EXCHKR Privacy Policy

This Privacy Policy is not a contract and does not create any legal rights or obligations.

This Privacy Policy describes how EXCHKR Inc. and our corporate subsidiaries and affiliates (collectively, "EXCHKR Inc.", "we", "us", or "our") collects, uses and shares your personal information if you visit exchkr.com or our other websites or services that link to this Privacy Policy (collectively, the "Services"), contact us, receive our communications, or attend our events.

Links to Third-Party Sites

This notice does not apply to any third-party applications, integrations, or websites that may link to, or be accessible from, our sites and tools. We are not responsible for any of the content, features, functionality, or privacy practices of such linked third-party applications, integrations, or websites. The data collection and use practices of any linked third-party application, integration, or website will be governed by that third party's applicable privacy notice, statement, or policy, and its terms of use. We encourage you to read them.

Individuals in Europe

We provide important information for individuals in Europe below.

Personal Information We Collect

Information you provide to us. Personal information you provide to us through the Services may include:

• Contact information, such as your first and last name, email address, phone number, organization role, professional title, and organization name.
• Profile information, such as your username and password and any account preferences for the Services.
• Feedback or correspondence, such as information you provide when you contact us with questions, feedback, or otherwise correspond with us.
• Usage information, such as information about how you use the Services and interact with us, including information you provide when you use any interactive features of the Services.
• Financial information, including account balances and dues amounts, membership information including names and contact information for members, and any information tied to Stripe or Plaid usage or accounts with an affiliated bank to the extent that EXCHKR sees that info.
• Marketing information, such as your preferences for receiving communications about our products, activities, and publications, and details about how you engage with our communications.
• Financial transaction information, such as your dues amounts, account balances, and transaction history associated with your use of the Services.
• Other information that we may collect which is not specifically listed here, but which we will use in accordance with this Privacy Policy or as otherwise disclosed at the time of collection.

Information we obtain from social media platforms.We may maintain pages for EXCHKR Inc. on social media platforms, such as Instagram, TikTok, Twitter, Substack, and LinkedIn. When you visit or interact with our pages on those platforms, the platform provider's privacy policy will apply to your interactions and their collection, use, and processing of your personal information. You or the platforms may provide us with information through the platform, and we will treat such information in accordance with this Privacy Policy.

If you choose to connect your account on a third-party platform or network to the Services, we may collect information from that platform or network. For example, this information may include your username, profile picture, and other profile information. You may also have the opportunity to provide us with additional information via the third-party platform or network, such as a list of your connections. You can read more about your privacy choices for social media networks and other third-party platforms below.

Information we obtain from other third parties. We may receive personal information about you from third-party sources, such as marketing partners, publicly-available sources, and data providers.

Cookies and Other Information Collected by Automated Means. We, our service providers, and our business partners may automatically log information about you, your computer or mobile device, and activity occurring on or through the Services. The information that may be collected automatically includes your computer or mobile device operating system type and version number, manufacturer and model; device identifier; browser type; screen resolution; IP address; the website you visited before and/or after browsing to our website; location information such as city, state or geographic area; and information about your use of and actions on the Services, such as pages or screens you viewed, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, access times, and length of access. Our service providers and business partners may collect this type of information over time and across third-party websites and mobile applications. See our Cookie Policy for more information.

How We Use Your Personal Information

We use your personal information for the following purposes and as otherwise described in this Privacy Policy or at the time of collection:

To operate the Services. We use your personal information to: provide, operate, and improve the Services; establish and maintain your user profile on the Services; facilitate social features of the Services, such as our blog; communicate with you about the Services, including by sending you announcements, updates, security alerts, and support and administrative messages; understand your interests and personalize your experience with the Services; provide support and maintenance for the Services; and respond to your requests, questions, and feedback.

To power AI-assisted features.When you use AI-assisted features (including "Buck," our in-app assistant, and AI-powered document import) we send the information needed to answer your question or complete the requested action to our AI service providers in real time. This may include the raw contents of financial or membership records you upload (such as budget spreadsheets, rosters, or contracts), account and transaction data, and your chat messages, and may include personal information about other individuals in your organization who did not directly interact with the Services. See "How We Share Your Personal Information" below for the providers involved.

To train and improve AI models.Separately, we may use information about how you use the Services — including your queries, chat interactions, and confirm/edit decisions on AI-suggested actions — to develop, train, and improve our AI features. Before being used for this purpose, this information is de-identified. We do not use the raw contents of financial or membership records you upload to train AI or machine-learning models; only de-identified copies of chat interaction data may be used for this purpose, as described under "To create anonymous data" below. As of the date of this policy, we have not used this data to train or fine-tune any AI model.

For research and development. We analyze use of the Services to improve the Services and to develop new products and services.

