This Privacy Policy describes how Ottri (“Ottri,” “we,” “us,” or “our”) collects, uses, shares, and protects information when individuals or businesses interact with the Ottri platform, including websites, applications, dashboards, embedded widgets, and APIs (the “Platform”).

Scope

This Privacy Policy applies to information collected through the Platform. It applies to:

• Merchants and merchant personnel
• Partners and authorized users
• Consumers interacting with Ottri-powered experiences through a Merchant
• Any visitors to our Platform

This Policy does not apply to lender-controlled application portals or third-party websites or services not operated by Ottri. Lenders maintain their own privacy practices and notices.

For purposes of this Privacy Policy, "Ottri Inc." refers to Ottri Inc., a Delaware corporation that operates the Ottri Platform. "Ottri Global LLC" refers to Ottri Global LLC, a separate Delaware limited liability company (NMLS ID 2776988) that holds state financial services licenses where required and conducts only those licensed activities for which it is authorized in each applicable jurisdiction. References to "Ottri," "we," "us," and "our" refer to the entity whose activities are described in the relevant provision. Both entities are subject to this Privacy Policy with the following allocation of responsibilities:

(a) Ottri Inc. is the controller of personal information collected through the Platform for technology operations, merchant onboarding, partner services, security, fraud prevention, and analytics. Ottri Inc. does not originate, underwrite, fund, or service credit and does not act as a finance lender or broker in any jurisdiction.

(b) Ottri Global LLC is the controller of personal information collected in connection with its state-licensed activities (NMLS ID 2776988) and is the responsible party for obligations specific to those activities under applicable federal and state financial services and privacy laws. Where Ottri Global LLC's activities are subject to the Gramm-Leach-Bliley Act or state financial privacy laws, this Privacy Policy serves as the required notice for those activities.

Where this Privacy Policy describes an activity, the responsible entity is the entity whose role corresponds to that activity under (a) or (b) above. The Ottri Terms of Service govern your use of the Platform and identify the applicable Ottri contracting entity based on the activity, including Ottri Inc. for general Platform technology services and Ottri Global LLC for consumer financing-related activities conducted by Ottri Global LLC.

Notice at Collection

If you are a California resident, the categories of personal information we collect, the purposes for which we use it, the third parties we share it with, and our retention practices are described in detail in our State Privacy Supplement — California: Notice at Collection. Ottri does not sell personal information for money. Ottri may use advertising cookies and similar technologies that may constitute a “sale,” “sharing,” or targeted advertising under certain state privacy laws. You may opt out through Your Privacy Choices or supported universal opt-out preference signals where required by law.

Ottri’s Role

Ottri Inc. provides technology infrastructure and Platform functionality. Ottri Inc. does not originate, underwrite, fund, or service credit, make credit decisions, set loan terms, or act as a finance lender or broker in any jurisdiction.

Where applicable law requires a licensed entity to conduct a particular consumer financing-related activity, that activity is conducted by Ottri Global LLC, NMLS ID 2776988, under its state financial services licenses where required. Ottri Global LLC may obtain and use consumer report information with consumer consent for initial matching and routing checks, fraud prevention, identity verification, and related consumer financing activities.

Credit decisions and final loan terms are determined solely by independent participating lenders.

Data Controller and Processor Roles

Ottri's role in relation to data varies depending on the context:

When Ottri collects and uses information for its own business purposes — such as operating the Platform, complying with regulatory obligations, performing analytics, and maintaining security — Ottri acts as the data controller.

When Ottri processes consumer application data or merchant information at the direction of a Lender or pursuant to a lender integration agreement, Ottri acts as a data processor on behalf of that Lender. In such cases, the Lender determines the purposes and means of processing.

When a Merchant submits consumer data through the Platform for financing purposes, Ottri processes that data as necessary to route the consumer to participating Lenders and to operate the Platform. Ottri acts as a controller for routing and platform operations and as a processor to the extent it transmits data to Lenders per their instructions.

Partners do not control consumer data processing. Partner access is limited to business-level Merchant information as described in the "How We Share Information" section.

Categories of Information We Collect

Ottri collects information necessary to operate the Platform. Depending on the interaction, this may include:

How We Collect Data

Ottri collects information through three methods:

Directly from you

Information you provide when interacting with the Platform, including merchant onboarding forms, consumer financing applications, partner registration, and communications with Ottri.

Automatically

Information collected through cookies, server logs, and similar technologies when you access or use the Platform, including IP address, browser type, device information, and session activity.

