Privacy Policy

I. Introduction

Please read carefully this Extend Enterprises Privacy Policy (the "Privacy Policy"), which is part of the Extend Terms and Conditions, before you access, download, or otherwise use our websites, use related other parties' websites, use any of our mobile applications, use our APIs, or otherwise interact with us, whether offline or online (collectively, the "Service").

This Privacy Policy applies to Extend Enterprises, Inc. ("Extend", "we", "us" or "our"). This Privacy Policy is part of the Extend Terms & Conditions. Any terms defined in the Terms & Conditions shall have the same meaning in this Privacy Policy. This Privacy Policy pertains to your accessing and using our websites, mobile applications, or APIs, and your interactions with us, without limitation, and it describes the information collected through your use of our Service, how we use your data, how we share it, how we protect it, and the choices you can make about your information.

By using the Service, you accept and agree to be bound by this Privacy Policy in full. If you do not accept this Privacy Policy, do not use the Service. You acknowledge that (a) you have read and understood this Privacy Policy; and (b) this Privacy Policy shall have the same force and effect as a signed agreement. Unless explicitly stated otherwise, any new features that augment or enhance the current Service shall be subject to this Privacy Policy.

We reserve the right to update or modify this Privacy Policy at any time without prior notice. We will update this page to reflect any changes to this Privacy Policy. Please review this Privacy Policy periodically, and especially each time you use the Service and before you provide any information. This Privacy Policy was made effective on the date indicated above.

II. Sensitive Information

Unless we specifically request or invite it, we ask that you not send us, and you not disclose, any sensitive personal information on or through the Service or otherwise to us. For purposes of this Privacy Policy, "sensitive information" includes, but is not limited to, the following: Social Security numbers, information related to racial or ethnic origin, political opinions, religion or philosophical beliefs, health, sex life or sexual orientation, criminal background, or biometric or genetic data for the purpose of uniquely identifying an individual.

III. Personal Information We Collect

We may collect information from you when you use the Service, contact or interact with us, sign up for our mailing list, register for an account, and voluntarily provide us with your comments and other content in connection with using the Service.

As part of your access to and use of the Service, we may receive and collect your name, email address, phone number, professional designation, and any other information you voluntarily provide on the Service.

When you register for a user account, we will collect: your first name, last name, a valid phone number, a valid email address, and your chosen user ID and password. If you register an eligible credit product within Extend, we will ask you for your credit product information including the billing address associated with that account, and we may display some of that information in the Extend application. Also, each time you request to create or use a virtual card number, the virtual card number information will be displayed in the Extend application, including a CVV or security code, along with the billing address of the registered card, which some merchants may require be included as part of a purchase transaction. At the time you make a transaction or attach receipts in our service, the transaction data and receipts will be made visible to both the cardholder and the recipient.

When you access and use the Service, we automatically collect information regarding you and your device, including information provided to us by your browser (such as the website you came from (known as the referring URL), any Extend online advertisements located on third party websites that you may have clicked on to access one of the Extend websites, the type of browser you use and the time and date of access) and your user name, permissions for the Service, device's Internet Protocol address, the domain name of your Internet service provider, your location, your mobile device information (e.g., device model and operating system version), your page visits, your social sharing activity, and aggregated information that cannot be used to specifically identify you. Additional information collected is described in the Analytics and Cookies sections.

We may combine all the information we collect from or about you and use it in the manner described in this Privacy Policy. Please note that Extend does not and will not sell or rent your personally identifiable information to third parties.

Information Collected From Other Services and Mobile Applications and Do Not Track Policy

Your browser or device may offer you a "Do Not Track" option, which allows you to signal to operators of websites, web applications, mobile applications, and services (including behavioral advertising services) that you do not wish such operators to track certain of your online activities over time and/or across different websites or applications. Our Service does not support Do Not Track requests at this time, which means that we or our analytics providers or other third parties with which we are working may collect information about your online activity both during and after your use of the Service.

