This Privacy Policy describes how your personal information is collected, used, and shared when you visit or use the Bold.org, Inc. (“Bold”) website (the “Site”) and when you use and engage our services (“Services”) which includes Personal Information collected via email, SMS, telephone, social media accounts, or other means. By using or accessing the Site or Services, you are accepting the practices described in this Privacy Policy and our processing of your information as described below.

Our Privacy Policy does not apply to services offered by other companies or individuals, including products or sites that may be displayed to you, or other sites linked from our Services. Our Privacy Policy does not cover the information practices of other companies and organizations who advertise our Services, and who may use cookies, pixel tags and other technologies to serve and offer relevant ads.

In addition, we may from time to time add new sites that may not be listed in this Privacy Policy which are also considered the Site.

Your privacy matters to you and it matters to us.

At Bold, your privacy is a top priority. The information provided below is not just so we can make our lawyers happy, but to show you that we can be trusted with your information. If you are a California resident, please see our Notice To California Residents to learn more about your rights under the California Consumer Privacy Act (the “CCPA”).

Your information that we collect

When you visit the Site, we automatically collect certain information about your device, including information about your web browser, IP address, time zone, and some of the cookies that are installed on your device. Additionally, as you browse the Site, we collect information about the individual web pages or products that you view, what websites or search terms referred you to the Site, and information about how you interact with the Site. This information is collected using the following technologies:

• “Cookies” are data files that are placed on your device or computer and often include an anonymous unique identifier. For more information about cookies, and how to disable cookies, visit https://www.allaboutcookies.org.
• “Log files” track actions occurring on the Site, and collect data including your IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.
• “Web beacons,” “tags,” and “pixels” are electronic files used to record information about how you browse the Site.

We may also collect personal information from you that includes your name and email address, and such other information as we may require to provide our services. Note, that we do not access your account or your personal information directly, however, we may need to access your account as an administrator in order to provide the services as necessary to remediate any technical bugs or other issues and to improve the Services. If you contact us, we may collect additional information such as your location, and any personal information that you provide in your contact request. In addition, we may receive information about you from other online or offline sources, including third parties from whom we validate consumer self-reported information, and verify information we already have about you. This helps us to update, expand and analyze our records and provide products and services that may be of interest to you.

How we use your information

We use your information to provide our services, but we generally do not sell your information to third parties without your indication of interest or consent. With your consent, we may also share your information with, and generate revenue from, scholarship providers, applicable academic institutions, and other third parties in which you have expressed interest while using the Site. Of course, you can opt-out at any time by providing us notice that you want us to delete and no longer use your information for any or all of those purposes.

We also use information that we collect to help us screen for potential risk and fraud (in particular, your IP address), and more generally to improve and optimize our Site (for example, by generating analytics about how our customers browse and interact with the Site).

Additionally, Bold participates in affiliate advertising programs designed to provide a means for Bold to generate revenue by advertising and linking to those affiliates’ products or services. When such affiliate relationships exist and there is an opportunity for Bold to be compensated for referring you to the affiliate, Bold will clearly and conspicuously disclose a notice explaining the affiliate relationship.

When you register for an account, you will be able to create a financial dashboard within your account that permits you to connect your bank accounts and loans to initiate and permit payments. Bold does not collect any financial, bank or payment information directly from the user. All transactions are handled by a third party payment processor. By using Bold’s services, you agree that Bold may share your financial, bank or payment information with the third party payment processor. We are not responsible for any loss of funds due in any part to the use of a third party payment processor.

How we share your information

We will share your information with scholarship providers, applicable academic institutions, and as otherwise necessary to provide the Bold service to you, but we will first clearly and conspicuously disclose that to you and obtain your consent before sharing such information. Bold generally does not sell your information without your prior consent, but by using the Bold service, you acknowledge, confirm, and consent to: (i) Bold’s generation of revenue from its partnerships with scholarship providers, applicable academic institutions, and other third parties who are necessary for Bold to provide its services to you, and (ii) Bold’s use of your information and data on Bold’s platform in order to do so. If you confirm that you would like Bold to share your information with a scholarship provider, academic institution, or other third party partner of Bold, Bold may generate revenue in connection with sharing that information. This includes third party processors (“Sub-processors”) which generally refers to technology vendors that need access to and use of your personal information to give us additional personal data about you, and to perform analytics and other work that we may need to outsource. These Sub-processors are bound by law and/or contract to protect the confidentiality and security of your personal information. They only process your personal information to provide requested services for us, and only act on our documented instructions.

For example, we use Google Analytics to help us understand how our customers use the Site. You can read more about how Google uses your information here. You can also opt-out of Google Analytics here.

