Privacy Policy

01Information We Collect

Personal Information You Provide

When you use our services, we may collect the following information:

• Contact Information: Name, email address, phone number, business address
• Business Information: Business name, industry, revenue, number of employees
• Financial Documents: Bank statements, existing funding agreements, payment schedules
• Tax Documents: W-9 forms, SS-4 letters
• Identity Verification: Government-issued identification, voided checks
• Account Credentials: Username, password, and security questions
• Bank Account Information (ACH Payments): Account holder name, bank account number, routing number, and bank name, collected for the purpose of processing ACH payments
• Scheduling Information: When you book an introductory call on this website, the contact and business details you enter plus the date and time you select

Financial Account Data via Stripe Financial Connections

When you authorize ACH payments through our platform, we use Stripe Financial Connections to instantly verify your bank account. With your explicit permission, Stripe Financial Connections may access and share with us the following data from your financial institution:

• Account and Routing Numbers: Tokenized versions used to process ACH debits — required for all ACH payment flows
• Account Ownership Details: Account holder name(s) as they appear at your financial institution, used to verify account ownership and prevent fraud
• Account Balances: Current available and ledger balances, accessed prior to initiating debits to reduce payment failures
• Account Status: Whether the account is active and eligible to receive ACH debits

This data is accessed only with your explicit consent during the bank linking process. You may disconnect your financial account at any time. Data accessed through Stripe Financial Connections is subject to Stripe's Privacy Policy.

Information Collected Automatically

When you visit our website, our hosting provider automatically collects standard server and security log data:

• IP address and device identifiers
• Browser type and operating system
• Pages visited and time spent on pages
• Referring website addresses

Our public website does not run advertising or third-party analytics trackers. See our Cookie Policy for exactly which cookies we set.

02How We Use Your Information

We use the information we collect to:

• Process and evaluate debt restructuring applications
• Communicate with you about your account and our services
• Schedule and confirm introductory calls you request
• Verify your identity and prevent fraud
• Negotiate with funders on your behalf
• Calculate and process commission payments to ISO partners
• Process ACH payments and recurring weekly debits for program fees and debt restructuring payments
• Verify bank account ownership and eligibility through Stripe Financial Connections prior to initiating ACH debits
• Perform pre-debit balance checks to reduce the risk of insufficient funds failures and returned payments
• Improve our website and services
• Comply with legal obligations, including NACHA ACH Operating Rules
• Send marketing communications (with your consent)

03How We Share Your Information

We may share your information with:

• Funding Partners: To negotiate debt restructuring terms on your behalf
• ISO Partners: Limited information necessary to process referral commissions
• Service Providers: Third parties who help us operate our business (payment processing, hosting, database, email, and messaging — see Section 9)
• Stripe, Inc.: Our payment processor. When you connect a bank account or make an ACH payment through our platform, your bank account data (including account and routing numbers, ownership details, and balances) is shared with Stripe for payment processing and fraud prevention purposes. Stripe acts as our data processor and is bound by their own Privacy Policy and Financial Connections Terms.
• Legal Authorities: When required by law, court order, or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

We do not sell your personal information to third parties for marketing purposes.

04Payment Processing & ACH Authorization

4.1 Stripe as Our Payment Processor

We use Stripe, Inc. to process ACH payments and bank account verifications. Stripe is a PCI DSS Level 1 certified payment processor. When you provide bank account information through our platform, that information is transmitted directly to and stored by Stripe using industry-standard encryption. Funders First does not store your full unencrypted bank account or routing numbers on our own servers.

4.2 Stripe Financial Connections — Instant Bank Verification

To authorize ACH debits without a multi-day micro-deposit delay, we use Stripe Financial Connections, Stripe's instant bank account verification product. When you enroll in our program and connect your bank account:

• You will be presented with a Stripe-hosted authentication interface
• You will log in to your financial institution directly through Stripe's secure environment
• You will select the account to be used for ACH payments
• You will be shown exactly what data Stripe and Funders First will access
• You must explicitly grant permission before any data is shared

The data accessed through Stripe Financial Connections is used solely to: (1) verify your bank account for ACH payments, (2) confirm account ownership, and (3) perform pre-debit balance checks to reduce payment failures. You may disconnect your financial account from our platform at any time by contacting us at info@fundersfirst.com. Learn more at stripe.com/financial-connections.

