FyScope Privacy Notice

Effective date: June 1, 2026

This Privacy Notice describes how FyScope (“FyScope,” “we,” “us,” “our”) collects, uses, shares, and protects personal information when you use our lead-brokering service.

FyScope is a lead broker. We do not make loans. We do not obtain consumer credit reports about you. We connect applicants who use our service with consumer-lending companies (the “Lenders”) who may offer loans.

1. Who we are

FyScope is a Delaware limited-liability company. Contact us at the support address shown in the footer of this page.

For privacy matters specifically, write to Contact via Email. We respond within 30 days, or sooner where required by applicable law.

2. Personal information we collect

We collect information you provide directly when you complete an application or when a referring partner submits your information to our service. Categories of personal information we collect include:

• Identifiers — name, postal address, email address, telephone number, date of birth.
• Government identifiers — Social Security number and the identification-document details (driver’s-license number, state, expiration).
• Employment and income information — employment status, employer name, occupation, pay frequency, reported income figures, employment tenure.
• Bank-account information — account number, routing number, account type, account age.
• Application context — loan amount requested, purpose, funding-urgency preference, autopay preference, your responses to our application survey.
• Device and network information — IP address, user-agent string, browser type, device fingerprint (where used for fraud prevention).
• Marketing attribution — referring partner, campaign identifiers, and similar source data when supplied by a referring partner.

We also collect information from third-party verification providers as described in Section 4 below.

3. How we use your personal information

We use the personal information we collect to:

• match you with consumer-lending companies that may offer to evaluate your application;
• verify the information you provided and screen your application for identity theft and other fraud;
• communicate with you about your application (transactional messages only);
• comply with legal, regulatory, and audit obligations;
• detect, prevent, and respond to security incidents and unlawful activity;
• maintain, improve, and operate the service.

We do not use your personal information for marketing solicitations by automated dialer, SMS, or email unless you provide separate, written consent. We do not use your personal information for cross-context behavioral advertising.

4. Who we share your personal information with

We share your personal information with the following categories of recipients:

• Consumer-lending companies (Lenders) matched to you based on the criteria you supplied, for the purpose of evaluating you for prequalification or origination. Each Lender obtains its own separate authorization from you before pulling a consumer credit report.
• Identity-verification and fraud-prevention service providers — providers that compare your information against public records, telephone-carrier records, prior application records, device-fingerprint and IP-reputation databases, and known-fraud lists. These providers are not consumer reporting agencies as defined in the Fair Credit Reporting Act.
• Alternative-data service providers — bank-account verification, income- and employment-verification, address-verification, and public-record-database providers. These providers are not consumer reporting agencies and do not provide us with consumer credit reports.
• Service providers acting on our behalf for hosting, data storage, error-tracking, transactional email, and analytics. These providers are bound by written contract to use your information only as we direct.
• Government, law-enforcement, or regulatory bodies when required by applicable law, valid legal process, or to protect our rights, your rights, or the rights of others.
• Successors in interest in the event of a merger, acquisition, financing, reorganization, or sale of assets, subject to confidentiality protections and your rights under applicable law.

We do not sell your personal information for marketing purposes. We do not share your personal information for cross-context behavioral advertising. We do not authorize our service providers to use your information for their own marketing or to share it with other clients except as needed to perform services for us.

5. How long we keep your personal information

We retain personal information only as long as needed to perform the purposes described in this notice and to comply with our legal, regulatory, accounting, and audit obligations. Specifically:

• Application records are retained for the period required by federal and state lending and consumer-protection laws (currently a minimum of 25 months from application).
• Consent snapshots (the exact text of the authorization you clicked) are retained for the same period and are immutable.
• Audit log entries are retained for the period required by applicable law and our compliance program.
• Device and network logs (IP, user-agent) are retained for 90 days for fraud-prevention and security purposes, then deleted or anonymized.

You may request earlier deletion under the rights described in Section 7; we will honor it where law does not require us to retain the record.

6. How we protect your personal information

We use technical and organizational measures designed to protect your personal information:

• Encryption in transit — all connections to our service use TLS 1.2 or higher.
• Encryption at rest — sensitive fields (Social Security number, bank-account number, identification-document number) are encrypted in our databases using AES-256.
• Access controls — production systems are accessible only by authorized personnel with multi-factor authentication and role-based access.
• Audit logging — every access to or change in your application record is recorded in a tamper-evident hash chain.
• Vendor diligence — we contractually require our service providers to maintain comparable security measures.

No system can be 100% secure. If you suspect unauthorized access to your account, contact us immediately.

7. Your privacy rights

Depending on where you reside, you may have the following rights with respect to your personal information:

• The right to know what personal information we have collected about you, including categories, sources, and recipients.
• The right to access the specific pieces of personal information we have about you.
• The right to correct inaccurate personal information.
• The right to delete your personal information, subject to legal retention obligations.
• The right to opt out of “sale” or “sharing” of personal information for cross-context behavioral advertising. We do not sell or share personal information for these purposes.
• The right to limit the use of sensitive personal information to the purposes necessary to provide the service.
• The right to portability of your personal information in a structured, commonly used format.
• The right to non-discrimination for exercising any of these rights.

These rights are available to residents of California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Tennessee (TIPA), Iowa (ICDPA), and any other state granting similar rights.

To exercise these rights, write to Contact via Email with the request, the relevant state of residence, and enough information for us to verify your identity. We respond within the timeframe required by the applicable statute (generally 45 days, extendable for an additional 45 days when necessary).

You may also designate an authorized agent to exercise these rights on your behalf, subject to the verification requirements of the applicable law.

8. Children’s privacy

Our service is intended for adults at least 18 years of age. We do not knowingly collect personal information from individuals under 18. If we learn we have collected information from a person under 18, we will delete it. Parents and guardians who believe their minor has provided personal information to us should contact Contact via Email.

9. Cookies and similar technologies

We use a small number of strictly necessary cookies to maintain your session, enforce CSRF protection, and remember your application progress. We do not use cookies for advertising. We do not use third-party tracking pixels or behavioral-advertising tools on the application flow.

If you reject cookies entirely, the application wizard will not function — we use a session cookie to remember what you have entered between steps.

10. Changes to this notice

We may update this notice from time to time. When we make material changes, we will post the updated notice with a new “Effective date” and, where required by law, provide additional notice (for example, by email to applicants whose records we still hold). Continued use of the service after a change indicates acceptance of the updated notice.

11. Gramm-Leach-Bliley Act (GLBA) summary

This notice satisfies our obligation under the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801–6809, to inform you of our information-sharing practices with respect to nonpublic personal financial information:

• We share information only with the categories of recipients described in Section 4.
• We do not share information with non-affiliated third parties except as described in this notice.
• We do not authorize affiliates or joint marketers to use your information for their own marketing.
• We do not sell personal information.

12. Contact

For questions about this notice or our privacy practices generally: Contact via Email

For general questions or support: Contact via Email

For statutory consumer-privacy requests under CCPA/CPRA/CPA/CTDPA/VCDPA/UCPA/TDPSA/OCPA/MCDPA/TIPA/ICDPA or any similar state law: Contact via Email with the subject “Privacy Rights Request — [state]”.