Privacy Policy

1. Scope

This Privacy Policy explains how Rise Digital Financial Corp ("Zivo," "we," "us") collects, uses, shares and protects personal information when you use the Zivo: Cash Advance app, the zivoneobank.com website and related services (the "Service"). It also serves as our privacy notice under the Gramm-Leach-Bliley Act for the financial products we offer. By using the Service you agree to this Policy.

2. Information We Collect

Information you give us: your mobile number, name, email address, date of birth, state of residence and mailing address; a live selfie and images of your government-issued photo ID, plus the data extracted from that ID (name, ID number, date of birth, address, expiration date); your language preference; and messages you send to support.

Information from your linked accounts: when you connect a bank account through Plaid or a payroll provider through Pinwheel we receive account identifiers, account and routing numbers (tokenised), balances, transaction history, income and paycheck deposits, employer name and pay-cycle information. This data powers membership eligibility, ZivoAdvance™ limits, settlement scheduling, Insights and Zivo Pulse.

Information about your activity: advances requested, fees, settlement history, membership status, Zivo Pulse changes, notification preferences, in-app actions and support conversations.

Information from your device: device model, operating system, app version, language, time zone, a device identifier, IP address, push-notification token (via OneSignal) and crash and performance logs. We do not collect precise geolocation, contacts, photos other than the captures you take for verification, or microphone audio.

Face ID and Touch ID are handled entirely by Apple on your device; Zivo never receives your biometric template. The facial geometry derived from your verification selfie is processed by our automated identity-verification technology (see Section 5) only to compare it with your ID photo, and is not used to identify you elsewhere.

Website: zivoneobank.com uses no advertising cookies, no third-party analytics and no tracking pixels. Our hosting provider records standard server logs (IP address, browser type, pages requested) for security and performance.

3. How We Use Information

We use personal information to: verify your identity and prevent fraud, duplicate accounts and money laundering; determine eligibility for membership and ZivoAdvance™ and set advance limits; deliver advances and collect settlements; bill membership fees; predict paydays and generate Insights, budgets and Zivo Pulse; send security codes, transactional notices and, with your consent, product updates; provide customer support; maintain, secure and improve the Service; comply with legal obligations and respond to lawful requests; and enforce our Terms.

We do not sell personal information, do not share it with third parties for their own marketing or advertising, do not use advertising SDKs or tracking pixels, and do not use your information for cross-app tracking or targeted advertising. The app does not request App Tracking Transparency permission because it does not track. We do not make solely automated decisions that produce legal effects about you without human review being available on request.

4. How We Share Information — Our Service Providers

We share personal information only with service providers that process it on our behalf, under contract, for the purposes listed below. They may not use it for their own purposes. The providers we use today are:

Plaid Inc. — bank-account connectivity and ACH transfers. When you link your paycheck account through Plaid Link, Plaid receives your bank login (which Zivo never sees) and provides us with account identifiers, tokenised account and routing numbers, balances, transaction history and income and deposit data. Used for eligibility, advance limits, payday prediction, settlement scheduling, Insights and Zivo Pulse. Plaid Transfer, Plaid's ACH service, also moves money on our instructions through Plaid's originating bank partners: ACH credits to deliver advances to your linked account and ACH debits for membership fees and advance settlement. For each transfer Plaid receives your name, the tokenised account identifier, and the amount, date and purpose of the transfer. Zivo never stores full account or routing numbers.

Pinwheel — payroll connectivity (optional). If you connect your payroll provider, Pinwheel receives your payroll login (which Zivo never sees) and provides us with employer, pay-cycle and paycheck information used to verify income and align settlement with payday.

OpenAI (OpenAI, L.L.C.) — automated document and income analysis. We send the images of your government-issued ID and your verification selfie to OpenAI's API to read the ID, check it for signs of tampering and compare the face on the ID with your selfie. We may also send paycheck-deposit records (dates, amounts and payer descriptions from your linked account) to OpenAI's API to detect your pay cycle and estimate your next payday. See Section 5 for how this works, what OpenAI may do with the data and your consent.

OneSignal, Inc. — push notifications. OneSignal receives a push-notification token, a device identifier, your Zivo user ID, device model, OS version, app version, language and time zone in order to deliver notifications about advances, settlements, security and (if you opt in) product updates.

Twilio Inc. — SMS. Twilio receives your mobile number and the content of one-time security codes and service texts we send you.

Resend, Inc. — email. Resend receives your email address, name and the content of transactional emails (receipts, notices, support replies) we send you.

Hosting and infrastructure — Supabase, Inc. (database and file storage, hosted on Amazon Web Services in the United States), Railway Corp. (application servers for the Zivo backend) and Vercel Inc. (hosting for zivoneobank.com). These providers store and transmit data for us but do not access it except to operate their platforms.

Sponsor and originating banks and payment networks (for example the bank that originates ACH entries through Plaid Transfer) receive the account numbers, names and amounts needed to settle each transfer, as required by NACHA rules. We may engage additional ACH or payment processors in the future and will update this Policy before they receive your information.

We do not use third-party analytics, advertising or crash-reporting SDKs in the Zivo app.

