Privacy Policy

Last Updated January 15, 2026

Affiniti Finance, Inc. together with its affiliates (collectively "Affiniti", "we", "us", “our”) places a high priority on the privacy of individuals who visit our website, affiniti.com      or other sites that link to this Privacy Policy (the “Site”) and/or the individuals and/or the businesses they represent who use our services (“you” or “User”) including our card platform or any of our other websites, networks, applications, mobile applications, or other services provided by us that link to this Privacy Policy (collectively, the "Affiniti Service" or “Service”).

The Affiniti Services include current and future financial products and services offered by Affiniti, including corporate and business payment cards, deposit and checking accounts, payment initiation and bill pay services, lending or credit products, treasury services, expense management, and related financial technology services, whether offered directly by Affiniti or through one or more financial institution partners.

When any of these activities occur, your      Information may be collected, processed, and/or shared by Affiniti. This Policy is designed to explain how we collect, use, store, retain, disclose by transmission, disseminate or otherwise make available (collectively “Process”) your      Information. For purposes of this Privacy Policy, “Information” includes all data collected, generated, received, or derived in connection with the Affiniti Services, including Personal Information (as defined below) and other information described in this Policy. Please be aware that the Affiniti Service is integrated with certain third parties (“Third-Party Service Providers”).

Our Terms of Service describes in detail why we need, and are sometimes required to, collect      Information. This Privacy Policy describes how we use that data, what we do with it and when we share it with other parties. If at any time you have questions about our Privacy Policy, please contact Affiniti at support@affiniti.finance. Capitalized terms that are not defined in these terms and conditions have the definitions provided in the Affiniti Terms of Service available for reference at affiniti.com/legal.

In connection with the provision of specific Services, we may provide additional "just-in-time" disclosures or additional information about our data processing practices. These notices may supplement this Privacy Policy, clarify our privacy practices in the circumstances described or may provide you with additional choices about how Affiniti processes your Information.

What Is Personal Information?

“Personal Information” is any information that relates to, and can be used to identify, you. It includes, but is not limited to, name, date of birth, home address, billing and shipping address, email address, photograph, government-issued identification information (such as driver’s license number, social security number or passport number), financial information (such as bank account details, payment card numbers, credit reports), authentication details, and IP address or other device information. Personal Information does not include information that does not identify a specific person or information that is publicly available through open databases.

As a provider of financial products and services, Affiniti is subject to the Gramm-Leach-Bliley Act (“GLBA”) and its implementing regulation, Regulation P. We collect and share nonpublic Personal Information (“NPI”) as necessary to provide our services and as permitted or required by law. You may have the right to limit certain sharing of NPI. We do not disclose your account numbers or access numbers to nonaffiliated third parties for marketing purposes, except as permitted under Regulation P.

Personal Information We Collect.

Affiniti processes Information at multiple stages of the customer relationship, including (i) when an individual or business applies for the Affiniti Services, even if an account is never opened; (ii) while a customer maintains an active account or otherwise uses the Affiniti Services; and (iii) after an account is closed or a customer ceases using the Affiniti Services, including where retention of information is required or permitted for legal, regulatory, compliance, audit, fraud prevention, dispute resolution, or internal business purposes.

Our ability to provide all features on the Site and Affiniti Service to you may be conditioned on you providing us with your Personal Information. This Personal Information may be sensitive in nature.

When you apply for an Account, Personal Information we collect may include your legal name, social security number, phone number, home and/or business address, employment information, and other identifying information. When your Company applies for an Account, we may collect additional information such as ownership, employment information, phone numbers, contact information, financials, spending, organizational documents and details, banking information, including real-time financial accounting information provided to and by third parties and linked accounts; credit information about the Company; and any information related to the compliance and/or enforcement with respect to federal and state anti-money laundering and Know Your Customer/Business laws, banking laws, and regulations (collectively “Application Information”). We may retain and process Application Information even if an application is incomplete, abandoned, denied, or withdrawn, including to comply with legal obligations, prevent fraud, conduct risk analysis, improve onboarding and underwriting processes, and maintain records required by applicable law.

