Stash Privacy Policy

This Privacy Policy, effective May 21, 2025, governs Stash Financial, Inc. and its affiliates (Stash Investments LLC, Stash Capital LLC, Stash Cash Management LLC, and Stash Insurance Services LLC) and describes how personal information is collected, used, processed, and disclosed in connection with the Stash Platform, including its website and mobile application. The policy states that Stash collects an extensive range of personal information including Social Security numbers, bank account credentials, government-issued identification, selfie photographs, geolocation data, device identifiers, behavioral and clickstream data, and financial data including net worth and income ranges; it further states that this information may be shared with affiliates, service providers, marketing partners, data analytics vendors, and third parties in connection with business operations and promotional activities. The policy asserts that anonymized or aggregated data falls entirely outside its scope and may be used for any business purpose without limitation, a broad carve-out that may interact with California Consumer Privacy Act protections depending on how anonymization is implemented and verified in practice. As a registered investment adviser, broker-dealer, and banking services provider, Stash's data practices engage multiple regulatory frameworks including the Gramm-Leach-Bliley Act, SEC and FINRA recordkeeping and privacy requirements, the FTC Act's unfair and deceptive practices standards, and the California Consumer Privacy Act as amended by the CPRA; the policy expressly provides California residents with rights to know, delete, correct, and opt out of sharing, but the breadth of the anonymization carve-out and the Do Not Track non-response posture may warrant further review under applicable state privacy frameworks.