To send you marketing and promotional communications. We may send you marketing communications as permitted by law. You can opt out of our marketing and promotional communications as described below.

To comply with law. We use your personal information as we believe necessary or appropriate to comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities.

For compliance, fraud prevention, and safety.We may use your personal information and disclose it to law enforcement, government authorities, and private parties as we believe necessary or appropriate to: (a) protect our, your, or others' rights, privacy, safety, or property (including by making and defending legal claims); (b) enforce the terms and conditions that govern the Services; and (c) protect, investigate, and deter against fraudulent, harmful, unauthorized, unethical, or illegal activity.

With your consent. In some cases we may specifically ask for your consent to collect, use, or share your personal information, such as when required by law.

To create anonymous data. We may create aggregated and other anonymous data from your personal information and other individuals whose personal information we collect. We make personal information into anonymous data by removing information that makes the data personally identifiable to any individual. We may use this anonymous data and share it with third parties for our lawful business purposes, including to analyze and improve the Services and promote our business.

How We Share Your Personal Information

We do not share your personal information with third parties without your consent, except in the following circumstances or as otherwise described in this Privacy Policy:

Affiliates. We may share your information with our corporate parents and affiliates for purposes consistent with this privacy policy.

Service providers. We may share your personal information with the following third-party service providers that help us operate the Services: Render (hosting), Stripe (payment processing), Plaid (bank account linking), Unit.co (banking infrastructure), Resend (email delivery), and Anthropic, Groq, Together AI, and OpenAI (AI-assisted features).

As of the date of this policy, these service providers have their privacy policies at the following urls:

• Resend: resend.com/privacy
• Stripe: stripe.com/privacy
• Plaid: plaid.com/legal
• Unit.co
• Render: render.com/privacy
• Anthropic: anthropic.com/legal/privacy
• Groq: groq.com/privacy-policy
• Together AI: together.ai/privacy
• OpenAI: openai.com/policies/privacy-policy

Large-Language Model Providers and other AI Companies. We use LLM providers to provide the services. These providers retain certain rights to use personal information they receive in providing us services to train their models and improve their products and services.

Partners. We may sometimes share your personal information with business partners or enable them to collect information directly via our Services. See our Cookie Policy for more information about third parties that collect information through our Services with cookies and similar technologies.

Third-party platforms and social media networks.If you have enabled features or functionality that connect the Services to a third-party platform or social media network (such as by connecting your account with a third party to the Services or sharing content via a third-party platform), we may disclose the personal information that you authorized us to share. We do not control the third party's use of your personal information.

Other Users of the Services. We may provide functionality that enables you to disclose personal information to other users of the Services. For instance, organization administrators and treasurers may be able to view member information such as names and email addresses within their organization. We do not control how other users use any personal information that you make available to them through the Services.

Professional advisors. We may disclose your personal information to professional advisors, such as lawyers, bankers, auditors, and insurers, where necessary in the course of the professional services that they render to us.

For compliance, fraud prevention and safety. We may share your personal information for the compliance, fraud prevention and safety purposes described above.

Government Requests. Notwithstanding anything to the contrary in this policy, we may preserve or disclose your information if we believe that it is reasonably necessary to comply with a law, regulation, or legal request or to protect the safety, property, or rights of EXCHKR or others. However, nothing in this policy is intended to limit any legal defenses or objections that you may have to a third party or government request to disclose your information.

Business transfers. We may sell, transfer, or otherwise share some or all of our business or assets, including your personal information, in connection with a (potential) business transaction such as a corporate divestiture, fundraising round, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution.

Your Choices

In this section, we describe the rights and choices available to all users.

Access or update your information. If you have registered for an account with us, you may review and update certain personal information in your account profile by logging into your account.

Opt out of marketing communications. You may opt out of marketing emails by following the unsubscribe instructions at the bottom of the email. You may continue to receive service-related and other non-marketing emails.

Text messaging opt-in. Phone numbers and SMS consent collected for text message updates are used solely to send you the messages you signed up for. We do not sell or share your mobile opt-in information or SMS consent with any third parties for marketing or promotional purposes, under any circumstances.

Cookies & browser web storage. For information on how to disable cookies and similar technologies used in the Services, see our Cookie Policy.

Choosing not to share your personal information. Where we are required by law to collect your personal information, or where we need your personal information to provide the Services to you, if you do not provide this information when requested (or you later ask to delete it), we may not be able to provide you with the Services. We will tell you what information you must provide to receive the Services by designating it as required at the time of collection or through other appropriate means.

Third-party platforms or social media networks. If you choose to sign in to the Services using a third-party account such as Google or Apple, we will collect certain information from those platforms such as your name and email address. You may be able to limit the information shared with us through your Google or Apple account settings. If you disconnect your Google or Apple account from our Services, that choice will not apply to information we have already received from those platforms.

