What we collect, and what we don’t.

Last updated 23 September 2026

This Privacy Policy (this “Policy”) applies to personal information that NOIR Holdings, Inc. [ confirm exact registered name ] (doing business as Mochi Finance) (“we”, “us” or “our”) collects, uses, discloses and otherwise processes about you (a “user”, “you” or “your”) when you use our website, mobile application or other digital products that link to this Policy, or when you otherwise interact with us (collectively, the “Services”). Capitalized terms not defined here have the meanings given in our Terms of Service. For purposes of applicable data protection laws, we are the controller of your personal information.

1. Scope and Applicability

This Policy applies to your information when you use the Services. It does not apply to third-party applications, platforms or services used in connection with the Services, including your banks and other financial institutions (“Connected Institutions”), the data aggregation providers that connect them (“Aggregation Providers”), app stores, or any website we link to. Those are provided by independent parties under their own terms and privacy policies. We are not responsible for their practices. Your Connected Institution’s privacy policy, and your agreement with your Connected Institution, may restrict what you are permitted to do with data from your accounts. You are responsible for reviewing those agreements.

2. What Information Do We Collect?

2.1 Information you provide to us

Account information such as your name, email address and password or single sign-on identifier; the documents you upload and everything contained in or extracted from them; and anything you send us in a support request.

2.2 Connected Account Data

When you connect a financial account, we and our Aggregation Providers collect, at your direction: account identifiers, account type, balances, transaction descriptions, amounts, dates, merchant and counterparty information, categories, statements, holdings, income and payroll records, and identity information held by the Connected Institution. We never receive or store your banking credentials.

2.3 Information we collect automatically

Log data (IP address, browser type and settings, referring pages, dates and times of requests), device identifiers and app interaction data.

2.4 Information we receive from third parties

From Aggregation Providers (Section 2.2), and from single sign-on providers such as Apple or Google if you use them to create your account.

2.5 Information about other people

Data you connect or upload will often contain personal information about other people — a joint account holder, a spouse, an employer, a client. You are responsible for having the right to provide it.

2.6 Records of the choices you make

When you accept these terms, confirm your date of birth, or turn a consent on or off, we record it: which document you were shown, the exact wording that was on your screen, what you tapped, when, and the IP address the request came from. We store the wording itself rather than a reference to it, so the record cannot drift as the wording changes. These entries are never edited or deleted — see Section 9.

2.7 De-identified and aggregated information

We aggregate and de-identify personal information so that it can no longer reasonably be used to identify you, and may use it to operate and improve the Services. We do not describe any data as “anonymous”.

3. How Do We Use the Information We Collect?

To operate the features you asked for: calculating net worth, categorising spending, detecting recurring charges, tracking budgets and goals, reading the documents you upload, and answering your questions about your own finances. Also to secure the Services, prevent fraud, provide support, comply with law, and communicate with you about the Services.

4. Do We Sell or Share Your Personal Information?

4.2 Planned Data Licensing Program

We plan to offer an optional program under which you could choose, document by document, to let us license documents you upload (such as statements or pay stubs) to third parties, including companies that train artificial intelligence models. If we launch it: (a) it will be strictly opt-in, with a separate consent for each upload; (b) it will never be a condition of using the Services, and declining will never affect your features, price or account; (c) Connected Account Data will never be part of it; and (d) before the program starts, we will update this Policy, deliver an updated financial privacy notice, provide the opt-out mechanisms required by state law, and notify you. Nothing you upload before the program launches will be licensed without your new, explicit consent.

4.3 If the program launches

Where state law treats the program as a “sale” of personal information, we will treat it as one and honor the corresponding rights, including opt-out rights and, for sensitive data, opt-in consent requirements.

5. Who Else Do We Disclose Your Personal Information To?

We disclose personal information: to Aggregation Providers, in order to establish and maintain your account connections; to service providers that support our operations, including cloud hosting, database administration, customer support, communications, security and analytics providers, in each case under contracts limiting their use of the information; to professional advisors, including auditors, lawyers and accountants; in connection with, or in anticipation of, a merger, acquisition, financing, asset sale, bankruptcy or other corporate transaction — in which case your data would transfer to the acquirer and would remain subject to this Policy until you are notified of a change; where we have a good-faith belief that disclosure is reasonably necessary to detect, prevent or investigate fraud, security incidents or illegal activity; where required or permitted by law or legal process, or to protect our rights, the safety of users or the public, or to enforce our Terms of Service; and otherwise with your consent or at your direction. [ We have no corporate affiliates or subsidiaries — confirm. ]

The providers we use

6. Federal Financial Privacy Notice (Gramm-Leach-Bliley Act)

[ We treat ourselves as a “financial institution” under the Gramm-Leach-Bliley Act and the FTC’s Privacy Rule and Safeguards Rule — counsel to confirm in writing. ] Our financial privacy notice is delivered when you open an account and annually thereafter, and is available at mochifinance.com/financial-privacy.

6.1 Your right to limit sharing

Federal law gives you the right to limit our sharing of nonpublic personal information about you with nonaffiliated third parties for purposes other than our everyday business purposes. We do not currently share your nonpublic personal information in any way you have the right to limit. If we launch the planned Data Licensing Program described in Section 4, deliveries under it would be such a disclosure; before it starts we will send you an updated notice with opt-out instructions, and no document would be included without your per-upload consent.

6.2 Effect of exercising it

If sharing you can limit ever begins and you direct us to limit it, we will stop going forward. We will not close your account or deny you the Services because you exercised the right, and your election will remain in effect until you change it.

6.3 Safeguards

We maintain a written information security program with administrative, technical and physical safeguards appropriate to our size, the nature of our activities and the sensitivity of the information we hold, as required by the FTC Safeguards Rule.

