ZayZoon USA Privacy Policy

ZayZoon US Inc. ("ZayZoon", "we", or "us") is a fintech provider that helps small and midsize businesses offer low-cost, transparent financial products to their employees. This Privacy Notice ("Notice") explains how ZayZoon and its affiliates in Canada ("Affiliates") collect, use, disclose, and store Personal Information through zayzoon.com and the other websites and applications that link to this Notice (collectively, our "Websites"; the ZayZoon apps are the "Apps").

This Notice applies when you:

• visit or use our Websites, including when you download resources, request a demo, or ask us to contact you; and
• provide Personal Information so that we can deliver our services and manage our relationship with you (collectively, the "Services"), such as setting up an account or accessing your accrued but unpaid wages.

If you have a ZayZoon account through your employer, you authorize your employer and payroll provider to share your Personal Information with ZayZoon for the purposes described in this Notice, including payroll and employment information needed to provide the Services. Your acceptance of this Notice confirms your consent to those disclosures.

How this Notice works: financial-product data vs. other data

ZayZoon is a financial institution under the federal Gramm-Leach-Bliley Act (“GLBA”). How your information is regulated depends on how you interact with us:

• If you apply for, open, or use a ZayZoon account or financial product, the nonpublic personal information we collect to provide that product is governed by the GLBA and, where applicable, the California Financial Information Privacy Act ("FIPA"). That information is subject to ZayZoon's GLBA privacy practices or a separate GLBA privacy notice, as applicable, and the state consumer-privacy rights described later in this Notice generally do not apply to it.
• If your only contact with us is visiting our Websites, requesting a demo, marketing, or business-to-business communications, that information is not GLBA-regulated, and the state privacy rights described in this Notice apply to it.

We explain both below. Where a state law applies to us as a company regardless of the GLBA (as in California, Connecticut, Minnesota, Montana, and Oregon), we honor the applicable rights for the information that is not otherwise exempt.

Definitions

Personal Information (or Personal Data) means information that, alone or combined with other information, identifies you directly or indirectly.

A Controller (or Business) decides the purposes and means of processing Personal Information. A Processor (or Service Provider, Contractor, or Third Party) processes Personal Information on the Controller's behalf.

1. Personal Information we collect

Information you give us

From the Websites or events: Information you choose to provide, for example through a "Get a free demo" form, a chat on our Websites, or event registration. If you contact us, we keep a record of that correspondence.

From the Services: Information you provide directly, or through your payroll provider, employer, bank, or another third party. This may include your name, email and postal address, phone number, job title, date of birth, and employment information such as wages, time and attendance, and scheduling. We may also collect documents or other materials you provide, and commercial information such as records of your use of the Services or demo requests.

Information we collect automatically

When you use the Websites: Internet and network activity collected through cookies and similar technologies, which may include your device's IP address, the referring website, the pages your device visited, and the time of the visit. We also use analytics and anti-fraud tools. You can set your preferences in the preference center on our Websites.

When you use the Services:

• Identifying information for our KYC/AML obligations, such as your name, email, phone number, date of birth, and the last four digits of your SSN.
• Employment and financial information, such as pay, time and attendance, and the account to which pay is directed.
• Usage information, such as activity within the Services, device configuration, performance metrics, and interface interactions, which we use to support you and improve the product.
• Log information, such as login credentials, browser type, service provider or operating system, and IP address.
• Information from cookies and similar technologies.
• Customer feedback, including communications with us by chat or phone, and any feedback you choose to give (which is optional).

If we collected your Personal Information through our Websites or as part of the Services, the information stored in our CRM or marketing systems may be enriched or updated through third-party data sets to keep it accurate. We may obtain contact information, employment or account-status information, and company or business information from third-party data providers when needed to maintain accurate CRM and marketing records, support outreach, and understand business relationships. We do not use third-party enrichment to add demographic attributes that are not needed for those purposes.

