U.S. State Privacy Rights

1. Rights That May Be Available

Depending on your state of residence, the type of information, and applicable exemptions, you may have the right to:

• confirm whether we process personal information about you;
• access personal information or obtain specific pieces of information;
• correct inaccurate personal information;
• request deletion;
• obtain a portable copy of certain information;
• opt out of the sale of personal information;
• opt out of sharing or processing for targeted advertising;
• opt out of certain profiling or automated decision-making activities where applicable;
• limit certain uses or disclosures of sensitive personal information where applicable;
• withdraw consent for processing that relies on consent; and
• appeal our decision on a privacy request where state law provides an appeal right.

2. Categories of Personal Information

Depending on your interaction with the service, we may collect identifiers and contact information; loan-request and financial information; commercial and transaction information; internet or electronic activity; approximate location inferred from technical information; employment or professional information; sensitive information used for lender transmission; and limited inferences, fraud-prevention signals, or routing information.

For details, see our Privacy Policy.

3. Sources

We collect information primarily directly from consumers. We also collect technical data automatically and may receive limited routing, transaction-status, attribution, analytics, or fraud-prevention information from lenders and service providers.

UnitedStatesCredit does not purchase consumer records or third-party consumer lists for inclusion in our loan-matching or first-party marketing databases. The underlying marketing contact records described in this notice are collected directly from consumers interacting with UnitedStatesCredit.

4. Purposes

We use personal information to provide and secure the loan-matching service; route requests to participating lenders; communicate with consumers; prevent fraud; maintain consent, privacy, and suppression records; improve services; attribute advertising; conduct marketing permitted by law; and comply with legal obligations.

5. Categories of Recipients

Recipients may include participating lenders and financial-service providers; hosting, security, fraud-prevention, analytics, compliance, communications, and data-processing providers; contracted list-management and marketing companies; advertising and analytics providers; professional advisers; regulators and law-enforcement agencies; and parties to a lawful corporate transaction.

6. Sale, Sharing, and Targeted Advertising

Some state laws define "sale" broadly to include certain transfers for valuable consideration and define "sharing" or targeted advertising to include certain advertising-related disclosures. Because UnitedStatesCredit uses advertising technology and contracted marketing/list-management arrangements, some activities may be treated as a sale, sharing, or targeted advertising under a particular state's law.

Where an opt-out right applies, you may exercise it through Your Privacy Choices. A browser sale or sharing opt-out does not require identity verification. Transfers to service providers or processors acting only on our behalf under legally compliant contracts may be excluded from these definitions under applicable law.

7. Sensitive Personal Information

UnitedStatesCredit processes Social Security numbers, driver's-license numbers, and bank-account or routing information only as needed to transmit your requested loan application to participating lenders and financial-service providers involved in that request. We do not persistently retain those identifiers after transmission. We may retain limited contact, transaction, routing, consent, security, and suppression records for the purposes described in our notices, but those retained records do not include your Social Security number, driver's-license number, or bank-account or routing information.

UnitedStatesCredit does not use that information for unrelated marketing.

Where a state law requires consent or provides a right to limit a sensitive-data use that is not otherwise exempt, we will provide the applicable choice.

8. California Residents

California residents may have rights under the California Consumer Privacy Act (CCPA), including rights to know/access, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service and pricing when exercising CCPA rights, subject to statutory exceptions.

We honor qualifying browser-based opt-out preference signals, including Global Privacy Control, as required by California law. Financial information subject to the Gramm-Leach-Bliley Act or the California Financial Information Privacy Act may be exempt from some CCPA provisions, while other website, advertising, or technical information may remain subject to the CCPA.

California consumers should also review our California Financial Privacy Notice.

California direct-marketing disclosure requests

California residents may also have rights to request certain information about disclosures of personal information for third-party direct-marketing purposes under California's direct-marketing law. Requests may be sent to info@bluekeel.com with the subject "California Direct Marketing Request."

9. Requests to Access, Correct, Delete, or Obtain a Copy

Submit a request through Your Privacy Choices or email info@bluekeel.com. We may ask for information reasonably necessary to verify identity and authority. We will not request more information than reasonably necessary for verification.

10. Authorized Agents

Where state law permits an authorized agent to submit a request, we may request evidence of the agent's authority and may ask the consumer to verify identity or confirm the authorization directly.

11. Appeals

If your state provides a right to appeal and we deny a privacy request, you may appeal by emailing info@bluekeel.com with the subject "Privacy Request Appeal" and identifying the original request. We will respond within the period required by applicable law.

12. Non-Discrimination

We will not unlawfully discriminate against a consumer for exercising a privacy right. This does not prevent differences permitted by law, including a bona fide financial incentive program that separately satisfies applicable requirements.

13. Timing

We respond to verified privacy requests within the time required by applicable law. California requests to know, delete, or correct are generally subject to a 45-day response period, with a legally permitted extension when reasonably necessary and with required notice.

14. Retention

We retain each category only as long as reasonably necessary and proportionate to the disclosed purpose, legal requirements, security, fraud prevention, dispute resolution, consent evidence, and suppression obligations. A suppression record may be retained after an opt-out so we can continue honoring the request.

15. Contact