In addition to collecting information about your identity, we may also collect information about your Transactions, such as amount, location, entity, and payment status (“Transaction Information”). When you interact with our support email, provide Feedback, or communicate with us, we collect any other Personal Information you submit (“Support Information”).

An Admin User may be granted administrative rights in your Account, including the right to allow more than one individual User from your organization to access your Affiniti Account. The Admin User may view all your Transactions and deactivate your Account in its sole discretion without recourse to you.

When you or your Company ask us to integrate your third-party accounts into the Affiniti Service, we use Third-Party Service Providers to access, process, and collect information about your and the Company’s financial and purchase activity. Any time you link an account from a Third-Party Service Provider, we may receive real-time, periodic, or ongoing data and information associated with the linked accounts, including account names, transaction history, account balances, bank routing numbers, unique identifiers, and related information (“Account Information”), and may continue to access and receive such information until the account is disconnected or access is otherwise revoked, subject to applicable law and the terms governing the integration.     .

When you interact with our Site, you will submit or create data, passwords, usernames, PINs, other login information, materials, rewards, and other content through our Site (“User Content”).

Why We Collect Information.

In general, the Information we collect from you is reasonably necessary to provide you with the Affiniti Services. We use your Personal Information to: comply with relevant financial regulations; process applications and onboard you; prevent or mitigate financial crimes such as fraud or

anti-money-laundering; manage our products and Services, including product and service testing and modeling; conduct a comprehensive risk analysis and risk report; communicate information about your Affiniti Account to Third-Party Service Providers and vendors; communicate information about any of your transactions; assess creditworthiness and evaluate whether you have the ability to make payments owed to us on time; and investigate inquiries or complaints. 

We also collect your Personal Information to customize offers to you, tailor our services or products for you, conduct marketing functions, maintain complete and accurate contact information, and fulfill our legal obligations with respect to the Bank Secrecy Act, anti-money laundering, counterterrorism, and other regulations. Specifically, we use your email and phone number to send you email marketing, text updates, and to respond to your queries on our Site, as applicable. We may share this Personal Information with hosting, CRM, email marketing, and SMS service providers.

We may also analyze your individual Account Information and Transaction Information to generate insights, reports, visualizations, recommendations, and other personalized outputs regarding your financial activity, usage patterns, risk profile, spending trends, and financial condition, and to present such insights to you through the Affiniti Services

We anonymize your Personal Information as part of and for our own processes and procedures for market research and new product development. To the extent permitted by law and without your express permission, we may also permit our Third-Party Service Providers or affiliates to use your Personal Information as set forth below. We do not sell or share your Personal Information, as such term is defined by the California Consumer Privacy Act.

We collect Application Information to determine whether you qualify for access to the Affiniti Services and to administer your Account. We also use your Application Information to inform you about new products or services.

We collect Account Information as you direct to provide services and integrations that leverage the support of Third-Party Service Providers and to determine your eligibility for an Account.

We collect User Content to authenticate your access to the Site and Affiniti Service, and to provide integrations with Third-Party Service Providers.

We collect Transaction Information to administer and secure the Affiniti Service, to improve our Site, and to fulfill our contractual obligations with your Company and our Third-Party Service Providers (such as providing you with rewards and rebates).

We collect Support information to assist you in using the Affiniti Service, and to improve, secure, and otherwise provide the Site.

How We Collect Personal Information.

Directly From You. Before you open an Account, we collect Application Information. When you use the Affiniti Services, you provide us with Support Information and User Content.

We collect this information either (1) in person; (2) through documentation you provide to us; (3) telephone calls with you or Third-Party Service Providers; (4) e-mails with you or Third-Party Service Providers; (5) the access provided to you on our websites and/or applications; (6) research using

Third-Party Service Providers and (7) ongoing communications with you or your Company’s employees or associated persons. We may also collect your Personal Information from individuals who are listed as associated with your Affiniti Account, public sources, yours or our advisor(s), introducers, referrers, brokers, credit reporting agencies, and other reporting organizations or exchanges that serve the financial services industries.

