Privacy Policy

1. Introduction

Cleo Financial Inc. (“Cleo,” “we,” “us,” or “our”) is committed to protecting your privacy and earning your trust. This Privacy Policy describes our practices concerning personal information we collect when you use our payment processing services, commercial card programs, financial accounts, 1099 and W9 record collection, and other financial reporting and services (collectively, the “Services”).

This Privacy Policy discloses our privacy practices regarding the collection, use, disclosure, and safeguarding of your information. By accessing or using our Services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy.

2. Information We Collect

We collect several categories of personal information from and about our users. The following table outlines the categories of personal information we collect, from whom we collect it, and the business purpose for collection.

3. Sources of Information

We collect your personal information in the table listed above from various sources. For example, we collect and obtain information:

Directly from you. We collect personal information you provide to us, such as when you create an account, complete transactions, communicate with us via phone, email, online form, or in any other way in connection with our Services.

From third parties. We collect personal information stored with third parties that you choose to provide to Cleo, such as information you may have provided to a third-party application that you authorized to provide information to us. By linking your third-party accounts, you authorize Cleo to have access to this information and you agree that Cleo may collect and use this information in accordance with this Privacy Policy. We may also collect your personal information from third parties such as financial institutions, data aggregators, credit bureaus, law enforcement, identity verification and fraud prevention services, and pre-employment background check companies.

When you visit our website or use our Services. We use analytics software when you visit our website. Our analytics providers may also use analytics software to collect information on our behalf.

4. Cookies and Tracking Technologies

Cookies

In operating our website and services, we may use cookies. Cookies are small text files which are placed on your browser when you visit a website, open or click on an email, or interact with an advertisement. Our website uses session cookies (which expire when you close your browser) and persistent cookies (which expire at a set expiration date or when you manually delete them). We incorporate both first-party cookies (which are cookies served directly by us) and third-party cookies (which are cookies served by third parties we work with).

We use cookies for a variety of purposes, including to:

• Help make our website work
• Personalize your browsing experience
• Prevent fraud and assist with security
• Perform measurement and analytics
• Provide advertising (including targeted advertising)

If you would prefer not to accept cookies when using our website or Services, please follow the instructions provided by your website or mobile browser (usually located within the “Help”, “Tools” or “Edit” facility) to modify your cookies settings. Please note that if you disable cookies, you may not be able to access certain parts of our website or Services and other parts may not work properly.

Web Beacons

In addition to cookies, we may use web beacons (also known as “clear GIFs”), which are transparent graphic images placed on a web page or in an email and indicate that a page or email has been viewed or tell your browser to get content from another server. We use web beacons to measure traffic to or from, or use of, our online forms, tools or content items and related browsing behavior and to improve your experience when using our Services.

5. How We Use Your Information

Over the past twelve months, and on an ongoing basis, we may use the information we collect about you to do the following:

• To research, develop, customize and improve your experience with our Services
• Provide the Services to you
• Validate your account
• Notify you about your account activity
• Process transactions and collect fees
• Provide customer support and resolve disputes
• Verify your identity, contact, and account information
• Open, verify, and operate your commercial card accounts and financial accounts, including verifying your identity with our banking and card partners
• Authorize, process, settle, and monitor your card and account transactions and resolve related disputes
• Identify, prevent, and report potentially prohibited, fraudulent, or illegal activities
• Notify you about important changes to our Services and/or our terms and conditions
• To promote, market, and advertise the Services
• To notify you about your payment and/or payment request
• We may also provide you with news, offers, and information about our Services based on your communications preferences
• Comply with legal and regulatory obligations under applicable law
• Any other purpose that we disclose to you in the course of providing our Services

We may also merge or otherwise combine your information in furtherance of the purposes above.

