Privacy Policy

1. Scope and How the Two Privacy Regimes Fit Together

This Privacy Policy explains how Banrox Inc. ("Banrox," "we," "us," "our") collects, uses, discloses, retains, and protects personal information through banrox.com, the Banrox member dashboard, our emails and text messages, and any page or feature that links to this policy.

Two bodies of law apply to what Banrox holds about you. Banrox applies both of them to all of it.

Banrox is a financial institution under the Gramm-Leach-Bliley Act because it is significantly engaged in financial activities. Banrox does not use the GLBA exemption to take a state privacy right away from you. You have every right listed at State Privacy Rights over all personal information Banrox holds about you, including information the Gramm-Leach-Bliley Act regulates and information a state law would otherwise let Banrox exclude. Where the GLBA Privacy Notice and this policy say different things about the same data, Banrox follows the more protective statement.

Five states reach Banrox whatever the exemption says. California, Connecticut and Montana exempt only the data the Gramm-Leach-Bliley Act regulates and not the company holding it, and Oregon and Minnesota exempt only kinds of institution that Banrox is not. Banrox does not rely on the difference between those states and the rest. It applies one standard in all fifty. Section 12 explains why Banrox is not a data broker, and that explanation rests first on the fact that Banrox deals with you directly. Nothing in Section 12 reduces any right described in Section 9.

This policy does not cover a third party's site or product. When you leave Banrox for a lender, bank, card issuer, or insurer, that company's own privacy policy governs from that moment.

2. What We Collect, Where It Comes From, and Why

The table below is the notice at collection required by California law and serves the equivalent requirement in other states. "Sold or shared" uses the statutory meaning in those laws, which is broader than an exchange of money.

Banrox does not ask you for, and does not collect to run any feature, biometric identifiers, precise geolocation, health data, genetic data, union membership, religious or philosophical beliefs, racial or ethnic origin, sexual orientation, or immigration status. If you volunteer any of it in a free text field, Banrox deletes it when it finds it. If you use identity monitoring, a source Banrox watches can contain health information about you, because breach files and public records sometimes do, and Section 8 of State Privacy Rights explains what Banrox does with a finding like that.

What Banrox sold or shared in the last 12 months. In the preceding 12 months Banrox sold or shared only one category of personal information: referral information, consisting of your name, email, phone, postal code, product interest and requested amount, and only to the specific company you asked to be matched with. Banrox shared online activity for cross context behavioural advertising only where a visitor gave consent in the cookie banner. Banrox sold or shared no other category, and it sold or shared no sensitive personal information at all.

What Banrox disclosed for a business purpose in the last 12 months. In the preceding 12 months Banrox disclosed identifiers, government identifiers, financial account information, consumer report data, identity exposure data, online activity, communications, user content and inferences to the service providers named at Service Providers and Data Recipients, and for no other purpose than to deliver the service to you.

Call recording. Banrox does not record a call unless you are told at the start of that call, before any recording begins. That applies to every call, inbound and outbound. If you do not want the call recorded, say so and the recording stops, and you lose nothing by asking. Where a call is recorded, Banrox keeps the recording for 5 years, and the telephony provider named at Service Providers and Data Recipients carries and stores it under a contract that bars any use of its own.

3. Sensitive Personal Information

Banrox asks for your consent before it processes sensitive personal information, and it asks separately for each thing. You consent to Banrox obtaining your credit file when you sign the written instruction on the credit page. You consent to Banrox receiving your bank account data when you complete the bank connection. You consent to Banrox using your Social Security number and government ID for identity verification at the point it asks for them. Banrox records that you gave each consent and the date you gave it. Capture of the exact wording you were shown, and of the internet address it came from, is in build and is not running yet, so until it ships the version of the wording published on the relevant Banrox legal page on the date you agreed is the wording Banrox will treat as the wording you were shown. You can withdraw any of them in Privacy Settings or by writing to [email protected], and withdrawing switches off the feature it was given for and nothing else. Sixteen of the twenty state privacy laws in force require that consent, and Banrox asks for it in all fifty states.

Your Social Security number, government ID numbers, financial account information, and the contents of your consumer report are sensitive personal information under California law and are protected categories under other state laws.

We use them only to verify your identity, to prevent and detect fraud and security incidents, to deliver the specific service you asked for, and to meet a legal obligation. We do not use them to infer characteristics about you. We do not use them for advertising. We do not include them in a referral. We do not sell them and we do not share them for cross context behavioural advertising, in any circumstance, for any price.