 

2. How and why we use Personal Information

Information collected through our Websites

We use this information to:

• operate and maintain our Websites, including troubleshooting, analysis, and testing;
• improve how content is presented;
• monitor trends, market, and advertise;
• fulfill requests you make, such as a demo, webinar, or whitepaper, and tell you about Services that may interest you;
• support data security and fraud prevention; and
• research and develop our products.

Information collected to provide the Services

We use this information to:

• set up and maintain your account and provide the Services;
• process transactions and send related confirmations;
• respond to inquiries and provide customer support;
• send technical, security, and administrative messages;
• investigate and prevent fraud and other unlawful activity; and
• conduct analytics about how the Services are used.

We rely on the need to provide the Services to you, and on our legitimate interests in security and improving our business, to process this information. We may use your email or mobile number to send Service updates and to respond to your requests. You authorize your wireless carrier to share device or account information with us or our service providers to help verify your identity and prevent fraud.

When you use the Apps, we use strictly necessary cookies and similar technologies for authentication, security, and fraud prevention. The cookie and tracking preferences you set on our Websites also apply in the Apps.

3. How we share and disclose Personal Information

We do not sell your Personal Information for money. As explained in the California section below, some of our online advertising activity may count as "sharing" or a "sale" under certain state laws, and you can opt out. We otherwise share information only as needed to provide, develop, market, and improve the Services:

Service providers. We share information with affiliates and processors that perform services for us, such as payment processing (e.g., Interchecks), website analytics (e.g., Google), anti-fraud and security tools (e.g., Cloudflare), product feedback and help-desk tools (e.g., Intercom), CRM (e.g., HubSpot), and communications (e.g., Twilio).

Marketing and advertising. On our Websites only, we use cookies and similar technologies, including Google and Meta tools, to deliver and measure advertising based on the preferences you set in our preference center. We use these for audience targeting, ad personalization, campaign measurement, brand-safety, and fraud prevention. We do not use these advertising technologies inside the Apps.

Direct marketing. We may send you marketing communications as permitted by law. You can opt out at any time using the unsubscribe link in our emails or by replying STOP to a text message.

Business transfers. If we buy or sell assets, or are involved in a merger, acquisition, bankruptcy, or other change of control, Personal Information may be transferred as part of that transaction.

ZayZoon group companies. We may share information within the ZayZoon family of companies consistent with this Notice.

Legal and safety. We may access, preserve, and disclose information when reasonably necessary to operate the Services; comply with law, legal process, or a government request; enforce our agreements; or protect the rights, property, or safety of ZayZoon, our users, or others, including for national security or law enforcement.

Anonymous information. We may create and use anonymized data for lawful business purposes, including workforce insights for our employer clients.

4. Sensitive information

Some information we collect is treated as "sensitive" under state privacy laws, including your Social Security number, financial account information, and account login credentials. We collect and use this information only as needed to provide the Services, meet our legal obligations (such as KYC/AML), secure our systems, and prevent fraud. We do not use sensitive information to infer characteristics about you, and we do not sell it or use it for targeted advertising. Where state law gives you the right to limit the use of sensitive information, we honor that right as described below.

5. How long we keep Personal Information

We keep Personal Information only as long as needed for the purpose it was collected, and we apply an internal retention schedule that sets retention periods by category, taking into account the purpose of collection, whether the information is needed to provide the Services, and our legal, regulatory, security, and fraud-prevention obligations. When a retention period expires, we securely delete or anonymize the information, and we may keep aggregated or de-identified information for lawful business purposes. If you ask us to delete your information, we will do so unless we are permitted or required to retain it, in which case we keep only what is needed for that purpose.

6. Security

We use reasonable technical, organizational, and administrative measures to protect Personal Information from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. No system is perfectly secure. Your account is protected by a password; please choose a unique password, keep it confidential, and sign off after each session.

