California Privacy Disclosure

This Privacy Policy for California Residents supplements the information contained in the Privacy Policy of American First Finance, a Delaware limited liability company (“AFF,” the “Company,” “us,” or “we”) and applies solely to all visitors, users, borrowers, and others who reside in the State of California (“Consumers” or “you”). We adopt this notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”), California Privacy Rights Act of 2020 (“CPRA”), and any terms defined in the CCPA and CPRA have the same meaning when used in this Policy.

Information We Collect

We collect information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device (“personal information“).

Personal information does not include:

• Publicly available information from government records
• Deidentified or aggregated consumer information
• Information excluded from the CCPA’s scope, such as:
  • Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data
  • Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994

The following is a list of categories of personal information which we may collect or may have been collected from California residents within the last twelve (12) months. Please note that the categories and examples provided in the list below are those defined in the CCPA. This does not mean that all examples of that category of personal information were in fact collected by us, but reflects our good faith belief to the best of our knowledge that some of that information from the applicable category may be and may have been collected. For example, certain categories of personal information would only be collected if you provided such personal information directly to us.

Category	Examples	Collected
A.    Identifiers	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.	Yes
B.    Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))	A name, signature, Social Security number, physical characteristics or description, address, telephone number, driver’s license or state identification card number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information. Some personal information included in this category may overlap with other categories.	Yes
C.    Sensitive personal information categories listed in the California Privacy Rights Act (Cal. Civ. Code § 1798.140(ae))	A social security number, driver’s license, state identification card, financial account numbers.	Yes
D.    Protected classification characteristics under California or federal law	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	Yes
E.    Commercial information	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	Yes
F.    Biometric information	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifiers or identifying information, such as fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke or gait, or other physical patterns, and sleep, health or exercise data.	No
G.    Internet or other similar network activity	Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.	Yes
H.   Geolocation data	Approximate physical location.	Yes
I.    Sensory data	Audio, electronic, visual, thermal, olfactory, or similar information.	No
J.   Professional or employment-related information	Current or past job history or performance evaluations.	Yes
K.    Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99))	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	No
L.    Inferences drawn from other personal information	Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	Yes

We obtain the categories of personal information listed above from the following categories of sources:

• Directly from you. For example, from forms or applications you complete or products and services you purchase.
• Indirectly from you. For example, from observing your actions on our website.
• From third parties. For example, to verify information in your loan application as allowed by law.

Use of Personal Information

We may use or disclose the personal information we collect for one or more of the following purposes:

• To fulfill or meet the reason you provided the information. For example, if you share your name and contact information to ask a question about our financial products or services, we will use that personal information to respond to your inquiry. If you provide your personal information to apply for one of our financial products, we will use that information to process the evaluation of that loan application. We may also save your information to facilitate new product orders or process returns.
• To provide, support, personalize, and develop our website, products, and services.
• To create, maintain, customize, and secure your financing transactions and account with us.
• To process your requests, purchases, transactions, and payments and prevent transactional fraud.
• To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
• To personalize your website experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our website, third-party sites, and via email or text message (with your consent, where required by law).
• To help maintain the safety, security, and integrity of our website, products and services, databases and other technology assets, and business.
• For testing, research, analysis, and product development, including to develop and improve our website, content, products, and services.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described to you when collecting your personal information or as otherwise set forth in the CCPA.
• As part of the closing process to close your financing transaction.
• To evaluate job applicants.
• To engage independent contractors and compensate them for services.
• To provide benefits or any other employment-related services to employees.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our customers or website users is among the assets transferred.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Disclosing Personal Information

We may share your personal information by disclosing it to a third party for a business purpose. We only make these business purpose disclosures under written contracts that describe the purposes, require the recipient to keep the personal information confidential, and prohibit using the disclosed information for any purpose except performing the contract. In the preceding twelve (12) months, Company has disclosed personal information for a business purpose to the categories of third parties indicated in the chart below.

Personal Information Category	Third-Party Recipients Having Received Business Purpose Disclosures
A. Identifiers	Data analytic providers, social networks, service providers, affiliates, internet cookie data recipients, merchants that we work with to offer our services, lenders and assignees
B. California Customer Records personal information categories	Data analytic providers, social networks, service providers, affiliates, internet cookie data recipients, merchants that we work with to merchants that we work with to offer our services, lenders and assignees
C. Sensitive personal information	Service Providers, affiliates, lenders and assignees
D. Protected classification characteristics under California or federal law	Service Providers, affiliates, lenders and assignees
E. Commercial information	Affiliates, lenders and assignees
A. Biometric information	None
G. Internet or other similar network activity	Data analytic providers, social networks, service providers, affiliates, internet cookie data recipients
H. Geolocation data	Data analytic providers, social networks, service providers, affiliates, internet cookie data recipients, merchants that we work with to merchants that we work with to offer our services
I. Sensory data	None
J. Professional or employment-related information	Service providers and affiliates
K. Non-public education information	None
L. Inferences drawn from other personal information	Service Providers, affiliates

Please note that the categories listed above are those defined in the CCPA. This does not mean that all examples of that category of personal information were in fact disclosed, but reflects our good faith belief to the best of our knowledge that some of that information from the applicable category may be and may have been disclosed.

Sale of Personal Information

As defined in the CCPA, “sell” and “sale” mean selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for valuable consideration. This means that we may have received some kind of benefit in return for sharing personal information, but not necessarily a monetary benefit.