Banrox does not use sensitive personal information to infer any characteristic about you, including what product might suit you. Product suggestions come only from the filters you set and the pages you chose to look at. Because Banrox uses sensitive personal information only for the purposes listed at 11 C.C.R. section 7027(m), the right to limit the use of sensitive personal information does not change how Banrox treats it, and California does not require Banrox to post a limit link. You may still send the request and Banrox will confirm this in writing within 45 days.

4. How We Use Personal Information

• Provide, operate, secure, and improve the Services, and deliver the features you turned on
• Verify identity, authenticate logins, and prevent fraud, account takeover, bot abuse, and money laundering
• Obtain and display your own credit information at your written request
• Monitor for exposure of your information and act on removal instructions you give us
• Take payment, manage subscriptions, and issue refunds
• Send service, security, billing, and legally required messages
• Send marketing where you consented, and stop when you tell us to
• Answer support requests and resolve complaints and disputes
• Measure and improve the site, run aggregate analytics, and test changes
• Comply with law, respond to lawful requests, enforce our terms, and establish or defend legal claims

Banrox does not approve, deny, or price credit, insurance, or any financial product, and does not decide anything about your employment, housing or education. Those decisions belong to the providers, which make them with their own systems. Banrox does run one automated score of its own: a fraud and bot score at signup and at login, which can slow down or block an attempt that looks automated or looks like a stolen credential. Section 9 sets out what that score does and what you can do about it.

5. Who We Disclose Information To, and What Counts as a Sale

Service providers

We use vendors to host, secure, verify, message, analyse, and support. Each is contractually restricted to using Banrox data only to perform its service for Banrox and is barred from selling it. Some of these companies run fraud, identity and network security services that only work by comparing signals across many clients, and Banrox does not claim a restriction it did not obtain. Which companies do that, and what each one receives, is set out company by company at Service Providers and Data Recipients.

Providers you asked to be matched with

When you ask to be matched or request a quote, we pass the referral information listed in Section 2 to the specific providers responsive to that request, so that they can respond to you. Under California law this transfer can be a "sale" because we may be paid for it, so we treat it as one and give you the opt out even though you asked us to make it.

The hard limits on referrals. A referral never contains your Social Security number, a government ID number, a financial account number, a precise location, or anything taken from your credit report or your credit score, including anything derived from either. Banrox does not sell or share a referral for anyone under 18. We do not sell lists of members to companies you did not ask about, and we do not place your information into an open bidding exchange.

Advertising partners

We do not share personal information for cross context behavioural advertising unless you consent through the cookie banner. If you consent, you can withdraw at any time, and a Global Privacy Control signal withdraws it automatically. See the Cookie and Tracking Technologies Notice.

Legal, safety and corporate

We disclose information when compelled by law or valid legal process, to protect the rights, property, or safety of Banrox, our members, or the public, to enforce our terms, and to auditors, insurers, and professional advisers under confidentiality. In a merger, acquisition, financing, or sale of assets, information may transfer to the successor, which remains bound by this policy for information collected before the transfer, and we will give notice before any material change in how it is handled.

We do not give any government agency direct or unfettered access to member data, and we require valid legal process. Where we are permitted to tell you about a request, we will.

6. Do Not Sell or Share My Personal Information, and Global Privacy Control

You may opt out of the sale or sharing of your personal information at any time. It is free, Banrox applies it as soon as it receives it and in every case within 15 business days, and Banrox does not treat you differently for using it. A Global Privacy Control signal is applied immediately.

• Send a Global Privacy Control signal from your browser or extension. Banrox detects and honours it automatically, with no account and no form. If you are signed in, Banrox applies it to your account as well. Banrox also honours any other browser level opt out mechanism that a state regulator adds to its published list of recognised mechanisms, and Banrox checks those lists at least twice a year.
• Use the Do Not Sell or Share My Personal Information control in your account privacy settings.
• Email [email protected] with the subject line "Do Not Sell or Share My Personal Information."
• Call (888) 888-6401.

An opt out stops future transfers. It cannot pull back information a provider already received, and you would need to contact that provider directly to ask it to delete what it holds. We will tell you which providers received a referral if you ask.

7. How Long We Keep Information

We keep each category for the period stated in the table in Section 2, and no longer, unless a law, a regulatory record keeping obligation, a tax rule, or an active legal claim or investigation requires us to keep it longer. When a retention period ends we delete the record or de-identify it so it can no longer be linked to you, and we do not attempt to re-identify de-identified data.

