Privacy Policy

I. Introduction

Please read carefully this Extend Enterprises Privacy Policy (the "Privacy Policy"), which is part of the Extend Terms and Conditions, before you access, download, or otherwise use our websites, use related other parties' websites, use any of our mobile applications, use our APIs, or otherwise interact with us, whether offline or online (collectively, the "Service").

This Privacy Policy applies to Extend Enterprises, Inc. ("Extend", "we", "us" or "our"). This Privacy Policy is part of the Extend Terms & Conditions. Any terms defined in the Terms & Conditions shall have the same meaning in this Privacy Policy. This Privacy Policy pertains to your accessing and using our websites, mobile applications, or APIs, and your interactions with us, without limitation, and it describes the information collected through your use of our Service, how we use your data, how we share it, how we protect it, and the choices you can make about your information.

By using the Service, you accept and agree to be bound by this Privacy Policy in full. If you do not accept this Privacy Policy, do not use the Service. You acknowledge that (a) you have read and understood this Privacy Policy; and (b) this Privacy Policy shall have the same force and effect as a signed agreement. Unless explicitly stated otherwise, any new features that augment or enhance the current Service shall be subject to this Privacy Policy.

We reserve the right to update or modify this Privacy Policy at any time without prior notice. We will update this page to reflect any changes to this Privacy Policy. Please review this Privacy Policy periodically, and especially each time you use the Service and before you provide any information. This Privacy Policy was made effective on the date indicated above.

II. Sensitive Information

Unless we specifically request or invite it, we ask that you not send us, and you not disclose, any sensitive personal information on or through the Service or otherwise to us. For purposes of this Privacy Policy, "sensitive information" includes, but is not limited to, the following: Social Security numbers, information related to racial or ethnic origin, political opinions, religion or philosophical beliefs, health, sex life or sexual orientation, criminal background, or biometric or genetic data for the purpose of uniquely identifying an individual.

III. Personal Information We Collect

We may collect information from you when you use the Service, contact or interact with us, sign up for our mailing list, register for an account, and voluntarily provide us with your comments and other content in connection with using the Service.

As part of your access to and use of the Service, we may receive and collect your name, email address, phone number, professional designation, and any other information you voluntarily provide on the Service.

When you register for a user account, we will collect: your first name, last name, a valid phone number, a valid email address, and your chosen user ID and password. If you register an eligible credit product within Extend, we will ask you for your credit product information including the billing address associated with that account, and we may display some of that information in the Extend application. Also, each time you request to create or use a virtual card number, the virtual card number information will be displayed in the Extend application, including a CVV or security code, along with the billing address of the registered card, which some merchants may require to be included as part of a purchase transaction. At the time you make a transaction or attach receipts in our service, the transaction data and receipts will be made visible to both the cardholder and the recipient.

When you access and use the Service, we automatically collect information regarding you and your device, including information provided to us by your browser (such as the website you came from (known as the referring URL), any Extend online advertisements located on third-party websites that you may have clicked on to access one of the Extend websites, the type of browser you use, and the time and date of access) and your username, permissions for the Service, device's Internet Protocol address, the domain name of your Internet service provider, your location, your mobile device information (e.g., device model and operating system version), your page visits, your social sharing activity, and aggregated information that cannot be used to specifically identify you. Additional information collected is described in the Analytics and Cookies sections.

We may combine all the information we collect from or about you and use it in the manner described in this Privacy Policy. Please note that Extend does not and will not sell or rent your personally identifiable information to third parties.

For additional information regarding the types of information we may collect, how we use the information, and how we share the information, please see the Privacy Chart below.