From third parties

Information received from consumer reporting agencies, identity verification providers, lender partners, and other service providers in connection with Platform operations, including credit data (with consumer consent), verification outputs, and publicly available business information.

How We Use Information

Ottri uses information to:

• Operate, maintain, and secure the Platform
• Verify Merchant, Partner, and authorized user information
• Facilitate consumer soft credit inquiries with consent
• Route consumers to participating Lenders
• Comply with legal, licensing, and regulatory obligations
• Communicate with consumers, merchants, lenders, and partners

Messaging Practices

We may communicate with you or others by phone, SMS, WhatsApp, and other messaging channels for Platform-related purposes, including status updates, notifications, and business communications. Message frequency varies based on your account activity and lifecycle stage and may include multiple messages per day during active onboarding, activation, support, or re-engagement periods. Message and data rates may apply.

Ottri may use aggregated or de-identified information for analytics, security, and platform improvement. Such information does not identify individuals or businesses.

You may opt out of text messages at any time by replying STOP to any message. For help, reply HELP or contact support@ottri.com or 800-809-0011. You may also contact support@ottri.com to revoke messaging consent or ask questions about Platform-related communications.

For questions about our messaging practices, contact privacy@ottri.com or call 800-809-0011.

Carriers are not liable for delayed or undelivered messages.

Legal Basis for Processing

Ottri processes information based on the following legal grounds, as applicable:

Consent

You may withdraw consent at any time by contacting support@ottri.com, except that privacy rights requests may also be submitted to privacy@ottri.com.

Contractual necessity

Where processing is necessary to perform or enter into an agreement with you, including merchant onboarding, platform access, and partner services.

Legitimate interest

Where processing is necessary for Ottri's legitimate business interests, such as platform security, fraud prevention, analytics, and service improvement, provided those interests are not overridden by your rights and interests.

Legal obligation

Where processing is required to comply with applicable laws, regulations, licensing requirements, or legal process.

Credit Information and Soft Pulls

With consumer consent obtained in the Platform experience, Ottri Global LLC may obtain and use soft-pull consumer report information and related data from TransUnion and other consumer reporting agencies for identity verification, fraud prevention, initial matching and routing checks, lender-routing calculations, and matching consumers with participating lenders.

Soft credit inquiries are not used by major credit-scoring models, including FICO and VantageScore, in score calculations. Soft-pull results are used to help route and present potential financing options and do not guarantee approval, final terms, APR, or funding.

Ottri Global LLC does not make final credit decisions, approve or deny loans, set APRs, fund loans, or service loans. Participating lenders perform independent credit evaluations and determine all final loan terms, approvals, denials, and funding decisions.

Under the Fair Credit Reporting Act, you have the right to know if information in your consumer file has been used against you, to dispute incomplete or inaccurate information, and to limit prescreened offers of credit. For more information about your rights under the FCRA, visit the Consumer Financial Protection Bureau at consumerfinance.gov or contact the nationwide consumer reporting agencies.

If you accept a financing offer or submit an application to a lending partner, that lending partner may conduct a hard credit inquiry as part of its independent evaluation, processing, or servicing of your loan. A hard credit inquiry may affect your credit score.

Information You Provide Before Submitting

If you provide information during your application but do not click “Agree & Continue” to submit, we may retain that information so you can resume your application if you return, maintain security, prevent fraud, and improve the Platform. We do not use that information to obtain a soft credit inquiry or share it with participating lenders unless you complete the required authorization and submit your financing request.

How We Share Information

This section describes Ottri’s information sharing practices. Where Ottri Global LLC’s activities are subject to the Gramm-Leach-Bliley Act or applicable state financial privacy laws, this section serves as the required notice for those activities.

Ottri may share information with:

• Participating lenders, as needed to route, process, evaluate, and support consumer financing requests, and with appropriate consumer consent.
• Consumer reporting agencies and other data providers, as needed for soft-pull consumer report information, identity verification, fraud prevention, and related Platform operations.
• Service providers, including hosting, analytics, messaging, compliance, identity verification, fraud prevention, data processing, customer support, and security providers, subject to contractual confidentiality and use restrictions.
• Referring merchants and their service providers, limited to information necessary to support the consumer’s project and financing request, including application status, high-level financing outcome, funding status, lender/product status, and project-related identifiers.
• Regulators, law enforcement, courts, or other third parties, when required or permitted by law, subpoena, court order, regulatory request, legal process, or to protect the rights, property, safety, or security of Ottri, users, consumers, merchants, lenders, or the public.

Ottri does not share a consumer’s full consumer report or full Social Security number with the referring merchant. Other information may be shared only as described in this Policy and as permitted by law.

Ottri does not share mobile information or SMS opt-in data with third parties for their independent marketing or promotional purposes.

Mobile Messaging Data

Ottri collects and processes mobile phone numbers and SMS opt-in data to support communications with merchants, partners, authorized users, and consumers, as described in the Ottri Terms of Service and applicable agreements. For consumers who provide their phone number through a financing application or pre-qualification flow on the Platform, the consent provided at the time of application governs application-related calls and text messages from Ottri, participating lending partners involved in the consumer’s financing request, and applicable agents and service providers.

Ottri does not sell mobile phone numbers or SMS opt-in data. Ottri does not share SMS opt-in data with third parties for their independent marketing purposes. Mobile phone numbers may be shared with service providers (including messaging platform vendors and compliance vendors) solely to deliver messages, maintain opt-out lists, honor revocation requests, and support Ottri's legal and regulatory obligations. For consumer phone numbers provided through a financing application, mobile phone numbers may also be shared with lending partners and their service providers in connection with the consumer's credit request. These service providers and lending partners are contractually restricted from using the data for their own independent marketing purposes.

For details on how to opt out of SMS messages or revoke consent, see the "SMS and Text Messaging Consent" section of the Ottri Terms of Service.

Your Right to Limit Sharing

Under the Gramm-Leach-Bliley Act, you have the right to opt out of certain sharing of your nonpublic personal information with nonaffiliated third parties. Ottri does not share nonpublic personal information with nonaffiliated third parties for purposes that would trigger opt-out rights under Regulation P (12 C.F.R. Part 1016), except as permitted by law. If our sharing practices change, we will provide you with a revised notice and an opportunity to opt out before any such sharing occurs. To exercise your rights or ask questions, contact privacy@ottri.com or call (800) 809-0011.

Third-Party Services

The Platform integrates with third-party services and Lender systems. These third parties process information as necessary to provide services to Ottri and are subject to contractual restrictions. Lenders and third-party services maintain their own privacy policies. When you accept a financing offer from one of our lending partners, that lender's privacy policy will then govern your continued relationship with that lender, and we will identify the lender to you at the point you receive an offer. Ottri is not responsible for the privacy practices of third parties not under its control.

Data Security and Retention

Ottri maintains administrative, technical, and physical safeguards designed to protect information, consistent with industry standards and applicable regulatory requirements. Safeguards include encryption of data in transit and at rest, role-based access controls, continuous monitoring, and regular security assessments.

Ottri retains personal information for the period necessary to fulfill the purposes described in this Policy and to comply with legal, licensing, and regulatory record-retention obligations, which for licensed lending services may require retention of up to seven years.

We securely dispose of information when the applicable retention period expires and no legal or regulatory obligation requires further retention.

Ottri shares information only as described in the How We Share Information section of this Policy and maintains administrative, technical, and contractual controls designed to prevent unauthorized disclosure. Ottri does not sell personal information for money. Ottri may use advertising cookies and similar technologies that may constitute a “sale,” “sharing,” or targeted advertising under certain state privacy laws. You may opt out through Your Privacy Choices or supported universal opt-out preference signals where required by law. Ottri does not share mobile phone numbers or messaging opt-in data with third parties for their independent marketing or promotional purposes.

Platform safeguards are designed to ensure the confidentiality and security of Social Security numbers. Ottri limits access to Social Security numbers to those who need to process the information and prohibits the unlawful disclosure of Social Security numbers.

Cookies and Tracking Technologies

Ottri uses cookies and similar technologies on its website and Platform for the following purposes:

Essential cookies are used for security, fraud prevention, session management, and core Platform functionality. These cookies are necessary for the website and Platform to operate and cannot be disabled.

Analytics and behavioral cookies, including Google Analytics, HubSpot, Customer.io, and session replay tools, are used to measure website performance, understand how visitors interact with our website, attribute leads, deliver lifecycle communications, and improve Platform functionality. These tools may collect information such as pages visited, time on site, click and scroll behavior, referring URLs, form submissions, and email engagement. Analytics data is processed by third-party service providers and may be transferred to servers outside the United States.

Advertising cookies, including Meta Pixel, LinkedIn Insight Tag, and Google Ads conversion tracking, are used to measure the effectiveness of Ottri's marketing campaigns and to deliver relevant advertisements to you on third-party platforms. These cookies may collect information about your browsing activity on the Ottri website and share it with advertising platforms for measurement and targeting purposes.

