Privacy and Data Protection Policy

Information We Collect Directly from You

• First and last name
• Email address
• Phone number

Account information

• First and last name
• Email address

Information you make available on or through the Services:

• First and last name
• Email address
• Billing address
• Date of birth
• Social Security number

Information required for Know Your Customer checks and compliance with the USA PATRIOT Act when opening card accounts:

• First name, middle name, last name
• Social Security number
• Address
• Date of birth
• Driver’s license or government-issued ID

For the Fold Bitcoin Credit Card specifically:

• Employment information (employer name, job title, income)
• Financial information (annual income, housing costs, existing debts)
• Transaction history and payment patterns
• Credit utilization and balance information
• Bank account information for payments and autopay

Job applicant details:

• Information included in your resume or CV, references, job history, and other information collected as part
  of evaluating your candidacy.

‍

Third-Party Service Providers

To enable certain features of the Services (including, without limitation, payments, instant funding/ACH, card issuance, credit underwriting, identity verification, and the financing of credit products), we work with various financial institutions, lenders, financial services providers, and other third-party service providers. When you use these features, we share only the information necessary for the provider to perform its respective services. Except as noted below, payment card and bank account information is collected and stored by the relevant provider, not by us.Please review each provider’s privacy policy. Current third-party service providers include (but are not limited to):

• Stripe, LLC (card issuing, processing, and servicing): Provides card-issuing services; processes payment information to collect and settle payments, perform KYC/AML processes, and monitor for transaction fraud; and provides card servicing services. Privacy policy: stripe.com/us/privacy.
• Astra, Inc. (instant funding and ACH): Processes bank account information to complete instant-funding and ACH transfers. Privacy policy: astra.finance/privacy.
• Sutton Bank (Fold Prepaid Debit Card issuer): Collects and uses Personal Data to issue and service your Fold Prepaid Debit Card. Privacy policy: suttonbank.com.
• Celtic Bank (issuing bank for the Fold Bitcoin Credit Card): Collects and uses Personal Data to evaluate applications (including obtaining consumer reports), underwrite, originate, service, and enforce your Fold Bitcoin Credit Card account. Celtic may share information with consumer-reporting agencies and with its service providers, payment networks, and regulators as permitted by law. Fold acts as a program manager/service provider to Celtic and may receive limited account information (e.g., application and account status, transaction metadata) solely to operate the program, calculate rewards, provide support, and prevent fraud. Fold does not make credit decisions. To the extent your information is collected, processed,or disclosed by Celtic as a financial institution, such processing is subject to Celtic’s GLBA privacy notice and related disclosures, which control in the event of any conflict with this Privacy Policy. For GLBA sharing choices and FCRA notices (including how Celtic reports to credit bureaus), please review Celtic’s privacy policy and notices. If you set up autopay or link a bank account for payments, any bank-account linking may be facilitated by an open-banking provider (e.g., Plaid), and your credentials are provided directly to that provider, not to Fold. Privacy policy: celticbank.com/privacy.
• Incode Technology, Inc. (identity verification): Collects information including biometric data to verify your identity. Privacy policy: incode.com/incode-privacy-policy.
• Very Good Security, Inc. (tokenization): Stores sensitive data and returns tokenized values. Privacy policy: verygoodsecurity.com/privacy-notice.
• BitGo Trust Company, Inc. (digital-asset custody): Provides digital-asset custody and settlement services. Privacy policy: bitgo.com/legal/bitgo-privacy.
• Plaid Inc. (open-banking): Facilitates bank account linking. Credentials are provided to Plaid, not to Fold.Privacy policy: plaid.com/legal.
• Marqeta, Inc. (card processing): Provides card-issuing and processing services. Privacy policy: marqeta.com/services-privacy.
• Unit21, Inc. (fraud/AML): Provides fraud/AML analytics and case management. Privacy policy:unit21.ai/privacy-policy.
• SardineAI Corp. (fraud/risk): Provides fraud and risk-decisioning tools. Privacy policy: sardine.ai/privacy-policy.

Fold does not take responsibility for the content, products, services, or privacy policies of third-party services. Weencourage you to carefully review the privacy policies of any third-party services you access.

‍

Information We Automatically Collect

Some Personal Data is automatically collected when you use our Services:

• IP address,
• Web browser information,
• Operating system information,
• Pages you visit and links you click on in connection with Services
• Certain Cookies (see below for more information).

When you access or use the Services, we use information from your web browser and your device’s settings and unique identifiers to reliably and accurately provide you with the Services. Our Services may contain web beacons that permit us to count website visitors and compile similar statistics.

For fraud protection purposes only, we collect your battery usage, device identifier, device storage, MAC address,and SIM information; and we collect enough information to determine if you are trying to fake your current location using a VPN or similar tools.