Our use of Google Analytics, cookies and other tracking technologies may be considered a sale of personal information under the CCPA. Categories of personal information that we have shared through third-party cookies include Identifiers (e.g., IP addresses) and Internet or other similar network activity.

You can opt out of our tracking technologies for analytics and advertising via by clicking the Do Not Sell my Personal Information link on our website.
In the preceding twelve (12) months, AFF has not used or disclosed Sensitive Personal Information for purposes other than those specified under CCPA Regulation 7027(m).

Your Rights and Choices

The CCPA provides Consumers (California residents) with specific rights regarding their personal information.

Right to Know

The right to request, up to 2 times in a 12-month period, that we identify to you (1) the categories of personal information we have collected about you going back to January 1, 2022, unless doing so would be impossible or involve disproportionate effort, or unless you request a specific time period, (2) the categories of sources from which the personal information was collected, (3) the business or commercial purpose for collecting, selling, or sharing this information, (4) the categories of third parties with whom we share or have shared your personal information;

Right to Access

The right to request, up to 2 times in a 12-month period, that we disclose to you, free of charge, the specific pieces of personal information we have collected about you going back to January 1, 2022, unless doing so would be impossible or involve disproportionate effort, or unless you request a specific time period; Right to Delete. The right to request, up to 2 times in a 12-month period, that we delete personal information that we collected from you, subject to certain exceptions;

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting or selling that personal information.
• The categories of third parties with whom we share that personal information.
• Although we do not sell your personal information, if that practice ever changed and we had sold or disclosed your personal information for a business purpose, two separate lists disclosing:
  • sales, identifying the personal information categories that each category of recipient purchased; and
  • disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
• The specific pieces of personal information we collected about you (also called a data portability request).

Right to Delete

The right to request, up to 2 times in a 12-month period, that we delete personal information that we collected from you, subject to certain exceptions;

Right to Correct

The right to request that we correct inaccurate personal information (to the extent such an inaccuracy exists) that we maintain about you;

Right to Opt-Out

You have the right, at any time, to opt out of the selling or sharing of your personal information. If you opt-in to personal information sales or sharing, you may opt out of future sales or sharing of your personal information at any time. If you are age 16 or older, you have the right to direct us to not sell your personal information at any time (the “right to opt-out”). We do not sell or share the personal information of consumers we actually know are less than 16 years old.

Exercising Your Rights

To exercise your rights described above, please submit a request by either:

• Calling us at 1-855-721-1188
• Emailing us at privacy@americanfirstfinance.com

Only you, or someone legally authorized to act on your behalf, may make a request related to your personal information.

Verifying Your Request

When you submit a Right to Know, Right to Access, Right to Delete, or Right to Correct request through one of the methods provided above, we will ask you to provide some information in order to verify your identity and respond to your request. Specifically, we will ask you to verify information that can be used to link your identity to particular records in our possession, which depends on the nature of your relationship and interaction with us. For example, we may need you to provide your name, email, phone number, IP address, browser ID, amount of your last purchase with the business, and/or date of your last transaction with the business.

Response Timing and Format

We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day time frame, please contact privacy@americanfirstfinance.com. We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing. We will deliver our written response electronically, unless you request us to provide it by mail. The response we provide will also explain the reasons we cannot comply with your request, if applicable.

For a request to correct inaccurate personal information, we will accept, review, and consider any documentation that you provide, and we may require that you provide documentation to rebut our own documentation that the personal information is accurate. You should make a good faith effort to provide us with all necessary information at the time that you make the request to correct. We may deny a request to correct if we have a good faith, reasonable, and documented belief that a request to correct is fraudulent or abusive. If we deny your request to correct, we shall inform you of our decision not to comply and provide an explanation as to why we believe the request is fraudulent.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Authorized Agents

If you are a California resident, you can authorize someone else as an authorized agent who can submit a request on your behalf. To do so, you must either (a) execute a valid, verifiable, and notarized power of attorney or (b) provide other written, signed authorization that we can then verify. When we receive a request submitted on your behalf by an authorized agent who does not have a power of attorney, that person will be asked to provide written proof that they have your permission to act on your behalf, and we will also contact you and ask you for information to verify your own identity directly with us and not through your authorized agent. We may deny a request from an authorized agent if the agent does not provide your signed permission demonstrating that they have been authorized by you to act on your behalf.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you with a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

Data Retention

We retain personal information and sensitive personal information for as long as necessary to complete our business purpose. Because we maintain our applications and websites to protect from accidental or malicious loss and destruction, residual copies of your personal information and sensitive personal information may be retained in our backup and archival systems for a limited period of time, after which the information will be automatically deleted or put beyond use where deletion is not possible.

Changes to Our Privacy Policy

We reserve the right to amend our Privacy Policy and this California notice at our discretion and at any time. When we make changes to this privacy policy, we will post the updated notice on the Website and update the notice’s effective date. Your continued use of our Website following the posting of changes constitutes your acceptance of such changes.

Contact Information

If you have any questions or comments about this notice, the ways in which American First Finance collects and uses your information described here and in the Privacy Policy, or regarding your choices and rights, or wish to exercise your rights under California law, please do not hesitate to contact us at:

Phone: 1-855-721-1188
Website: www.americanfirstfinance.com
Email: privacy@americanfirstfinance.com
Postal Address: P.O. Box 565848, Dallas, TX 75356

If you need to access this Policy in an alternative format due to having a disability, please contact privacy@americanfirstfinance.com and/or 1-855-721-1188.