If you apply for or are employed by Cleo, we may also use your information for the following purposes:

• To develop and improve your experience with employment including to generate analytics
• To process your application, assess your qualifications or to communicate with you about employment
• To administer pay and other benefits that are a part of your employment package
• To provide general business management and operation
• For accounting, financial reporting and business planning
• To ensure your safety and the security of company-held information
• To perform pre-employment background checks where permitted by law
• To comply with legal and regulatory obligations under applicable law
• For any purpose as reasonably required by Cleo in connection with your application for and during the course of your employment with Cleo

6. Disclosure of Your Information

Over the past twelve months, and on an ongoing basis, we may share your personal information for the following business purposes:

• When you send or receive money using our Services, we will provide the other party to the financial transaction appropriate details about the transaction
• With financial institutions and other partners that are part of the payment process
• With our service providers to provide, maintain, and improve our Services, including for fraud prevention, identity verification, auditing, marketing, advertising, analytics, maintenance, security, or for other related business purposes. We strive to contractually prohibit these service providers from retaining, using, or disclosing your personal information for any purpose other than performing agreed-upon services for us.
• To the extent analytics software is used to improve the functionality of our website, analytics providers may receive information about your use and interaction with the software in order to assist us with providing and improving our Services
• If you are offered or accept employment with us, we may share your information with credit bureaus, pre-employment background check providers

Payment, Card, and Financial Account Service Providers

To provide money movement, commercial card, and financial account features within our Services, we work with third-party financial service providers, including Dwolla, Inc. and Stripe, Inc. (together with Stripe Payments Company and its bank partners, “Stripe”). When you enroll in or use these features, we collect and share personal and financial information about you and your business with these providers and their banking partners as needed to establish and operate your accounts, verify your identity, process and settle transactions, prevent fraud, and meet legal and regulatory obligations.

• Commercial cards. Cleo commercial spend cards are issued by Celtic Bank through Stripe. When you apply for or use a Cleo card, we collect and share identifying and financial information, which may include your name, date of birth, a government-issued identification number such as a Social Security number or Employer Identification Number, address, and financial account details, with Stripe and Celtic Bank to verify your identity, open and maintain your card account, and comply with applicable customer identification, Bank Secrecy Act, and anti-money-laundering requirements. Details of your card transactions, such as the merchant, amount, date, and location of a purchase, are shared with Stripe, Celtic Bank, and the applicable card networks to authorize, clear, settle, monitor, and resolve disputes relating to those transactions.
• Financial accounts. Cleo financial accounts are provided through Fifth Third Bank, N.A. by means of Stripe. When you open or use a Cleo financial account, we collect and share identifying and financial information with Stripe and Fifth Third Bank, N.A. to verify your identity, open and operate the account, hold and move funds, and meet applicable regulatory requirements. Funds in your financial account are held at Fifth Third Bank, N.A.

By enrolling in these features, you acknowledge that you are also entering into a relationship with the applicable bank partner, and that your information will be handled in accordance with the privacy notices of Stripe and the relevant bank in addition to this Privacy Policy. You are responsible for the accuracy and completeness of the information you provide. You can review these providers’ privacy practices in the Stripe Privacy Policy at stripe.com/privacy and in the privacy notices of Celtic Bank and Fifth Third Bank, N.A.

Other than as stated in this Privacy Policy, Cleo does not disclose, share or sell any of your personal information to third parties without your consent. Please note that third parties, such as merchants that you pay and third-party websites that you visit, have their own privacy policies. Cleo is not responsible for the policies and practices of such third parties and we encourage you to review their privacy policies.

Other Circumstances for Disclosure

• Cleo may release information to third parties upon your request
• Cleo may release your information to governmental, legal, or regulatory authorities if we believe disclosure is reasonably necessary to comply with any applicable law, legal process, or government request; to investigate or bring legal action against someone who may be violating our rights, our terms and conditions, or the rights of others; or to protect the safety and security of Cleo, our users, or the public
• Cleo may also share individual personal information and aggregated, non-personally identifiable information with third parties who provide analytics, marketing and advertising services
• Cleo may also release your information to an acquirer if we are involved in a merger, acquisition, or sale of all or a portion of our stock or assets. If this occurs, you will be notified of any change to this Privacy Policy, as well as any choices you may have regarding your personal information

7. Sale or Sharing of Personal Information

Cleo does not “sell” or “share” any of your sensitive personal information (e.g., social security number, driver’s license number, financial information, etc.). Cleo only uses your sensitive personal information to the extent necessary to provide the Services.

Our sharing of your personal information, including sensitive information such as a government identification number or financial account information, with our payment, card, and financial account providers and their banking partners is a disclosure for a business purpose to provide the Services you request. It is not a “sale” or a cross-context “sharing” of your personal information for advertising purposes.

