Privacy Policy

1. Introduction

This Privacy Policy applies to Extra Extra LLC, a Florida limited liability company doing business as Extra Business Funding ("Extra Business Funding," "EBF," "we," "us," or "our"). It explains how we collect, use, disclose, and protect personal information when you visit www.extrabusinessfunding.com (the "Site"), submit an application for a merchant cash advance, or otherwise interact with us. By using the Site or providing information to us, you agree to the practices described in this Policy.

EBF is a financial services company offering merchant cash advances ("MCAs") to small businesses. As a financial institution, we are subject to the Gramm-Leach-Bliley Act ("GLBA") and other privacy laws applicable to financial services providers. A specific GLBA notice appears later in this Policy.

2. Information We Collect

2.1 Information from Site visitors

When you browse the Site, we automatically collect technical information including your IP address, browser type and version, operating system, the referring URL that brought you to the Site, the pages you view, and the time you spend on each page. We use this information for basic analytics and to keep the Site secure. We also use Cloudflare Turnstile to distinguish human visitors from automated bots on form submissions.

If you submit our contact form, we collect the name, email address, phone number, and message you provide.

2.2 Information from applicants

When you apply for funding, we collect the information you provide on the application, including:

• Business information: legal business name, doing-business-as (DBA) name, Employer Identification Number (EIN), business address, business phone, time in business, industry, self-reported monthly revenue, requested funding amount, and intended use of funds.
• Owner/principal information: first and last name, date of birth, Social Security Number, home address, mobile phone, personal email, and ownership percentage.
• Documents: bank statements (typically as PDFs) that you upload to support your application. You may upload one or multiple files.
• Consent records: records of your electronic signature, credit-check authorization, and consent to receive communications.
• Submission metadata: the IP address and timestamp of your submission, retained for fraud-prevention purposes.

2.3 Information collected during underwriting

If your application proceeds to underwriting, we may collect additional information from third parties and through your continued participation:

• Credit reports from credit reporting agencies such as Experian, Equifax, or TransUnion. We typically perform a soft credit inquiry during underwriting; a hard credit inquiry may be performed at the time of funding.
• Bank account verification through Plaid Inc. Plaid's handling of your bank credentials is governed by Plaid's own privacy policy, available at plaid.com/legal/.
• UCC filings and public-record searches through third-party search providers.
• Identity-verification data through third-party verification services.
• Additional documents you provide to satisfy underwriting stipulations, such as a driver's license, voided check, tax returns, or articles of incorporation.

2.4 Information from funded merchants

If we fund your business, we collect and process additional servicing information, including ACH bank-account details for fixed payments, transaction history (which payments cleared and which failed), and the substance of your communications with us.

3. How We Use Information

We use the information we collect to:

• Evaluate and underwrite your application.
• Verify your identity and comply with our obligations under the Bank Secrecy Act, the USA PATRIOT Act, and other applicable anti-money-laundering and know-your-customer requirements.
• Detect, investigate, and prevent fraud.
• Service any advance we fund, including processing payments.
• Communicate with you about your application and any funded advance.
• Send marketing communications about EBF products and services, subject to your right to opt out (see Section 9).
• Comply with our legal obligations, including responding to subpoenas, court orders, regulatory inquiries, and lawful requests from law-enforcement or government authorities.
• Improve the Site, our products, and our underwriting models, including through aggregated and de-identified analysis.

4. How We Share Information

We share personal information only in the circumstances described below. We do not sell personal information to third parties for their own marketing purposes.

4.1 Independent sales organizations and brokers

If your application reaches us through an independent sales organization, broker, or referral partner, we may share the status and outcome of your application with that party so they can coordinate with you. Brokers are independent third parties. Their use of your information is governed by their own privacy practices, not by this Policy.

