Vance Money Services LLC

Vance Money Services LLC d/b/a Aspora (“Aspora,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy (“Policy”) describes how Aspora collects, uses, shares, and protects personal information when you visit our website, use the Aspora mobile application, or otherwise use our money remittance services (the “Services”). It also explains your privacy rights and choices, and how you can contact us about your information.

By using our Services, you acknowledge that you have read and understood this, Policy. This Privacy Policy is incorporated by reference into Aspora’s Terms and Conditions and forms part of your agreement with us regarding use of the Services.

1. Scope of this Privacy Policy

This Privacy Policy applies to all individuals who access or use Aspora’s Services. Please note that Aspora is currently licensed to operate its money transmission Services only in the State of Delaware, Arkansas, Illinois, Maryland and Michigan, United States. Accordingly, this Policy describes our privacy practices for personal information collected through our website, mobile application (the “Aspora App”), and Services in Delaware. “Personal information” (also referred to as “personal data”) means any information that identifies, relates to, describes, or is reasonably capable of being associated with an identified or identifiable individual. This Policy applies to both current and former customers of Aspora’s Services, as well as to visitors of our website or app.

Please note that this Policy only addresses how Aspora and its affiliates handle your information. It does not cover the practices of any third-party websites, services, or partners that Aspora does not control (see Section 12 below for more details on third-party websites and services).

2. Information We Collect

2.1 Information You Provide to Us: We collect personal information that you provide when using ourServices – for example, when you create an Aspora Account, send or receive money, enroll inprograms, or contact us. This includes:

(a) Identification Information: Full name, postal address, email address, telephone number, date of birth, Social Security number or other government-issued identification numbers (e.g., driver’s license or passport), and any other information required for identity verification (Know Your Customer or KYC checks).

(b) Biometric Identifiers: In certain cases, we may collect biometric information from you to verify your identity. For example, we might ask for a fingerprint, a facial scan (selfie photograph), or a voiceprint during account verification or login. We will only collect biometric identifiers with your knowledge and consent (as required by laws such as the Illinois Biometric Information Privacy Act (BIPS)) and use them solely for verification, fraud prevention, or security purposes. We will not use your biometric data for any commercial purpose, and we will handle and dispose of it in accordance with our retention policy and applicable law (see Section 9).

(c) Transaction Information: Information about the transactions you perform through Aspora, including the transaction amount, currency, frequency, location, and any promotions or offers used. If you send money, we collect recipient details such as the recipient’s name and contact information, and in some cases their bank account or mobile wallet details, to complete the transfer.

(d) Payment Information: Financial account information and payment instrument details that you use to fund a transfer or receive money. For example, we collect your bank account number and routing number, or your debit/credit card number, expiration date, and CVV when you provide these to fund a remittance or when you link an external account.

(e) Communications and Support: The content of your communications with us. If you contact Aspora customer support or otherwise communicate with us (by email, phone, chat, or otherwise), we will collect the information you provide in your inquiries or feedback, along with your contact details.

(f) Other Information You Choose to Provide: This may include responses to surveys or contests, referrals (for example, if you refer a friend where permitted), or any other information you voluntarily submit to us through our Services.

2.2 Information We Collect Automatically: When you use our website or mobile app, we automatically collect certain information about your device and your usage of the Services. This information helps us secure the Services and improve your user experience. It includes:

(a) Device Information: Technical details about the device you use to access the Services, such as your device model, operating system, browser type, application version, language settings, and device identifiers (e.g., IP address or unique device ID).

(b) Usage Data: Data about your interactions with our Services, including the pages or screens you visit, the features you use, the dates and times of your visits, click-stream data, and referring/exit page URLs. For example, we may log when you log into your account, initiate a transaction, or view certain content on our site or app.

(c) Location Data: General geographic location inferred from your IP address or mobile device (such as city or state). For example, we may determine what region you are in when you use Aspora’s app or website, which helps us comply with any location-based legal requirements or restrictions and assists in fraud prevention. (We do not collect precise GPS coordinates from your device unless you expressly allow us to do so.)

(d) Cookies and Similar Technologies: We (and service providers acting on our behalf) use cookies, web beacons, pixels, and similar tracking technologies to automatically collect information about your browsing activities and device. Cookies are small text files placed on your browser or device that allow us to recognize you and maintain your preferences from session to session. They help us track usage of the Services (for example, which pages you view and which links you click) and enable certain features like remembering your settings. We may also use cookies and related technologies to facilitate analytics (through third-party analytics providers) and for advertising or marketing purposes as described in Section 5 below. For more details on cookies, see Section 5 (Cookies and Tracking Technologies).

