or Request to Opt Out of Offline Sales or Shares, please contact us by either:

• Call us at: 844-200-9028
• Submit a California Privacy Rights Request

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information.

When Submitting a Request to Know, Request to Delete, or Request to Correct

When you submit a Request to Know, Request to Delete, or Request to Correct, we will take steps to verify your identity by requiring you to log into your account (if one exists) or by matching the information provided by you in your request with the information we have in our records. We will generally respond to requests within 45 days. If we need additional time, we will let you know and will explain the reason.

When Submitting a Request to Opt Out of Offline Sales or Shares

When you submit a Request to Opt Out of Offline Sales or Shares, no specific verification will be required unless we suspect fraud. However, we may ask you to provide certain information that is needed to complete your opt out request, such as information necessary to identify you within our systems. We will complete your opt out request within 15 business days of receiving your request.

Authorized Agents

Before we can respond to Requests to Know, Requests to Delete, or Requests to Correct submitted by an authorized agent, we need to confirm that person or entity’s authority to act on behalf of a consumer and verify the identity of the authorized agent. If you are authorized to submit a request on behalf of a California resident, please email us at privacy@elastic.com and provide the following information:

1. To verify the agent’s authorization to request on behalf of a California resident, please attach written permission from the California resident, or a valid power of attorney to the request email.
2. To verify the agent’s identity, please provide a valid government issued ID, and a utility bill, bank statement, or similar documentation to verify the agent’s name and address.
3. The identity of the consumer will also need to be verified.

Authorized agents may also submit a Request to Opt Out of Offline Sales or Shares. To do so, the authorized agent must submit written permission from the consumer, or a valid power of attorney.

10. CALIFORNIA SHINE THE LIGHT

Pursuant to California Civil Code §1798.83, California residents with whom we have a business relationship can request certain details about the types of personal information (a smaller subset of data than defined above as “Personal Information”), if any, we shared with third parties for the direct marketing purposes of the third parties and the identities of the third parties with whom we shared such information in the last twelve (12) months. We do not, however, share your personal information with third parties in a covered manner.

We maintain and reserve the right to assert any and all applicable exemptions but provide the above statement as a courtesy.

11. SECURITY

We maintain commercially reasonable security measures to protect the Personal Data we collect and store from loss, misuse, destruction, or unauthorized access. However, no security measure or modality of data transmission over the Internet is 100% secure. Although we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee absolute security.

12. THIRD PARTY LINKS

The Site and Services may contain links that will let you leave the Site and Services and access another website. Linked websites are not under our control. This Privacy Policy applies solely to Personal Data that is acquired by us on this Site and Services. We accept no responsibility or liability for these other websites.

13. CHILDREN’S PRIVACY

The Site and Services are not intended for minors. We do not knowingly collect, use, or disclose Personal Information of children under 16.

14. CREDIT REPORTING AND USE OF BANK ACCOUNT INFORMATION

Credit reporting: We may make inquiries concerning your credit history and standing, and may report information concerning your performance including, but not limited to, late payments, missed payments, or other defaults, to credit reporting agencies. Late payments, missed payments, or other defaults on your line of credit may be reflected in your credit report.

Collection and use of bank account and other information about you: As part of our credit underwriting and information collection process, we will consider the checking account information provided by you as eligible for us to process payments against, we may detect additional bank accounts under your ownership, and we also may collect and consider information about you from non-credit reporting agency data providers and publicly available information.

15. SOCIAL MEDIA

We encourage you to review your privacy options and settings with the social media platforms and networks you use to understand what choices you have about sharing information from those platforms and networks with us.

16. ACCESSIBILITY

We are committed to ensuring this Privacy Policy is accessible to individuals with disabilities. If you wish to access this Privacy Policy in an alternative format, please contact us as described below.

17. HOW TO CONTACT US

For questions or concerns about our privacy policies or practices, please contact us at: