Privacy Policy

Flokapital
Operated by Flokapital, a company organized under the laws of [State of formation]
Effective Date: [Effective Date]

This Privacy Policy describes how Flokapital ("Flokapital," "we," "us," or "our"), collects, uses, shares, and protects information in connection with our website, calculators, educational content, funding-application tools, communications, and related services (collectively, the "Services").

Flokapital is a small-business funding brokerage, marketplace, and education brand. We are not a bank, not a lender, and not a government agency. We help business owners explore and apply for commercial funding options that may be offered by unaffiliated banks, non-bank lenders, and other funding providers (together, "Funding Providers"). We may use third-party application and technology platforms to collect or process applications, and we may use customer-relationship management and communications systems to manage leads, applications, and communications.

This Policy is written for applicants and visitors in the United States. It is a policy document, not legal advice to you, and it does not form a contract except to the extent our Terms of Use incorporate it. If you do not agree with this Policy, please do not use the Services or submit an application.

1. Scope and who this Policy covers

This Policy applies to personal information and business-related information we collect online and offline in connection with the Services, including when you:

• visit our website or use our calculators and educational materials;
• start or submit a funding profile or application;
• contact us by form, email, phone, text message, chat, or social media;
• receive emails, calls, or text messages from us; or
• interact with our advertisements or pixels on our site or on third-party sites.

This Policy does not apply to websites, applications, or practices of Funding Providers or other third parties that we do not control. If you proceed with a Funding Provider, that provider’s privacy policy and terms will also apply to information it collects or receives.

Some information we collect relates to a business (for example, legal name, EIN, revenue, and bank-account activity). We also collect information about individual owners, officers, guarantors, and other natural persons associated with an application. When this Policy refers to "personal information" or "your information," it includes information that identifies or is reasonably linkable to you as an individual, and, where applicable, information about your business that is connected to you.

2. Information we collect

The information we collect depends on how you use the Services. It may include the categories below.

2.1 Information you provide

• Identifiers and contact information. Name, email address, phone number, postal address, and similar contact details for you and your business.
• Business information. Legal business name, DBA, entity type, EIN or other tax ID, ownership and officer information, industry, time in business, business address, websites, and number of employees.
• Application and funding information. Requested amount, use of funds, product interest (for example, term loan, line of credit, equipment financing, SBA, or merchant cash advance), and other application answers.
• Financial information. Self-reported or documented revenue, average monthly sales, existing debt, bank balances or statements, financial statements, tax returns, accounts receivable or payable, and similar information.
• Credit-related information. Self-reported credit ranges and, where authorized, consumer or commercial credit reports, scores, and related information obtained through Funding Providers or credit-reporting partners. This may involve a soft inquiry, a hard inquiry, or both, as described in our Terms of Use and Disclosures and in materials presented at the time of authorization.
• Identity-verification information. Date of birth, Social Security number or Individual Taxpayer Identification Number, government-issued ID, and similar data when needed to verify identity, prevent fraud, or complete an application with a Funding Provider.
• Bank-connection and account data. If you connect a business bank account through a service such as Plaid or a similar data-aggregation or open-banking provider, we or our processors may receive account-holder names, account identifiers or tokens, institution name, balances, transaction history, and related data you authorize. We do not ask you to share your online banking password with Flokapital directly. The bank-connection provider’s terms and privacy policy also apply.
• Communications. The content of emails, texts, calls, chats, voicemails, and other messages, and records of those communications (including, where permitted, call recordings or transcripts).
• Marketing preferences and consents. Records of your opt-in or opt-out choices for email, SMS, and phone, including timestamp, method, and related records needed to demonstrate consent.
• Other information you choose to provide. Documents you upload, survey responses, event registrations, or other materials.

You may choose not to provide certain information, but then we may be unable to review a funding profile, pre-qualify you, or connect you with Funding Providers.

2.2 Information collected automatically

When you use the Services, we and our service providers may automatically collect:

• Device and log data. IP address, browser type, device type, operating system, referring/exit pages, date and time stamps, clickstream data, approximate location derived from IP address, and error logs.
• Cookies, pixels, SDKs, tags, and similar technologies. We and third parties may use cookies, pixels, web beacons, local storage, and similar tools for site function, analytics, fraud prevention, session management, and advertising or remarketing. See Section 8.
• Usage data. Pages viewed, buttons clicked, calculator inputs (which are used to generate estimates and may be stored), scroll depth, and similar interaction data.
• Call, SMS, and email metadata. Phone numbers, delivery and bounce data, open and click data for emails (where used), and SMS delivery status.