• Marketing and Analytics: We use third-party analytics tools to better understand who is using the Service and how people are using it. These tools may use cookies and other technologies to collect information about your use of the Service and your preferences and activities. These tools collect information sent by your device or the Service and other information that assists us in improving the Service. This information may be used to analyze and track data, determine the popularity of certain content, and better understand your online activity, among other things.
• Cookies and Other Tracking Technologies: We, along with third parties, use cookies, local storage objects, Web beacons, and other technologies. These technologies are used for tracking, analyzing, personalizing, and optimizing the Service. Cookies are small files that are transferred to and stored on your computer through your Web browser (if you allow it) that enable the website's or service provider's system to recognize your browser and capture and remember certain information. You can instruct your browser to stop accepting cookies. But if you do not accept cookies, you may not be able to use all portions of all functionality of the Service.
• Persistent cookies remain on the visitor's computer after the browser has been closed. Session cookies exist only during a visitor's online session and disappear from the visitor's computer when they close the browser software. Flash cookies (also known as local shared objects) are data files that can be created on your computer by the websites you visit, and are a way for websites to store information for later use. Flash cookies are stored in different parts of your computer from ordinary browser cookies. You can disable the storage of flash cookies. For additional information about managing and disabling flash cookies, please visit http://helpx.adobe.com/flash-player/kb/disable-local-shared-objects-flash.html. Web beacons are small strings of code that provide a method for delivering a graphic image on a Web page or in an email message for the purpose of transferring data. You can disable the ability of Web beacons to capture information by blocking cookies.

We use cookies and other tracking technologies on the website to help us understand and save your preferences and interests, so we can personalize your future visits and compile aggregate data about website traffic and website interaction, so that we can offer better website experiences and tools in the future. Some of our business partners, such as our analytics providers and social media connections, also use cookies and other tracking technologies on our website, some of which may track users across websites and over time.

We may use Google Analytics to better understand who is using the Service and how people are using it. Google Analytics uses cookies to collect and store information such as Service pages visited, places where users click, time spent on each Service page, Internet Protocol (IP) address, type of operating system used, location-based data, device ID, search history, gender, age, and phone number. We use this information in the aggregate to improve the Service and as otherwise described in this Privacy Policy. To better understand Google Analytics and the options you have with respect to the Google Analytics features, please visit: https://tools.google.com/dlpage/gaoptout/ and https://policies.google.com/privacy.

Information Collected From Other Services and Mobile Applications and Do Not Track Policy: Your browser or device may offer you a "Do Not Track" option, which allows you to signal to operators of websites, web applications, mobile applications, and services (including behavioral advertising services) that you do not wish such operators to track certain of your online activities over time and/or across different websites or applications. Our Service does not support Do Not Track requests at this time, which means that we or our analytics providers or other third parties with which we are working may collect information about your online activity both during and after your use of the Service.

IV. How We Use Personal Information

The purposes for which we may use the information we collect may include:

• Providing information and services to you;
• Connecting with your social media accounts and sharing information with you, if you choose to connect with our social media accounts;
• Processing and responding to your inquiries and comments;
• Contacting you for market research purposes and to use this information to customize the Service according to your interests;
• Personalizing and enhancing your experience using the Service;
• Sending periodic emails. If you choose, the email address you provide may be used to send you occasional news, updates, related product, or service information, etc. If at any time you would like to unsubscribe from receiving future emails, we include detailed unsubscribe instructions at the bottom of each email;
• Analyzing the accuracy, effectiveness, usability, or popularity of the Service;
• Preventing fraud and abuse of the Service and to otherwise protect users and visitors and our business;
• Assisting law enforcement and responding to court orders and legal investigations;
• Complying with applicable regulations, statutes, and laws;
• Performing other business activities as needed, or as described elsewhere in this Privacy Policy;
• Transferring information in the event of a merger, transfer of assets, or other organizational restructuring; and
• As explained elsewhere in this Privacy Policy, personal information we collect may be processed by our service providers in providing services related to the Service (such as administration services, technical services relating to the maintenance, servicing, and upgrading of products, software, hosting services, customer service, data migration services, and analytical services, among others).

V. How We May Share Personal Information

Information may be disclosed to third parties in accordance with our Privacy Policy. Please note that a user may choose not to share certain information as described in this Privacy Policy. As described further below, we may share your personal information with the following types of entities:

