Privacy Policy

1. SCOPE AND APPLICATION

1.1 Covered Entities and Services

This Privacy Policy applies to all information collected by Bridge Capital LLC and its subsidiaries, affiliates, and agents through: (a) our website at www.bridgecapital.io and all associated subdomains; (b) our mobile applications; (c) our funding application portal; (d) email communications; (e) telephone communications; (f) text messages; (g) in-person interactions; and (h) any other means by which you interact with us.

1.2 Acceptance of Policy

By accessing our services, submitting an application, or otherwise providing information to us, you acknowledge that you have read, understood, and consent to the practices described in this Privacy Policy. If you do not agree with our practices, please do not use our services.

2. INFORMATION WE COLLECT

2.1 Personal Information

We collect the following categories of personal information:

• Identifiers: Full legal name, date of birth, Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN), driver's license number, passport number, home address, email address, telephone number;
• Financial Information: Bank account numbers, routing numbers, credit card information, credit history, credit scores, income information, tax returns, profit and loss statements, balance sheets;
• Business Information: Business name, Employer Identification Number (EIN), business address, industry classification, years in business, ownership structure, annual revenue, number of employees;
• Employment Information: Current occupation, employer name, employment history;
• Protected Classifications: We do not intentionally collect information regarding race, religion, sexual orientation, or other protected classifications;
• Biometric Information: We may collect electronic signatures and, in some cases, voice recordings for verification purposes;
• Internet Activity: IP address, browser type, operating system, device identifiers, pages visited, links clicked, time spent on pages;
• Geolocation Data: Approximate location based on IP address;
• Sensory Data: Recorded telephone calls for quality assurance and compliance purposes;
• Professional Information: Business licenses, certifications, professional references;
• Inferences: Profiles created based on collected information to assess creditworthiness and risk.

2.2 Sources of Information

We collect information from the following sources:

• Directly from You: When you complete applications, forms, or communicate with us;
• Automated Collection: Through cookies, web beacons, pixels, and similar technologies;
• Third-Party Data Providers: Credit bureaus (Experian, Equifax, TransUnion), business data providers (Dun & Bradstreet, LexisNexis), identity verification services;
• Financial Institutions: Through Plaid or similar services that connect to your bank accounts with your authorization;
• Public Records: UCC filings, court records, business registrations, property records;
• Our Funding Network: Information related to funding offers and decisions;
• Social Media: If you interact with us through social media platforms;
• Referral Sources: If you were referred to us by another party.

2.3 Sensitive Personal Information

We collect certain sensitive personal information as defined under applicable privacy laws, including Social Security Numbers, financial account credentials (via Plaid), and precise geolocation. This information is collected solely for purposes of providing our services and is protected with enhanced security measures.

3. HOW WE USE YOUR INFORMATION

3.1 Business Purposes

We use your information for the following business purposes:

• Application Processing: To evaluate, process, and facilitate your funding application;
• Identity Verification: To verify your identity and prevent fraud;
• Credit Assessment: To assess creditworthiness and determine eligibility for funding products;
• Lender Matching: To match you with appropriate funding partners based on your profile;
• Communication: To contact you regarding your application, offers, and account;
• Customer Service: To respond to inquiries and provide support;
• Legal Compliance: To comply with applicable laws, regulations, and legal processes;
• Security: To detect, prevent, and respond to fraud, abuse, and security incidents;
• Quality Assurance: To monitor and improve our services;
• Debt Collection: To collect amounts owed to Bridge Capital, including brokerage fees.

3.2 Commercial Purposes

We may also use your information for commercial purposes, including:

• Marketing: To send promotional communications about our services (with your consent where required);
• Analytics: To analyze trends, usage patterns, and effectiveness of our services;
• Product Development: To develop and improve our products and services;
• Personalization: To customize your experience and provide relevant offers.

3.3 Legal Bases for Processing (GDPR Compliance)

For individuals subject to the General Data Protection Regulation (GDPR), our legal bases for processing include: (a) performance of a contract; (b) legitimate business interests; (c) compliance with legal obligations; and (d) consent where specifically obtained.

4. INFORMATION SHARING AND DISCLOSURE

4.1 Categories of Recipients

We may share your information with the following categories of recipients:

• Capital Providers: Banks, merchant cash advance providers, and other funding sources to whom we submit your application;
• Service Providers: Companies that provide services on our behalf, including:
  • Cloud hosting providers (e.g., Vercel, AWS)
  • Payment processors (e.g., Airwallex, Stripe)
  • Bank connectivity services (e.g., Plaid)
  • Email service providers (e.g., Zoho, SendGrid)
  • Customer relationship management systems
  • Analytics providers
  • Document processing services
• Credit Bureaus: We may report payment information to consumer reporting agencies;
• Professional Advisors: Attorneys, accountants, auditors, and other professional advisors;
• Government Authorities: When required by law, subpoena, court order, or government investigation;
• Business Transfers: In connection with a merger, acquisition, or sale of assets;
• Affiliates: Companies under common ownership or control with Bridge Capital.