2.3 Information from other sources

We may combine information we collect with information from:

• Funding Providers and their service providers, about application status, underwriting outcomes, or funding;
• credit bureaus and commercial data providers (where authorized or otherwise permitted);
• identity-verification, fraud-prevention, and KYC/AML vendors;
• bank-connection and document-collection vendors;
• marketing partners, lead sources, and advertising platforms;
• publicly available sources (for example, corporate registries or business websites);
• our service providers, including third-party application and technology platforms and CRM or communications providers; and
• other companies in connection with a corporate transaction, if applicable.

3. How we use information

We use information for the following business and commercial purposes:

• to operate, maintain, and improve the Services, including calculators and educational content;
• to create and evaluate funding profiles and applications;
• to match, refer, or transmit applications and supporting data to Funding Providers that may be able to offer commercial financing or other funding products;
• to communicate with you about your inquiry, application, documents, and next steps, including by email, phone, and text if you consent or as otherwise permitted by law;
• to send marketing or educational communications where allowed, and to honor opt-outs;
• to personalize content and measure the effectiveness of our site, campaigns, and partners;
• to verify identity, prevent fraud, abuse, and money laundering, and protect security;
• to obtain, use, or facilitate consumer or commercial credit reports where authorized, and to maintain required records;
• to perform analytics, quality assurance, training, and product development;
• to provide customer support;
• to enforce our terms, protect our rights and users, and comply with law, legal process, licensing, and audit requirements;
• to administer our relationship with vendors and Funding Providers; and
• for other purposes disclosed at the time of collection or with your consent.

We may use de-identified, aggregated, or anonymized information that is not reasonably likely to identify you for any lawful purpose, including research, benchmarking, and improving the Services. We will not attempt to re-identify such information except as permitted by law (for example, to test de-identification).

4. How we share information

We do not sell your personal information for money. We do share information as described in this Section in order to operate a funding brokerage and marketplace, to market our Services, and to work with vendors. Some of these activities may be considered a "sale" or "sharing" under certain state privacy laws when, for example, advertising or analytics partners receive identifiers for cross-context behavioral advertising. See Sections 6 and 7 for your choices.

We may share information with:

4.1 Funding Providers and their partners

If you submit a profile or application, or ask us to check options, we may share your application, supporting documents, credit-related information, and related data with banks, non-bank lenders, MCA or receivables purchasers, equipment lessors, brokers, and other Funding Providers, and with their underwriters, bank partners, and service providers, so they can evaluate whether to offer you a product and to communicate with you about that process.

This sharing is the core of our service. If you do not want your information shared with Funding Providers, do not submit an application.

4.2 Service providers (processors)

We share information with vendors that perform services for us, under contracts that limit their use of the data, such as:

• third-party application and technology platforms that support applications and underwriting;
• CRM, communications, and marketing-automation platforms;
• cloud hosting, data storage, security, and IT;
• document collection, e-signature, and bank-connection providers;
• credit-reporting, identity, and fraud vendors;
• analytics, tagging, and advertising-measurement providers;
• call-center, SMS/10DLC, email-delivery, and customer-support tools;
• professional advisors (attorneys, accountants, auditors, and insurers); and
• payment processors, if you ever pay us a fee (we do not currently charge a fee merely to check options).

4.3 Marketing and advertising partners

We may share limited identifiers and event data (for example, cookie IDs, IP address, or hashed email) with advertising networks, social platforms, and measurement partners to show or measure ads. You can often control this through cookie preferences, industry opt-out tools, and the rights described below.

4.4 Affiliates and corporate transactions

We may share information with affiliates under common ownership or control, if any, for the purposes in this Policy. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to applicable law.

4.5 Legal, safety, and compliance

We may disclose information if we believe in good faith that it is necessary to comply with law, regulation, licensing, or legal process; to respond to lawful requests from public authorities; to protect the rights, property, or safety of Flokapital, our users, Funding Providers, or the public; or to detect, prevent, or address fraud, security, or technical issues.

4.6 With your direction or consent

We may share information when you direct us to, or when you otherwise consent.

We do not permit mobile opt-in data or SMS consent records to be shared with unaffiliated third parties for those third parties’ own marketing, consistent with CTIA and 10DLC expectations. See our SMS Terms.

5. GLBA-style privacy notice (U.S. financial privacy)

Depending on our activities, Flokapital may be treated as a "financial institution" under the Gramm-Leach-Bliley Act ("GLBA") and its implementing rules, including the Consumer Financial Protection Bureau’s Regulation P or applicable Federal Trade Commission rules, and under similar state financial-privacy laws. This Section is intended to provide the type of notice those rules require, in addition to the rest of this Policy.

Information we collect. We collect information about you from your applications and other forms, from your transactions with us and our service providers and Funding Providers, and from consumer reporting agencies and other third parties, as described in Section 2.

Information we disclose. We may disclose all of the categories of information described in this Policy, including identifiers, application and financial information, and credit-related information, to Funding Providers and to service providers as needed to offer and provide our referral and application services, to market our Services as permitted, and as required or permitted by law.

Your choices. Where GLBA or similar law gives you a right to opt out of certain sharing with non-affiliated third parties, we will provide a reasonable means to do so and will honor that request, except for sharing that is permitted without an opt-out (for example, sharing with service providers under a confidentiality agreement to perform services for us, sharing with Funding Providers as necessary to process a transaction or application you requested, or sharing as required by law). To request an opt-out or ask whether an opt-out applies to you, contact us at [Contact Email] or [Phone].

This GLBA-style notice is provided in addition to, and does not limit, any rights you may have under state consumer-privacy laws, except where a statute exempts GLBA-regulated data from that law. Counsel should confirm our GLBA status and any required annual-notice practices before this Policy is finalized.

6. "Sale," "sharing," and targeted advertising; your opt-out choices

We do not sell personal information for monetary consideration in the ordinary sense. We also do not sell or share sensitive personal information for additional cross-context advertising beyond what this Policy describes.

However, under the California Consumer Privacy Act as amended by the CPRA ("CCPA"), and under some other state laws, "sale" and "share" can include making identifiers available to advertising or analytics partners for cross-context behavioral advertising, even if no money changes hands. If we use pixels, advertising cookies, or similar tools that meet those definitions, you have the right to opt out.

How to opt out. You may:

• use a "Do Not Sell or Share My Personal Information" or "Opt Out of Targeted Advertising" link, if one is presented on our site, or email [Contact Email] with the subject line "Privacy Opt-Out";
• enable a recognized universal opt-out or Global Privacy Control ("GPC") signal in a browser or extension that supports it. We intend to treat a valid GPC signal as an opt-out of sale/sharing for that browser, to the extent required by law; and
• use industry tools such as the Digital Advertising Alliance’s WebChoices page and your device advertising settings.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

An opt-out of sale/sharing or targeted advertising does not stop us from sharing information with Funding Providers or service providers to process an application you requested, or from using strictly necessary cookies.

7. State privacy rights (CCPA/CPRA and other state laws)

Depending on your state of residence and whether you are acting as an individual, you may have rights under laws such as the CCPA/CPRA (California), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, the Oregon Consumer Privacy Act, and similar laws in other states that have adopted or may adopt comparable rights. Some of these laws apply only to "consumers" in a personal or household context and may apply differently, or may not apply, to information collected solely in a commercial or employment context. We describe the rights below and will honor them where they apply to you. If a law does not apply, we may still consider a reasonable request.

7.1 Rights that may be available

Subject to legal limitations and verification, you may have the right to:

• Know and access the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collection, and the categories of third parties to whom we disclose it;
• Correct inaccurate personal information;
• Delete personal information we collected from you, subject to exceptions (for example, to complete a transaction, detect security incidents, comply with law, or maintain an application record);
• Port a copy of certain personal information in a readily usable format;
• Opt out of sale, sharing, or targeted advertising, as described in Section 6;
• Limit the use or disclosure of sensitive personal information, where that right applies (for example, certain government identifiers or account-login data), if we use such data for purposes beyond those reasonably necessary to provide the Services;
• Appeal a denial of a request, in states that require an appeals process; and
• Nondiscrimination for exercising your rights (we will not deny goods or services, or charge a different price, solely because you exercised a privacy right, except as a lawfully offered financial incentive, if any, that we clearly describe).

We do not currently offer a financial-incentive program in exchange for personal information. If that changes, we will describe it.

