Privacy Policy

This Privacy Policy describes how Ottri (“Ottri,” “we,” “us,” or “our”) collects, uses, shares, and protects information when individuals or businesses interact with the Ottri platform, including websites, applications, dashboards, embedded widgets, and APIs (the “Platform”).

Scope

This Privacy Policy applies to information collected through the Platform. It applies to:

• Merchants and merchant personnel
• Partners and authorized users
• Consumers interacting with Ottri-powered experiences through a Merchant
• Any visitors to our Platform

This Policy does not apply to lender-controlled application portals or third-party websites or services not operated by Ottri. Lenders maintain their own privacy practices and notices.

For purposes of this Privacy Policy, “Ottri Inc.” refers to Ottri Inc., a Delaware corporation that operates the Ottri Platform. “Ottri Global LLC” refers to Ottri Global LLC, a separate Delaware limited liability company (NMLS ID 2776988) that holds state financial services licenses where required and conducts only those licensed activities for which it is authorized in each applicable jurisdiction. References to “Ottri,” “we,” “us,” and “our” refer to the entity whose activities are described in the relevant provision. Both entities are subject to this Privacy Policy with the following allocation of responsibilities:

(a) Ottri Inc. is the controller of personal information collected through the Platform for technology operations, merchant onboarding, partner services, security, fraud prevention, and analytics. Ottri Inc. does not originate, underwrite, fund, or service credit and does not act as a finance lender or broker in any jurisdiction.

(b) Ottri Global LLC is the controller of personal information collected in connection with its state-licensed activities (NMLS ID 2776988) and is the responsible party for obligations specific to those activities under applicable federal and state financial services and privacy laws. Where Ottri Global LLC’s activities are subject to the Gramm-Leach-Bliley Act or state financial privacy laws, this Privacy Policy, together with the Ottri Global LLC Financial Privacy Notice referenced below, serves as the required notice for those activities.

Where this Privacy Policy describes an activity, the responsible entity is the entity whose role corresponds to that activity under (a) or (b) above. The Ottri Terms of Service govern your use of the Platform and identify the applicable Ottri contracting entity based on the activity, including Ottri Inc. for general Platform technology services and Ottri Global LLC for consumer financing-related activities conducted by Ottri Global LLC.

Notice at Collection

If you are a California resident, the categories of personal information we collect, the purposes for which we use it, the third parties we share it with, whether it is sold or shared, and our retention practices are described in the “State Privacy Rights” section of this Policy. Ottri does not sell personal information for money. Ottri may use advertising cookies and similar technologies that may constitute a “sale,” “sharing,” or targeted advertising under certain state privacy laws. You may opt out through Your Privacy Choices or supported universal opt-out preference signals where required by law.

Ottri’s Role

Ottri Inc. provides technology infrastructure and Platform functionality. Ottri Inc. does not originate, underwrite, fund, or service credit, make credit decisions, set loan terms, or act as a finance lender or broker in any jurisdiction.

Where applicable law requires a licensed entity to conduct a particular consumer financing-related activity, that activity is conducted by Ottri Global LLC, NMLS ID 2776988, under its state financial services licenses where required. Ottri Global LLC may obtain and use consumer report information with consumer consent for initial matching and routing checks, fraud prevention, identity verification, and related consumer financing activities.

Credit decisions and final loan terms are determined solely by independent participating lenders.

Data Controller and Processor Roles

Ottri’s role in relation to data varies depending on the context:

When Ottri collects and uses information for its own business purposes, such as operating the Platform, complying with regulatory obligations, performing analytics, and maintaining security, Ottri acts as the data controller.

When Ottri processes consumer application data or merchant information at the direction of a Lender or pursuant to a lender integration agreement, Ottri acts as a data processor on behalf of that Lender. In such cases, the Lender determines the purposes and means of processing.

