Slash — U.S. Consumer Privacy Notice

Why?

Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.

What?

The types of personal information we collect and share depend on the product or service you have with us. This information can include:

• Name and email address
• Transaction history — the amount, date, merchant, and category of transactions in the bank account you choose to connect
• Account identifiers for the financial institution you connect

When you are no longer our customer, we continue to share your information only as described in this notice.

How?

All financial companies need to share customers' personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers' personal information, whether Slash shares, and whether you can limit that sharing.

Because we do not share your personal information in any way that you can limit, there is nothing for you to opt out of.

Questions? Email privacy@theslash.app

Who is providing this notice?

Slash LLC, an Illinois limited liability company, operator of the Slash mobile application and theslash.app.

How does Slash protect my personal information?

To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings.

Specifically: the access token that lets us retrieve your transactions is encrypted at rest using AES-256-GCM and is never returned to the app or to any third party. All communication between the app and our servers is encrypted in transit. Access to your records is restricted to your own account through database row-level security. We maintain a written information security program, we require multi-factor authentication for everyone who can reach a system holding customer information, and we contractually require our service providers to protect your information.

We never receive or store your online banking username or password. You enter those directly with Plaid.

How does Slash collect my personal information?

We collect your personal information, for example, when you:

• create an account or provide your email address
• connect a bank account through Plaid
• set a spending limit or change your settings
• purchase a subscription through the Apple App Store

We also collect your personal information from others, such as Plaid Inc., the financial data provider that connects to your bank at your direction.

Why can't I limit all sharing?

Federal law gives you the right to limit only:

• sharing for affiliates' everyday business purposes — information about your creditworthiness
• affiliates from using your information to market to you
• sharing for nonaffiliates to market to you

State laws and individual companies may give you additional rights to limit sharing. See "Other important information" below.

Affiliates — Companies related by common ownership or control. They can be financial and nonfinancial companies.

Slash has no affiliates.

Nonaffiliates — Companies not related by common ownership or control. They can be financial and nonfinancial companies.

Slash does not share your personal information with nonaffiliates so they can market to you. We do use service providers to run our business — Plaid Inc. (bank connection and transaction data), Supabase (authentication and database hosting), Railway (backend hosting), and Apple (subscription processing and the App Store). These providers may use your information only to perform services for us.

Joint marketing — A formal agreement between nonaffiliated financial companies that together market financial products or services to you.

Slash does not jointly market.

We do not sell your personal information, and we do not use it for advertising or for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act.

The apps you choose to block stay on your phone. Your Family Activity selection and your Screen Time usage data are handled entirely by Apple's on-device framework. They are never transmitted to us and we cannot access them.

You can delete everything. You can disconnect your bank at any time from within the app, and you can delete your account and all associated data from within the app — including before you subscribe. Deleting your account permanently removes your profile, settings, transaction records, and bank connections, and revokes your bank access token with Plaid. It does not cancel your App Store subscription; you cancel that through Apple.

Plaid's own practices are governed by Plaid's end-user privacy policy at plaid.com/legal.

This notice is one of two. Our general Privacy Policy describes everything we do with all of your information, including your rights under state privacy laws and the GDPR. This notice covers specifically what federal financial privacy law requires us to tell you.

You receive this notice when you first connect a bank account, and it is always available at theslash.app/glba-privacy.

Because we do not share your personal information with nonaffiliated third parties in any manner that would require us to offer you an opt-out, and because our policies and practices have not changed since we last delivered this notice, we are not required to send you an annual copy. If that ever changes, we will resume sending you this notice every year and we will tell you before the change takes effect.