8. Cross-Border Data Transfers, Retention, and Protection of Information

Cross-Border Transfers: We may transfer your personal information to a jurisdiction other than the one from which we have collected your personal information, including to countries that may not have the same level of protections as the country where you are located. If we do transfer your personal information to another jurisdiction, we will do so following due diligence and provided that the data recipient is subject to contractual agreements imposing obligations on it to ensure appropriate technical and organizational measures are implemented and maintained at all times to prevent the unauthorized and unlawful processing of personal information, and the accidental loss or destruction of, or damage to, personal information, consistent with our obligations under applicable data protection laws. By using our Services, you agree to the transfer of your personal information to other jurisdictions.

Retention of Personal Information: We will retain your personal information for as long as you use the Services or as necessary to fulfill the purpose(s) for which it was collected, provide our products and services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable law. If we are required to maintain a record of any information, you may not be able to delete such information due to such requirements. Please be aware that your personal information may be stored on backup tapes and locations, third-party servers, and other repositories that may not be erasable and residual information may be retained. In addition, certain records relating to your transactions, accounts, and consents are retained for the periods required by financial and money transmission regulations, card network rules, and our banking partners, in some cases for at least five (5) years after an account is closed, even after you stop using the Services.

Security of Personal Information: We maintain administrative, technical, and physical safeguards that are designed to protect the privacy and security of your personal information. For example, all information you provide is accessible only to designated staff. We note, however, that the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of information transmitted to our website. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the website. In addition, where you have chosen a password for access to certain parts of our website, you are responsible for keeping this password confidential.

9. Third-Party Links

We may provide links to other sites or resources provided by third parties. These links are provided for your convenience only. We have no control over the content of those sites or resources and accept no responsibility for them or for any loss or damages that may arise from your use of them. If you decide to access any third-party links on our website, you do so entirely at your own risk and subject to the terms and conditions of those websites.

10. Do-Not-Track Settings

Do Not Track (“DNT”) is an optional browser setting that allows you to express your preferences regarding tracking by advertisers and other third parties. We do not currently respond to DNT signals.

11. Children Under 13 Years of Age

Our Services are not directed to children under 13 years of age, and we do not knowingly collect information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will prohibit and block such use and will make all efforts to promptly delete any personal information stored with us with regard to such child.

12. Your Privacy Rights

Depending on your jurisdiction, you may have certain rights regarding your personal information. Under Florida law and applicable federal laws, these rights may include:

Right to Know

You may have the right to request that we disclose information to you about our collection and use of your personal information. Upon submission of a verifiable consumer request, we will disclose to you:

• The categories of personal information we have collected about you
• The categories of sources for the personal information we have collected about you
• Our business or commercial purpose for collecting your personal information
• The categories of third parties with whom we share your personal information
• The specific pieces of personal information we have collected about you

Right to Access and Data Portability

You may have the right to request a copy of the personal information that we have collected about you.

Right to Deletion

You may have the right to request that we delete your personal information that we collected and retained, subject to certain exceptions.

Right to Correction

You may have the right to request that we correct inaccurate personal information that we maintain about you.

Right to Opt-Out

You may have the right to opt-out of having your personal information sold or shared. To opt-out, please contact us using the information provided in the “Contact Us” section below.

To exercise these rights, please contact us using the information provided in the “Contact Us” section below. We may ask you to provide certain information to identify yourself so that we may compare it with our records in order to verify your request. We will respond to your request within a reasonable timeframe as required by applicable law.

13. Changes to This Privacy Policy

We may, in our sole discretion, change this Privacy Policy from time to time. If we make any material change to this Privacy Policy, we will notify you by posting a notice on our website prior to the change becoming effective and may also elect to send you an email notifying you of the policy modifications. Your continued access and use of our Services and submission of data to us constitutes your acceptance of this Privacy Policy and consent to the uses set forth in this Privacy Policy.

14. Governing Law

This Privacy Policy is governed by the laws of the State of Florida, without regard to its conflict of law provisions.

15. Contact Us

If you have any questions or concerns about this Privacy Policy or our privacy practices, please contact us at:

Cleo Financial Inc.
Info@Cleo-Pay.com

16. Effective Date

This Privacy Policy was originally effective March 3, 2025, and was last amended July 25, 2026.