4.2 Service providers

We share information with service providers that help us operate our business, including:

• Hosting and infrastructure providers (Vercel, Supabase).
• Bank account verification (Plaid).
• Credit reporting agencies (such as Experian, Equifax, or TransUnion).
• Email delivery (Resend).
• Payment processors and ACH providers (such as GoACH).
• Identity-verification and document-search providers.
• Artificial-intelligence providers used for document analysis and underwriting assistance, as described in Section 4.3.

These service providers are authorized to use your information only as necessary to provide services to us and are required to protect that information.

4.3 AI providers (important disclosure)

We use third-party artificial-intelligence services, including Anthropic's Claude, to analyze financial documents and assist with underwriting decisions. Your bank statements, application data, credit reports, and other submitted information may be transmitted to these services for processing. Anthropic's privacy practices are governed by their own privacy policy, available at anthropic.com. We select AI providers that contractually commit to not using customer data to train their models, but you should review their policies if you have concerns. If you do not wish your information to be processed by AI providers, please contact us at info@extrabusinessfunding.com before submitting an application; declining AI processing may limit our ability to evaluate your application.

4.4 Capital partners and investors

We may share aggregated or pseudonymized portfolio information with capital partners and investors. We may share specific deal information when required for syndication or capital sourcing, subject to confidentiality protections.

4.5 Legal and regulatory disclosures

We may disclose information when required by law, subpoena, court order, or regulatory request; to cooperate with law-enforcement authorities; to investigate suspected fraud or other unlawful activity; or to protect the rights, property, or safety of EBF, our customers, or others.

4.6 Successor entities

In the event of a merger, acquisition, asset sale, financing, reorganization, bankruptcy, or other corporate transaction affecting all or part of our business, your information may be transferred to a successor or acquiring entity, subject to continued protection consistent with this Policy.

5. GLBA Notice (Financial Privacy Notice)

Because EBF is a financial institution under the Gramm-Leach-Bliley Act, federal law requires that we provide you with a notice of our information-sharing practices. The information you provide to us, together with information we obtain from third parties such as credit reporting agencies, is "nonpublic personal information" under the Act.

What we collect: the information described in Section 2 of this Policy.

What we share, with whom, and why:

• For everyday business purposes such as processing your application, servicing your account, responding to court orders and legal investigations, and reporting to credit bureaus — we share with our affiliates and service providers as described in Section 4. You cannot limit this sharing.
• For marketing purposes — we currently do not share nonpublic personal information with non-affiliated third parties for their own marketing purposes. If we ever begin to do so, we will provide you with notice and an opportunity to opt out.
• For our own marketing purposes — we may use your information to communicate with you about EBF products and services. You can opt out of marketing communications at any time using the instructions in Section 9.

6. Cookies and Tracking

We use a small number of cookies that are strictly necessary to operate the Site (for example, to maintain your session if you log in to the admin area) and a limited number of cookies for basic analytics. As of the date of this Policy, we do not run third-party advertising or marketing pixels on the Site. If we add such technologies in the future, we will update this Policy and, where required by law, provide a separate consent mechanism.

Most browsers allow you to refuse or delete cookies through their settings. Doing so may affect the functionality of the Site.

7. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. Specifically:

• Data is transmitted over the Internet using TLS encryption.
• Data is stored in databases that provide encryption at rest at the database level.
• Social Security Numbers receive an additional layer of application-level encryption (AES-256-GCM) before being stored, using keys that are not stored alongside the data.
• Uploaded bank statements and other documents are stored in private cloud storage with a deny-by-default access policy. Authorized administrators can retrieve them only through short-lived, signed download links.
• Administrator access to systems containing personal information is restricted to authorized personnel and protected by strong password requirements, idle and absolute session timeouts, and rate-limiting on sign-in attempts.
• All access to sensitive data — including reveals of masked Social Security Numbers and downloads of uploaded documents — is recorded in an audit log capturing the administrator's identity, the time of access, the network address used, and the stated reason for the access.

