Abra Cap LLC Privacy Policy

Effective Date: September 8, 2026
Last Updated: September 8, 2026
(Note: Previous versions of this Privacy Policy are available upon request.)

SUMMARY OF KEY POINTS

At a Glance:

• What personal information do we collect? We collect business and personal details, including names, contact information, financial documents, bank statements, and technical usage data.
• Do we process any sensitive personal information? Yes, we collect Social Security Numbers, driver's license numbers, and financial account details to facilitate financing applications and verify identity.
• Do we collect information from third parties? Yes, we may receive information from identity verification services and our financing partners.
• How do we use your information? We use your data to process applications, match you with third-party financing partners, comply with KYC (Know Your Customer) regulations, and secure our platform.
• Who do we share your personal information with? We share data with our network of financing partners (under strict confidentiality) and essential service providers who help run our platform.
• What are your privacy rights? You have the right to access, correct, delete, and port your data, as well as the right to opt out of marketing communications.
• How can you contact us? You can reach us anytime at hello@abracap.com.

---

1. INTRODUCTION

Abra Cap LLC ("Company", "we", "us", or "our") hereby sets forth this Privacy Policy to govern the collection, use, and disclosure of personal data. Abra Cap LLC is a New York-based commercial finance platform that facilitates access to funding for businesses—ranging from early-stage companies to publicly traded corporations—including term loans, lines of credit, revenue-based financing, SBA financing, equipment financing, and structured capital. The Company operates strictly as a marketplace and not as a direct lender; accordingly, we match applicants with financing offered through a network of third-party financing partners. We are formally committed to safeguarding your privacy and ensuring that your personal data is processed in accordance with all applicable United States federal and state privacy laws. This policy applies to all users of our platform, website (https://www.abracap.com/), and related financial services. Should you have any inquiries regarding this Privacy Policy, you shall direct such correspondence to hello@abracap.com.

2. WHAT WE COLLECT & WHY

Pursuant to our provision of financial marketplace services, the Company collects specific categories of personal and business information. The collection of such data is strictly limited to what is necessary for the stated purposes herein.

Information You Provide Directly

To process applications and facilitate financing offers, we collect identifying details, financial documents, bank statements, payment information, and account preferences. Furthermore, we collect sensitive personal information, including Social Security Numbers, driver's license numbers, and financial account details.

• Legal Basis: Processing is necessary for the performance of a contract to which you are a party, and for compliance with legal obligations, specifically Know Your Customer (KYC) and Anti-Money Laundering (AML) statutory requirements.

Information Collected Automatically

When you access our platform, we automatically collect usage analytics, cookies and tracking data, device information, technical logs, and communication records.

• Legal Basis: Processing is based on our legitimate interest in maintaining platform security, ensuring operational functionality, and optimizing the user experience.

Information from Third Parties

We may obtain data from third-party identity verification agencies, credit bureaus, and our network of financing partners to evaluate financing offers and verify application data.

• Legal Basis: Processing is necessary for compliance with legal obligations and our legitimate interest in preventing fraudulent financial transactions.

3. HOW WE USE YOUR INFORMATION

The Company shall process your personal information exclusively for the following specific and lawful purposes:

• Core Service Delivery: To register your account, manage your profile, process applications, and match you with third-party financing partners. (Basis: Contractual necessity).
• Service Improvement and Personalization: To analyze platform usage and enhance our marketplace functionality. (Basis: Legitimate interest).
• Communication: To transmit transactional notices, application updates, and administrative alerts. (Basis: Contractual necessity and consent).
• Security and Fraud Prevention: To monitor for unauthorized access, verify identities via KYC protocols, and protect the integrity of our financial systems. (Basis: Legitimate interest).
• Legal Compliance: To adhere to applicable financial regulations, respond to lawful subpoenas, and maintain required financial records. (Basis: Legal obligation).
• Marketing: To deliver promotional materials and offers, provided you have not opted out. (Basis: Consent).

4. WHEN WE SHARE YOUR INFORMATION

The Company strictly limits the disclosure of your personal information. We shall only share your data under the following circumstances:

• Financing Partners: We share application data, including financial documents and identifying details, with our network of third-party financing partners to obtain and evaluate financing offers. Such partners are bound by strict confidentiality obligations.
• Essential Service Providers: We disclose data to vendors providing hosting, payment processing, electronic signature, and analytics services necessary for our operations.
• Legal Requirements: We shall disclose information when compelled by law, subpoena, or court order, or to protect the legal rights of the Company.
• Business Transitions: In the event of a merger, acquisition, or asset sale, user data may be transferred as a business asset, subject to the surviving entity honoring this Privacy Policy.
• With Your Consent: We may share data for other purposes pursuant to your explicit written or electronic consent.

Notwithstanding any other provision herein, the Company hereby represents and warrants that we do not sell your personal information, nor do we share it for cross-context behavioral advertising.

5. YOUR PRIVACY RIGHTS

Subject to applicable state laws (including the CCPA/CPRA, VCDPA, CPA, CTDPA, and others), you are hereby granted the following actionable rights regarding your personal data:

• Right to Access: You may request a copy of the personal data we hold about you. We shall respond to such requests within the legally mandated timeframe (typically 45 days).
• Right to Correction: You maintain the right to rectify any inaccurate or incomplete personal data held by the Company.
• Right to Deletion: You may request the erasure of your personal data, subject to our legal and regulatory data retention obligations.
• Right to Data Portability: You may request your data in a structured, commonly used, and machine-readable format.
• Right to Opt-Out of Marketing: You may withdraw consent for marketing communications at any time via the unsubscribe mechanism provided in such communications.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw such consent without affecting the lawfulness of processing conducted prior to withdrawal.
• Right to Lodge Complaints: You maintain the right to file a complaint with the relevant state attorney general or data protection authority in your jurisdiction.

To exercise any of the aforementioned rights, you shall submit a formal request to hello@abracap.com.

6. DATA SECURITY

Given the critical risk level associated with financial data, the Company maintains a paranoid risk tolerance and employs stringent, industry-standard security measures. We utilize advanced encryption protocols, role-based access controls, and continuous network monitoring to safeguard your personal and financial information against unauthorized access, alteration, or destruction.

Notwithstanding the foregoing, the Company acknowledges that no method of electronic transmission or data storage is unequivocally secure; therefore, we cannot guarantee absolute security. Users are strictly advised to utilize strong, unique passwords and maintain the security of their own devices. In the event of a confirmed data breach compromising your personal information, the Company shall provide notification in accordance with applicable statutory timelines and regulatory requirements.

7. DATA RETENTION

The Company shall retain your personal data for a strict period of seven (7) years. This retention period applies uniformly across our systems and is necessitated by our regulatory obligations as a financial services platform, statutory limitations for legal claims, and comprehensive financial compliance requirements.

• Active Account Data: Retained for 7 years from the date of account closure or last activity.
• Financial Records & KYC Data: Retained for 7 years to comply with federal and state anti-money laundering and financial reporting laws.
• Technical Logs: Retained for 7 years to ensure historical security auditing capabilities.
• Marketing Preferences: Retained until consent is withdrawn, after which a suppression list is maintained for 7 years to ensure compliance with your opt-out request.

8. COOKIES & TRACKING

The Company utilizes cookies, web beacons, and similar tracking technologies to ensure platform functionality, analyze user behavior, and maintain session security. We deploy essential cookies (strictly necessary for platform operation) and analytical cookies (to assess performance). You may manage or disable non-essential cookies through your browser settings; however, doing so may impair certain functionalities of the platform. We do not utilize third-party tracking cookies for cross-context behavioral advertising.

9. CHILDREN'S PRIVACY

The Company's services are strictly intended for commercial entities and adult representatives thereof. We do not knowingly collect, solicit, or process personal information from individuals under the age of eighteen (18). Should we become aware that personal data of a minor has been collected without verified parental consent, we shall immediately expunge such data from our systems.

10. INTERNATIONAL TRANSFERS

The Company is headquartered in the United States, and our data processing operations are primarily conducted within this jurisdiction. In the event that personal data is transferred to sub-processors located outside the United States, the Company shall ensure that such transfers are governed by appropriate legal safeguards, including Standard Contractual Clauses (SCCs) or equivalent adequacy mechanisms, to ensure your privacy rights remain fully protected.

11. CHANGES TO THIS POLICY

The Company reserves the right to amend, modify, or update this Privacy Policy at our sole discretion. In the event of material changes, we shall provide fair notice by transmitting an email to the address associated with your account and by updating the "Effective Date" at the top of this document. Continued use of our services following such notification shall constitute your acknowledgment of the revised policy. The current version of this policy shall always be accessible at https://www.abracap.com/.

12. CONTACT US

Should you require further clarification regarding this Privacy Policy or wish to exercise your legal rights, you shall contact the Company via the following methods:

• Privacy Inquiries & General Contact: hello@abracap.com
• Website: https://www.abracap.com/
• Expected Response Time: The Company endeavors to acknowledge and respond to all privacy-related inquiries within ten (10) business days.

13. CATEGORIES TABLE (CCPA/CPRA)

Pursuant to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the following table delineates the categories of personal information collected by the Company within the preceding twelve (12) months.

Right to Limit the Use of Sensitive Personal Information: The Company collects Sensitive Personal Information (as defined below). You maintain the right to direct us to limit our use of your sensitive personal information to that use which is necessary to perform the services reasonably expected by an average consumer.

Category	Sources	Business Purpose	Categories of Third Parties Disclosed To	Retention Period
Identifiers (Name, email, IP address)	Direct user input, automated tracking	Account creation, communication, security	Service providers, financing partners	7 years
Sensitive Personal Information (SSN, Driver's license, financial accounts)	Direct user input, identity verification services	KYC compliance, financing application processing	Financing partners, identity verification vendors	7 years
Commercial Information (Financial documents, bank statements, payment info)	Direct user input, financing partners	Evaluating financing offers, processing transactions	Financing partners, payment processors	7 years
Internet/Network Activity (Usage analytics, device info, technical logs)	Automated tracking, cookies	Platform optimization, fraud prevention	Analytics providers, hosting services	7 years

14. AUTOMATED DECISION-MAKING

The Company hereby explicitly states that it does not engage in automated decision-making or profiling that produces legal or similarly significant effects concerning users. While we utilize technology to match applicants with financing partners, the final evaluation and issuance of financing offers are conducted by the respective third-party financing partners.

15. PRIVACY SIGNALS

The Company acknowledges and honors Global Privacy Control (GPC) browser signals. If your browser transmits a GPC signal, our systems shall automatically recognize and process this signal as a valid request to opt-out of any applicable tracking or data processing, in strict compliance with the privacy laws of California, Colorado, Connecticut, Montana, Texas, and other applicable jurisdictions.

16. SUB-PROCESSORS

To facilitate the delivery of our services, the Company engages specific third-party sub-processors. Our current essential sub-processors include DocuSign (electronic signatures), Vercel (hosting and infrastructure), Supabase (database management), PostHog (product analytics), and HubSpot (customer relationship management and communications).

The Company maintains a current and comprehensive list of all active sub-processors. Customers may request access to this list and may subscribe to receive formal notification prior to the addition of any new sub-processor by submitting a request to hello@abracap.com.