7. Minors

The Services are intended for working adults. In limited circumstances, employees who are 16 or 17 years old may access certain Services through their employer. We collect date of birth at sign-up, so we know when a user is under 18.

For any user we know to be under 18, we do not sell or share their Personal Information, and we do not use it for targeted advertising or to deliver third-party advertising. Our advertising and analytics technologies run on our Websites only and not in the Apps where account holders are served.

We do not knowingly collect Personal Information from children under 13. If you believe a child under 13 has given us Personal Information, contact us at support@zayzoon.com and we will delete it.

8. Your privacy rights

Depending on where you live and the applicable law, you may have the right to:

• know what Personal Information we collect and why, and the categories of recipients;
• access a copy of your Personal Information;
• correct or update your Personal Information;
• delete your Personal Information;
• opt out of the "sale" or "sharing" of your Personal Information and of targeted advertising;
• limit the use of sensitive information;
• appeal a denial of a request, where the applicable state provides for an appeal; and
• not be discriminated against for exercising these rights.

These rights are subject to exceptions in applicable law, and they generally do not apply to information governed by the GLBA or FIPA.

How to submit a request. You can submit a request, including a request to opt out of selling or sharing, through our request form or by emailing support@zayzoon.com. We will respond within the time the applicable law allows, and we will tell you if we need more time or cannot fulfill a request. We do not charge a fee unless a request is excessive, repetitive, or manifestly unfounded, in which case we will give you an estimate first.

Authorized agents. You may use an authorized agent to submit a request. We will ask for written, signed proof of the agent's authority, and we may take steps to verify your identity.

Opt-in and opt-out of marketing messages. You may opt out of promotional emails using the unsubscribe link, and of promotional texts by replying STOP. We may still send you administrative messages, such as password resets, verification messages, and payment notices.

9. Cookies and online tracking choices

Global Privacy Control and opt-out preference signals. Several state laws require us to honor a browser or device privacy signal, such as Global Privacy Control (“GPC”), as a request to opt out of the sale or sharing of Personal Information and of targeted advertising. We are in the process of implementing support for these signals on our Websites. In the meantime, and at any time, you can opt out of the sale or sharing of your Personal Information by using the “Do Not Sell or Share My Personal Information” link on our Websites or by submitting a request as described in Section 8. Opt-out preferences are specific to the browser or device you use, so you will need to set them on each browser and device.

Do Not Track. Separately, some browsers send a "Do Not Track" signal. There is no common industry standard for Do Not Track, and our Websites do not respond to it. You can learn more at allaboutdnt.com.

Other ways to control tracking. You can also:

• block or remove cookies through your browser settings;
• limit the advertising ID on your mobile device through your device settings;
• use a privacy-focused browser or extension, such as Brave, Privacy Badger, DuckDuckGo, Ghostery, or uBlock Origin; and
• use advertising-industry opt-out tools at optout.aboutads.info (Digital Advertising Alliance) and optout.networkadvertising.org (Network Advertising Initiative), and platform opt-outs offered by partners such as Google (adssettings.google.com).

These choices are specific to each browser and device, so you will need to set them everywhere you use the Services.

10. State privacy rights

This section describes rights that may be available to residents of states with comprehensive privacy laws. These rights apply to the Personal Information we collect that is not governed by the GLBA or FIPA. If your contact with us is limited to visiting our Websites or communicating with us, your information is not GLBA-regulated and these rights apply.

These rights generally do not apply to:

• information we collect to provide a ZayZoon financial product or account, which is governed by the GLBA and FIPA; or
• information about representatives of businesses that buy from or sell to us, except where California law provides otherwise.

Categories of Personal Information we collect. The table below summarizes the categories of Personal Information covered by state privacy laws, along with our sources, purposes, recipients, and whether we sell or share each category. Financial-product and account information that is regulated by the GLBA or FIPA is not covered by these state-law rights and is described separately under “How this Notice works” above and in ZayZoon’s GLBA privacy practices or separate GLBA privacy notice, as applicable.