When a Merchant submits consumer data through the Platform for financing purposes, Ottri processes that data as necessary to route the consumer to participating Lenders and to operate the Platform. Ottri acts as a controller for routing and platform operations and as a processor to the extent it transmits data to Lenders per their instructions.

Partners do not control consumer data processing. Partner access is limited to business-level Merchant information as described in the “How We Share Information” section.

Categories of Information We Collect

Ottri collects information necessary to operate the Platform. Depending on the interaction, this may include:

How We Collect Data

Ottri collects information through three methods:

Directly from you

Information you provide when interacting with the Platform, including merchant onboarding forms, consumer financing applications, partner registration, and communications with Ottri.

Automatically

Information collected through cookies, server logs, and similar technologies when you access or use the Platform, including IP address, browser type, device information, and session activity.

From third parties

Information received from consumer reporting agencies, identity verification providers, lender partners, referring Merchants, and other service providers in connection with Platform operations, including credit data (with consumer consent), verification outputs, and publicly available business information.

How We Use Information

Ottri uses information to:

• Operate, maintain, and secure the Platform
• Verify Merchant, Partner, and authorized user information
• Facilitate consumer soft credit inquiries with consent
• Route consumers to participating Lenders
• Comply with legal, licensing, and regulatory obligations
• Communicate with consumers, merchants, lenders, and partners

Ottri may use aggregated or de-identified information for analytics, security, and platform improvement. Such information does not identify individuals or businesses. Ottri does not sell personal information, and does not use personal information to train large language models or other generative AI systems.

Messaging Practices and Mobile Information

This section describes how Ottri collects and uses mobile phone numbers and messaging consent data.

What we collect. When you provide a mobile phone number to Ottri, we collect that number, the date, time, and method of your consent, the messaging program you opted in to, and your opt-out status.

How we use it. We use mobile phone numbers to send the messages you have opted in to receive. Depending on the program you selected, messages may include account notifications, onboarding and activation steps, financing application status updates, customer support communications, and, only where you have separately opted in, marketing or promotional messages about the Platform. Message frequency varies based on your account activity and lifecycle stage and may include multiple messages per day during active onboarding, activation, support, or re-engagement periods. Message and data rates may apply.

Non-sharing of mobile information. We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes. Mobile phone numbers may be disclosed only to service providers acting on Ottri’s behalf, such as messaging platform vendors and compliance vendors, solely to deliver messages, maintain opt-out lists, honor revocation requests, and support Ottri’s legal and regulatory obligations. These service providers are contractually prohibited from using mobile information for any purpose other than performing services for Ottri.

Consent is specific to Ottri. Your messaging consent is collected by and for Ottri only. It is not transferred, assigned, or extended to any other sender. If you interact with a participating lender, that lender obtains its own consent for any messages it sends.

Opting out. You may opt out of text messages at any time by replying STOP to any message. For help, reply HELP, email support@ottri.com, or call (800) 809-0011. You may also contact support@ottri.com to revoke messaging consent or ask questions about Platform-related communications.

Carriers are not liable for delayed or undelivered messages.

Legal Basis for Processing

Ottri processes information on the following grounds, as applicable:

Consent

Where you have given consent, such as consent to a soft credit inquiry, consent to receive text messages, or acceptance of non-essential cookies. You may withdraw consent at any time by contacting support@ottri.com. Privacy rights requests may also be submitted to privacy@ottri.com.

Contractual necessity

Where processing is necessary to perform or enter into an agreement with you, including merchant onboarding, platform access, and partner services.

Legitimate interest

Where processing is necessary for Ottri’s legitimate business interests, such as platform security, fraud prevention, analytics, and service improvement, provided those interests are not overridden by your rights and interests.

Legal obligation

Where processing is required to comply with applicable laws, regulations, licensing requirements, or legal process.

Credit Information and Soft Pulls

With consumer consent obtained in the Platform experience, Ottri Global LLC may obtain and use soft-pull consumer report information and related data from TransUnion and other consumer reporting agencies for identity verification, fraud prevention, initial matching and routing checks, lender-routing calculations, and matching consumers with participating lenders.

