State Privacy Notice (CCPA/CPRA and others)

State Privacy Notice

Last updated: August 26, 2026

This State Privacy Notice supplements the INeedADownPayment.com Privacy Policy. It provides additional information for residents of states with comprehensive consumer privacy laws.

These laws may include the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), and privacy laws in Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states as their laws become effective.

The rights described below apply only when the relevant law covers INeedADownPayment.com and the particular processing activity. Terms such as “personal information,” “personal data,” “consumer,” “controller,” “business,” “process,” “sale,” “sharing,” and “targeted advertising” have the meanings assigned by applicable law.

INeedADownPayment.com is a matching, referral, and educational platform. We are not a lender, creditor, bank, or financial institution, and we do not make credit decisions.

1. Categories of Personal Information

During the preceding 12 months, we may have collected the following categories of personal information.

Identifiers

Examples include:

• Name
• Email address
• Telephone number
• Postal address, ZIP code, and state
• IP address
• Account, application, session, device, or referral identifiers

Sources may include you, your device, dealers, salespeople, referral sources, and participating providers.

Customer-Record Information

Examples include:

• Contact information
• Date of birth when legitimately required
• Employment and income information
• Housing information
• Financial circumstances
• Application and account information

Commercial Information

Examples include:

• Purchase category
• Item or vehicle information
• Purchase price
• Requested down-payment amount
• Cash contribution
• Estimated funding gap
• Dealer or seller information
• Potential options viewed or selected
• Referral and conversion activity

Internet and Electronic Activity

Examples include:

• Pages visited
• Links selected
• Referring website
• Application progress
• Session activity
• Scroll depth
• Visit duration
• Browser, operating system, and device information
• Campaign and referral attribution

Geolocation Information

We may collect general location information, such as country, region, or city, based on an IP address. We do not intentionally collect precise GPS location through the general website experience.

Professional or Employment Information

Examples include:

• Employment status
• Employer
• Length of employment
• Income
• Additional-income information

Inferences

We may create inferences concerning:

• Potential provider eligibility
• Purchase preferences
• Estimated funding needs
• Fraud or security risk
• Likely application completion
• Relevant educational or financial resources

A potential match or score created by INeedADownPayment.com is not a credit decision, approval, or guarantee of funding.

Sensitive Personal Information

Depending on applicable law, some information may be considered sensitive, including:

• Account login credentials
• Financial information
• Income information
• Contents of support communications
• Date of birth
• Information used for fraud prevention or account security

We do not request Social Security numbers during the general matching process.

We use sensitive personal information only for reasonably necessary service, security, authentication, fraud-prevention, compliance, and consumer-requested purposes unless we provide additional notice and obtain consent where required.

2. Sources of Personal Information

We may collect personal information from:

• You
• Your browser or device
• Cookies and similar technologies
• Dealers and salespeople
• Referral sources and campaigns
• Participating providers
• Service providers
• Fraud-prevention and security tools
• Publicly available sources when permitted
• Other parties acting at your direction

3. Purposes for Collection and Use

We may collect and use personal information to:

• Operate the website and application
• Create and secure accounts
• Save and resume applications
• Calculate estimated funding gaps
• Match users with potential providers and resources
• Display and explain potential options
• Process consumer-directed provider referrals
• Communicate about accounts and applications
• Provide customer support
• Record consents and disclosures
• Track referrals and conversions
• Measure visitor journeys and application performance
• Improve website content and usability
• Detect bots, fraud, duplicate applications, and abuse
• Protect users, partners, and the platform
• Troubleshoot errors
• Enforce agreements
• Comply with legal obligations
• Establish, exercise, or defend legal claims

We do not use protected-class information to unlawfully discriminate or make improper eligibility decisions.

4. Categories of Recipients

We may disclose personal information to:

• Hosting, database, and cloud-service providers
• Email and text-message providers
• Authentication and security providers
• Analytics and performance providers
• Fraud-prevention providers
• Customer-support providers
• Professional advisers
• Dealers or referral sources receiving limited status information
• Participating providers selected by the consumer
• Government authorities when legally required
• Parties involved in a merger, acquisition, financing, or sale
• Other recipients you authorize

We may disclose identifiers, application information, purchase information, employment or income information, and other relevant answers to a participating provider after you select that provider and provide any required partner-sharing consent.

5. Sale, Sharing, and Targeted Advertising

We do not sell personal information for money as a standalone data product.

INeedADownPayment.com may receive compensation when a consumer clicks a provider link, submits an application, receives an approval, obtains funding, purchases a product, or completes another qualifying action.

Some state laws define “sale” broadly to include transferring personal information for money or other valuable consideration. California also defines “sharing” to include certain disclosures for cross-context behavioral advertising.