When you first visit the Ottri website, you will be presented with a cookie consent notice that allows you to accept or decline non-essential cookies (analytics and advertising). You may update your preferences at any time by clicking the "Your Privacy Choices" link in the website footer. If you decline non-essential cookies, only essential cookies will be used.

Ottri does not send promotional marketing communications to consumers based on Platform activity. Ottri does not sell personal information for money. Ottri may use advertising cookies and similar technologies that may constitute a “sale,” “sharing,” or targeted advertising under certain state privacy laws. You may opt out through Your Privacy Choices or supported universal opt-out preference signals where required by law.

Users may also control cookies through browser settings. Disabling cookies may affect website functionality.

State Privacy Rights

Residents of U.S. states with comprehensive privacy laws have rights that may include the right to:

• Access Personal Information
• Correct inaccuracies
• Request deletion where permitted by law
• Obtain a copy of Personal Information
• Opt out of the sale of personal data, targeted advertising, and certain profiling
• Limit use and disclosure of Sensitive Personal Information (California residents — CPRA §1798.121)

Right to Non-Discrimination

We will not discriminate or retaliate against you for exercising any of your privacy rights. This means we will not deny you goods or services, charge different prices or rates, provide a different level or quality of goods or services, or suggest you may receive different treatment because you exercised your rights under California or other applicable state privacy laws.

Ottri recognizes universal opt-out preference signals, including the Global Privacy Control (GPC), as valid opt-out requests where required by applicable state law. When Ottri detects a GPC signal, it will process the signal as an opt-out of the sale of personal data and targeted advertising for that browser or device.

To exercise these rights, contact privacy@ottri.com.

California residents may also exercise opt-out rights through the "Your Privacy Choices" link available on the Ottri website.

We may require verification of your identity before processing a request. Authorized agents may submit requests on your behalf where permitted by law.

Ottri will respond within the timeframes required by applicable law, which are generally within 45 days and may be extended where permitted. If a request is denied, you may appeal by contacting privacy@ottri.com. California residents may also submit complaints to the California Privacy Protection Agency (CPPA). Residents of other states may submit complaints to their respective state attorneys general.

For state-specific rights and disclosures, see the State Privacy Supplement appended to this Policy.

Children’s Privacy

The Platform is intended for adults 18 years of age or older. Ottri does not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a person under 18, we will delete it. Ottri does not knowingly sell or share personal information of consumers under 16 as those terms are defined under the CCPA/CPRA.

U.S. Operations and International Access

The Platform is intended for use in the United States. Information is primarily processed and stored in the United States and may be accessed by authorized personnel or service providers from other locations as necessary to support Platform operations.

Changes to This Policy

Ottri may update this Privacy Policy from time to time. Updates will be posted with a revised “Last Updated” date. Please check this Policy for changes.

Purpose

This Supplement provides state-specific privacy rights information and disclosure requirements that extend or modify the Ottri Privacy Policy for residents of specific U.S. states with comprehensive privacy laws.

California (CCPA / CPRA)

Notice at Collection

Ottri collects the following categories of personal information from California residents:

Ottri processes sensitive personal information only for purposes permitted under CPRA and does not use sensitive personal information for purposes beyond those disclosed above.

Retention Periods

Your Rights

California residents have the right to know, access, correct, delete, and port their personal information; to opt out of the sale or sharing of personal information; and to limit the use and disclosure of sensitive personal information. To exercise these rights, contact privacy@ottri.com or use the "Your Privacy Choices" link available on the Platform.

For a complete description of our privacy practices, see our Privacy Policy.

Consumer Rights

California residents have the right to: know what personal information is collected, access their personal information, correct inaccuracies, delete their personal information (subject to exceptions), opt out of sale or sharing of personal information, and limit the use and disclosure of sensitive personal information.

Sensitive Personal Information

California residents may exercise the right to limit the use and disclosure of sensitive personal information under Cal. Civil Code Section 1798.121. Ottri processes sensitive personal information only for purposes permitted under CPRA and does not use sensitive personal information for purposes beyond those disclosed.

Residents of other U.S. states with comprehensive consumer privacy laws — including (but not limited to) Colorado, Connecticut, Virginia, Texas, and Utah — have rights that may include the right to access, correct, delete, port, and opt out of sale or sharing of personal data, targeted advertising, and certain profiling, in each case as defined and limited by the applicable state law. To exercise rights, contact privacy@ottri.com or call (800) 809-0011.

How to Exercise Rights

Residents of any covered state may exercise their rights by contacting: privacy@ottri.com or (800) 809-0011. Ottri will respond within the timeframes required by applicable state law.

‍