‍‍

Information We collect From Third Parties

We may obtain information about you from third parties, including: (i) referees and other third parties whom you authorize to provide us with information; (ii) third-party data providers that assist us in verifying your identity; and(iii) consumer reporting agencies (credit bureaus) in connection with credit product applications and ongoing account servicing. Any information we obtain from third parties will be treated in accordance with this Privacy Policy

‍

Consumer Report Information (Credit Card Applicants)

If you apply for or hold a Fold Bitcoin Credit Card, Celtic Bank (the issuing bank and creditor) will obtain consumer reports (“credit reports”) from one or more consumer reporting agencies to evaluate your application, set credit terms, and service your account. This may include:

• Credit history and credit scores
• Public records (bankruptcies, judgments, liens)
• Existing credit accounts and payment history
• Inquiries from other creditors

Celtic Bank makes all credit decisions for the Fold Bitcoin Credit Card. Fold does not make credit decisions and does not have access to your full credit report.

‍

Additional Information About Cookies

The Services use “Cookies” to enable our servers to recognize your web browser and tell us how and when you visit and use our Site and Services. Cookies are small files placed on your device when you use that device to visit our Site.

Cookies can be “session Cookies” (temporary, stored while you visit) or “persistent Cookies” (stored for a period after you leave). We use persistent Cookies to track how often you visit and how your use varies over time.

Your browser may offer a “Do Not Track” option. Like many websites, our website is not designed to respond to such signals, and we do not use or disclose your information in any way that would legally require us to recognize opt-out preference signals.

We use the following types of Cookies:

• Essential Cookies: Required for providing features or services you have requested. Disabling these may make certain features unavailable.
• Analytics Cookies: We use analytics Cookies, including Google Analytics, to help improve our Site by collecting and reporting information on how you use it.‍
• Advertising and Third-Party Tracking Cookies: With your consent, third-party advertising, attribution, and analytics providers may place Cookies, pixels, or similar technologies on our Site that collect information about your online activities over time and across different websites and online services. These providers use that information to measure our advertising campaigns and to show you ads for Fold on other websites and services. These Cookies are non-essential and are placed only if you accept them in our Cookie preference center.

You can manage your Cookie preferences at any time using the Cookie preference center on our Site at https://foldapp.com/?cmpscreen, or through your browser settings. Selecting “Reject All” works to prevent non-essential Cookies from being placed on your device and, if you previously accepted them, works to stop further non-essential Cookie activity. Note, the App does not use browser Cookies. The App uses SDKs provided by our service providers to support App functionality, fraud prevention, identity verification, and product analytics. Certain SDKs are necessary to operate the Services and to meet our legal obligations related to fraud prevention and identity verification. You can limit certain tracking in the App through your device settings, including by declining the App Tracking Transparency prompt on Apple devices.

‍

How Do We Use Your Personal Data?

We process Personal Data to operate, maintain and understand our Services. For example, we use Personal Data to:

• Verify and establish your account
• Verify, establish, and maintain your Fold Prepaid Debit Card account with Sutton Bank
• Verify, establish, and maintain your Fold Spending Account with Lead Bank
• Verify, establish, and maintain your Fold Bitcoin Credit Card with Celtic Bank, including facilitating the credit application and underwriting process
• Coordinate with business partners to assist opening accounts or facilitate your use of Fold Services
• Process and fulfill your purchases of the Services or other products
• Calculate, track, and distribute bitcoin rewards
• Protect against or deter fraudulent, illegal, or harmful actions
• Communicate with you about the Services, including updates, offers, and newsletters
• Provide support and assistance for the Services
• Identify trends and statistical information useful to our business
• Comply with our legal or contractual obligations
• Respond to user inquiries and fulfill user requests
• Resolve disputes
• Enforce our Terms and Conditions

‍

How and With Whom Do We Share Your Data?

We disclose Personal Data to three types of recipients. The first is our affiliates, meaning companies under common ownership or control with Fold, Inc., which may use Personal Data only for the purposes described in this Privacy Policy. The second is service providers, meaning vendors and agents that process Personal Data on our behalf and on our instructions and that are contractually prohibited from using it for their own purposes. The third is third parties, including our bank partners and other financial institutions, that also process Personal Data for their own purposes as separate controllers under their own privacy notices. We employ practices to limit each disclosure to the minimum information required for the recipient’s purpose. Categories of service providers and third parties include:

• Business partners
• Hosting service providers 
• Email providers
• Payment processors
• Card manufacturing, personalization, and delivery providers
• Banking and financial partners and payment networks
• Consumer reporting agencies (credit bureaus) for credit product servicing and reporting
• Analytics providers
• Cloud communication service providers
• Delivery providers
• Other contractors as needed for business purposes
• Lending partners and financial institutions involved in credit product origination and servicing

We also share Personal Data when necessary to:

• Comply with applicable law or respond to valid legal process
• Protect us, our business, or our users (e.g., enforce Terms, prevent fraud)
• Respond to emergencies involving potential threats to physical safety
• Act on your express consent
• Complete a transaction in which we or substantially all of our assets are acquired, or in which we enter bankruptcy

Text Messaging Opt-In Data

Notwithstanding any other provision of this Privacy Policy, we do not sell, share, or provide mobile information, including your mobile phone number and text messaging originator opt-in data and consent, to third parties or affiliates for marketing or promotional purposes. All categories of disclosure and sharing described in this Privacy Policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, excluding aggregators and providers of the text message services, who act on our behalf and may not use it for their own purposes.