A consumer-directed referral to a provider may be excluded from these definitions under some laws. Where an activity is legally considered a sale, sharing, or targeted advertising, eligible consumers may opt out.

To submit an opt-out request, email [email protected] with the subject line:

Do Not Sell or Share My Personal Information

An opt-out request will not prevent disclosures reasonably necessary to provide a service you request, complete a referral you authorize, maintain security, prevent fraud, or comply with law.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

6. California Privacy Information

California residents may have the right to request:

• The categories of personal information collected
• The specific pieces of personal information collected
• The categories of sources
• The business or commercial purposes for collection, use, sale, or sharing
• The categories of third parties receiving information
• Deletion of personal information
• Correction of inaccurate personal information
• Opt-out of sale or sharing
• Limitation of certain uses of sensitive personal information
• Equal service without unlawful discrimination

For the categories described in this notice, we may disclose personal information for business purposes to service providers, selected partners, dealers, referral sources, professional advisers, and other recipients described above.

We do not offer a financial incentive in exchange for enrolling in the general matching service. If we later offer a program that qualifies as a financial incentive under California law, we will provide a separate notice before enrollment.

California “Shine the Light”

California residents may request information about certain disclosures of personal information to third parties for their own direct-marketing purposes, where applicable.

Submit requests to [email protected] with the subject line California Privacy Request.

7. Rights Available in Other States

Depending on your state and applicable law, you may have the right to:

• Confirm whether we process your personal data
• Access your personal data
• Correct inaccurate personal data
• Delete personal data
• Obtain a portable copy of personal data
• Opt out of the sale of personal data
• Opt out of targeted advertising
• Opt out of certain profiling with legal or similarly significant effects
• Limit certain uses or disclosures of sensitive data
• Withdraw consent
• Obtain a list of certain third parties receiving personal data where required
• Appeal a denied privacy request
• Exercise your rights without unlawful discrimination or retaliation

INeedADownPayment.com does not itself make lending or credit decisions based on automated profiling.

8. How to Exercise Your Rights

To submit a privacy request, email:

[email protected]

Use one of these subject lines:

• Privacy Access Request
• Privacy Correction Request
• Privacy Deletion Request
• Do Not Sell or Share My Personal Information
• Limit Sensitive Personal Information
• Privacy Appeal

Include:

• Your full name
• The email address associated with your account or application
• Your state of residence
• The right you wish to exercise
• Enough information for us to locate the relevant records

Do not email Social Security numbers, passwords, bank-account numbers, or copies of sensitive identity documents unless we specifically provide a secure and appropriate method.

You do not need to create a new account to submit a privacy request.

9. Verification

We may need to verify your identity before fulfilling a request. Verification may involve matching information you provide with information already associated with your account or application.

The amount of information requested for verification will depend on the nature and sensitivity of the request.

If we cannot verify your identity, we may be unable to complete some requests. We will explain the reason where permitted.

10. Authorized Agents

Where permitted, an authorized agent may submit a request for you.

We may require:

• Written proof that you authorized the agent
• Verification of your identity
• Direct confirmation that you gave the agent permission

These requirements may not apply when the agent has a valid power of attorney recognized under applicable law.

11. Response Timing

We will confirm and respond to requests within the time required by applicable law.

Many state laws generally require a substantive response within 45 days, subject to a permitted extension. California may require confirmation or processing of certain requests within different periods.

If we need additional time, we will provide notice when required.

Requests are generally processed without charge. A reasonable fee may be permitted for requests that are manifestly unfounded, excessive, technically infeasible, or repetitive.

12. Appeals

If we deny a request, residents of states providing an appeal right may appeal by emailing:

[email protected]

Use the subject line:

Privacy Appeal

Include the original request and explain why you believe the decision should be reconsidered. We will respond within the period required by applicable law and provide information about contacting the appropriate state authority when required.

13. Nondiscrimination

We will not unlawfully discriminate or retaliate against you for exercising an applicable privacy right.

Exercising a privacy right may affect a feature when the requested information is reasonably necessary to provide that feature. For example, deleting an application may prevent you from resuming it.

14. Data Retention

We retain personal information only for as long as reasonably necessary for the disclosed purposes.

Raw IP addresses associated with visitor analytics are generally retained for approximately 30 days. Page-view and visitor-journey records may generally be retained for approximately 400 days.

Applications, accounts, consents, disclosures, security records, communications, referrals, conversions, and audit records may be retained longer when reasonably necessary for services, security, fraud prevention, contracts, legal compliance, or legal claims.

15. Contact Us

For questions or requests concerning this State Privacy Notice, contact:

INeedADownPayment.com Email: [email protected] Website: https://ineedadownpayment.com