• The financial institution that provides the cardholder with the credit product used in the Service; merchants; your employer or the company through which you are utilizing the Extend services or applications; card networks such as Visa, MasterCard, or American Express; and other third parties with which you have authorized us to share information, such as your expense management platform.
• Third-party service providers to perform functions in connection with the Service, such as email marketing, site analytics, social sharing, relationship management, functions related to analyzing and improving the Service's usefulness, reliability, user experience, and operation, storing data, and as otherwise described in this Privacy Policy. Extend partners with third-party technology partners, including Astrada, to deliver transaction monitoring services. By registering a payment card in connection with transaction monitoring, you authorize Extend to share your payment card information with the Payment Card Networks. You authorize the Payment Card Networks to monitor transactions on your registered card(s) in order to enable your usage of real-time transaction data for all transactions made on an enrolled card linked through the Service. Notwithstanding anything to the contrary in the Terms and Conditions or Privacy Policy, Extend and its third-party service providers (including Astrada) will use transaction information solely as follows: To create a record of the transaction data and thereafter maintain and use data in connection with operating the Service; To provide information in order to respond to a request from a government authority or a payment organization involved in a transaction with you or a merchant. You may opt-out of this monitoring at any time by deleting your registered card(s). You authorize the sharing, exchange, and use of transaction data described above and herein by and among Extend and Extend's third-party service providers and applicable Payment Card Networks.
• Third-party business partners for their direct marketing and promotional purposes and so they can provide offers and services to you. For example, Extend may provide an opt-in box for customers to receive information that is sent by a third-party fulfillment house.
• Third-party business parties related to business changes if we become involved in a merger, acquisition, sale of assets, joint venture, securities offering, bankruptcy, reorganization, liquidation, dissolution, change of control, or other transaction, or if the ownership of all or substantially all of our shares, assets, or business otherwise changes, we may transfer your information to a third party or parties in connection therewith.
• Government authorities and other third parties if we believe that such disclosure is necessary to comply with the law or guidance and cooperate with government or law enforcement officials or private parties; investigate, prevent, or take action regarding suspected illegal activities, suspected fraud, the rights, reputation, safety, and property of us, users, or others, or violations of our policies or other agreements with us; respond to claims and legal processes (e.g., subpoenas); and/or protect against legal liability.

We may also share aggregated/de-identified information relating to users of the Service with affiliated or unaffiliated third parties. This information does not contain personal information about any user.

VI. Information Security

Extend is committed to the security of your information. To protect your personal information from unauthorized access and use, we implement and maintain reasonable security measures that are intended to maintain the confidentiality of personal information. However, no security measures are infallible. We cannot and do not guarantee that our safeguards will always work. Please always use caution when transmitting information over the Internet, use strong and unique passwords that you do not also use for other online services, and notify us immediately of any concerns with your account or passwords.

VII. International Transfers

We are based in the United States. Any information collected through the Service is stored and processed in the United States. The information you submit to us and that we collect as a result of using our Service will be transferred to the United States. By using the Service, products, and websites, you consent to the collection, international transfer, storage, and processing of your information. If you use our Service outside of the United States, you consent to having your data transferred to the United States.

VIII. California, Virginia, Connecticut, and Colorado Residents

Residents of certain United States states may have rights under those states' respective privacy laws (collectively known as "State Privacy Laws"). In addition, this section of our Privacy Policy is not applicable to personal information processed solely in the business-to-business context, for example, information about an individual acting in his or her capacity as a representative of a company and other data that is exempt from the requirements of these laws.

This Privacy Policy is reviewed annually and may be updated periodically.

Rights Under the State Privacy Laws: Individuals whose personal information is covered by the State Privacy Laws have the right, subject to certain limitations, to: (i) request, up to twice every 12 months, access to and information about personal information we collect and share about you; (ii) correct your personal information when incorrect, out of date or incomplete; and (iii) request that we delete the personal information we have collected from you.

Your Right to Request Disclosure of Information We Collect and Share About You: Individuals whose personal information is covered by the State Privacy Laws have a right to request that Extend provide the following information:

• The categories of personal information that Extend has collected about you.
• The categories of sources from which Extend collected the personal information.
• The business or commercial purposes for which Extend collected and/or sold the personal information.
• The categories of any third parties with which Extend shared the Personal information.
• The specific pieces of personal information Extend collected over the past year.

Such individuals may also submit a request to Extend for the following additional information:

• The categories of personal information, if any, Extend has sold about you, categories of third parties to which Extend sold that personal information, and the categories of personal information sold to each type of third party.
• The categories of personal information that we have disclosed for a business purpose.

Our responses to any of these requests will cover the 12-month period preceding our receipt of the request.

