State Privacy Rights

1. What You Can Ask For

Banrox gives every United States resident the same set of privacy rights, whether or not the state you live in has passed a privacy law yet. Banrox took that decision because running one standard is honest and because it is simpler to audit than twenty.

That includes information the Gramm-Leach-Bliley Act regulates. Banrox is a financial institution under that Act, and several state privacy laws would let a financial institution put that information beyond their reach. Banrox does not use the exemption to take a right away from you. Every right on this page covers every category of personal information Banrox holds about you, including your Social Security number, your bank connection and the contents of your credit file.

2. How to Submit a Request

Use any of these. All are free.

• Global Privacy Control. Turn it on in your browser or install a supported extension. We detect it and treat it as an opt out of sale and sharing immediately. No account, no form, no email.
• Your account. Sign in and open Privacy Settings. Access, correction, deletion, and Do Not Sell or Share My Personal Information are all there.
• Email. [email protected]. Put the right you want in the subject line.
• Phone. (888) 888-6401.
• Mail. Banrox Inc., Attn: Privacy, 40 N Altadena Dr, Ste 105, Pasadena, CA 91107.

You do not need a Banrox account to make a request. If you have never had one, we will still search for information about you and answer.

3. How We Verify You

We have to be sure a request comes from the person it concerns, because handing your data to an impostor would be the worse failure.

• If you have an account, sign in. That is the verification.
• If you do not, we will ask you to confirm two or three pieces of information we already hold, matched against our records.
• For deletion of sensitive information, or for a copy of specific pieces of information, we may ask for a signed declaration under penalty of perjury.
• We never ask you to create an account in order to make a request, and we never ask for information we do not already have in order to verify you.

Information you send Banrox purely to verify a request is used only for that purpose. Banrox destroys the material itself as soon as the request closes. Banrox keeps a record that the request was made, how it was verified and how Banrox answered, for 24 months, because California requires that record. That record does not contain the documents you sent.

4. Authorised Agents

Someone else can act for you, including a privacy service. Send us written permission signed by you, or a lawful power of attorney. We may still contact you directly to confirm you gave permission, and to verify your identity, unless a power of attorney is in place.

An opt out of sale or sharing submitted by an agent, including through a browser signal, does not require this paperwork. We honour it as sent.

5. How Long We Take

6. Appealing a Refusal

If we refuse a request in whole or in part, our answer will say exactly why and will include the appeal instructions. To appeal, reply to that message or write to [email protected] with the subject "Privacy Appeal" within 60 days. A person who was not involved in the original decision reviews it. We answer within 45 days in writing.

If the appeal is denied, we give you a way to complain to your state attorney general. You may also complain to the California Privacy Protection Agency at cppa.ca.gov if you are a California resident, or to the Federal Trade Commission at reportfraud.ftc.gov. You never have to appeal to us before going to a regulator.

7. One Exception Worth Understanding: Credit Report Data

We cannot correct or delete your credit file. Credit report information displayed in Banrox comes from consumer reporting agencies and belongs to their file, not ours. A deletion request to Banrox removes it from your Banrox account. It does not change what Equifax, Experian, or TransUnion holds, and no company can promise otherwise. To fix an error in your file you dispute it with the bureau and with the company that reported it, which is free. The step by step route is at Credit Data and Your FCRA Rights.

8. State by State

Twenty states have comprehensive privacy laws in force. Banrox applies the same standard to all of them and to the thirty states that do not yet have one.

How these laws treat a financial institution. Banrox is a financial institution under the Gramm-Leach-Bliley Act. California, Connecticut and Montana exempt only the data that Act regulates and not the company holding it. Oregon and Minnesota exempt only certain kinds of institution, which Banrox is not. The remaining fifteen, Maryland among them, exempt a financial institution as an entity and would let Banrox put your financial information outside the law altogether. Banrox does not sort you by which of those lists your state is on. Every right on this page is given in every state, over every category.

Universal opt out signals. California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas require businesses to honour a browser level opt out signal. Banrox honours the Global Privacy Control signal from every visitor in every state, not only those twelve. Banrox also honours any other browser level opt out mechanism that a state regulator adds to its published list of recognised mechanisms, and Banrox checks those lists at least twice a year.

Selling sensitive data. Maryland bans the sale of sensitive data outright, with no consent that cures it. New Jersey's flat ban took effect on 30 June 2026. Connecticut adds bans on the sale of facial recognition data and of precise geolocation from 1 October 2026. Banrox does not sell sensitive data in any state, has never done so, and does not intend to.

Consumer health data. Banrox does not ask you for health data and does not collect it to run any feature. If you use identity monitoring, a source Banrox watches can contain health information about you, because breach files and public records sometimes do. Where that happens Banrox shows the finding to you, uses it only to alert you and to send the removal requests you asked for, never sells it, never shares it for advertising, and deletes it when you close your account or turn the feature off. Washington's My Health My Data Act reaches any person whose consumer health data is collected in Washington, not only people who live there. If that is you, ask Banrox at [email protected] to delete any such finding and Banrox will do it and confirm in writing. Nevada residents can ask for the same thing at the same address under Senate Bill 370.

Additional state notices. California residents also have the Shine the Light right described in the Privacy Policy. Nevada residents may submit a verified request not to sell covered information under NRS 603A.340 to [email protected].

9. What Banrox Publishes About Requests

Banrox is below the threshold at which California requires a business to publish annual request metrics, and it does not publish them. What Banrox will do is answer you directly. Write to [email protected] and ask how many privacy requests Banrox received in the last 12 months, how many it complied with, how many it refused and how long it took on average, and Banrox will send you the numbers within 10 business days.

10. Contact