Soft credit inquiries are not used by major credit-scoring models, including FICO and VantageScore, in score calculations. Soft-pull results are used to help route and present potential financing options and do not guarantee approval, final terms, APR, or funding.

Ottri Global LLC does not make final credit decisions, approve or deny loans, set APRs, fund loans, or service loans. Participating lenders perform independent credit evaluations and determine all final loan terms, approvals, denials, and funding decisions.

Under the Fair Credit Reporting Act, you have the right to know if information in your consumer file has been used against you, to dispute incomplete or inaccurate information, and to limit prescreened offers of credit. For more information about your rights under the FCRA, visit the Consumer Financial Protection Bureau at consumerfinance.gov or contact the nationwide consumer reporting agencies.

If you accept a financing offer or submit an application to a lending partner, that lending partner may conduct a hard credit inquiry as part of its independent evaluation, processing, or servicing of your loan. A hard credit inquiry may affect your credit score.

Information You Provide Before Submitting

If you provide information during your application but do not click ”Agree & Continue” to submit, we may retain that information so you can resume your application if you return, maintain security, prevent fraud, and improve the Platform. We do not use that information to obtain a soft credit inquiry or share it with participating lenders unless you complete the required authorization and submit your financing request.

Health Information

Ottri is a financing technology platform. Ottri is not a health care provider and is not a covered entity under the Health Insurance Portability and Accountability Act (HIPAA). Information you or a Merchant provide to Ottri about a procedure or treatment is not protected health information under HIPAA when held by Ottri, but Ottri treats it as sensitive personal information under this Policy.

Ottri collects only the procedure or treatment information needed to facilitate a financing request, such as the procedure name or category, estimated cost, and scheduled date. Ottri does not request diagnoses, medical records, or clinical notes. Treatment information is shared only with participating lenders as part of the financing request and with service providers as described in this Policy. It is never used for advertising and is never sold.

Residents of Washington, Nevada, and other states with consumer health data laws may exercise the rights described in the “State Privacy Rights” section with respect to health-related information.

How We Share Information

This section describes Ottri’s information sharing practices. Where Ottri Global LLC’s activities are subject to the Gramm-Leach-Bliley Act or applicable state financial privacy laws, this section, together with the Ottri Global LLC Financial Privacy Notice, serves as the required notice for those activities.

Ottri may share information with:

• Participating lenders, as needed to route, process, evaluate, and support consumer financing requests, and with appropriate consumer consent. Information transmitted to a lender as part of a financing request includes the identity, contact, and application information the consumer provided, which may include the consumer’s phone number so the lender can process the request. This transmission is part of the financing application and is not a disclosure of messaging consent data. Lenders obtain their own consent for any messages they send.
• Consumer reporting agencies and other data providers, as needed for soft-pull consumer report information, identity verification, fraud prevention, and related Platform operations.
• Service providers, including hosting, analytics, messaging, compliance, identity verification, fraud prevention, data processing, customer support, and security providers, subject to contractual confidentiality and use restrictions.
• Referring merchants and their service providers, limited to information necessary to support the consumer’s project and financing request, including application status, high-level financing outcome, funding status, lender/product status, and project-related identifiers.
• Distribution partners, limited to business-level Merchant information as described in the Terms of Service. Sensitive financial, identity, verification, and banking data are never shared with Partners.
• Regulators, law enforcement, courts, or other third parties, when required or permitted by law, subpoena, court order, regulatory request, legal process, or to protect the rights, property, safety, or security of Ottri, users, consumers, merchants, lenders, or the public.

Ottri does not share a consumer’s full consumer report or full Social Security number with the referring merchant. Other information may be shared only as described in this Policy and as permitted by law.

We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes.