Right to Request the Deletion of Personal Information We Have Collected from You: Individuals whose personal information is covered by the State Privacy Laws may also request the deletion of information covered by the State Privacy Laws. Upon receiving and verifying such request, Extend will delete the personal information we have collected about you, unless that information is necessary for Extend to: complete the transaction for which we collected the information; provide you with a good or service you requested; perform a contract Extend entered into with you; detect security incidents; maintain the functionality or security of Extend's systems; comply with or exercise rights provided by the law; or use the information internally in ways that are comparable with the context in which you provided the information to Extend or that are reasonably aligned with expectations based on your relationship with Extend, among other things. We may also retain information where another exception to the deletion requirements may apply.

Please note that if you or your authorized agent request that your personal information be deleted, you may no longer be able to access or use certain parts of the Sites.

Process to Submit Requests for Access, Correction, or Deletion of Personal Information: If you are a resident of a state with a State Privacy Law, to exercise your right to request access to or deletion of your personal information, please submit a request via email to privacy-requests@paywithextend.com. Extend may request additional information confirming your identity if the request involves sensitive information. If you are making a request through an authorized agent on behalf of such a state resident, you may use the same submission method. As part of the verification process, we may request that you provide proof that you have been authorized by the resident on whose behalf you are making the request.

We will verify and respond to your request consistent with applicable law.

Our Process for Responding to Requests for Access, Correction or Deletion under State Privacy Laws: For requests for access or deletion, we will confirm receipt of the request within 10 business days and provide information on how we will respond to your request. We will respond to your request or your authorized agent's in writing, or verbally if requested, as soon as practicable and in any event generally not more than within 30 calendar days after receipt of the request. We may extend this period to 90 calendar days and, in the event that we do extend the period, we will explain to you or your authorized agent why we did so.

IX. European Residents: Your Privacy Rights

If you are a European Resident, you have the right to access your personal data, and the right to request that we correct, update, or delete your personal data. You can object to the processing of your personal information, ask us to restrict processing of your personal information, and request portability of your personal information. If we collected and processed your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent. If you have any questions or comments about the processing of your personal information, you may contact us at privacy-requests@paywithextend.com. For European Residents, please note that the personal information we obtain from or about you may be transferred, processed, and stored outside of the EEA or United Kingdom for the purposes of the Privacy Policy, including in the United States of America. We take the privacy of our users seriously and therefore take steps to safeguard your information, including ensuring an adequate level of data protection in accordance with E.U. and United Kingdom standards in effect as of the date of this Privacy Policy. These steps include use of Standard Contractual Clauses for transfers of personal information within Extend and with our third party, which require all companies to protect European Residents' personal information in accordance with applicable data protection laws.

For European Residents, our legal basis for collecting and using the information described above will depend on the specific information concerned and the context in which we collect it. We will only collect personal information from you only where we have your consent to do so, where we need to perform a service for you, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms.

X. Data Retention Policy, Managing Personal Information

We will retain your information for as long as you use the Service and for a reasonable time thereafter. Extend is a regulated entity and must retain order records under certain regulations. We may maintain anonymized or aggregated data, including usage data, for analytics purposes. We may retain and use your information as necessary to comply with our legal obligations, resolve disputes, and/or for the period required by laws in applicable jurisdictions. Please note that some or all the information we have collected may be required for the Service to function properly.

XI. Links to Other Services or Applications

This Privacy Policy applies only to the Service. The Service may contain links to other websites or apps or may forward users to other websites or apps that we may not own or operate and to which this Privacy Policy does not apply. The links from the Service do not imply that we endorse or have reviewed these websites or apps. The policies and procedures we describe here do not apply to these websites or apps. We neither can control nor are responsible for the privacy practices or content of these websites or apps. We suggest contacting these websites or app providers directly for information on their privacy policies. Nonetheless, we seek to protect the integrity of our Service and welcome any feedback about these linked websites and mobile applications.

XII. Minors' Privacy

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from an individual under age 13. If you are under the age of 13, please do not submit any personal information through the Service. If you have reason to believe that we may have accidentally received personal information from an individual under age 13, please contact us immediately at privacy-requests@paywithextend.com.

XIII. Terms and Conditions

Please also visit the Extend Terms & Conditions, which state the terms, disclaimers, and limitations of liability governing your use of the Service.

XIV. Contact Us

If you have any questions about our Privacy Policy or practices, please contact us:

• Email: privacy-requests@paywithextend.com
• Mailing Address: Extend, 50 West 23rd Street, New York NY 10010

The Privacy Policy was reviewed and approved by Extend Legal & Compliance.

Last updated April 17, 2026