From Third Parties. When utilizing an integration, we collect Account Information from Third-Party Service Providers. If you request access to the Affiniti Service, we also obtain credit information from a credit checking service provider.

Automatically. We automatically collect Transaction Information and some User Content when you use the Affiniti Service and your card. Your Device may provide us the IP address of the computer or Device you use to connect with us online.

Your Privacy Choices and Opt-Out Rights

Federal law gives you the right to limit some, but not all, sharing of your Personal Information. You may request that we limit disclosure of your nonpublic Personal Information to non-affiliated third parties, unless the disclosure is required to provide our services, comply with the law, or is otherwise permitted by Regulation P. To limit our sharing, contact us at legal@affiniti.com or use any opt-out mechanism we may make available on the Site.

Disclosure Of Your Personal Information.

Third-Party Service Providers, Subprocessors, and Consultants. Affiniti engages certain third-party service providers, subprocessors, and consultants to carry out certain data processing functions to provide the Services. These third parties are limited to only accessing or using your Personal Information to provide services to us and must execute agreements to appropriately safeguard your Personal Information. Affiniti may engage, replace, or supplement Third-Party Service Providers that perform similar functions without providing individualized notice, provided that such providers are subject to contractual obligations to protect Personal Information and the processing is consistent with this Privacy Policy.  We do not disclose your Personal Information to non-affiliated service providers.  We disclose your Personal Information to the following categories of Third-Party Service Providers:

• Analytics: User Content, Account Information, Cookies, Transaction Information
• Security: All
• Customer Service, Payment Processor, and OFAC: Application Information, Account Information, Transaction Information, Support Information, User Content
• Rewards: Account Information, Transaction Information, User Content, Cookies
• Co-Marketing Partner: Account Information
• Credit Review, Customer Identification, Know Your Customer, Know Your Business: Application Information
• CRM: Application Information, Account Information, User Content, Cookies, Transaction Information
• Sponsor Bank and Financial Partners: All
• Servicer, Backup Servicer, and Servicing Partners: All
• Other Affiniti Products: All
• Hosting: All

Usage of Rightfoot

We use Charitize, Inc. (“Rightfoot”) to gather your Personal Information and/ or your company’s financial information, as applicable, from financial institutions associated with you and/or your company (collectively, “Financial Information”). By interacting with the services for which we use Rightfoot, you acknowledge and agree that we may provide information about you and/or your business, as applicable, in order for Rightfoot to access and retrieve such Financial Information. The terms of Rightfoot’s Privacy Policy (available here) govern Rightfoot’s collection, transfer, storage, and use of that information, and you consent to Rightfoot’s Privacy Policy. You also expressly grant Affiniti and Rightfoot the right, power, and authority to act on your behalf to access and transmit Financial Information from your financial institution(s) as reasonably necessary for Rightfoot to provide its services. You may withdraw your consent to these practices by contacting us at support@affiniti.finance; however, depending on your relationship with us, doing so may affect the products and services we provide to you, or our ability to provide such products and services.

Compliance with Legal Obligations. We may disclose your Personal Information to a third party if (i) we reasonably believe that disclosure is compelled by applicable law, regulation, legal process or a government request (including to meet national security or law enforcement requirements), (ii) to enforce our agreements and policies, (iii) to protect the security or integrity of our services and products, (iv) to protect ourselves, our other Users, or the public from harm or illegal activities, or (v) to respond to an emergency which we believe in good faith requires us to disclose information to assist in preventing a death or serious bodily injury. If Affiniti is required by law to disclose any Personal Information of you or your end-user, we will notify you of the disclosure requirement, unless prohibited by law. Further, we may object to requests we do not believe to be valid.

Business Transfers. If we go through a corporate sale, merger, reorganization, dissolution or similar event, Information may be part of the assets transferred or shared in connection with the due diligence for any such transaction. Any acquirer or successor of Affiniti may continue to process      Information consistent with this Privacy Policy.

Aggregated or De-Identified Data. Affiniti may share de-identified and/or aggregated Personal Information and Transaction Information with third parties for lawful purposes.     