Other Sites, Mobile Applications, and Services

The Services may contain links to, or content or features from, other websites and online services operated by third parties. These links are not an endorsement of, or representation that we are affiliated with, any third party. In addition, our content may be included on web pages or in mobile applications or online services that are not associated with us. We do not control third-party websites, mobile applications, or online services, and we are not responsible for their actions. Other websites and services follow different rules regarding the collection, use, and sharing of your personal information. We encourage you to read the privacy policies of the other websites and mobile applications and online services you use.

Security Practices

The security of your personal information is important to us. We employ a number of organizational, technical and physical safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information. As of the date of this policy, it is our policy to use the following security practices:

• Password protection: user passwords are hashed using crypt before storage. Our policy is to not store passwords in plain text.
• Encrypted transmission: data transmitted over the internet between your device and our Services is encrypted using HTTPS/TLS.
• Database security: we use parameterized queries designed to protect against unauthorized database access.
• Session security: user sessions are managed via JWT tokens that expire after 24 hours, with refresh tokens expiring after 7 days. Tokens are validated on every request.
• Bank linking security: bank linking tokens provided by Plaid are encrypted at rest and not stored as plain text.

However, no security measures are perfect or impenetrable, and we cannot guarantee the security of your personal information.

Data Retention

We retain your information for as long as necessary to provide you and our other users the EXCHKR platform.

We retain your information for as long as necessary to provide you the EXCHKR platform, as follows:

• Account and profile information (name, email, organization role) — retained for as long as your account is active. Upon account deletion, we delete your personal information within 90 days.
• Transaction records (dues payments, disbursements, payment history) — retained for 7 years to comply with tax and accounting obligations.
• Bank linking information (via Plaid) — we do not store raw bank account credentials or account numbers. Bank linking tokens are passed directly to Unit.co and are not retained by EXCHKR. Retention of such information is subject to the policies of Plaid and Unit.co.
• Login and security logs (IP address, login timestamps, device data) — retained by EXCHKR for 90 days.
• AI assistant conversations ("Buck") — raw chat logs are retained for 7 days, after which they are de-identified; de-identified copies are retained for 12 months to support future AI model development. Uploaded documents processed via AI-assisted import (rosters, budgets, contracts) are not stored after processing; only the resulting proposed actions are retained pending your approval. Connected expense sheets are retained until replaced or disconnected.
• Support communications (emails sent to our support address) — retained by EXCHKR for 2 years.

We also retain your information as necessary to comply with our legal obligations, resolve disputes, and enforce our terms and policies.

We use session cookies to keep you logged in to your account. These cookies are essential for the platform to function and are automatically deleted when you log out or after a period of inactivity.

Your California Privacy Rights

This section covers California rights other than the Consumer Privacy Rights Act (CCPA).

Shine Your Light Law.Under California law, California residents are entitled, once per calendar year, to ask us for a notice identifying the categories of personal customer information that we share with certain third parties for the third parties' direct marketing purposes, and providing contact information (i.e., names and addresses) for these third parties. If you are a California resident and would like a copy of this notice, please submit a written request to us via email at team@exchkr.com. You must put the statement "Your California Privacy Rights" in your request and include your name, street address, city, state, and ZIP code. We are not responsible for notices that are not labeled or sent properly, or do not have complete information.

Do Not Track.Some Internet browsers may be configured to send "Do Not Track" signals to the online services that you visit. We currently do not respond to "Do Not Track" or similar signals. To find out more about "Do Not Track," please visit www.allaboutdnt.com. This is distinct from our response to opt-out signals such as Global Privacy Control (aka GPC).

Your Nevada Rights

Effective May 20, 2026

You may review and request changes to your information or opt-out of the sale of your personal information at: team@exchkr.com

International Data Transfers

We are headquartered in the United States and have service providers in other countries, and your personal information may be transferred outside of your state, province, or country to the United States or other locations where privacy laws may not be as protective as those in your state, province, or country.

Children

The Services are not directed to, and we do not knowingly collect personal information from, anyone under the age of 17. If we learn that we have collected personal information of a child without the consent of the child's parent or guardian, we will delete it. We encourage parents with concerns to contact us.

Changes to this Privacy Policy

We may amend this Privacy Policy by posting the amended version on the Services and indicating the effective date of the amended version. We may announce any material changes to this Privacy Policy through the Service and/or via email if we have your email address. In all cases, your continued use of the Services after the posting of any modified Privacy Policy indicates your assent to the amended Privacy Policy.

How to Contact Us

If you have any questions or comments about this Policy or EXCHKR Inc.'s privacy practices, email us at team@exchkr.com. You may also write to us via postal mail at:

EXCHKR Inc.
Attn: Legal – Privacy
16 Highland Way, Scarsdale, NY 10583