Category	Sources	Purposes	Recipients	Sold or shared?
Identifiers and contact or business information	You; your employer or payroll provider; Website forms and events; CRM and marketing data providers	Provide and support the Services; respond to requests; maintain accurate CRM and marketing records; security and fraud prevention	Service providers; affiliates; employer and payroll partners; legal and safety recipients	Not sold for money. Website marketing identifiers may be shared for cross-context behavioral advertising. You can opt out, including via GPC.
Internet, device, cookie, and network activity, and related inferences	Your browser or device; cookies and similar technologies; analytics and advertising partners; security tools; ZayZoon systems	Operate and secure the Websites; analytics; preference management; Website advertising measurement and targeting; marketing segmentation; product research	Analytics, advertising, and security providers and partners; affiliates; partners receiving aggregated or anonymized insights	Not sold for money. May be shared or “sold” under state-law definitions for Website advertising only. You can opt out, including via GPC.

Honoring deletion across states. As a matter of practice, we honor verified deletion requests regardless of the state you live in, subject to exceptions for AML, tax, audit, dispute-resolution, fraud-investigation, chargeback, security, completing a service you requested, other legal obligations, and similar purposes permitted by law.

Notice to California residents

The California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), gives California residents the rights described in Section 8, including the rights to know, access, correct, delete, opt out of the sale or sharing of Personal Information, and limit the use of sensitive personal information. A California "resident" includes anyone in the state other than temporarily, and anyone domiciled in the state who is temporarily away. The CCPA applies to California residents from whom we collect workforce-related information or information in certain business-to-business communications.

We do not sell Personal Information for money. We do “share” Personal Information for cross-context behavioral advertising on our Websites, as that term is defined under California law, and you can opt out. You can opt out by using the “Do Not Sell or Share My Personal Information” link on our Websites or by submitting a request as described in Section 8. We are implementing support for opt-out preference signals such as GPC, as described in Section 9.

Sensitive personal information. You can direct us to limit the use of your sensitive personal information to what is needed to provide the Services and other purposes the CCPA permits. We do not use sensitive personal information to infer characteristics about you.

Minors. We do not sell or share, or use for targeted advertising, the Personal Information of any consumer we know to be under 16 without the consent the CCPA requires, and we treat information of consumers we know to be under 16 as sensitive personal information.

Correction and explanation. We will correct inaccurate information on a verified request where doing so is not impossible or unreasonably burdensome. If we deny a request, we will explain why.

Non-discrimination. We will not discriminate against you for exercising your rights.

Notice to residents of other states

If you are a resident of another state with a comprehensive privacy law, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the rights described in Section 8, subject to your state's law.

Appeals. If your state provides a right to appeal and we deny your request, you may appeal by contacting us as described in Section 8. If we deny your appeal, you may contact your state attorney general. For example, Virginia residents may contact the Office of the Attorney General at (800) 552-9963; Colorado residents at coag.gov; and Connecticut residents at portal.ct.gov/AG.

Universal opt-out. Several states require us to honor a universal opt-out preference signal such as GPC. We are implementing support for these signals, as described in Section 9. In the meantime, you can opt out using the methods described above.

11. Linked websites

Our Websites may link to other sites we do not control. This Notice does not apply to those sites, and we are not responsible for their privacy practices. We encourage you to read the privacy notice of any site you visit.

12. Changes to this Notice

We may update this Notice from time to time. Changes take effect when we post the updated Notice, and we will note the date it was last updated at the top. We will tell you about material changes as required by law, for example by posting a notice on our Websites or emailing you. Your continued use of the Services after a change means you accept the updated Notice.

13. Contact us

If you have questions about this Notice, contact us at support@zayzoon.com or by mail at:

ZayZoon US Inc.

#300, 15051 N. Kierland Blvd

Scottsdale, AZ 85254