4.2 Data Processing Agreements

We require all service providers to enter into data processing agreements that obligate them to: (a) process personal information only as instructed by us; (b) implement appropriate security measures; (c) assist with data subject rights requests; and (d) delete or return personal information upon termination of services.

5. DATA SECURITY

5.1 Security Measures

We implement comprehensive administrative, technical, and physical security measures to protect your information, including:

• Encryption: All data in transit is protected using TLS 1.3 encryption. Sensitive data at rest is encrypted using AES-256 encryption;
• Access Controls: Role-based access controls, multi-factor authentication, and principle of least privilege;
• Network Security: Firewalls, intrusion detection systems, and regular vulnerability assessments;
• Physical Security: Data centers with 24/7 monitoring, biometric access controls, and environmental protections;
• Employee Training: Regular security awareness training for all personnel;
• Incident Response: Documented incident response procedures and regular testing;
• Vendor Management: Security assessments of all third-party service providers;
• Audit Logging: Comprehensive logging of system access and data modifications.

5.2 Data Breach Notification

In the event of a data breach affecting your personal information, we will notify you in accordance with applicable law. Notification will include the nature of the breach, types of information affected, steps we are taking, and actions you can take to protect yourself.

6. DATA RETENTION

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including:

• Active Applications: For the duration of the application process plus seven (7) years;
• Funded Transactions: For the life of the funding arrangement plus seven (7) years;
• Declined Applications: Three (3) years from the date of denial;
• Marketing Communications: Until you opt out, plus a reasonable period to process your request;
• Legal Compliance: As required by applicable law, regulation, or legal proceeding;
• Tax Records: Seven (7) years in accordance with IRS requirements.

7. YOUR PRIVACY RIGHTS

7.1 Rights Under California Law (CCPA/CPRA)

If you are a California resident, you have the following rights:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you;
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions;
• Right to Correct: You may request correction of inaccurate personal information;
• Right to Opt-Out of Sale/Sharing: Although we do not sell personal information, you may opt out of any future sales;
• Right to Limit Use of Sensitive Personal Information: You may limit our use of sensitive personal information to purposes necessary to provide our services;
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

7.2 Rights Under Other State Laws

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws may have similar rights. Please contact us to exercise your rights under applicable state law.

7.3 Exercising Your Rights

To exercise your privacy rights, please submit a request by: (a) emailing privacy@bridgecapital.io; (b) calling (888) 555-FUND; or (c) submitting a request through our website. We will verify your identity before processing your request and respond within the timeframes required by applicable law.

7.4 Authorized Agents

You may designate an authorized agent to make requests on your behalf. Authorized agents must provide proof of authorization and we may still require you to verify your identity directly.

8. SMS COMMUNICATIONS

8.1 SMS Opt-In and Consent

By providing your mobile phone number and opting in to receive text messages from Bridge Capital AI LLC, you consent to receive automated text messages regarding your funding application, account status, and related services. Message frequency varies based on your application status and account activity.

8.2 Message and Data Rates

Standard message and data rates may apply depending on your mobile carrier and plan. Bridge Capital AI LLC is not responsible for any charges incurred from your mobile carrier.

8.3 Opting Out of SMS

You may opt out of receiving text messages at any time by replying STOP to any message. After opting out, you will receive a confirmation message and no further texts will be sent unless you re-subscribe. Reply HELP for assistance or contact us at support@bridgecapital.io.

8.4 Types of Messages

• Application Updates: Notifications about your funding application status;
• Document Requests: Reminders to submit required documentation;
• Funding Alerts: Notifications when funds have been disbursed;
• Account Alerts: Important information about your account;
• Service Messages: Responses to your inquiries and support requests.

8.5 Carrier Disclaimer

Carriers are not liable for delayed or undelivered messages. Bridge Capital AI LLC reserves the right to modify or discontinue the SMS program at any time.

9. COOKIES AND TRACKING TECHNOLOGIES

9.1 Types of Cookies We Use

• Essential Cookies: Required for the operation of our website (e.g., session management, security);
• Analytics Cookies: Help us understand how visitors interact with our website (e.g., Google Analytics);
• Functional Cookies: Enable personalized features and remember your preferences;
• Marketing Cookies: Used to deliver relevant advertisements and track campaign effectiveness.

9.2 Managing Cookies

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our website. We honor "Do Not Track" signals and Global Privacy Control (GPC) signals where required by law.

10. CHILDREN'S PRIVACY

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will take steps to delete such information promptly.

11. INTERNATIONAL DATA TRANSFERS

Bridge Capital is based in the United States. If you access our services from outside the United States, your information may be transferred to, stored, and processed in the United States. By using our services, you consent to such transfer. We implement appropriate safeguards for international transfers, including Standard Contractual Clauses where required.

12. THIRD-PARTY LINKS

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these websites. We encourage you to review the privacy policies of any third-party sites you visit.

13. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. Material changes will be communicated by: (a) posting the updated policy on our website with a new effective date; (b) sending notice to your email address on file; or (c) displaying a prominent notice on our platform. Your continued use of our services after such changes constitutes acceptance of the updated policy.

14. CONTACT US

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

15. GRAMM-LEACH-BLILEY ACT NOTICE