In addition to Google Analytics, we may share your information with other third parties in an aggregated and anonymous manner to assess the overall trends and information about our customers, but such sharing does not involve selling your information and does not directly generate revenue for Bold. This information will not contain any of your personal information and is only shared in an aggregated and anonymized manner.

Additionally, if you indicate you are interested in particular educational institutions in your profile or via other means when using Bold’s platform, Bold may sell your information to or share your information with those educational institutions from time to time. If you do not want Bold to sell or share your information with those educational institutions at all, please let us know by contacting privacy@bold.org.

Finally, we may also share your information to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request for information we receive, or to otherwise protect our rights.

Some information security basics

The security of your information is very important. To help protect your information, we maintain reasonable physical, technical and administrative safeguards. We update and test our security technology on an ongoing basis. We restrict access to your personal information to those employees who need to know that information in order to provide services to you. In addition, we train our employees about the importance of confidentiality and maintaining the privacy and security of your information.

Although we take reasonable steps designed to protect your information, please be advised that no security system or means of transmitting data over the Internet can be guaranteed to be entirely secure (including without limitation with respect to computer viruses, malicious software and hacker attacks). We cannot and do not guarantee or warrant the security of your information or any information you disclose or transmit to us. We are not responsible for the acts of those who gain unauthorized access, and we make no warranty, express, implied or otherwise, that we will prevent such access, and we are not responsible for any damages or liabilities relating to any such incidents to the fullest extent permitted by law. Where required under law, we will notify you of any such loss, misuse or alteration of your information that may affect you so that you can take the appropriate actions.

For our international users

The Site and the Services we offer through it are U.S. based and are controlled, operated and administered by Bold and its Sub-processors from offices and servers within the United States. The Site and this Privacy Policy is strictly intended for audiences located in the United States and are provided in accordance with and subject to applicable United States law. If you decide to continue to access our Site from your location outside the United States, you hereby agree that your use of the Site or any services we may offer are subject to this Policy and your personal information will be transferred or processed in the United States, and you may have fewer privacy rights and protections than you have in your country of origin.

Our retention of your information

We will retain your information for as long as your account is active or as needed to provide you services. If you wish to request that we no longer use your information to provide you services or updates on additional products or for any other reason described in this Privacy Policy, contact us at privacy@bold.org. Additionally, we will retain and use your information as necessary to comply with our legal or regulatory obligations, resolve disputes, and enforce our agreements.

Children’s Information

We do not knowingly or intentionally gather personal information about children who are under the age of 13. If you become aware that a child has provided us with personal information, a child has provided us with personal information, a parent or guardian of that child may contact us at privacy@bold.org to have the information deleted from our records. If we learn that we have inadvertently collected the personal information of a child under 13, or equivalent minimum age depending on jurisdiction, we will take steps to delete the information as soon as possible and cease the use of that information in accordance with applicable law.

NOTICE TO CALIFORNIA RESIDENTS

This notice supplements the Bold privacy policy and provides additional information applicable only to California residents identified as “consumers” regarding their personal information pursuant to the California Privacy Rights Act (the “CPRA”). The California Privacy Rights Act (“CPRA”) provides California residents with rights to receive certain disclosures regarding the collection, use, and sharing of information about them, as well as rights to know/access, delete, and limit sharing of personal information. You have the right to be free from discrimination based on your exercise of your CPRA rights.

Bold may disclose your personal information to commercial providers for a business purpose, which includes verifying your identity when you make a payment or registering access to your accounts. When we disclose personal information for these reasons, we enter into a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not to use it for any purpose except for the purposes set forth in the contract.

Notice at Collection Regarding the Categories of Personal Information Collected

You have the right to receive notice of the categories of personal information we collect, and the purposes for which those categories of personal information will be used. The categories we use below to describe the information are those enumerated in the CPRA.

Entities to whom we disclose information for business purposes are service providers, which are companies that we engage to conduct activities on our behalf. Service providers are restricted from using personal information for any purpose that is not related to our engagement.

The following chart describes information we collect when you act as a customer or prospective customer of our services or visit our website. The sources of this personal information are described in the "Your Information that We Collect" section above. We collect this personal information for the purposes described in the “How We Use Your Information” section above.

Access, Deletion and Do Not Sell Right

As a consumer under the CPRA, you have the following right subject to certain limitations described in the CPRA: (1) to request that we disclose to you what Personal Information we collect, use, disclose and sell, including the right to request that we provide you the specific Personal Information we have collected about you in the prior twelve (12) months (the “Right To Know”), (2) to request that we correct inadequate or out of date information ("Right to Correct"), (3) to ask us to delete your Personal Information (the “Right to Delete”), and (4) to limit the use and disclosure of sensitive personal information. You can opt-out from our potential sale of your Personal Information as described below (“Do Not Sell My Information”).

