1.1 This Privacy Policy explains how Vantar Inc. and its affiliates (“Vantar”, “we”, “us”) collect, use, share, keep and protect personal information. It applies when you:

• visit vantar.co or any other website we operate
• use the Vantar web app or mobile apps
• apply for, open or use an Account
• contact us, join our community, take part in promotions or research, or otherwise interact with us

We call all of these the “Platform”.

1.2 It covers visitors, applicants, customers, former customers and people whose information customers give us, such as trusted contacts.

1.3 Other privacy notices also apply in some cases:

• Brokerage account: Alpaca’s privacy notice
• Wallets: the Wyrr privacy notice
• Vantar Prime institutional clients: their client agreements

3.1 Information you give us

3.2 Information we collect automatically

We don’t access your contacts, photos or microphone. The camera is used only during identity verification, when you choose to take a document photo or selfie.

3.3 Information created when you use our services

• account numbers, account status, balances, positions, orders, trades and cost basis
• deposits, withdrawals, conversions, transfers and fees
• Auto-Invest risk score, portfolio and rebalancing history
• verification results, risk ratings, and sanctions and screening results
• statements, confirmations and tax documents

3.4 Information from third parties

3.5 Sensitive personal information. Some information is considered sensitive under certain laws:

• government identifiers
• account numbers and financial information
• account sign-in credentials
• biometric data (outside the U.S.)

We use sensitive information only for the purposes the law allows: opening and running your Account, verifying your identity, preventing fraud, keeping your Account secure and meeting legal obligations. We don’t use it to infer characteristics about you.

3.6 Biometric data. If you’re verified outside the U.S., our verification provider uses your selfie and ID photo to create a facial template and compare the two. We use this biometric data only to confirm your identity and prevent fraud, only with your explicit consent, and keep it only as described in section 9. U.S. customers aren’t asked for biometric data.

3.7 Information about other people. If you give us information about someone else, such as a trusted contact, you confirm that you’ve told them and have the right to share it.

4.1 Automated decision-making. We use automated tools to help with:

• verifying your identity
• screening against sanctions lists
• detecting fraud
• scoring your Auto-Invest questionnaire to set your risk level

Where an automated decision has a legal or similarly significant effect on you, such as declining an application, our team reviews it before it becomes final. Where the law gives you the right, you can ask for human review, give your point of view and contest the decision.

4.2 Aggregated and de-identified information. We may create information that no longer identifies you, and use it for any lawful purpose, such as research and reporting. We won’t try to re-identify it.

We don’t sell your personal information, and we don’t share it with third parties for their own marketing. We don’t share it for cross-context behavioral advertising, except as you allow through cookie settings.

We share personal information only:

Pulse summaries are produced from third-party market news and data. We don’t use your personal information to generate Pulse, and we don’t use your Account data to train third-party AI models.

7.1 We and our service providers operate in the United States, Nigeria, the United Kingdom and other countries where our group or service providers operate. Your information may be processed in countries other than your own, where data protection laws may differ.

7.2 When we transfer personal information out of the UK or Nigeria, we protect it as those laws require. This means relying on adequacy decisions, or using the UK International Data Transfer Agreement or Addendum, or other safeguards the NDPA accepts. You can ask for a copy of the safeguards by emailing privacy@vantar.co.

8.1 We use administrative, technical and physical safeguards that fit the sensitivity of the information, including:

• encryption in transit and at rest
• multi-factor authentication
• role-based access controls and least-privilege access
• logging and monitoring
• vulnerability management and penetration testing
• vendor due diligence
• staff training

8.2 No system is completely secure. Protect your Account as described in our Security & Fraud Prevention Policy.

8.3 If a data breach affects your personal information, we’ll notify you and the authorities as the law requires.

We keep personal information for as long as needed for the purposes in this policy, including to meet legal, regulatory, tax, accounting and reporting requirements. We then delete or anonymize it.

• Marketing: unsubscribe from any marketing email, reply STOP to marketing texts, or change your choices in Settings › Notifications.
• Cookies: choose Cookie settings in the website footer or Settings › Privacy in the app. We honor Global Privacy Control signals.
• Push notifications: manage them in Settings or on your device.
• Advertising identifiers: limit ad tracking in your device settings.
• Community: leave the WhatsApp group at any time.
• Closing your Account: see our Account Closure & Deletion Policy.

Depending on where you live, you may have the right to:

• Access: know what personal information we hold about you and get a copy
• Correction: have inaccurate information corrected
• Deletion: have information deleted, subject to our legal duty to keep records
• Portability: receive information in a portable format
• Restriction and objection: restrict or object to certain processing, including processing based on legitimate interests
• Withdraw consent: at any time, without affecting earlier processing
• Object to direct marketing: at any time
• Automated decisions: ask for human review of significant automated decisions
• Complain: to a data protection authority

See section 15 for the details that apply where you live.

11.1 How to make a request. Email privacy@vantar.co, or use the request form in Settings › Privacy.

• We’ll verify your identity before acting, usually by confirming details you’ve given us or through your signed-in Account.
• An authorized agent may make a request for you where the law allows, with proof of authority.
• We’ll respond within the time the law requires, usually 30 or 45 days, and tell you if we need more time.

11.2 When we can’t fully comply. Financial services law requires us to keep many records, even after you ask us to delete them. We’ll tell you what we can’t delete and why.

11.3 No discrimination. We won’t treat you differently for using your privacy rights.

The Platform is for adults only. We don’t knowingly collect personal information from anyone under 18. If you think a child has given us information, email privacy@vantar.co and we’ll delete it.

The Platform links to third-party services, such as Apple and Google sign-in, Plaid, WhatsApp and app stores. Their privacy practices are governed by their own policies.

We may update this Privacy Policy. If we make material changes, we’ll tell you in the app or by email before they take effect, and get your consent where the law requires. The effective date at the top shows when it last changed.

15.1 California residents

Some U.S. state laws, including the California Consumer Privacy Act (CCPA) and the Virginia Consumer Data Protection Act (VCDPA), give residents specific rights. These laws do not apply to non-public personal information collected by financial institutions, which falls under separate financial privacy laws, so they do not cover most of the information. Personal information we collect and share under the Gramm-Leach-Bliley Act, which is most customer financial information, is covered by our U.S. Consumer Privacy Notice instead.

In the last 12 months, we collected the following categories of personal information:

• Your rights: to know, delete and correct; to opt out of sale or sharing; and to limit the use of sensitive personal information.
• Sale or sharing: we don’t sell personal information or share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing information of consumers under 16.
• Sensitive information: we use it only for permitted purposes.
• Making a request: email privacy@vantar.co.
• Shine the Light: California customers may ask about disclosures for direct marketing. We don’t share personal information with third parties for their direct marketing.

15.2 Other U.S. states. Residents of states with comprehensive privacy laws may have similar rights for personal information those laws cover, including the right to appeal our decision on your request. To appeal, reply to our decision or email privacy@vantar.co with “Appeal” in the subject line. If you aren’t satisfied, you can contact your state Attorney General.

15.3 Nigeria

• We process personal information under the Nigeria Data Protection Act 2023.
• You have the rights in section 11, including the right not to be subject to decisions based solely on automated processing that significantly affect you.
• We treat biometric, financial and identification data as sensitive, with extra protection.
• You can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).