Affiniti may generate and use aggregated, de-identified, anonymized, or otherwise derived data that is based on or derived from Personal Information, Transaction Information, or usage of the Affiniti Services (“Derived Data”). Derived Data does not reasonably identify you or any individual. Affiniti may use Derived Data for any lawful business purpose, including analytics, benchmarking, product development, risk modeling, improving the Affiniti Services, developing industry insights, and internal research, and may share Derived Data with third parties provided it does not reasonably identify you.

By supplying your Personal Information to Affiniti either directly or indirectly, you consent to your information being transferred across international borders to Affiniti and its affiliates, Third-Party Service Providers, and agents. Vendors and other outside contractors we engage are subject to our contractual requirements for safeguarding Personal Information.

Affiniti strives to ensure that any information collected from you or gathered about you is complete, accurate and up to date. We take reasonable steps to ensure we meet this goal by, among other things, requesting information from you on an ongoing basis, conducting research through third party services, researching publicly available information and searching for media associated with your Company.

Right to Financial Privacy Act (RFPA)

Where applicable, Affiniti complies with the Right to Financial Privacy Act, which restricts the disclosure of financial records about individuals to government authorities without valid legal process and notice. We will not disclose your financial records to government agencies unless authorized by law, compelled by valid legal process, or required under specific regulatory exceptions.

Information Security.

We use certain physical, organizational, and technical safeguards designed to protect      Information submitted to us, and we employ appropriate measures to protect      Information against unauthorized access, disclosure, alteration, or destruction. These measures may include, among others, physical access security, administrative security measures, data encryption, firewalls, and other appropriate technologies. Affiniti reviews and enhances its security systems as necessary.

Notwithstanding Affiniti’s efforts, no security measure is perfect or impenetrable and no method of transmission over the internet or electronic storage is 100% secure. Therefore, Affiniti cannot guarantee complete security of the transmission or storage of your      Information. It is important that you maintain the security and control of your account credentials, and not share your password with anyone. We offer our Users two-factor authentication which is designed to protect their account.

Data Retention

Affiniti retains Personal Information, Transaction Information, Account Information, Application Information, User Content, Support Information, Financial Information, and Derived Data for as long as reasonably necessary to provide the Affiniti Services, comply with applicable legal, regulatory, accounting, and reporting obligations, resolve disputes, prevent fraud, enforce our agreements, and protect the security and integrity of our business.

Certain laws and regulations applicable to financial institutions and financial technology companies require us to retain records for specified minimum periods, which may extend beyond the closure of your account or termination of your relationship with Affiniti.

Where retention is no longer required, we may delete, de-identify, anonymize, or aggregate Information in accordance with our data retention policies and applicable law. Requests to delete Information may be denied or limited where retention is required or permitted by law.

Following account closure or termination, Affiniti may continue to process retained Information for the purposes described in this Privacy Policy, including compliance, audits, investigations, fraud prevention, dispute resolution, internal analytics, and the creation and use of Derived Data.

Cookies.

Cookies are small data files that are stored in your device memory or on your hard drive when you visit a website. Cookies, including beacons, pixels, or trackers, may be used as a mechanism to recognize you, record behavior, and/or customize your experience with the Site. The information collected in this manner includes IP address, browser characteristics, device IDs and characteristics, operating system version, language preferences, referring URLs, location data, and information about your usage of the Service and Site, including pages viewed and interactions. Cookies can also be used to monitor Site activity, mitigate risk, measure the effectiveness of promotions and prevent potential fraud. If you choose to disable cookies, your use of the Site may be limited or otherwise affected. By using this Site, you permit us to collect and use your information related to Site access and device activity.

We place two kinds of cookies on the Site: essential and non-essential. Essential cookies help us operate the Site by authenticating you, tracking your session, and other essential Site functions. You cannot opt out of Essential cookies and the Site may not work if you disable them. We use information from essential cookies, for example, to ensure that the Service functions properly, to determine how many Users have visited certain pages or opened messages, or to prevent fraud.

Non-essential Cookies help us track activity on the Site, effectiveness of advertisements, and performance data. We also work with analytics providers which use cookies and similar technologies to collect and analyze information about use of the Service and report on activities and trends.

