Privacy Policy

1. Introduction

IOU Finance LLC, a Georgia limited liability company ("IOU," "we," "us," or "our"), operates the IOU mobile application and associated website at legal.iou.llc (collectively, the "Platform").

This Privacy Policy ("Policy") governs the collection, use, storage, disclosure, and protection of personal information and financial data we collect from users ("you"). This Policy is incorporated by reference into our Terms of Service and constitutes a legally binding agreement. By creating an account or using the Platform in any manner, you consent to the practices described in this Policy.

2. Information We Collect

2.1 Identity and Contact Information

• Full legal name as it appears on government-issued identification
• Date of birth for identity verification and age confirmation
• Email address for account creation, communications, and authentication
• Mobile phone number for multi-factor authentication and notifications
• Physical address for identity verification and regulatory compliance
• Social Security Number last four digits or full SSN where required by applicable law

2.2 Financial Information

• Bank account numbers and routing numbers for payment processing
• Micro-charge verification amounts used to confirm bank account ownership
• Financial institution name and account type
• Account balance information as provided through our banking integration partners
• Transaction history including payment amounts, dates, parties, and statuses
• Payment agreement terms including principal amounts, interest rates, payment schedules, and durations

2.3 Technical and Usage Information

• Device information including device type, model, operating system version, and unique device identifiers
• IP address and approximate geographic location
• Usage data including features accessed, screens viewed, and navigation patterns
• Log data including access times, error logs, and system activity
• Cookies and similar tracking technologies as described in Section 8

2.4 Information from Third-Party Partners

Plaid Technologies, Inc. — When you connect a bank account through Plaid Link, Plaid provides us with account verification data, account holder name, and account type. Initial bank linking is verification-only. If you separately choose to enable transaction history for a connected account, Plaid may also provide available transaction data (merchant, amount, and date) for that account, generally covering up to approximately the prior 24 months where available. We use this optional transaction history privately within your own account — for example, to detect recurring bills and build your historical payment record. It is not shared with other IOU users and does not affect your IOU Score in this release. Your use of Plaid is subject to Plaid's Privacy Policy at plaid.com/legal. IOU does not receive or store your financial institution login credentials.

Dwolla, Inc. — Where payment processing is available, we use Dwolla as our payment processing partner. We may share your name, email address, bank account information, and transaction details with Dwolla to facilitate payments. Dwolla's Privacy Policy is at dwolla.com/legal/privacy.

Scan Receipt (on-device text recognition) — If you use the Scan Receipt feature, supported iPhone devices use Apple's on-device Vision framework to read text from the receipt photo you capture or select. The receipt photo is processed locally on your device for text recognition and is not uploaded to IOU or any third-party OCR provider through this feature. Structured information extracted from the receipt (such as merchant, date, items, and totals) may be stored in your account. You may choose manual entry instead.

2.5 Information You Provide

• Profile information including profile photo
• Payment agreement terms that you create or accept
• Any documents or images you submit through Platform features

3. How We Use Your Information

3.1 Service Delivery

• Creating, maintaining, and managing your account
• Verifying your identity and bank account ownership before enabling payment features
• Recording and documenting payment agreements between parties
• Facilitating payment processing through licensed third-party partners where available
• Maintaining transaction records and payment history
• Sending transaction confirmations, payment notifications, and account alerts

3.2 Security, Fraud Prevention, and Compliance

• Verifying user identity to prevent fraudulent account creation
• Monitoring for suspicious activity
• Complying with applicable anti-money laundering (AML) and know-your-customer (KYC) regulations
• Complying with applicable federal and state laws and regulations
• Responding to lawful requests from government authorities and law enforcement
• Maintaining records as required by applicable financial regulations

3.3 Communications

• Communicating material changes to this Policy or our Terms of Service
• Providing customer support

4. Disclosure of Your Information

4.1 Disclosure to Counterparties

When you enter into a payment agreement with another user, that user will see your full name and the terms and status of the agreement.

4.2 Disclosure to Service Providers

We share information with trusted third-party service providers contractually obligated to use your information solely to perform services for us. These include Plaid Technologies, Inc. (bank verification and, if you enable it, optional transaction-history access — see Section 2.4), Dwolla, Inc., Supabase, Inc., and identity verification providers.

4.3 Disclosure for Legal Compliance

We may disclose your information when necessary to comply with applicable law, enforce our Terms of Service, prevent fraud, or protect the rights and safety of IOU, our users, or the public.

4.4 Business Transfers

In connection with a merger, acquisition, or sale of assets, your personal information may be transferred to a successor entity with prior notice to you.