Your Right to Limit Sharing (Gramm-Leach-Bliley Act)

Under the Gramm-Leach-Bliley Act, you have the right to opt out of certain sharing of your nonpublic personal information with nonaffiliated third parties. Ottri does not share nonpublic personal information with nonaffiliated third parties for purposes that would trigger opt-out rights under Regulation P (12 C.F.R. Part 1016), except as permitted by law. If our sharing practices change, we will provide you with a revised notice and an opportunity to opt out before any such sharing occurs.

The Ottri Global LLC Financial Privacy Notice, in the standard “Facts” format, is available on request. To exercise your rights or ask questions, contact privacy@ottri.com or call (800) 809-0011.

Third-Party Services

The Platform integrates with third-party services and Lender systems. These third parties process information as necessary to provide services to Ottri and are subject to contractual restrictions. Lenders and third-party services maintain their own privacy policies. When you accept a financing offer from one of our lending partners, that lender’s privacy policy will then govern your continued relationship with that lender, and we will identify the lender to you at the point you receive an offer. Ottri is not responsible for the privacy practices of third parties not under its control.

Data Security and Retention

Ottri maintains administrative, technical, and physical safeguards designed to protect information, consistent with industry standards and applicable regulatory requirements. Safeguards include encryption of data in transit and at rest, role-based access controls, continuous monitoring, and regular security assessments.

Ottri retains personal information for the period necessary to fulfill the purposes described in this Policy and to comply with legal, licensing, and regulatory record-retention obligations. Retention periods by category are set out in the “State Privacy Rights” section. We securely dispose of information when the applicable retention period expires and no legal or regulatory obligation requires further retention.

Platform safeguards are designed to ensure the confidentiality and security of Social Security numbers. Ottri limits access to Social Security numbers to those who need to process the information and prohibits the unlawful disclosure of Social Security numbers.

Cookies and Tracking Technologies

Ottri uses cookies and similar technologies on its website and Platform for the following purposes:

Essential cookies are used for security, fraud prevention, session management, and core Platform functionality. These cookies are necessary for the website and Platform to operate and cannot be disabled.

Analytics and behavioral cookies, including Google Analytics, HubSpot, Customer.io, and session replay tools, are used to measure website performance, understand how visitors interact with our website, attribute leads, deliver lifecycle communications, and improve Platform functionality. These tools may collect information such as pages visited, time on site, click and scroll behavior, referring URLs, form submissions, and email engagement. Analytics data is processed by third-party service providers and may be transferred to servers outside the United States.

Advertising cookies, including Meta Pixel, LinkedIn Insight Tag, and Google Ads conversion tracking, are used to measure the effectiveness of Ottri’s marketing campaigns and to deliver relevant advertisements to you on third-party platforms. These cookies may collect information about your browsing activity on the Ottri website and share it with advertising platforms for measurement and targeting purposes. Advertising cookies are used only on Ottri’s public marketing website. They are not used within consumer financing application screens.

When you first visit the Ottri website, you will be presented with a cookie consent notice that allows you to accept or decline non-essential cookies (analytics and advertising). You may update your preferences at any time by clicking the “Your Privacy Choices” link in the website footer. If you decline non-essential cookies, only essential cookies will be used.

Ottri does not send promotional marketing communications to consumers based on Platform activity. Ottri does not sell personal information for money. Ottri may use advertising cookies and similar technologies that may constitute a “sale,” “sharing,” or targeted advertising under certain state privacy laws. You may opt out through Your Privacy Choices or supported universal opt-out preference signals where required by law.

Users may also control cookies through browser settings. Disabling cookies may affect website functionality.

State Privacy Rights

Residents of U.S. states with comprehensive privacy laws have rights that may include the right to:

• Access personal information
• Correct inaccuracies
• Request deletion where permitted by law
• Obtain a copy of personal information in a portable format
• Opt out of the sale of personal data, targeted advertising, and certain profiling
• Limit use and disclosure of sensitive personal information (California residents, CPRA §1798.121)

Certain personal information collected by Ottri Global LLC in connection with its licensed financial services activities is subject to the Gramm-Leach-Bliley Act and is exempt from some state privacy law rights. Where an exemption applies, Ottri will tell you in its response.

California Notice at Collection

The table below describes the categories of personal information Ottri has collected in the preceding 12 months, the purposes for which each category is used, the categories of third parties to which it is disclosed for a business purpose, and whether it is sold or shared. Retention periods for each category follow in the next table.

*Internet and device activity may be shared through advertising cookies or similar technologies on Ottri’s public marketing website where advertising cookies are enabled. You may opt out through Your Privacy Choices or supported universal opt-out preference signals where required by law.

Ottri does not sell contact information, Social Security numbers, government identifiers, consumer application information, health or treatment information, or credit information. Ottri processes sensitive personal information only for purposes permitted under the CPRA and does not use sensitive personal information to infer characteristics about you.

Retention Periods

Sources of Personal Information

Ottri collects personal information directly from you, automatically through the Platform, and from third parties including consumer reporting agencies, identity verification providers, participating lenders, and referring Merchants.

How to Exercise Your Rights

To exercise these rights, email privacy@ottri.com or call (800) 809-0011. California residents may also exercise opt-out rights through the “Your Privacy Choices” link available on the Ottri website.

Verification. To protect your information, we will verify your identity before responding to a request to access, correct, or delete personal information. We will ask you to confirm at least three data points we already hold, such as name, email address, phone number, date of birth, or the last four digits of your Social Security number. Requests to opt out of sale, sharing, or targeted advertising do not require verification.

Authorized agents. An authorized agent may submit a request on your behalf where permitted by law. We will require the agent to provide written, signed permission from you or a valid power of attorney, and we may also ask you to verify your identity directly with us.

Universal opt-out signals. Ottri recognizes universal opt-out preference signals, including the Global Privacy Control (GPC), as valid opt-out requests where required by applicable state law. When Ottri detects a GPC signal, it will process the signal as an opt-out of the sale of personal data and targeted advertising for that browser or device.

Timing and appeals. Ottri will respond within the timeframes required by applicable law, generally within 45 days, and may extend that period where permitted. If a request is denied, you may appeal within 45 days by contacting privacy@ottri.com with the subject line “Privacy Appeal.” We will respond to your appeal within 45 days. California residents may also submit complaints to the California Privacy Protection Agency (CPPA). Residents of other states may submit complaints to their respective state attorneys general.

Right to Non-Discrimination

We will not discriminate or retaliate against you for exercising any of your privacy rights. This means we will not deny you goods or services, charge different prices or rates, provide a different level or quality of goods or services, or suggest you may receive different treatment because you exercised your rights under California or other applicable state privacy laws.

California “Shine the Light”

California Civil Code §1798.83 permits California residents to request information about disclosures of personal information to third parties for those third parties’ direct marketing purposes. Ottri does not disclose personal information to third parties for their direct marketing purposes.

Nevada Residents

Ottri does not sell personal information as defined under Nevada law. Nevada residents may submit a request to privacy@ottri.com to confirm this or to opt out of any future sale.

Children’s Privacy

The Platform is intended for adults 18 years of age or older. Ottri does not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a person under 18, we will delete it. Ottri does not knowingly sell or share personal information of consumers under 16 as those terms are defined under the CCPA/CPRA.

U.S. Operations and International Access

The Platform is intended for use in the United States. Information is primarily processed and stored in the United States and may be accessed by authorized personnel or service providers from other locations as necessary to support Platform operations.

Changes to This Policy

Ottri may update this Privacy Policy from time to time. Updates will be posted with a revised “Last Updated” date at the top of this Policy. If we make material changes to how we use or share personal information, we will provide notice through the Platform or by email before the change takes effect.

Contact Us

Ottri Inc. and Ottri Global LLC
110 E Broward Blvd, Suite 1580
Fort Lauderdale, FL 33301

Privacy requests: privacy@ottri.com
Support: support@ottri.com
Phone: (800) 809-0011