Other disclosures. Legal and safety: regulators, law enforcement or other parties when required by law, subpoena or court order, or when we believe disclosure is necessary to prevent fraud, protect rights or safety, or enforce our Terms. Corporate transactions: if Rise Digital Financial Corp is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy. With your direction: for example, when you ask us to share information with your bank or employer.

5. Automated Identity Verification and Income Analysis (Artificial Intelligence)

We use OpenAI's API, an artificial-intelligence service operated by a third party, to help verify identity documents and analyze income patterns. During onboarding, the photo of your government-issued ID and your live selfie are transmitted (encrypted) from our servers to OpenAI's API, which returns the text it reads from the ID, an assessment of whether the document appears genuine, and a judgement of whether the face on the ID matches your selfie. After you link a bank account, we may send OpenAI's API your paycheck-deposit history (dates, amounts and payer descriptions — not your name, account number or login) so that it can identify your pay cycle and predict your next payday. OpenAI does not receive your bank credentials, card details or Zivo account identifiers.

The AI output is one input to our verification and eligibility rules; it is reviewed against our own checks and a Zivo team member can review any outcome on request. Images and data sent to OpenAI's API are not used to train OpenAI's models: under OpenAI's API data-usage terms, API inputs and outputs are not used for training by default (see openai.com/enterprise-privacy and openai.com/policies/api-data-usage-policies). OpenAI may retain API inputs and outputs for up to 30 days to monitor for abuse and then deletes them.

Your consent. Before you capture your ID and selfie, the app tells you that your images will be analyzed by an automated identity-verification service operated by a third-party provider (OpenAI) on our behalf, and you confirm that you agree before continuing. If you do not consent you cannot complete identity verification and cannot activate a membership, because verification is required by our compliance program. You may withdraw consent at any time by deleting your account (Section 9).

6. Third-Party Terms

Plaid's collection and use of your information is governed by the Plaid End User Privacy Policy (plaid.com/legal). Pinwheel's is governed by its privacy policy (pinwheelapi.com). OpenAI's handling of API data is governed by its API data-usage and enterprise-privacy terms (openai.com/enterprise-privacy). OneSignal's is governed by its privacy policy (onesignal.com/privacy). By linking an account or completing verification you agree that those providers may collect, use and share your information as described in their policies and this Policy.

7. Retention and Deletion

We keep personal information for as long as your account is open and afterwards as needed to meet legal, regulatory, tax, audit and fraud-prevention obligations. Identity-verification images and extracted ID data are retained for the period required by our compliance program (generally five years after account closure) and then deleted; copies sent to OpenAI's API are deleted by OpenAI within 30 days. Linked-account transaction data is retained while the account is linked and for a limited period afterwards to support dispute resolution. ACH transfer records held by Plaid are retained as required by NACHA rules. Push tokens are deleted when you uninstall the app or delete your account. Support conversations are retained for up to three years.

How to delete your account and data: in the app open You (your profile settings) → Delete account, or email support@zivoneobank.com from the email address on your account. Deletion is permanent. Before deletion any open advance must be settled and your membership is cancelled. We will delete or de-identify your personal information within 30 days, except for records we must keep under the obligations above, and we will instruct our service providers to do the same.

8. Security

We protect personal information with encryption in transit (TLS) and at rest, tokenisation of bank credentials, access controls limited to staff who need access, logging and monitoring, and regular review of our providers. Bank credentials are never seen or stored by Zivo — they are entered directly with Plaid. No method of transmission or storage is completely secure; if a breach affects you we will notify you as required by law.

9. Your Choices and Rights

Access, correct, delete: you can view and edit your profile in the app, disconnect linked accounts, and delete your account from You (your profile settings) → Delete account. You can also email support@zivoneobank.com to request a copy of your data, correction of inaccurate data or deletion, subject to the retention obligations above.

Notifications: manage push notifications in iOS Settings → Notifications → Zivo. Reply STOP to opt out of marketing SMS; security codes and required service messages will still be sent.

State privacy rights: depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas, Oregon or Florida) you may have the right to know what personal information we hold, to request deletion or correction, to obtain a portable copy, to opt out of sale, sharing or targeted advertising (we do none of these) and not to be discriminated against for exercising your rights. Submit requests to support@zivoneobank.com; we will verify your identity before responding, and you may use an authorised agent where the law allows.

Federal financial privacy (GLBA): because much of the information we collect is non-public personal financial information, we share it only as permitted by the Gramm-Leach-Bliley Act — to service your account, to prevent fraud, with your consent or as required by law. There is no opt-out available for these sharing categories because we do not share for marketing purposes.

10. Children

The Service is for adults 18 and older. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us information, contact support@zivoneobank.com and we will delete it.

11. Location of Processing

Zivo is offered only in the United States and your information is processed and stored in the United States, including by the service providers listed in Section 4. Some service providers may process technical data in other countries under appropriate safeguards.

12. Changes to This Policy

We may update this Policy from time to time. Material changes will be announced in the app or by email before they take effect. The current version, with its effective date, is always at zivoneobank.com/privacy.

13. Contact

Privacy questions and requests: support@zivoneobank.com. Postal notices: Rise Digital Financial Corp, 323 Sunny Isles Blvd, 7th Floor, Sunny Isles Beach, FL 33160. For information about how Zivo is regulated, see zivoneobank.com/disclosures.