Banrox does not keep a Social Security number, a government ID number or a bank connection after your account closes. Nothing in law requires Banrox to, because Banrox is not a lender, not a bank and not a consumer reporting agency.

Backups follow their own rotation and are overwritten on a rolling basis, normally within 90 days. A deletion request removes the record from live systems immediately and from backups as they cycle.

8. How We Protect Information

Banrox runs a security programme with a named person accountable for it, encryption of personal information in transit and at rest, multi factor authentication for administrative access, access on a need basis removed when a person leaves, logging and monitoring, dependency and secret scanning before code ships, edge protection against bots and credential stuffing, and contractual security obligations on every vendor. Banrox has not commissioned an independent penetration test, holds no security certification, and has not completed several of the written artefacts a larger financial institution would hold. Those gaps are listed by name at Security and Vulnerability Disclosure, which is the controlling statement of what Banrox does and does not run.

No system is perfectly secure, and we do not claim otherwise. If personal information about you is subject to a breach, Banrox will investigate, contain it, and notify you and the applicable regulators within the deadlines the law sets, and the notice will say what happened, what was involved, and what Banrox is doing. Encryption does not change that: if information was encrypted but the key was also taken, Banrox treats it as unencrypted, and if someone gains unauthorised access to information, Banrox treats it as acquired unless there is reliable evidence that it was not. Our full posture, including which certifications we do and do not hold, is at Security and Vulnerability Disclosure.

9. Your Privacy Rights

Depending on where you live, you have some or all of the rights below. Every one of them is exercised through the same place: State Privacy Rights, which also sets out how we verify a request, how an authorised agent may act for you, how long we take, and how to appeal a refusal.

• Know and access. What we collected, where it came from, why, who received it, and a copy in a portable format.
• Correct. Fix information about you that is inaccurate.
• Delete. Have us delete information about you, subject to legal exceptions we will identify specifically if we rely on one.
• Opt out of sale or sharing. As described in Section 6.
• Limit sensitive information. As described in Section 3.
• Question a profiling result. Banrox does not profile you to decide anything about credit, insurance, employment, housing, education or any other financial product. Banrox does run an automated fraud and bot score, described below this list, and you can ask why, see what it used, and have a person review it.
• Know who has your data by name. Ask which specific companies received your information, which category they received, and when. Banrox answers with company names, not categories.
• Appeal a denied request, and then complain to your state attorney general.
• Non-retaliation. We will not deny service, charge a different price, or give you a lower quality of service because you used a privacy right.

The fraud and bot score, in full. Banrox scores a signup and a login for signs of automation, stolen credentials and account takeover. A high score can slow the attempt down, ask you for another check, or block it, and Banrox can refuse an account on it. It is the one automated decision Banrox makes about you, so Banrox describes it here rather than deny it. If it happens to you, write to [email protected] and a person reviews it. Banrox tells you the general reason, lets you see the information the score used, corrects that information if it is wrong, and reverses the block if the block was wrong. Banrox answers within 10 business days. You cannot switch the score off, because it is what keeps other people out of your account, and every state privacy law lets a business keep a security measure running. What you can do is challenge the result, and that is the right described here. Minnesota gives you the right to question the result of profiling, to be told why it came out that way, and to see the data behind it, and Banrox gives that right to everyone. Where a failed identity check is the reason Banrox refuses or ends an account, the notice Banrox sends is described at Credit Data and Your FCRA Rights.

The dates Banrox is working to. Colorado Senate Bill 26-189 takes effect on 1 January 2027 and covers automated decision making technology used in consequential decisions, which expressly include financial services. It requires a clear pre use notice, a plain language explanation of the decision and of the technology's part in it within 30 days of an adverse outcome, and rights to correct the data and to meaningful human review. California's automated decision making technology regulations set 1 January 2027 as the compliance date for technology already in use, require risk assessments of activities carried on before 2026 to be completed by 31 December 2027, and require the first attestation to the California Privacy Protection Agency by 1 April 2028. Banrox is working to those dates. What is written above is what Banrox does today.

California residents may also request, once a year and free, information about disclosures of personal information to third parties for their direct marketing purposes under California Civil Code section 1798.83, the "Shine the Light" law. Write to [email protected] with the subject "Shine the Light." Nevada residents may submit a verified request not to sell covered information under NRS 603A.340 to the same address.

10. Cookies, Pixels, Session Tools and Signals

Strictly necessary cookies run so the site works and stays secure. Analytics, session replay and advertising technologies load only after you choose to allow them in the cookie banner, and none of them loads if you choose Essential only.

Two third party tools are what that choice is about, and Banrox names them here rather than describe them as categories.

Microsoft Clarity. Session replay and heat maps, which together are a reconstruction of how a page was used.

Google Analytics 4. Measurement of which pages and journeys were used and how often. Accepting also turns on advertising measurement inside Google Analytics 4, which is why the choice is worth reading before you make it.

Neither tool receives what you type. A form that carries a password, a Social Security number, a date of birth, an account or routing number, a telephone number or an income figure is masked in your browser as a block, labels included, before anything is sent.

Banrox also measures, on its own servers, which pages and elements of a page were used. That measurement carries no field contents, goes to no other company, and is never sold or shared. How it is controlled is set out at Cookie and Tracking Technologies Notice.

Global Privacy Control. Banrox honours it. If your browser sends that signal, Banrox treats it as a refusal before anything loads: you are shown no banner at all, no session replay runs, and no analytics runs. You do not have to click anything and you are not asked twice. Banrox also honours any other browser level opt out mechanism that a state regulator adds to its published list of recognised mechanisms, and Banrox checks those lists at least twice a year.

Banrox does not respond to legacy Do Not Track headers, because no common standard for them was ever settled, and Banrox says so here rather than leave it unanswered. Full detail, including each vendor and what it receives, is at Cookie and Tracking Technologies Notice.

11. Children

The Services are for adults, and you must be 18 to use them. Banrox collects a date of birth, so if Banrox sees that an account holder is under 18 it closes the account, deletes the personal information within 30 days, and refunds any subscription charged to that account in full. Banrox does not knowingly collect personal information from a child under 13. Banrox does not sell or share the personal information of anyone under 18, does not use it for targeted advertising, and does not profile it, whether or not Banrox knows the person's age. If you believe a child gave Banrox information, write to [email protected] and Banrox will delete it and confirm to you that it did.

12. Our Status Under Data Broker Laws

Banrox is not a data broker in California or in any other state, for one reason above all: a data broker is a business that sells the personal information of people it has no direct relationship with, and every person whose information Banrox holds is a Banrox member or someone who came to Banrox directly. Banrox does not buy consumer lists and does not resell anyone's information. The California Delete Act also excludes a business to the extent that it is covered by the Gramm-Leach-Bliley Act or the Fair Credit Reporting Act, and most of what Banrox holds is covered by one or the other. Those exclusions are written as limits on an activity rather than as a blanket exemption for a company, so Banrox relies on the direct relationship first and on them second.

Privacy Protect does not change that. When Banrox sends an opt out or a deletion request as your authorised agent, it acts on your instruction, about you, to a business you asked Banrox to write to. Banrox has a direct relationship with you and sells nothing. On the words of California Civil Code section 1798.99.80 that is not data broker activity. No California Privacy Protection Agency guidance addresses the point, so this is Banrox's reading of the statute and not a position the regulator has confirmed, and this section says so rather than present it as settled.

California now runs a free deletion platform of its own, and every data broker registered in California has to check it at least once every 45 days and act on what it finds. Banrox is not registered there, because Banrox is not a broker, so a request sent through that platform does not reach Banrox. Send a deletion request to Banrox at State Privacy Rights instead, where it is also free. The platform is reached from the California Privacy Protection Agency at cppa.ca.gov.

Banrox states its status here rather than leave you to guess it, and will update this section in the same release as any change to how it obtains or transfers information. If the status ever changes, Banrox will register where required and honour deletion requests through the state mechanism, and this page will say so.

13. Where Information Is Processed

Banrox serves the United States and processes personal information in the United States. Some vendors provide support from other countries under contractual protections. We are not offering the Services in the European Economic Area, the United Kingdom, or Switzerland, and we do not target residents there.

14. Changes to This Policy

We will post any change here with a new effective date. If a change materially affects how we use information already collected about you, we will give notice by email to the address on your account at least 30 days before it takes effect, and where the law requires consent for the new use we will ask for it rather than assume it. Prior versions are available on request at [email protected].

15. Contact the Privacy Team

If you are not satisfied with our answer, you may complain to your state attorney general, to the California Privacy Protection Agency at cppa.ca.gov, or to the Federal Trade Commission at reportfraud.ftc.gov. Complaining to a regulator costs nothing and you do not have to come to us first.