7.2 Categories collected, used, and disclosed

In the preceding 12 months, we have collected and may have disclosed the following categories of personal information (as those terms are used under the CCPA and similar laws), for the purposes in Sections 3 and 4:

We do not collect biometric identifiers or precise geolocation as a standard practice. We do not use sensitive personal information for the purpose of inferring characteristics about you for advertising, except as this Policy otherwise discloses.

7.3 How to submit a request or appeal

To exercise a privacy right, email [Contact Email] with the subject line "Privacy Request," call [Phone], or use any request form we make available. Please tell us which right you wish to exercise and the email or phone number associated with your use of the Services. We may need to verify your identity (for example, by matching information you provide to information we already have). You may use an authorized agent where the law allows; we may require proof of authorization and may still verify your identity.

We will respond within the time required by applicable law (generally 45 days under the CCPA, with a permitted extension when reasonably necessary and when we notify you). If we deny a request, and an appeals right applies, you may appeal by emailing [Contact Email] with the subject line "Privacy Appeal" within a reasonable time after our decision. We will inform you of the outcome of the appeal and of any remaining right to contact a state attorney general or other regulator.

We will not discriminate against you for exercising a privacy right.

8. Cookies, analytics, pixels, and Do Not Track

We use cookies and similar technologies that are:

• Strictly necessary for security, load balancing, consent records, and core site function;
• Analytics (for example, to understand how the Services are used); and
• Advertising or measurement, if we run digital ads or remarketing.

You can often block or delete cookies through your browser, but some features may not work. Where required, we will present a cookie notice or preference tool.

Do Not Track and GPC. There is no uniform browser "Do Not Track" (DNT) standard. We do not currently respond to DNT signals in a particular way. We do intend to honor Global Privacy Control (GPC) signals as an opt-out of sale/sharing or targeted advertising for that browser, to the extent required by applicable law. Implementation details should be confirmed by counsel and engineering before launch.

Third-party cookies are subject to the third party’s privacy policy.

9. Data retention

We retain information only as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain application and consent records, resolve disputes, and comply with legal, tax, accounting, licensing, audit, and recordkeeping obligations.

Retention periods vary by record type. As a general guideline (which counsel should confirm):

• completed or in-process applications and supporting documents may be retained for several years after the last activity, often at least five to seven years, or longer if a Funding Provider relationship, legal hold, or residual liability requires it;
• marketing communications and consent/opt-out records may be retained for as long as needed to demonstrate compliance and honor your choices;
• website logs and analytics may be retained for a shorter period, often measured in months unless needed for security investigations; and
• de-identified or aggregated data may be retained without a fixed limit.

When information is no longer needed, we will delete, de-identify, or archive it in accordance with our practices and applicable law.

10. Security

We use administrative, technical, and physical safeguards reasonably designed to protect personal information, including access controls, encryption in transit where appropriate, vendor due diligence, and employee limitations on access. No method of transmission or storage is completely secure. We cannot guarantee absolute security. Please use unique, strong passwords for any portal or email account you use with us, and notify us promptly at [Contact Email] if you suspect unauthorized access.

11. Children

The Services are intended for adults 18 years of age or older who are seeking commercial funding or business information. We do not knowingly collect personal information from children under 13, and we do not target children. If you believe a child has provided us information, contact [Contact Email] and we will take appropriate steps to delete it.

12. International users

The Services are operated from the United States and are intended for a U.S. audience. If you access the Services from outside the United States, you understand that your information will be processed in the United States, where laws may differ from those in your country. We do not currently target the Services to the European Economic Area, the United Kingdom, or Switzerland. If that changes, we will update this Policy and implement any additional transfer or legal bases required.

13. Changes to this Policy

We may update this Policy from time to time. The "Effective Date" at the top will change when we do. For material changes, we may provide additional notice (for example, a site notice or email) as required by law. Your continued use of the Services after the effective date of an update constitutes acceptance of the revised Policy to the extent permitted by law.

14. Contact us

To make a privacy request, ask a question, or opt out of certain sharing or marketing:

Flokapital
[Business Address]
Email: [Contact Email]
Phone: [Phone]

For SMS help or to stop texts, see our SMS Terms (reply STOP or HELP to our messages).

If you are a California resident, you may also contact the California Attorney General or the California Privacy Protection Agency with complaints about CCPA compliance. Residents of other states may contact their state attorney general.