No system is completely secure. Although we take security seriously, we cannot guarantee that unauthorized parties will never be able to defeat our safeguards. If we become aware of a security incident that affects your personal information, we will notify you in accordance with applicable law.

8. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, comply with our legal and regulatory obligations, resolve disputes, and enforce our agreements. Retention periods vary depending on the type of information and applicable legal requirements. We are in the process of formalizing specific retention schedules and will update this Policy when we do.

9. Your Choices and Rights

You have choices about how we use and share your information:

• Marketing communications. We do not currently send marketing emails or SMS messages. If we begin to do so in the future, marketing emails will include an unsubscribe link, and any marketing SMS program will be opt-in and comply with the Telephone Consumer Protection Act (TCPA). Transactional communications about your application or any funded advance will continue regardless of marketing preferences.
• Cookies. You can configure your browser to refuse cookies as described in Section 6.
• Access, correction, and deletion. You may request a copy of the personal information we hold about you, ask us to correct inaccurate information, or ask us to delete information that we are not legally required to retain. Send requests to info@extrabusinessfunding.com.

10. California Privacy Rights

This section applies to California residents and supplements the rest of this Policy. We do not currently offer funding in California, but we may collect information from California visitors and applicants.

10.1 Categories of personal information collected

In the past twelve months we have collected the following categories of personal information described in the California Consumer Privacy Act ("CCPA"):

• Identifiers (name, email, postal address, phone, IP address).
• Personal information categories listed in California Civil Code § 1798.80(e) (including SSN, signature, financial-account information).
• Commercial information (business records, application data).
• Internet or other electronic-network activity information.
• Geolocation data (general location inferred from IP address).
• Professional or employment-related information.
• Inferences drawn from any of the above to create a profile reflecting risk and creditworthiness for underwriting.

10.2 Sources of personal information

Directly from you; from your interactions with the Site; from brokers and other referral sources; and from third parties such as credit-reporting agencies, identity-verification services, and public-record providers.

10.3 Business or commercial purpose

The purposes described in Section 3 of this Policy.

10.4 Categories of third parties

The categories of recipients described in Section 4 of this Policy.

10.5 Your CCPA rights

California residents have the right to:

• Know what personal information we have collected about you.
• Request deletion of personal information.
• Correct inaccurate personal information.
• Opt out of the "sale" or "sharing" of personal information. EBF does not sell personal information and does not share personal information for cross-context behavioral advertising, so there is nothing to opt out of, but you may still submit a request and we will confirm our practices.
• Limit the use of sensitive personal information beyond what is necessary to provide the requested services.
• Be free from retaliation for exercising any of these rights.

To exercise these rights, email info@extrabusinessfunding.com. We will verify your identity before responding. You may also designate an authorized agent to act on your behalf, subject to verification.

11. Nevada Privacy Rights

Under Nevada Revised Statutes § 603A and Nevada SB 220, Nevada residents have the right to direct certain businesses not to sell their personal information. EBF does not sell personal information to third parties. If you are a Nevada resident and wish to confirm this in writing, please contact us at info@extrabusinessfunding.com.

12. Children's Privacy

The Site and our services are intended for use by adults aged 18 and older in connection with their business. We do not knowingly collect personal information from anyone under the age of 18. The application requires confirmation that you are at least 18 years of age. If you believe we have inadvertently collected information from someone under 18, please contact us so we can delete it.

13. Third-Party Links

The Site may contain links to third-party websites or services that we do not own or operate. This Policy does not apply to those third parties. We encourage you to review the privacy practices of any third party before providing information.

14. Updates to This Policy

We may update this Policy from time to time. When we do, we will update the "Last updated" date at the top of the page. Material changes will be announced more prominently, for example through a notice on the Site or by email to applicants and funded merchants where appropriate. Your continued use of the Site after we post a revised Policy constitutes your acceptance of the revised Policy.

15. Contact Us

Questions about this Policy or our privacy practices can be sent to: