Benjamin Privacy Policy

This policy is provided in English. English is the controlling language.

Summary

This is a summary. The full policy follows and controls.

• Who we are. Benjamin is a personal budgeting and financial insights app operated by Wasder, Inc., a Delaware corporation.
• We never see your banking passwords. Account connections are handled by Plaid Inc. Your financial institution credentials go to Plaid, not to us.
• We do not sell your personal information. We do not share it for cross-context behavioral advertising. We do not use it for third-party marketing.
• We use AI. We use automated systems, including large language models provided by third-party vendors acting as our service providers, to generate the insights you see. Those vendors are contractually prohibited from training their models on your data.
• We do not currently collect credit reports or credit scores. If we ever do, it will require your separate, express authorization on its own screen.
• You control your connections. You can disconnect any account and delete your Benjamin account at any time.
• Questions. gm@wasd3r.com

1. Scope

1.1 This Privacy Policy explains how Wasder, Inc. ("Wasder," "we," "us," "our") collects, uses, discloses, and protects personal information in connection with the Benjamin application, the Benjamin product pages at wasd3r.com/products/benjamin, and related services (the "Services").

1.2 This Policy applies only to the Services. Other products operated by Wasder, Inc. under different brands are governed by their own separate privacy policies and are not covered here. The Services do not involve cryptocurrency, stablecoins, or blockchain-based assets of any kind.

1.3 The Services are offered only to individuals located in the United States who are 18 or older. The Services are not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it. Contact gm@wasd3r.com.

1.4 This Policy is incorporated into the Benjamin Terms of Service.

2. Information we collect

2.1 Information you give us

• Account information: name, email address, password (stored only as a salted hash), and optionally a phone number.
• Profile and preferences: financial goals, budget targets, categories you create or rename, notification settings.
• Support communications: messages, feedback, and attachments you send us.
• Survey and interview responses: responses you provide during the beta program, if you choose to participate.

2.2 Financial account information, via Plaid

When you connect a financial account, we receive from Plaid the data you have authorized, which may include:

• account type, account name, institution name, and a masked account number;
• account holder name and address as reported by the institution, where available;
• current and available balances;
• transaction history, including amount, date, merchant name, category, and, for some merchants, location;
• recurring transaction and subscription patterns identified from that history;
• for credit cards and loans: outstanding balance, credit limit, interest rate or APR, minimum payment amount, next payment due date, and last statement balance;
• for investment accounts, if you connect one: holdings, positions, and investment transactions.

We do not receive, see, or store your online banking username, password, PIN, or multi-factor authentication codes. Those are handled by Plaid and your financial institution.

2.3 Credit report information

We do not currently collect, request, or receive consumer reports, credit reports, or credit scores from any consumer reporting agency. Any credit-related view in the Services today is calculated from the connected accounts described in Section 2.2 and is not a consumer report or a credit score.

If we introduce credit report features in the future, we will not obtain that information about you unless you first provide separate, express, affirmative authorization on its own screen, distinct from this Policy and from the Terms of Service. See Section 9 of the Terms of Service.

2.4 Information collected automatically

• Device and technical data: device type, operating system version, app version, language, time zone, IP address, and mobile advertising identifier only if you permit it.
• Usage data: screens viewed, features used, session timestamps, tap and scroll events, and crash and error logs.
• Cookies and similar technologies: on our website, for authentication, session management, security, and aggregate analytics. We do not use advertising cookies or third-party ad trackers.

2.5 Sensitive personal information

We do not currently collect Social Security numbers, government identification numbers, precise geolocation, biometric data, health data, racial or ethnic origin, religious beliefs, sexual orientation, or union membership.

Financial account information and account login credentials are treated as sensitive under some state laws. We collect financial account information as described in Section 2.2. We do not collect your banking login credentials at all.

If we ever need a Social Security number to support a credit report feature, we will tell you why at the point of collection, collect it only with your separate authorization, and disclose how it is stored and retained.

3. How we use information

We use personal information for the following purposes and no others without telling you first:

• Provide the Services: retrieve and display your accounts, categorize transactions, build budgets and cash-flow views, detect recurring charges, and generate insights.
• Generate insights: automated analysis, including artificial intelligence, as described in Section 4.
• Personalize: tailor the content, suggestions, and educational information we show you.
• Communicate: service messages, security alerts, support responses, and product updates you have not opted out of.
• Improve the Services: debug, measure feature performance, and improve the accuracy of categorization and insights, using aggregated or de-identified data wherever it is sufficient for the purpose.
• Security and fraud prevention: authenticate you, detect and investigate unauthorized access, abuse, and suspicious activity.
• Legal compliance: comply with applicable law, respond to lawful requests, and enforce our agreements.

We do not use your personal information to:

• sell or rent it to anyone;
• serve you third-party advertising or share it for cross-context behavioral advertising;
• build consumer reports, credit scores, or scoring models;
• create data products sold to third parties;
• train the general-purpose models of any third-party AI vendor;
• make decisions about your eligibility for credit, insurance, employment, or housing.

4. Automated processing and artificial intelligence

4.1 The Services use automated processing, statistical methods, machine learning, and large language models to categorize transactions, detect patterns, generate summaries, and produce the insights and suggestions you see. These are generated substantially or entirely without individualized human review.

4.2 Third-party AI service providers. To generate insights, we may transmit financial account data, or information derived from it, to third-party artificial intelligence providers that act as our service providers. We contract with these providers to require that they:

• process the information only on our documented instructions and only to deliver the Services;
• not use the information to train, fine-tune, or otherwise improve their own general-purpose models;
• not retain the information beyond what is necessary to return a result to us, subject to any minimum retention required by law;
• maintain appropriate administrative, technical, and physical safeguards;
• not sell or share the information or use it for their own purposes; and
• be bound by confidentiality and by restrictions at least as protective as this Policy.

4.3 Data minimization in AI processing. Where a task can be performed with derived or aggregated features rather than raw records, we use the derived features. We do not transmit your name, email address, account numbers, or banking credentials to third-party AI providers.

4.4 Credit report information is excluded. If credit report features are ever activated, we will not transmit consumer report data, credit scores, or any field extracted from a consumer report to any third-party AI provider. That information would be processed only within systems we control.

4.5 Automated output can be wrong. Automated systems can produce results that are inaccurate, incomplete, outdated, or unsuitable for your circumstances. Insights are informational only. If an insight appears materially inaccurate, tell us at gm@wasd3r.com and we will investigate and correct it where we can.

4.6 No automated decisions with legal effects. We do not use automated processing to make decisions that produce legal or similarly significant effects about you, such as denying you credit, insurance, employment, or housing.

5. How we disclose information

We do not sell personal information and we do not share it for cross-context behavioral advertising. We have not done so in the preceding 12 months.

We disclose personal information only as follows:

• Plaid Inc. receives your instruction to connect an account, and you authenticate directly with Plaid. This is how we establish and maintain connections to your financial institutions. Plaid's own handling of your information is governed by the Plaid End User Privacy Policy at plaid.com/legal. You can review and manage your Plaid connections at my.plaid.com.
• Cloud infrastructure and hosting providers store and process Service data in encrypted form, so that we can operate the Services.
• Third-party AI providers receive financial data or derived features, as limited by Section 4, to generate insights.
• Analytics and error monitoring providers receive device, usage, and crash data so we can measure performance and fix defects.
• Customer support tooling receives your support messages and account identifiers so we can respond to you.
• Professional advisors receive information as needed for legal, accounting, and audit services, under confidentiality obligations.
• Legal and safety recipients receive information where required to comply with law, valid legal process, or a governmental request; to enforce our Terms; or to protect the rights, property, or safety of Wasder, our users, or the public.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, information may transfer to the successor. We will notify you, and any acquirer will remain bound by this Policy for information collected before the transfer, or you will be given notice and a choice before any material change.

All service providers act on our behalf, are bound by written contracts, and are prohibited from using your information for their own purposes.

We do not disclose your information to nonaffiliated third parties for their own marketing purposes.

6. Financial privacy and security

6.1 We treat information obtained from your connected financial accounts as nonpublic personal information. We do not disclose it to nonaffiliated third parties except as described in Section 5, which is limited to service providers acting for us, legal compliance, and business transfers.

6.2 We maintain a written information security program with administrative, technical, and physical safeguards designed to protect personal information, consistent with the FTC Safeguards Rule and applicable law. Controls include:

• encryption of data in transit and at rest;
• access limited to personnel with a business need, under least-privilege principles;
• multi-factor authentication for administrative access;
• logging and monitoring of access to production systems;
• logical separation of credit report data from other data, with its own access controls and retention limits, if and when such data is ever collected;
• vendor security review before onboarding any service provider that will process personal information;
• an incident response plan, including notification to affected users and regulators where required by law.

6.3 No system is perfectly secure. We cannot guarantee absolute security. Protect your account by using a strong, unique password and enabling any additional security features we offer. Report suspected unauthorized access to gm@wasd3r.com.

7. Retention

7.1 We retain personal information only as long as necessary for the purposes described in this Policy, or longer where required by law.

7.2 Backups are purged on a rolling schedule. Data deleted from production may persist in encrypted backups for up to 90 days before being overwritten.

8. Your choices and rights

8.1 Available to everyone, regardless of where you live

• Disconnect an account in the app at any time. This stops further data retrieval from that institution.
• Delete your account in the app, or by emailing gm@wasd3r.com. See Section 7 for what happens to your data.
• Access a copy of your data by emailing gm@wasd3r.com. We will provide it in a portable, machine-readable format.
• Correct your information in the app for profile data, or by emailing gm@wasd3r.com. Note that we cannot correct data supplied by your financial institution. Contact the institution directly.
• Opt out of marketing email using the unsubscribe link in any marketing message, or by emailing gm@wasd3r.com. You will still receive essential service and security messages.
• Turn off notifications in the app or in your device settings.

8.2 State privacy rights

Depending on your state of residence, you may have the right to: know the categories and specific pieces of personal information we have collected; know the categories of sources, purposes, and recipients; delete personal information; correct inaccurate personal information; obtain a portable copy; opt out of sale, sharing, or targeted advertising; limit the use of sensitive personal information; and appeal a denial of a request.

We do not sell personal information, do not share it for cross-context behavioral advertising, and do not process it for targeted advertising or profiling that produces legal or similarly significant effects. There is therefore nothing to opt out of in those categories, but you may still submit a request.

Submitting a request. Email gm@wasd3r.com or use the in-app privacy controls. We will verify your identity using information already associated with your account, and we will not require you to create an account to make a request. We respond within 45 days and may extend once by 45 days with notice.

Authorized agents. An authorized agent may submit a request on your behalf with written permission signed by you. We may contact you to confirm.

Appeals. If we deny your request, you may appeal by replying to our response or emailing gm@wasd3r.com with the subject line "Privacy Appeal." We will respond within 45 days. If we deny your appeal, we will tell you how to contact your state attorney general.

Non-discrimination. We will not deny you services, charge different prices, or provide a different level of quality because you exercised a privacy right.

8.3 Global Privacy Control

Our website honors the Global Privacy Control browser signal as a valid opt-out request where required by law.

8.4 California residents

In addition to the rights above, California residents may request the categories of personal information disclosed for a business purpose in the preceding 12 months. That information is in Section 5. We have not sold or shared personal information in the preceding 12 months, and we do not have actual knowledge of selling or sharing the personal information of anyone under 16.

Under California Civil Code Section 1798.83, California residents may request information about disclosure of personal information to third parties for their direct marketing purposes. We make no such disclosures.

Under California Civil Code Section 1789.3, the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs may be contacted in writing at 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210.

9. Categories of personal information

Collected in the preceding 12 months, using the categories defined by California law:

We retain each category as described in Section 7.

10. Third-party services

10.1 The Services depend on and may link to third-party services, most importantly Plaid. Those services have their own privacy policies, which we encourage you to read. We are not responsible for their practices.

10.2 The Services may display educational information about third-party financial products. Clicking through to a third party's site takes you to a service governed by that party's privacy policy.

11. International users

The Services are intended for individuals located in the United States, and personal information is processed and stored in the United States. If you access the Services from outside the United States, you do so on your own initiative.

12. Changes to this policy

12.1 We may update this Policy. We will post the updated version with a new "Last updated" date.

12.2 If a change materially affects how we use or disclose personal information, we will provide at least 30 days' advance notice by email or in-app notice before it takes effect.

12.3 A change to this Policy will never, by itself, authorize us to collect a consumer report or credit score about you. That authorization must always be given separately, as described in Section 2.3 and in Section 9 of the Terms of Service.

12.4 We will not materially change how we use previously collected personal information without your consent.

13. Contact us

Wasder, Inc. 300 Grant Avenue, San Francisco, California 94108

• Privacy requests, questions, support, and security reports: gm@wasd3r.com
• Legal notices: legal@wasd3r.com

Benjamin is a product of Wasder, Inc.