2.3 Information from Third Parties: We may receive personal information about you from third-party sources as allowed by law, which we may combine with other information we have about you. For example:

(a) Verification and Compliance Sources: To verify your identity and prevent fraud, we obtain information from identity verification services, fraud prevention agencies, credit bureaus, and public records. This may include verification of the identification documents you provide, screening against government watchlists (e.g., OFAC sanctions lists), and comparing the information you provide with external databases.

(b) Service Partners: If you conduct transactions through a business partner or intermediary (for instance, if Aspora’s Services are made available through a third-party platform or if you were referred to Aspora by another company), that third party may send us personal information about you to facilitate your transaction.

(c) Marketing and Data Enrichment: We may receive contact details and marketing lead information from joint marketing partners or referral programs, and we may collect data from social media platforms if you engage with our pages or content. We only collect such information as permitted by law and if you have agreed that the information can be shared with us.

2.4 Children’s Information: Aspora’s Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. We also do not allow individuals under 18 years old to register for an Aspora Account or use the Services. If we become aware that we have inadvertently collected information from a child under 13, we will promptly delete that information in accordance with the Children’s Online Privacy Protection Act (COPPA).

2.5. Information from Business Partners: We may receive personal information about you from business partners who provide services in connection with your use of our Services, including verification results, risk assessment data, payment processing information, and service delivery details.

2.6 BusinessPartner Data Quality: We work with business partners to ensure the accuracy and completeness of information they provide to us. If you believe information we received from a Business Partner is incorrect, you may contact us to request correction.

3. How We Use Your Information

3.1 We use the personal information we collect for a variety of business and operational purposes, all in accordance with applicable laws and regulations. These purposes include:

(a) Providing the Services: We use your information to create and manage your Aspora Account, to enable your money transfers and related transactions, and to generally provide our remittance and payment services. For example, we use your personal and financial information to process the transactions you request, to transfer funds to your designated recipients, to update you on the status of your transfers.

(b) Verification and Security: We use personal identifiers, identification documents, and other information to verify your identity when you register or before processing certain transactions. This helps us comply with legal obligations (like KYC requirements) and ensures that only authorized users can access the Services. We also use this information to authenticate logins and to detect and prevent fraud, hacking, identity theft, or other misuse of our Services.

(c) Compliance with Legal Obligations: Aspora is a regulated financial services provider, and we use your information to comply with various laws and regulatory requirements. This includes using personal and transaction information for compliance with anti-money laundering (AML), counter-terrorism financing, and sanctions screening obligations under the Bank Secrecy Act (BSA), the USA PATRIOT Act, Office of Foreign Assets Control (OFAC) regulations, and other applicable laws. For example, we may use and share your information to monitor transactions, report suspicious activities to government authorities, verify your eligibility to use the Services in certain jurisdictions, and retain records as required by law.

(d) Communications and Customer Service: We use your contact information (email, phone number, mailing address) to communicate with you about your account and transactions. For example, we send transaction confirmations, digital receipts, alerts, and respond to your inquiries. This includes sending service-related announcements and administrative messages (for instance, if we update our Terms or this Policy). If you contact us for support, we will use the information you provided to help resolve your issue.

(e) Marketing and Promotional Purposes: We may use your contact information and details about your use of the Services to inform you about new features, offers, promotions, or updates from Aspora that may interest you. For example, we might send you promotional communications about referral programs, or partner offers. We will only send you marketing communications as permitted by law – for instance, we may seek your consent where required before sending certain messages. You can opt out of marketing communications at any time as described in Section 10 below. (Even if you opt out of promotional emails, we may still send you transactional or service-related communications such as transfer confirmations or account notifications, since those are not promotional)

(f) Improving and Developing Our Services: We analyze usage information, feedback, and other data to understand how our Services are used and to improve their functionality and security. This helps us troubleshoot issues, develop new features, enhance user experience, and inform our business strategy. For example, we may use data analytics to identify trends in how customers use our service or to test the effectiveness of certain interface changes.

(g) Advertising and Personalized Content: Where permitted, we may use certain data about you to deliver tailored advertisements for Aspora services on our site and on third-party platforms. For instance, we might use cookies and usage data to re-market our Services to you on other websites – showing you Aspora ads that are relevant based on your past interactions with our site or app. We may also work with third-party advertising networks and social media companies to show you Aspora ads on other websites or social platforms. These third parties may use cookies or similar tracking technologies to collect information about your online activities over time for ad targeting. You can opt out of targeted advertising as described in Section 10 (Your Privacy Rights).