The following links are provided as an easy way for you to exercise these rights. Alternatively, you can contact us for more information or to make a request regarding your Personal Information. To ensure that we do not provide or delete your Personal Information in response to a fraudulent request, we will require verification of your identity prior to proceeding with your request. In the event we are unable to verify your identity, we will not be able to proceed with a Right to Know request, and will proceed with a “Do Not Sell My Information” request in response to a Right to Delete request.

Right to know

We will provide the requested information for no charge up to two times during a 12 month period.

Right to delete

We will also direct our service providers to delete your Personal Information subject to limitations proscribed by the CCPA. This request may be fulfilled by erasing or de-identifying certain information as permitted under the CCPA.

Right to correct

You have the right to request correction or changes of your personal information if it is found to be inaccurate or out of date. Please contact us by e-mail at privacy@bold.org or by mail using the details provided below.

Do Not Sell My Information

If you wish for us to retain your Personal Information, but do not want us to sell your Personal Information, please contact us by e-mail at privacy@bold.org or by mail using the details provided below.

Right to Non-Discrimination for the Exercise of Your Privacy Rights

You have the right not to receive discriminatory treatment by us for exercising your privacy rights conferred by the CPRA.

In some cases our ability to uphold these rights for you may depend upon our obligations to process personal information for security, safety, fraud prevention reasons, compliance with regulatory or legal requirements, or because processing is necessary to deliver the services you have requested. Where this is the case, we will inform you of specific details in response to your request.

We may deny your deletion request if retaining the information is necessary for us or our service providers to:

1. Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you;
2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;
3. Debug products to identify and repair errors that impair existing intended functionality;
4. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law;
5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.);
6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent;
7. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;
8. Comply with a legal obligation; or
9. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

Notice to Virginia Residents

Virginia residents have certain rights around Bold’s collection, use, and sharing of their personal data. Bold provides you with an opportunity to opt-out of the sale of your personal information as required by law. Similarly, Bold does not engage in profiling in furtherance of decisions that produce legal or similarly significant effects. Bold does not engage in “targeted advertising” as that term is defined in the Virginia Consumer Data Protection Act ("VCDPA").

Bold collects various categories of personal data when you use the Services, including identifiers, commercial information, internet or other electronic network or device activity information, geolocation data, and professional information. A more detailed description of the information Bold collects and how we use it is provided above in the “Your Information That We Collect” of this Policy. The section above titled, “How We Share Your Information,” describes the categories of third parties with whom we share personal data, and what information may be shared under different circumstances. If you are a resident of Virginia, starting January 1, 2023 you have the right to (1) request to know what personal data has been collected about you and to access that information; (2) request to correct inaccuracies in your personal data; (3) request deletion of your personal data, though exceptions under the VCDPA and other laws may allow Bold to retain and use certain personal data notwithstanding your deletion request; and (4) obtain a copy of your personal data. You can learn more about how to submit a data rights request, or appeal denial of a request, by emailing privacy@bold.org.

Notice to Colorado Residents

Colorado residents have certain rights around Bold's collection, use, and sharing of their personal data. Bold provides you with an opportunity to opt-out of the sale of your personal information as required by law. Similarly, Bold does not engage in profiling in furtherance of decisions that produce legal or similarly significant effects. Bold does not engage in “targeted advertising” as that term is defined in the Colorado Privacy Act ("CPA").

Bold collects various categories of personal data when you use the Services, including identifiers, commercial information, internet or other electronic network or device activity information, geolocation data, and professional information. A more detailed description of the information Bold collects and how we use it is provided above in the “Your Information That We Collect” of this Policy. The section above titled, “How We Share Your Information,” describes the categories of third parties with whom we share personal data, and what information may be shared under different circumstances. If you are a resident of Virginia, starting January 1, 2023 you have the right to (1) request to know what personal data has been collected about you, and to access that information; (2) request to correct inaccuracies in your personal data; (3) request deletion of your personal data, though exceptions under the CPA and other laws may allow Bold to retain and use certain personal data notwithstanding your deletion request; and (4) obtain a copy of your personal data. You can learn more about how to submit a data rights request, or appeal denial of a request, by emailing privacy@bold.org.

Changes to our privacy policy

Please review this Privacy Policy from time to time as we may update this Privacy Policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal or regulatory reasons. Unless otherwise provided by applicable law, any changes that we make to this Policy will be published on the Site and will become effective upon publication. Your continued use of our services or the Site will constitute your acceptance of any such.

How to contact us

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by e-mail at privacy@bold.org or by mail using the details provided below:

Effective Date: October 25, 2022.

Bold.org, Inc., 133 Kearny #400, San Francisco CA 94108 United States