‍

Credit Reporting and Furnisher Practices

For Fold Bitcoin Credit Card account holders, Celtic Bank (as the creditor and card issuer) reports information about your account to one or more consumer reporting agencies (credit bureaus). This is standard practice for credit products and helps build your credit history. The information reported may include:

• Account opening date
• Credit limit
• Current balance
• Payment history (including on-time and late payments)
• Account status (open, closed, charged-off, etc.)
• Whether the account is disputed

Celtic Bank maintains written policies and procedures to ensure the accuracy and integrity of the information reported, as required by the Fair Credit Reporting Act and Regulation V. If you believe information reported about your account is inaccurate, you have the right to dispute that information.

‍

Your Rights Under the Fair Credit Reporting Act (FCRA)

If you apply for or hold a Fold Bitcoin Credit Card, you have important rights under the Fair Credit Reporting Act:

• Right to Know if Information Was Used Against You: If your application is denied or other adverse action is taken based on a consumer report, you must be told and given the name, address, and phone number of the consumer reporting agency that provided the report.
• Right to a Free Credit Report: If adverse action is taken, you can request a free copy of your credit report from the consumer reporting agency within 60 days.
• Right to Dispute Inaccurate Information: You can dispute the accuracy or completeness of any information in your credit report. Consumer reporting agencies must investigate disputes (usually within 30 days) and correct or delete inaccurate information.
• Right to Accurate Reporting: Furnishers (including Celtic Bank) must report accurate information and investigate disputes forwarded by consumer reporting agencies.
• Right to a Security Freeze: You can place a security freeze on your credit report, which prohibits a consumer reporting agency from releasing information without your express authorization.• Right to Opt Out of Prescreened Offers: You may opt out of receiving prescreened offers by calling 1-888-5-OPTOUT (1-888-567-8688).

For more information about your FCRA rights, visit consumerfinance.gov/learnmore or write to the Consumer Financial Protection Bureau, 1700 G Street N.W., Washington, DC 20552.

‍

Adverse Action Notices

If your application for the Fold Bitcoin Credit Card is denied, or if other adverse action is taken on your account based on a consumer report, Celtic Bank will provide you with an adverse action notice. This notice will include:the name, address, and phone number of the consumer reporting agency; a statement that the agency did not make the adverse decision; your right to obtain a free copy of your credit report; and your right to dispute the accuracy of any information. If a credit score was used, you will also receive your score and the key factors that adversely affected it.

‍

How Do We Protect Your Personal Data?

We seek to protect Personal Data using appropriate technical and organizational measures, including:

• Limiting Personal Data tracking and only storing what we need to deliver the Services
• Employing “least privilege principles,” meaning employees only access data necessary for their role
• Limiting our use of third-party services to only those required
• Using encryption for data in transit and at rest
• Maintaining access controls and authentication measures
• Conducting regular security assessments and monitoring

We understand the importance of security, but we cannot promise that our security measures will eliminate all risks.Despite reasonable efforts, no security measures are impenetrable. Unauthorized entry, hardware or software failure, and other factors may compromise security at any time. We recommend that you do not use unsecure channels to send us sensitive information.

‍

Data Breach Notification

In the event of a data breach involving your Personal Data, we will notify you in accordance with applicable law. If a breach is reasonably likely to result in identity theft or other significant harm, we will notify affected individuals as required by applicable state and federal laws.

‍

Data Retention

We retain your information for as long as is reasonably necessary for the purposes specified in this Privacy Policy. We consider whether we need the information to administer your account, provide Services, resolve disputes, enforce agreements, prevent harm, promote safety and integrity, or protect our rights and property.

For credit card accounts, we are required by law to retain certain records for specified periods. For example, certain transaction records must be retained after the account is closed.

‍

Do We Collect Personal Data of Children?

We do not knowingly collect or solicit Personal Data from anyone under the age of 18. If you are under 18, please do not attempt to register for the Services or send any Personal Data to us. If we learn that we have collected Personal Data from a child under 18, we will delete that information as quickly as possible. If you believe that a child under 18 may have provided us Personal Data, please contact us at support@foldapp.com.

‍

California and Other US State Residents

This section applies to California residents and is provided to comply with the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”). This section is also drafted to satisfy our required disclosures as legally applicable to users of our Services, regardless of their state of residence.

‍

Information We Collect and Disclose

Within the last twelve (12) months, we have collected the following categories of Personal Data from the sources and for the business purposes explained in this Privacy Policy, and have disclosed them for a business purpose to the categories of recipients provided below:

‍