You may stop or restrict the placement of non-essential cookies and other similar technologies on your device or remove them by adjusting your preferences as your browser or device permits. The online advertising industry also provides websites from which you may opt out of receiving targeted ads from data partners and other advertising partners that participate in self-regulatory programs. You can access these, and also learn more about targeted advertising and consumer choice and privacy, at www.networkadvertising.org/managing/opt_out.asp, https://youradchoices.ca/choices/, and www.aboutads.info/choices/. Alternatively, for some devices you may use your Device’s platform controls in your settings to exercise choice. Please note you must separately opt out in each browser and on each Device. If, however, you do not accept cookies, you may experience some inconvenience in your use of the Site or Service.

By using the Site, you consent to the placement of cookies, beacons, pixels, trackers, and similar technologies in your browser and on emails in accordance with this Policy.

Online Tracking.

Some browsers incorporate a Do Not Track feature that signals to websites you visit that you do not want to have your online activity tracked. Tracking is not the same as using or collecting information in connection with a single website. For these purposes tracking refers to collecting personally identifiable information from consumers who use or visit a website or online service as they move across different websites over time.

How browsers communicate the Do Not Track signal is not yet uniform. As a result, the Site is not yet set up to interpret or respond to Do Not Track signals communicated by your browser. Even so, as described more fully throughout this Privacy Policy, we limit our use and collection of your Personal Information.

For a description of Do Not Track protocols for browsers and mobile devices, or simply to learn more about the choices available to you, you can visit the All About Do Not Track

website: http://allaboutdnt.com.

Our Website May Be Linked To Other Websites.

We may use third party analytics vendors to evaluate and provide us with information about your use of the Site and/or the Affiniti Service. We do not share your information with these third parties, but these analytics service providers may set and access their own cookies, pixel tags and similar technologies on the Site.

You may also access certain third party services through our Site, including, but not limited to Patriot Bank, N.A. The privacy policies or your agreements with these Third-Party Service Providers will govern their collection, use, disclosure and processing of your Personal Information; read more about Patriot Bank’s Privacy Practices here.

The Site And Affiniti Service Are Not Directed At Persons Under The Age Of 18 Years Old.

The Affiniti Service is intended for business use only and is not directed at persons under the age of 18. If you are a parent or guardian and believe we may have collected information about a person under the age of 18, please contact us at the email address or phone number set out at the beginning of this Policy. If we determine that we have inadvertently collected Personal Information from a person under the age of 18, we will promptly delete such information from our records to the extent permitted by applicable law.

California Privacy Rights (CCPA / CPRA)

If you are a resident of California, you have certain rights under the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”). These include the right to:

• Know the categories and specific pieces of Personal Information we collect;
• Request deletion of your Personal Information;
• Opt out of the sale or sharing of your Personal Information;
• Correct inaccuracies in your Personal Information;
• Limit use and disclosure of sensitive Personal Information;
• Not be discriminated against for exercising your privacy rights.
  

Affiniti does not sell or share your Personal Information as defined under CCPA. To exercise your rights, you may contact us at legal@affiniti.com. You may also designate an authorized agent to make a request on your behalf.

We collect and retain Personal Information as outlined in this Privacy Policy. The categories of information we collect and the purposes for which we use it are disclosed in the sections above.

Changes To This Privacy Policy.

The "Last Updated" date at the top of this page indicates when this Policy was last revised. From time to time, Affiniti may make changes to this Policy, so we encourage you to check back and review it regularly to ensure you are aware of current practices. If you disagree with the changes, you must stop your use of the Affiniti Service and discontinue use of our Site. Your continued use of the Affiniti Service and/or the Site following the effective date of any change, constitutes your consent to any modification to this Policy.

Contact Us.

If you have any questions about this Policy, or you want to make a complaint regarding any breach of your privacy by us, you want to correct or update your Personal Information in our possession, or you want to opt out of collection of Personal Information if such right is provided by applicable law, you may contact us at support@affiniti.finance. You may also write us at:

Affiniti Finance, Inc.

Attn: Privacy

147 West 24th Street

Floor 4

New York, NY 10011

‍