7. Tracking Technologies

7.1 Cookies and similar technologies

We and our providers use cookies, SDKs, pixels and similar technologies to operate the Services, remember your preferences and understand usage.

7.2 Analytics providers

[ List each analytics provider and link to its privacy policy. Keep this list accurate. ]

7.3 Opt-out preference signals

Our website recognizes the Global Privacy Control (GPC) signal. If you send us a GPC signal, we will treat it as a request to opt out of sale and sharing for that browser.

8. How Do We Secure Your Personal Information?

• Plaid access tokens are encrypted at rest with AES-GCM; the key lives in the server environment, never in the app.
• Every row of your data is isolated at the database level, readable only by your own authenticated account.
• Data is transmitted over TLS.
• Connected account data is stored separately from uploaded documents.
• Internal and administrative access requires multi-factor authentication, and access is logged.

No system is perfectly secure, and we cannot guarantee the security of your information.

9. Data Retention

We keep personal information for as long as your account is open, and afterwards only as long as needed for the purposes described in this Policy or as required by law. When you delete a document or close your account, we delete the associated personal information immediately: the deletion runs while you wait rather than on a later schedule, and your documents, your bank connections and your account records are gone before the request finishes. Copies held in encrypted backups are overwritten within [ 30 ] days.

Two things deliberately outlive your account. The first is a minimal record that the deletion happened — no name, no email, no address, only that an account was deleted and when. The second is the record of the choices described in Section 2.6: what you were shown and what you agreed to. Both are kept because they are the evidence of your own decisions, and a consent record that vanishes when you leave cannot answer the one question it exists to answer. Neither can be used to reconstruct your account, and nothing else survives, apart from anything the law or a documented security, fraud-prevention or record-keeping need requires us to keep.

10. Individuals Under 18

The Services are for adults. You must be 18 or older to use Mochi Finance, and we do not knowingly collect personal information from anyone under 18. Do not upload documents containing personal information about a minor.

11. Users Outside the United States

The Services are offered only in the United States and are not available in the European Economic Area, the United Kingdom or Switzerland. Your information is processed in the United States.

12. Your Privacy Rights and How to Exercise Them

Depending on where you live, you may have some or all of the following rights, which may be limited by law:

• Know / Access — confirmation and a copy of your personal information, its categories, sources, purposes and recipients; in some states, the specific third parties to which we disclosed it.
• Correction of inaccurate personal information.
• Deletion, subject to legal exceptions.
• Portability — a copy in a portable format.
• Opt out of sale or sharing — we do not currently sell or share personal information; see Section 4.
• Limit use of sensitive personal information.
• Opt out of profiling in furtherance of decisions with legal or similarly significant effects.
• Withdraw consent where we rely on it.
• Opt out of marketing communications.
• The federal financial privacy limit described in Section 6.
• Appeal of a decision on a rights request.

12.1 How to submit a request

Through Settings → Privacy in the App, the form at mochifinance.com/privacy-request, or by emailing shay@mochifinance.com. We will respond within the time required by applicable law.

12.2 Verification and authorized agents

We may need to verify your identity before honoring certain requests. If we cannot verify you, we may not be able to fulfill the request; where the law requires, we will instead treat an unverified deletion request as a request to opt out of sale and sharing. You may use an authorized agent, who must provide signed written permission, and we may still ask you to verify your identity directly.

12.3 No retaliation

We will not deny you the Services, charge you a different price, provide a different level or quality of service, or suggest that we will do any of those things, because you exercised a privacy right. We do not offer financial incentives in exchange for personal information.

12.4 Complaints

You may have the right to complain to your state attorney general or another supervisory authority. We encourage you to contact us first at shay@mochifinance.com so we can try to resolve your concern.

13. Financial Incentives

We do not offer a financial incentive or a price or service difference in exchange for personal information. The Services are free to everyone.

14. State-Specific Disclosures

14.1 Categories collected, sold and shared

In the preceding 12 months we collected the categories of personal information described in Section 2, from the sources and for the purposes described in Sections 2 and 3, and disclosed them to the categories of recipients described in Section 5. We did not sell personal information and did not share it for cross-context behavioral advertising.

14.2 California

If you are a California resident, the California Consumer Privacy Act, as amended, gives you the rights described in Section 12. To exercise them, see Section 12.1.

14.3 Connecticut

Connecticut treats financial account information and Social Security numbers as sensitive data and prohibits the sale of sensitive data without consent. We do not sell your data.

14.4 Texas

Texas residents have the rights described in Section 12, including the right to opt out of the sale of personal data and the right to appeal. We do not sell personal data.

14.5 Other states with comprehensive privacy laws

Residents of Florida, Oregon, Nebraska, New Hampshire, New Jersey, Delaware, Montana, Iowa, Indiana, Tennessee, Minnesota, Rhode Island, Kentucky, Maryland, Virginia, Colorado, Utah and other states with comprehensive privacy laws have the rights described in Section 12, to the extent those laws apply.

14.6 Biometric laws

[ If any biometric identifiers are ever collected, including through an identity-verification vendor, insert consent, retention and destruction disclosures here. ]

15. Changes to This Policy

We may change this Policy from time to time. We will post the updated Policy and revise the “Last Updated” date. If we make material changes to how we use, disclose, license or sell personal information, we will use reasonable efforts to notify you, such as by emailing the address associated with your account or by a prominent in-app notice, and will take any additional steps required by law. We will not apply a materially expanded licensing or selling practice to personal information we collected before the change without giving you notice and a meaningful opportunity to decline.

16. Contact Us

Questions about this Policy, your personal information or the Services: shay@mochifinance.com, or NOIR Holdings, Inc., [ postal address ], [ phone ].