4.5 What We Do Not Do

• We do not sell your personal information to third parties for marketing purposes
• We do not share your financial data with advertisers
• We do not report your payment history to any credit bureau or consumer reporting agency

4.6 Mobile Information and SMS Consent

If you provide your mobile phone number to receive SMS text messages from IOU — for example, to complete phone verification — the following applies:

• SMS messages are sent only for one-time account verification and account-security purposes. At this time, IOU does not send recurring promotional or marketing text messages.
• Message frequency varies based on your requests, such as how many times you request a verification code.
• Message and data rates may apply.
• No mobile information or SMS consent data will be shared, sold, or rented to third parties or affiliates for marketing or promotional purposes.
• We may share mobile/SMS information with service providers, such as our SMS delivery provider, who process it solely as needed to deliver and support the messaging service.
• Reply STOP to any IOU text message to opt out at any time, or HELP for help. See our SMS Terms for complete program details.

5. Data Retention and Deletion

We retain your personal information for as long as your account remains active and as necessary to provide our services, resolve disputes, and comply with regulatory obligations.

Your displayed IOU Score reflects a rolling twenty-four (24) month window of payment history. This display window does not affect the retention of your underlying transaction records or payment history, which remain subject to the retention obligations described in this section.

You can delete your account directly within the IOU app (Profile → Delete account, with password confirmation and a typed DELETE confirmation), which revokes your ability to sign in immediately, or by contacting legal@iou.llc. For email requests, we will deactivate your account within five (5) business days and delete personal information that is not subject to legal or regulatory retention requirements within thirty (30) days. Following account closure, we retain records required by applicable financial law for a minimum of five (5) years.

6. Data Security

We employ AES-256 encryption at rest, TLS 1.2+ in transit, role-based access controls, and token-based authentication. Our infrastructure is provided by Supabase, Inc. (SOC 2 Type II certified).

In the event of a data breach affecting your personal or financial information, IOU Finance LLC will notify you and applicable regulatory authorities as required by applicable law: Florida residents — no later than thirty (30) days (Fla. Stat. § 501.171); Georgia residents — without unreasonable delay (O.C.G.A. § 10-1-912); Massachusetts residents — as soon as reasonably possible after discovery (M.G.L. c. 93H, § 3).

7. Your Rights and Choices

You have the right to request access to, correction of, or deletion of your personal information. Upon a verified request, we will provide a copy in a commonly used electronic format within thirty (30) days.

You may opt out of non-essential communications by contacting legal@iou.llc. You cannot opt out of transactional communications related to active payment agreements. For SMS opt-out, see our SMS Terms.

Florida residents have rights under the Florida Digital Bill of Rights (Fla. Stat. § 501.701 et seq.). IOU Finance LLC does not sell personal data or use it for targeted advertising. To exercise Florida privacy rights, contact legal@iou.llc with subject line "Florida Privacy Rights Request."

Georgia residents may exercise rights under applicable Georgia law by contacting legal@iou.llc.

Massachusetts residents may exercise rights under M.G.L. c. 93H and the Massachusetts Consumer Protection Act (M.G.L. c. 93A) by contacting legal@iou.llc.

8. Cookies and Tracking Technologies

The Platform may use cookies and similar technologies for authentication and usage analytics. Essential cookies are required for the Platform to function. Analytics cookies may be controlled through your device or browser settings.

9. Children's Privacy

The Platform is intended solely for users 18 years of age or older. We do not knowingly collect personal information from individuals under 18. If you believe a minor has created an account, contact legal@iou.llc immediately.

10. Third-Party Services

The Platform integrates with Plaid Technologies, Inc. (bank verification and optional transaction-history access) and Dwolla, Inc. Your use of those services is governed by their respective privacy policies and terms of service. IOU Finance LLC is not responsible for the privacy practices of any third-party service.

11. Geographic Availability and Data Transfers

The Platform is currently available to residents of Georgia, Florida, and Massachusetts only. All data is stored and processed in the United States. By using the Platform, you consent to the processing of your information in the United States.

12. Regulatory Compliance

IOU Finance LLC is a payment facilitation and record-keeping platform. IOU does not hold funds. Where payment processing is available, it is provided exclusively through Dwolla, Inc. under Dwolla's applicable licenses. IOU Finance LLC is not itself a licensed money transmitter.

13. Changes to This Policy

We will notify you of material changes by posting an updated Policy on legal.iou.llc with a new effective date and sending an in-app notification. Your continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

14. Dispute Resolution

Disputes arising out of or relating to this Policy shall be governed by the laws of the State of Georgia. Legal proceedings shall be brought exclusively in state or federal courts located in Georgia.

15. Contact

IOU Finance LLC
Attn: Privacy Officer
Email: legal@iou.llc
Website: legal.iou.llc

We will respond to all verified privacy requests within thirty (30) days of receipt.