4.3 ACH Debit Authorization & NACHA Compliance

By enrolling in the Funders First program and completing the bank account connection process, you authorize Funders First, Inc. (operating through its payment processor Stripe, Inc. and its ACH originator Increase LLC) to initiate recurring ACH debit entries to your designated bank account in the amounts and on the schedule set forth in your Merchant Agreement. This authorization is governed by NACHA's ACH Operating Rules and the Electronic Fund Transfer Act (EFTA), 15 U.S.C. § 1693 et seq.

Specifically, by completing enrollment you authorize:

• Recurring Weekly ACH Debits: Automatic drafts every Wednesday for your weekly program payment
• Initial Enrollment Payment: A one-time debit for the Funders First enrollment fee plus your first weekly payment, initiated upon verification of your bank account
• Revocation: You may revoke this authorization at any time by providing written notice to Funders First at least 3 business days prior to the scheduled debit. Revocation does not relieve you of obligations under your Merchant Agreement.

A record of your ACH authorization, including the date, time, and method of authorization, is retained in accordance with NACHA requirements (minimum 2 years from the date of authorization or the date the authorization is terminated, whichever is later).

4.4 Returned Payments

If an ACH debit is returned unpaid for any reason (for example insufficient funds, account closed, or payment stopped), we may use the bank account data we have on file to re-attempt the debit in accordance with NACHA rules (maximum two re-presentments for NSF returns). We will notify you of any returned payment via the contact information on file.

05Data Security

We implement industry-standard security measures to protect your information, including:

• SSL/TLS encryption for data in transit
• Encrypted storage for sensitive documents
• Access controls, role-based permissions, and authentication requirements
• Regular security assessments and monitoring
• PCI DSS-compliant payment processing through Stripe's Level 1 certified infrastructure
• Tokenization: Bank account numbers are tokenized by our processor and are not stored in plaintext on Funders First servers

While we strive to protect your information, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

06Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. Financial records are typically retained for 7 years as required by law. ACH authorization records are retained for a minimum of 2 years from the date of authorization or termination of the authorization, as required by NACHA rules.

07Your Rights and Choices

Access and Correction

You may request access to your personal information and ask us to correct any inaccuracies by contacting us.

Deletion

You may request deletion of your personal information, subject to certain legal exceptions. We may need to retain certain information for legal compliance or legitimate business purposes, including ACH authorization records required by NACHA.

Disconnect Your Bank Account

If you have connected a bank account through Stripe Financial Connections, you may request disconnection at any time by contacting us at info@fundersfirst.com. Disconnecting your bank account does not terminate your payment obligations under your Merchant Agreement.

Marketing Communications

You may opt out of marketing emails by clicking the "unsubscribe" link in any marketing email or by contacting us directly.

California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, including:

• Right to know what personal information we collect
• Right to delete your personal information
• Right to opt out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising your rights

Arizona Residents

Arizona residents may have additional rights under applicable state laws. Contact us to exercise any data protection rights.

08Cookies and Tracking

We use a small number of strictly necessary cookies to keep you signed in and to protect form submissions. We do not use advertising cookies. For the full list, see our Cookie Policy.

09Third-Party Services

Our website and services involve third-party service providers whose own privacy policies apply to data they receive. Our key processors are:

• Stripe, Inc. — Payment processing and instant bank account verification. Privacy Policy
• Increase LLC — ACH transfer origination and payment disbursement
• Supabase — Database and authentication infrastructure for our dashboards
• Vercel — Website and application hosting
• Resend — Transactional email delivery (confirmations, notifications, enrollment)
• SendBlue — SMS and messaging delivery for deal communications
• Anthropic — AI processing used in our internal analysis tools

Our website may also contain links to other third-party websites. We are not responsible for the privacy practices of those external sites and encourage you to review their privacy policies.

10Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn we have collected information from a child, we will delete it promptly.

11Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website with a new "Last Updated" date. Your continued use of our services after changes constitutes acceptance of the updated policy.

12Contact Us

If you have questions about this Privacy Policy, wish to exercise your rights, or have questions about how your bank account data is used, please contact us: