Privacy Policy

2.1 — Information You Provide Directly

• Identity information: full legal name, date of birth, current and prior addresses, Social Security Number (last four digits only — BAG does not collect or store your full SSN), phone number, and email address
• Financial information: credit score ranges, debt balances, employment status, and income range — as provided by you for service qualification purposes
• Account information: usernames, passwords (encrypted), and service preferences for your BAG client portal account
• Communications: any information you provide in correspondence with BAG by email, phone, or written mail

2.2 — Information Obtained from Consumer Reporting Agencies

With your prior written authorization (BAG-AUTH-001), BAG obtains consumer credit report data from Experian, TransUnion, and/or Equifax. This data includes consumer credit file (tradelines, payment history, inquiry records, and public records), credit scores and reason codes, and any other data elements included in your consumer credit report.

BAG accesses this information solely pursuant to the Fair Credit Reporting Act, 15 U.S.C. § 1681b, and only for the specific purposes authorized by you in writing. You may withdraw this authorization at any time. See Section 6 for your rights.

2.3 — Automatically Collected Website Information

• Website usage data: pages visited, time spent, browser type, operating system, and referring URL — collected via standard web server logs and analytics tools
• IP address: collected automatically and used for security and fraud prevention purposes only
• Cookies: see Section 8 for our cookie policy

BAG does not collect, store, or process the following:

• Your full Social Security Number — only the last four digits are used for identity verification
• Payment card numbers, bank account numbers, or routing numbers — BAG does not process or store payment card data
• Biometric data of any kind
• Health or medical information

5.1 — We Share Information Only As Follows

• Consumer reporting agencies (Experian, TransUnion, Equifax) — solely to submit dispute correspondence and monitor dispute resolution on your behalf, pursuant to your written authorization
• Engine by MoneyLion or other licensed lending marketplace partners — solely to execute pre-qualification requests on your behalf, pursuant to your written authorization, when you have requested funding matching services
• SendCertifiedMail.com — solely to print and mail FCRA dispute letters on your behalf; this service provider is bound by a data processing agreement with security requirements no less stringent than this Policy
• Compliance counsel and legal advisors — solely for legal advice and representation
• As required by law — in response to a valid legal process, court order, or regulatory demand, or as required to comply with applicable law

5.2 — We Do Not Share

• Your information with any marketing company, data broker, or advertising network
• Your full credit report with any party other than the CRAs identified above and the specific parties authorized by you in writing
• Your information with affiliated BAG divisions for purposes you did not authorize

6.1 — Right to Access

You may request a copy of the personal information BAG holds about you at any time by submitting a written request to corporate@brightpathascendgroup.com. BAG will respond within 30 days.

6.2 — Right to Correct

If any information BAG holds about you is inaccurate, you may request correction by written notice to the address above.

6.3 — Right to Revoke Authorization — Credit Report Access

You may revoke your authorization for BAG to access your consumer credit report at any time by written notice to corporate@brightpathascendgroup.com or by certified mail to BAG’s principal office. Revocation takes effect within 24 hours of receipt and terminates all ongoing monitoring pulls.

6.4 — Right to Opt Out — Information Sharing

Under the Gramm-Leach-Bliley Act, you have the right to opt out of certain sharing of your nonpublic personal information with nonaffiliated third parties. To opt out, contact BAG at corporate@brightpathascendgroup.com or (917) 909-4051. BAG does not share your information with nonaffiliated third parties for marketing purposes.

6.5 — California Residents

California residents may have additional rights under the California Consumer Privacy Act (CCPA). Contact BAG at the address above for a California-specific privacy rights request.

6.6 — New York Residents

New York residents are protected by the NY SHIELD Act and NY General Business Law § 380 et seq. BAG complies with all applicable New York consumer privacy requirements.

BAG implements the following technical and organizational security measures to protect your personal and financial information:

• Encryption at rest using AES-256-GCM for all stored consumer data
• Encryption in transit using TLS 1.3 for all data transmissions
• Role-based access controls with mandatory multi-factor authentication for all personnel
• Private VPC network architecture — consumer data is never accessible from the public internet
• Continuous threat monitoring via AWS GuardDuty
• Seven-year audit log retention via AWS CloudTrail
• Annual security audits and employee training programs

In the event of a security incident involving your personal information, BAG will notify you as required by applicable law — within 30 days for New York residents under the NY SHIELD Act.