(h) Fraud Prevention and Security Monitoring: We continually use and analyze personal and transactional data to protect against fraud, unauthorized transactions, claims, and other liabilities. This may include using automated systems to flag suspicious activity or high-risk transactions (see Section 7 on Automated Decision-Making). If we detect potential fraud or security issues, we may use personal information to investigate and mitigate the issue (for example, by contacting you or by declining a transaction that appears fraudulent or unauthorized).

(i) Legal Defense and Enforcement of Rights: We may use your information as necessary to enforce our Terms and Conditions or other agreements, to collect amounts owed, to resolve disputes, or to defend against legal claims. If a dispute arises, we will use relevant data (such as transaction records or communications) to establish facts and assert our legal positions. We also may use information to comply with any court orders, subpoenas, or other legal processes that we are subject to.

(j) With Your Consent or at Your Direction: We will use your personal information for any other purpose that you specifically consent to or direct us to. For instance, if you instruct us to share your information with a third party or you opt in to a feature that uses your information beyond what is described above, we will use or share your information as needed in accordance with your instructions and applicable law.

3.2 We will not use your personal information for purposes materially different from those described above without notifying you (for example, by updating this Policy or obtaining your consent where required by law).

4. How We Share Your Information

4.1 Aspora understands the importance of keeping your personal information confidential. We share your personal information only for the purposes described in this Policy, and we do not sell your personal information to third parties for their own marketing use. When we do share information, we require the recipients to protect it and to use it only for the intended purposes, consistent with applicable law.

4.2 We may share personal information with the following categories of parties and in the following circumstances:

(a) Aspora Affiliates: We may share your information with companies that are under common ownership or control with Aspora (our affiliates), such as our parent company or subsidiaries, as needed to provide the Services and for internal administrative purposes. For example, an affiliate that provides technology or operational support may access personal data to facilitate transactions. All Aspora affiliates will protect personal information as described in this Policy and in accordance with applicable law.

(b) Service Providers and Vendors: We disclose personal information to trusted third-party service providers who perform functions on our behalf to support our Services. These include, for example, payment processors and banking partners (who process your payments and disburse funds to recipients); identity verification and fraud prevention providers (who assist with KYC checks, biometric verification, sanctions screening, and fraud detection); technology and IT infrastructure providers (for data storage, cloud services, and platform support); customer service and communication tool providers; and marketing and analytics partners. These service providers are bound by contractual confidentiality and security obligations and are permitted to use personal information only to provide services to Aspora and not for their own purposes.

(c) Recipients and Correspondent Partners: When you send a money transfer, we must share certain information with the recipient and with our intermediary or correspondent partners in order to complete the transaction. For example, we will share your name and other necessary sender details with the recipient or with the payout partner (such as a local bank, cash pickup agent, or mobile wallet operator in the recipient’s country) to notify them and facilitate disbursement of the funds. Similarly, if you are receiving money through Aspora, we may share your information with the sender or the sender’s financial service provider as necessary for them to initiate and execute the transfer. We share only the information required to fulfill the transaction – such as names, contact information, account numbers, transaction identification codes, and any other data mandated by financial messaging standards or local regulations.

(d) Business Partners and Promotions: If we collaborate with another company to offer a co-branded service, joint promotion, or special offer (for example, a referral program or a loyalty reward offered in conjunction with a merchant), we may share relevant information with that business partner to facilitate the program. This might include sharing your name, contact information, and eligibility status for the promotion or service. These partners are contractually required to keep such information confidential and to use it only for the agreed-upon purpose.

(e) Advertising and Analytics Partners: We may allow third-party analytics providers (such as Google Analytics) and advertising partners to collect information about your online activities through cookies and similar technologies on our website, to help us understand usage patterns and to serve ads on our behalf. While we do not directly share information that identifies you by name with these partners, they may collect device identifiers, browsing information, and usage data from your device over time and across different websites to provide aggregated analytics or targeted advertisements. Any data collected by such third parties via cookies on our Services is subject to those third parties’ privacy policies. You can control cookies as described in Section 5, and you can opt out of certain advertising uses as described in Section 10 of this Policy.

4.3 Partner Privacy Policy Integration: Each category of Business Partner maintains its own privacy policies and data handling practices. By using our Services, you acknowledge that your personal information may be processed by Business Partners in accordance with their respective privacy policies. Current Business Partner privacy policies are available at:

(a) Our website at Aspora Partners.

(b) The Aspora App in the “Partner Privacy Information” section.

By contacting our customer service team.

4.4 Compliance and Legal Requirements: We will share personal information with government authorities, law enforcement, courts, regulators, or other third parties when we believe disclosure is required to comply with a legal obligation or process, or to protect our rights or the rights of others. For example:

(a) Regulatory Reporting: As a money services business, we are required by law to monitor transactions and report certain activities to regulators (such as the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN), OFAC, or state financial regulators). We may share your personal information and transaction details with such authorities without your prior notice or consent when necessary to meet our legal obligations or to cooperate with official investigations. For example, we will disclose information in response to lawful requests such as subpoenas or inquiries from government agencies, and we also share information as needed to file reports of suspicious activities or to block transactions as required by law.

(b) Fraud and Security Protection: If you engage in (or we suspect) fraudulent or illegal activity, or if we detect threats to the security of the Services, we may share relevant information with appropriate parties such as other financial institutions, credit card networks, payment processors, or law enforcement agencies to investigate or prevent the activity. For instance, we might share details of a suspicious transaction with the payment network and with law enforcement to help prevent financial crime or to pursue those responsible.

(c) Legal Proceedings: In the event of a dispute or legal proceeding involving Aspora, we may need to provide personal information as evidence. This can include sharing information with our attorneys, advisors, or experts, and with courts or adjudicators as necessary to assert or defend against legal claims.

4.5 Corporate Transactions: If Aspora is involved in a potential or actual merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business or assets, personal information may be shared or transferred as part of that transaction. We will ensure that any acquiring entity or new combined entity is contractually obligated to protect your personal information in a manner consistent with this Policy. We will also provide notice before your personal information is transferred or becomes subject to a different privacy policy due to such a corporate change.

4.6 With Your Consent: We may share your information with other third parties not described above if you request or consent to such sharing. For example, if you opt in to a feature that allows you to link your Aspora account with a third-party service or to share details of your transactions with friends, we will share information as needed at your direction. You will be informed at the time of the request what information will be shared and with whom, and we will proceed only with your explicit consent.

4.7 No Sale of Personal Information: Aspora does not sell your personal information to third parties for monetary consideration. We also do not share your personal information with third parties for their own direct marketing purposes, unless you separately agree to such sharing. If in the future Aspora anticipates sharing information in a way that could be considered a “sale” or certain types of “sharing” (for cross-context behavioral advertising) under applicable law, we will provide you with appropriate notice and an opt-out mechanism as required by law.

5. Cookies and Tracking Technologies

5.1 We use cookies and similar tracking technologies on our website and mobile app to enhance your experience and for the purposes described in this Policy. A “cookie” is a small data file stored on your browser or device that allows websites to remember your actions or preferences over time. When you use the Aspora Services, we (or authorized third parties) may set cookies on your browser that collect information about how you interact with our Services or that recognize your device.

5.2 Why we use cookies: Cookies serve several important functions for us. For example, they:

(a) Allow our website to remember your login status so you do not have to re-enter your credentials on every page.

(b) Store your preferences (such as your chosen language or region) so we can customize content for you.

(c) Enable certain features, like remembering details of your last transaction for your convenience.

(d) Help us understand how our Services are used. For instance, we use analytics cookies to see which pages are popular, how users navigate our site, and where we can improve the user experience.

(e) Assist in our marketing efforts. Advertising partners may use cookies to track your browsing activity on our site and other sites so that they can show you Aspora ads that are more relevant to you on other websites (this is known as interest-based advertising).

5.3 Types of cookies: We use both session cookies (which expire once you close your web browser) and persistent cookies (which remain on your device until you delete them or they expire on their own). Some cookies are “first-party” cookies, which are set by Aspora’s own domain (for example, to remember your settings or track usage on our site). Others are “third-party” cookies, set by our service providers or partners (for example, Google Analytics sets cookies to help us measure site traffic, and advertising networks might set cookies to assist with ad targeting).

5.4 We may also use related technologies like web beacons or pixel tags in our emails or on our website. These are tiny graphic images or scripts that can detect when you have opened an email we sent or visited a certain page on our site. This helps us measure the effectiveness of our communications and gather statistics on usage of our Services.

5.5 Your choices: Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline certain cookies or to notify you before a cookie is placed. Please note that if you delete or disable cookies, some features of our Services may not function fully (for example, you may need to re-login each time or some of your preferences may not be saved).

5.6 For the mobile app, your mobile operating system might allow you to opt out of certain device identifiers used for interest-based advertising. Please refer to your device’s settings for options to limit ad tracking.

5.7 For more information on how to control and delete cookies, you can consult guidance such as the U.S. Federal Trade Commission’s online guide on cookies or the help section of your browser. Additionally, some third parties involved in online advertising offer opt-out mechanisms for targeted advertising (for example, through the Digital Advertising Alliance (DAA) or the Network Advertising Initiative (NAI) websites). Keep in mind that opting out of cookies or targeted advertising does not mean you will no longer see advertisements – it simply means those ads may be less relevant to your interests.

6. “Do Not Track” Signals

6.1 Some web browsers and devices offer a “Do Not Track” (DNT) feature that allows you to express a preference not to be tracked by websites. Currently, there is no uniform standard adopted across the industry on how to respond to DNT signals. Accordingly, Aspora’s websites do not respond to browser DNT signals. We treat the data of all users in accordance with this Privacy Policy, regardless of any DNT signal.

6.2 We will continue to monitor developments around DNT technology and efforts to establish a consensus standard. If a standard for responding to DNT signals is established in the future, we will update our practices and this Policy accordingly.

6.3 Please note that DNT is different from the Global Privacy Control (GPC). If and when applicable laws require us to recognize and process browser signals like GPC as a valid request to opt out of certain data processing (such as a “sale” of personal information under California law), we will honor such signals once we are able to implement that capability. In the meantime, you should use the opt-out methods described in this Policy (for example, the cookie management options in Section 5 and the privacy rights in Section 10) to exercise your preferences.

7. Automated Decision-Making

7.1 Aspora may use automated processes and decision-making in limited ways as part of providing our Services, particularly for purposes of fraud prevention, security, and compliance. “Automated decision-making” means that a decision concerning you is made by technological means without significant human involvement. Aspora may use automated tools including but not limited to:

(a) Fraud and Risk Screening: When you initiate a transaction, our systems automatically analyze data related to the transaction (such as the transaction amount, your location, your account history, and other factors) to detect patterns that might indicate fraud, money laundering, or other prohibited activities. If certain patterns or risk scores are triggered, the system may automatically flag or temporarily hold the transaction for further review. This automated screening is necessary to comply with legal obligations and to protect the integrity of our Services.

(b) Identity Verification: We may use automated software (including machine learning algorithms) to verify identity documents you submit and to compare your identification photograph to a photograph (selfie) you provide. This helps confirm your identity quickly and efficiently. If the system cannot verify the match or detects a possible issue (for example, if the document appears altered or invalid), it may automatically reject the verification attempt and prompt you for additional steps.

(c) Transactional Decisions: Our system may automatically decline or block certain transactions that violate predefined rules. For instance, if you attempt to send an amount that exceeds your account limits or if you are in a jurisdiction where our Service is not available, the system could automatically prevent the transaction or account creation. Similarly, our automated systems might block usage if your account is associated with a sanctions list or if required information is missing.

7.2 While some decisions may initially be made by automated means, Aspora maintains measures to minimize any unfair or adverse effects. Many automated flags result in a manual review by our compliance or risk team, who will consider the full context and any additional information before finalizing a decision. We do not make solely automated decisions that have legal or similarly significant effects on you without an opportunity for human review. If you believe an automated decision has been made in error, you can contact us (see Section 14 below) to request a manual review.

7.3 Residents of certain U.S. states (as described in Section 10) have the right to opt out of some forms of automated decision-making or profiling. We will honor those rights to the extent required by Applicable Laws. However, even if you opt out of targeted advertising or profiling for marketing purposes, we may still use automated systems for fraud detection and security purposes, since these processes are essential to the safety and legality of our Services.

8. Data Security

8.1 We take the security of your personal information very seriously and have implemented administrative, technical, and physical safeguards to protect your information from unauthorized access, use, or disclosure. Aspora’s security measures include encryption of sensitive information in transit (for example, we use Transport Layer Security (TLS)/ Secure Sockets Layer (SSL) protocols when transmitting personal and financial data); encryption or hashing of data at rest where appropriate; firewalls and intrusion detection systems to guard our networks; and access controls to ensure that personal data is only accessible to employees or contractors on a need-to-know basis. We also require our service providers to follow stringent security standards and to use data only for authorized purposes.

8.2 Aspora regularly reviews and updates its security practices to address new threats and to comply with applicable laws and regulations. We conduct periodic risk assessments and maintain a cybersecurity program consistent with federal law and industry standards. Our safeguards are designed to protect against foreseeable threats to the confidentiality, integrity, and availability of your information.

8.3 Despite our efforts, no security measure is infallible. We cannot guarantee absolute security of data, especially during transmission over the Internet. You also play an important role in keeping your information safe. We encourage you to use strong and unique passwords for your Aspora Account, never share your login credentials with anyone, and notify us immediately if you suspect any unauthorized access to your account. (Aspora will never ask you for your account password via email or phone, so if you receive such a request, it is likely fraudulent – please let us know if this occurs.)

8.4 In the event of a data breach or security incident that compromises your personal information, we will notify you and any applicable authorities as required by law.

9. Data Retention

9.1 Aspora retains personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, or as required or permitted by law. Because we are a financial services company subject to certain recordkeeping laws, we generally keep your personal and transactional information for at least seven (7) years from the date of your last transaction or the closure of your account, whichever is later. This retention period helps us comply with legal and regulatory requirements (for example, Bank Secrecy Act and anti-money laundering rules often mandate keeping records for a minimum period of five years) and also serves our business needs.

9.2 We may retain personal information for longer than 7 years if required by applicable law or if we have an ongoing legitimate business need to do so (for example, to handle a dispute or legal proceeding that began before the end of the retention period, or to enforce our agreements). We also maintain backup copies of data for a period of time in secure archives, which are protected and restricted.

9.3 When personal information is no longer necessary for the purposes for which it was collected, and we are not legally required to retain it, we will delete, destroy, or anonymize it in a secure manner. For example, if you close your Aspora Account, then after the applicable retention period has elapsed, we will remove your personal details from our active databases. We may continue to retain anonymized or aggregated data (which does not identify any individual) for analytical purposes without further notice, since this does not implicate personal privacy. Some specific data retention practices include:

(a) Transaction Records: Records of your money transfers and transactions (including sender and recipient details, amounts, dates, and related information) are retained for at least 7 years from the date of the transaction, in compliance with financial regulations.

(b) Identification and Verification Data: Copies of identification documents, verification photos, and KYC information are retained for as long as you have an active account and for a period after account closure as required by law (commonly 5 to 7 years after closing the account) to meet audit and compliance obligations.

(c) Communications: If you contact our customer support or otherwise communicate with us, we may retain those communications (including any transcripts or recordings) and related notes for a certain period to train our staff, to improve our services, or to defend against potential legal claims. These records will typically be deleted in accordance with our standard retention schedule unless a specific need requires us to keep them longer (for instance, if they are relevant to an ongoing investigation or dispute).

(d) Web and Device Data: Usage analytics data may be retained in aggregate form for an extended period. Raw log files of website or app activity are usually kept for a shorter period (for example, a few months), unless they are needed for security investigations or troubleshooting, in which case relevant portions might be retained until the issue is resolved.

(e) Biometric Data: If we collect biometric identifiers (such as a facial scan or fingerprint) for identity verification, we will retain and destroy that data in accordance with applicable biometric privacy laws. In practice, this means we will permanently delete biometric information once the initial purpose for its collection has been fulfilled or within three years of your last interaction with us, whichever comes first. We will not use or keep biometric data longer than necessary except as required by law (for example, if we are served with a court order to preserve certain data).

9.4 Please note that under certain circumstances we may need to suspend our routine deletion or anonymization of data. For instance, if we receive a legal hold or preservation request in connection with litigation or a law enforcement inquiry, we will retain the relevant data for as long as instructed and necessary to comply with that request.

10. Your Privacy Rights and Choices

10.1 Aspora respects your privacy rights and provides you with reasonable access and control over your personal information. Depending on your jurisdiction, you may have specific legal rights with respect to your personal data. In this section, we outline the choices and rights available to all users, as well as additional rights afforded to residents of certain U.S. states.

10.2 General Choices for All Users:

(a) Access and Update: You can review and update certain personal information by logging into your Aspora Account and accessing your account settings or profile section. For example, you can update your contact information or payment methods. If you need to access data that is not directly available through your account, you may contact us to request it (see Section 14 for contact details). We will provide you with the information as required by applicable law.

(b) Marketing Opt-Out: If you no longer wish to receive marketing or promotional emails from Aspora, you can opt out at any time by clicking the “unsubscribe” link in any marketing email, or by adjusting your communication preferences in your account settings (if available). Please note that even after you opt out of marketing messages, we may still send you transactional and service-related communications – such as transfer confirmations, account alerts, and security notices – since these are not promotional.

(c) Cookies: As described in Section 5 above, you have choices with respect to cookies and similar tracking technologies. You can adjust your browser settings to refuse or delete cookies, and you can use industry opt-out tools to control the use of your information for interest-based advertising. (For more details, see the Your choices subsection of Section 5.)

10.3 Privacy Rights for California and Other State Residents:

Residents of certain U.S. states have additional rights under state privacy laws regarding their personal information. Aspora will extend applicable privacy rights to individuals in those states as required by law. The rights described below may apply to you if you are a resident of California, Colorado, Connecticut, Utah, Virginia, Oregon, or another state with a comprehensive consumer privacy law. These rights are subject to various exceptions and limitations under the law:

(a) Right to Know/Access: You have the right to request that we disclose what personal information we have collected, used, and disclosed about you in the 12-month period preceding your request (and, where required, beyond 12 months). This includes the categories of personal information, the categories of sources from which it was collected, the business or commercial purpose for collecting it, and the categories of third parties with whom we shared your information. You may also request a copy of the specific pieces of personal information we collected about you.

(b) Right to Delete: You have the right to request deletion of personal information that we have collected from you and retained. Upon verification of your identity and request, we will delete your personal information from our records (and direct our service providers or contractors to do the same), unless an exception applies. For example, we may retain certain information if it is necessary for us or our service providers to complete a transaction you requested, to detect security incidents, to comply with a legal obligation (such as certain record retention requirements), or for other purposes permitted by law.

(c) Right to Correct: You have the right to request that we correct inaccurate personal information that we maintain about you. If you demonstrate that the information we hold is inaccurate, we will correct it as required by law.

(d) Right to Data Portability: In some states, you have the right to obtain a portable copy of certain personal information that you provided to us, in a readily usable format that allows you to transmit the data to another entity. Where applicable, we will provide such data in a common digital format (for example, a CSV file).

(e) Right to Opt Out of “Sale” or Sharing of Personal Information: Aspora does not sell personal information for money. However, some sharing of personal information (for example, through cookies and advertising identifiers for targeted advertising) might be considered a “sale” or “sharing” under certain state laws. In such cases, you have the right to direct us not to sell or share your personal information for cross-context behavioral advertising purposes. You can exercise this right by contacting us as described below or by using any “Do Not Sell or Share My Personal Information” link or mechanism on our website (if available). Once you opt out, we will refrain from selling or sharing your data for these purposes unless you later provide authorization allowing us to do so.

(f) Right to Opt Out of Targeted Advertising and Profiling: You have the right to opt out of the processing of your personal data for purposes of targeted advertising, and to opt out of any profiling in furtherance of decisions that produce legal or similarly significant effects on you. Aspora will honor such opt-out requests to the extent required by law. If you opt out, we will cease using or sharing your information for targeted advertising, and we will not use automated profiling to make significant decisions about you (except as necessary for fraud prevention or legal compliance, as noted earlier in this Policy).

(g) Right to Limit Use of Sensitive Personal Information: California residents have the right to direct a business to limit the use of “sensitive personal information” (as defined under California law) if it is used for certain secondary purposes (such as targeted advertising). Aspora, however, only uses sensitive personal information (for example, government-issued IDs, account login credentials, or precise geolocation) for essential business purposes—such as providing the Services, identity verification, security, fraud prevention, and legal compliance. We do not use or disclose sensitive personal information for purposes that would trigger the right to limit, so this right does not currently apply to Aspora’s practices. If that changes in the future, we will implement appropriate opt-out mechanisms.

(h) Right of Non-Discrimination: We will not discriminate against you for exercising any of the above rights. This means we will not deny you our Services, charge you a different price, or provide a different level or quality of Services just because you exercised your privacy rights. However, please note that if fulfilling your request (for example, deleting your data) would make it impossible for us to continue providing you with the Service, we may need to discontinue service to you or close your account. If that is necessary, we will inform you, and such action will only be taken in accordance with applicable law.

10.4 California “Shine the Light” Law: Separately from the above rights, California’s “Shine the Light” law allows customers to request information about our disclosures of certain categories of personal information to third parties for their direct marketing purposes during the previous calendar year. Aspora’s policy is not to share personal information with third parties for their own direct marketing purposes unless you explicitly consent to such sharing. If you are a California resident and wish to make an inquiry under the Shine the Light law, you can contact us as provided in Section 14.

10.5 Vermont Residents: We will not share information we collect about Vermont residents with non-affiliated third parties for marketing purposes, and we will not disclose information about your creditworthiness to our affiliates except as permitted by law or with your affirmative consent. This reflects the requirements of Vermont law, which places stricter limits on sharing of financial information. For clarity, Aspora does not disclose your personal information to non-affiliated companies for their own marketing purposes, except to provide our Services or as allowed by law (for example, to process your transactions or to comply with legal requirements), unless we have your express consent.

10.6 Nevada Residents: Nevada law gives consumers the right to direct a website operator not to sell certain personal information that the operator has collected or will collect about the consumer. Aspora does not sell personal information for monetary consideration. If you are a Nevada resident who nevertheless wants to ensure that your information is not sold in the future, you may send an opt-out request to us via the contact methods below, and we will record your preference.

10.7 Exercising Your Rights: If you wish to exercise any applicable privacy rights (such as accessing your data, requesting deletion or correction, or opting out of certain processing), you may contact us through one of the following methods:

Email: legal@aspora.com

Phone (Toll-Free): (888) 261-7110

Mail: Vance Money Services LLC (Aspora)

Office Number 1236, 1000 N. West Street, Suite 1200

Wilmington, DE 19801, USA

10.10 You may send a written request to our mailing address provided in Section 14 of this Policy. Please include your name, contact information, the nature of your request, and any relevant details.

