WEBSITE PRIVACY POLICY

Section 1.01 Responsible Company. This Website Privacy Policy (this "Policy") is provided by American Originations LLC, doing business as LoanAmerica ("we," "us," or "our"), located at 350 S Rampart Street, Suite 200, Las Vegas, Nevada 89145. This Policy explains how we collect, use, disclose, retain, and protect personal information when you visit www.loanamerica.com (the "Site"), use our calculators and tools, submit an inquiry, partnership request, or application, or communicate with us by email, telephone, or text message.

Section 1.02 Information Covered by Federal Financial Privacy Law. Personal information that we collect in connection with a request for, or the origination or servicing of, a consumer loan is also governed by the Gramm-Leach-Bliley Act and Regulation P. Our Privacy Notice under that law (the "GLBA Privacy Notice") describes how we share that information and the limited choices federal law provides. If this Policy and the GLBA Privacy Notice address the same information, the GLBA Privacy Notice controls as to that information, and certain state privacy rights described below do not apply to it.

Section 1.03 Other Notices. Separate notices apply to job applicants and employees, to residents of California, to residents of Colorado, and to visitors located in the European Economic Area, the United Kingdom, or Switzerland. Each is available from the Privacy link in the footer of the Site.

Section 2.01 Information You Provide. Depending on how you use the Site, you may provide us with the following: (a) identifiers and contact details, such as name, email address, telephone number, and mailing address; (b) school and program details, such as institution name, program of study, enrollment status, and cost of attendance; (c) financial details that you choose to enter, such as aid amounts, requested loan amount, income, and employment information; (d) information submitted by school and institutional partners through partnership, proposal, and intake forms; and (e) the content of messages, attachments, and other materials that you send to us.

Section 2.02 Information Collected Automatically. When you use the Site we receive, through our hosting and analytics providers, the following: (a) your Internet Protocol address and the approximate location derived from it; (b) device, browser, and operating system type; (c) pages viewed, links selected, time on page, and the referring website; and (d) campaign parameters contained in the link that brought you to the Site. The Site also stores on your device, using browser local storage, a value that records the country and state associated with your visit so that state-specific information can be displayed. That value remains on your device and is described in our Cookie Notice.

Section 2.03 Information From Other Sources. We may receive personal information from consumer reporting agencies and identity or fraud verification services, where you have authorized a credit review or verification as part of an application; from schools and financial aid offices, where a school certifies enrollment or cost of attendance; and from service providers that support the Site, our forms, and our email communications.

Section 2.04 Sensitive Personal Information. The Site is not designed to collect sensitive personal information outside of an application. If you submit an application, we may collect your Social Security number, government identification, financial account information, and similar sensitive information, which we treat under the GLBA Privacy Notice and our information security program. Please do not send sensitive personal information to us by general inquiry form or unencrypted email.

Section 2.05 Calculator Inputs. Values that you enter into a calculator are used to produce your estimate. If you ask us to send you results or you submit an inquiry, the values that you provided are transmitted to us with that request.

Section 3.01 Purposes. We use personal information to: (a) respond to inquiries and provide customer support; (b) determine eligibility, verify identity, and evaluate, originate, and service loan requests; (c) operate, secure, and improve the Site, our tools, and our products; (d) communicate with you about your request, your application status, and relevant program information; (e) evaluate and manage relationships with school and institutional partners; (f) detect, prevent, and investigate fraud, abuse, and security incidents; (g) comply with legal, regulatory, and recordkeeping obligations, including the Truth in Lending Act, the Equal Credit Opportunity Act, and the Fair Credit Reporting Act; and (h) establish, exercise, or defend legal claims.

Section 3.02 Marketing. We may send marketing email to individuals who have asked to receive it or who have an existing relationship with us, and we may send text messages only where you have given separate written consent. You may stop marketing email at any time by using the unsubscribe link in a message or by contacting us. We may continue to send messages about an active inquiry, application, or loan.

Section 4.01 Categories of Recipients. We disclose personal information to the following categories of recipients: (a) our affiliates and the entities involved in originating, underwriting, funding, or servicing a loan, as described in the GLBA Privacy Notice; (b) service providers that host the Site, store data, deliver email, verify identity, and provide analytics and security, each of which is bound by contract to use the information only to perform services for us; (c) consumer reporting agencies and verification partners in connection with an application that you submit; (d) your school, where you ask us to work with the financial aid office or where certification is required; (e) regulators, courts, law enforcement, and other parties where required by law or legal process, or to protect rights, property, and safety; and (f) a successor in connection with a merger, financing, or sale of assets, subject to this Policy.

Section 4.02 No Sale or Sharing for Advertising. We do not sell personal information. We do not share personal information with third parties for cross-context behavioral advertising, and we do not use advertising pixels or session replay tools on the Site as of the Effective Date. We do not knowingly sell or share the personal information of anyone under the age of sixteen. If this changes, we will update this Policy and provide a link titled "Your Privacy Choices" before the change takes effect.

Section 4.03 Service Provider Restrictions. We do not authorize service providers to use your personal information for their own marketing purposes.

Section 5.01 Technologies in Use. The Site uses technologies that are necessary to deliver and secure the Site, a privacy-oriented measurement service that reports aggregate traffic, and browser local storage as described in Section 2.02. A current description appears in our Cookie Notice at www.loanamerica.com/cookies.

Section 5.02 Global Privacy Control and Do Not Track. We treat a Global Privacy Control signal sent by your browser as a valid request to opt out of the sale or sharing of personal information, to the extent that any sale or sharing occurs. Because we do not sell or share personal information, the signal does not change how the Site operates today. The Site does not respond to the Do Not Track browser setting because there is no uniform standard for it.

Section 6.01 Retention Periods. We retain personal information only as long as needed for the purposes described in this Policy and as required by law. Unless a longer period is required by law or needed to resolve a dispute, we apply the following periods: (a) general inquiries and contact requests, twenty-four months after the last communication; (b) school and institutional partner records, for the duration of the relationship and three years afterward; (c) application records for a request that does not result in a loan, not less than twenty-five months after we notify the applicant of the action taken, as required by Regulation B, and not longer than seven years; (d) records of an originated loan, for the life of the loan and seven years afterward; (e) aggregate Site analytics, thirteen months; and (f) security and access logs, twelve months. After the applicable period we delete or de-identify the information.

Section 7.01 Safeguards. We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, role-based access controls, and restricted access to systems that hold applicant data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe that your information has been compromised, contact us at Support@loanamerica.com.

Section 8.01 Rights Available. Depending on the state in which you live, you may have the right to: (a) know and access the personal information we hold about you; (b) correct inaccurate personal information; (c) delete personal information, subject to legal exceptions; (d) receive a portable copy of personal information you provided; (e) opt out of the sale or sharing of personal information and of targeted advertising; (f) limit the use of sensitive personal information, where applicable; (g) appeal our decision on a request, where applicable; and (h) be free from discrimination for exercising a right.

Section 8.02 How to Submit a Request. You may submit a request through our privacy request form at www.loanamerica.com/privacy-request, by email to Support@loanamerica.com, or by telephone at (213) 818-7729. Requests relating to information submitted by an institution through our Partner Data Intake may also be made at www.loanamerica.com/data-request.

Section 8.03 Verification and Authorized Agents. We must verify your identity before acting on a request. We will ask you to confirm information that we already hold, and we will not require you to create an account. You may use an authorized agent, who must provide written proof of authorization, and we may ask you to verify your identity directly with us.

Section 8.04 Timing. We will confirm receipt of a request within ten business days and will respond within forty-five days. Where reasonably necessary we may extend the response period once by up to forty-five additional days, and we will tell you why. We do not charge a fee unless a request is manifestly unfounded or excessive.

Section 8.05 Appeals. If we decline to act on a request, you may appeal by replying to our decision or by writing to Support@loanamerica.com with the subject line "Privacy Appeal." We will respond to an appeal in writing within the period required by applicable law, and we will explain how to contact your state attorney general if the appeal is denied.

Section 8.06 Information Outside These Rights. Federal and state law exempt certain information from these rights, including information collected in connection with a consumer loan and governed by the Gramm-Leach-Bliley Act and the Fair Credit Reporting Act. We will tell you if we cannot fulfill a request for that reason.

Section 9.01 California. California residents should read our California Privacy Notice, which contains the notice at collection, the categories of information collected and disclosed in the preceding twelve months, and instructions for exercising California rights, including under California Civil Code Section 1798.83.

Section 9.02 Colorado. Our Colorado Privacy Notice describes the rights that we extend to Colorado residents and the appeal process.

Section 9.03 Nevada. Nevada law requires an operator of an internet website to disclose certain practices. The categories of information we collect are listed in Article II. Third parties with whom we disclose information are described in Article IV, and we do not sell personal information within the meaning of Nevada law. You may review and request changes to personal information that we hold by using the process in Section 8.02. We will post notice on the Site of material changes to this Policy. Our response to Do Not Track signals is stated in Section 5.02.

Section 9.04 Other States. Residents of other states with comprehensive privacy laws may submit requests through the channels in Section 8.02, and we will honor them to the extent required by the law of that state.

Section 9.05 International Visitors. The Site and our products are directed to persons in the United States. Visitors located in the European Economic Area, the United Kingdom, or Switzerland should read our International Visitors Privacy Notice.

Section 10.01 Under Eighteen. The Site is intended for adults. We do not knowingly collect personal information from anyone under the age of eighteen through the Site. If you believe a minor has provided information to us, contact Support@loanamerica.com and we will delete it.

Section 11.01 Links. The Site links to third-party resources, including studentaid.gov and school websites. We do not control those sites and are not responsible for their privacy practices.

Section 12.01 Updates. We may update this Policy as our products, technology, or legal obligations change. The Effective Date above shows the most recent revision. We will post material changes on the Site before they take effect and, where required, will obtain your consent.

Section 13.01 How to Reach Us. Questions about this Policy may be sent to Support@loanamerica.com, to American Originations LLC, doing business as LoanAmerica, 350 S Rampart Street, Suite 200, Las Vegas, Nevada 89145, or by telephone to (213) 818-7729. Our team is available Monday through Friday, 9:00 a.m. to 5:00 p.m. Pacific Time.