10.11 For your protection, we will need to verify your identity before processing certain requests (for example, requests to access or delete personal data). We may ask you to provide additional information or to confirm information we already have on file to ensure that you are the person (or an authorized representative of the person) whose data is the subject of the request. For instance, we might ask you to confirm recent transaction amounts or provide a piece of information used when you registered your account.

10.12 We will respond to privacy rights requests within the timeframe required by law. If we cannot fulfill your request, we will provide an explanation (for example, if we are legally prohibited from disclosing certain information). An authorized agent may submit a request on your behalf, but we will still take steps to verify that the request is legitimate. If you use an authorized agent, they should be prepared to provide proof of your permission and their identity.

11. Children’s Privacy

11.1 As noted above in Section 2.4, our Services are not intended for individuals under the age of 13. We do not knowingly solicit or collect personal information from children under 13 years old. If you are under 13, you should not use Aspora’s Services or submit any personal information to us. If we learn that we have inadvertently collected personal information from a child under 13, we will promptly delete that information from our records.

11.2 Parents or legal guardians who believe that their child under 13 may have provided us with personal information can contact us (see Section 14 below), and we will take appropriate steps to investigate and address the issue.

11.3 Our Services are generally intended for adults. We do not allow individuals under 18 years of age to register for an Aspora Account or use the Services without supervision. If you are between 13 and 17 years old, you may use Aspora’s Services only with the involvement and consent of a parent or legal guardian, and as permitted by our Terms and Conditions.

12. Third-Party Websites and Services

12.1 Our website and app may contain links to websites, applications, or services that are operated by third parties not affiliated with Aspora. For example, we may provide links to external resources, partner promotions, or Aspora pages on social media platforms. This Privacy Policy does not apply to those third-party sites or services, and any personal information you provide to those external sites is not governed by this Policy.

12.2 Aspora is not responsible for the privacy practices or content of any third-party websites or services. We encourage you to review the privacy policies of any third-party site or service that you visit or interact with. Clicking on a third-party link will direct you to a site that we do not control, and any information you share on that site will be subject to that site’s policies. Use of any third-party website or service is at your own risk.

12.3 Additionally, if you access our Services through a third-party platform or integrate Aspora with a third-party service, any information collected by that third party in the process is governed by that third party’s privacy policy. For instance, if you were to use Aspora’s services via another company’s app or website, the personal information collected by that company would be subject to their own privacy practices.

13. Changes to this Privacy Policy

13.1 We may update or modify this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. If we make material changes to this Policy, we will provide you with notice in accordance with applicable law. For example, we may post the updated Policy on our website and update the “Effective Date” at the top, and/or notify you through the Aspora App or via email (using the email address associated with your account).

13.2 If the changes are significant, we will endeavor to give you advance notice (such as 30 days before the changes take effect, when required). We encourage you to review this Policy periodically for the latest information on our privacy practices. Your continued use of the Services after any updates to this Policy become effective constitutes your acceptance of the changes, to the extent permitted by law. If you do not agree to the revised terms, you should stop using the Services and contact us with your concerns.

13.3 If you would like to see prior versions of this Privacy Policy or have questions about any changes, you may contact us as described in the next section.

14. Contact Information

14.1 If you have any questions, concerns, or requests regarding this Privacy Policy or Aspora’s privacy practices, please contact us:

Email: legal@aspora.com

Phone (Toll-Free): (888) 261-7110

Mail: Vance Money Services LLC (Aspora)

Office Number 1236, 1000 N. West Street, Suite 1200

Wilmington, DE 19801, USA

14.2 We will be happy to answer your questions or address your requests. If you contact us by mail, please include your contact information and a detailed description of your inquiry.

14.3 You also have the right to lodge a complaint with your state’s Attorney General or financial regulator if you believe we have violated your privacy rights or applicable law.

14.4 This Privacy Policy is provided to you by Vance Money Services LLC (Aspora), which is a licensed money transmitter in the State of Delaware. Aspora is required by U.S. law to provide certain privacy disclosures to its customers. This Policy is intended to serve as a comprehensive notice of our data practices for U.S. consumers.

14.5 In addition, we provide a separate U.S. Consumer Privacy Notice pursuant to the Gramm-Leach-Bliley Act (GLBA) for individuals who obtain our financial products or services for personal, family, or household purposes. That GLBA Privacy Notice describes in further detail how we share customer information and how you can limit certain types of sharing. You can find Aspora’s GLBA Consumer Privacy Notice on our website or request a copy from us at any time.