IV. How We Use Personal Information

The purposes for which we may use the information that we collect may include:

• Providing information and services to you;
• Connecting with your social media accounts and sharing information with you, if you choose to connect with our social media accounts;
• Processing and responding to your inquiries and comments;
• Contacting you for market research purposes and to use this information to customize the Service according to your interests;
• Personalizing and enhancing your experience using the Service;
• Sending periodic emails. If you choose, the email address you provide may be used to send you occasional news, updates, related product, or service information, etc. If at any time you would like to unsubscribe from receiving future emails, we include detailed unsubscribe instructions at the bottom of each email;
• Analyzing the accuracy, effectiveness, usability, or popularity of the Service;
• Preventing fraud and abuse of the Service and to otherwise protect users and visitors and our business;
• Assisting law enforcement and responding to court orders and legal investigations;
• Complying with applicable regulations, statutes, and laws;
• Performing other business activities as needed, or as described elsewhere in this Privacy Policy;
• Transferring information in the event of a merger, transfer of assets, or other organizational restructuring; and
• As explained elsewhere in this Privacy Policy, personal information we collect may be processed by our service providers in providing services related to the Service (such as administration services, technical services relating to the maintenance, servicing, and upgrading of products, software, hosting services, customer service, data migration services, and analytical services, among others).

V. How We May Share Personal Information

Information may be disclosed to third parties in accordance with our Privacy Policy. Please note that a user may choose not to share certain information as described in this Privacy Policy. As described further below, we may share your personal information with the following types of entities:

• The financial institution that provides the cardholder with the credit product used in the Service; merchants; your employer or the company through which you are utilizing the Extend services or applications; card networks such as Visa, MasterCard or American Express; and other third parties with which you have authorized us to share information, such as your expense management platform.
• Third-party service providers to perform functions in connection with the Service, such as email marketing, site analytics, social sharing, relationship management, functions related to analyzing and improving the Service's usefulness, reliability, user experience, and operation, storing data, and as otherwise described in this Privacy Policy.
• Government authorities and other third-parties if we believe that such disclosure is necessary to comply with the law or guidance and cooperate with government or law enforcement officials or private parties; investigate, prevent, or take action regarding suspected illegal activities, suspected fraud, the rights, reputation, safety, and property of us, users or others, or violations of our policies or other agreements with us; respond to claims and legal process (e.g., subpoenas); and/or protect against legal liability.

We may also share aggregated/de-identified information relating to users of the Service with affiliated or unaffiliated third parties. This information does not contain personal information about any user.

VI. Information Security

Extend is committed to the security of your information. To protect your personal information from unauthorized access and use, we implement and maintain reasonable security measures that are intended to maintain the confidentiality of personal information. However, no security measures are infallible. We cannot and do not guarantee that our safeguards will always work. Please always use caution when transmitting information over the Internet, use strong and unique passwords that you do not also use for other online services, and notify us immediately of any concerns with your account or passwords.

VII. International Transfers

We are based in the United States. Any information collected through the Service is stored and processed in the United States. The information you submit to us and that we collect as a result of using our Service will be transferred to the United States. By using the Service, products, and websites, you consent to the collection, international transfer, storage, and processing of your information. If you use our Service outside of the United States, you consent to having your data transferred to the United States.

VIII. California, Virginia, Connecticut and Colorado Residents

Residents of certain United States states may have rights under those states' respective privacy laws (collectively known as "State Privacy Laws"). In addition, this section of our Privacy Policy is not applicable to personal information processed solely in the business-to-business context, for example, information about an individual acting in his or her capacity as a representative of a company, and other data that is exempt from the requirements of these laws.

This Privacy Policy is reviewed annually and may be updated periodically.

Rights Under the State Privacy Laws: Individuals whose personal information is covered by the State Privacy Laws have the right, subject to certain limitations, to: (i) request, up to twice every 12 months, access to and information about personal information we collect and share about you; (ii) correct your personal information when incorrect, out of date or incomplete; and (iii) request that we delete the personal information we have collected from you.

Process to Submit Requests for Access, Correction or Deletion of Personal Information: If you are a resident of a state with a State Privacy Law, to exercise your right to request access to or deletion of your personal information, please submit a request via email to privacy-requests@paywithextend.com. Extend may request additional information confirming your identity if the request involves sensitive information. If you are making a request through an authorized agent on behalf of such a state resident, you may use the same submission method. As part of the verification process, we may request that you provide proof that you have been authorized by the resident on whose behalf you are making the request.

IX. European Residents: Your Privacy Rights

If you are a European Resident, you have the right to access your personal data, and the right to request that we correct, update, or delete your personal data. You can object to the processing of your personal information, ask us to restrict processing of your personal information, and request portability of your personal information. If we collected and processed your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent. If you have any questions or comments about the processing of your personal information, you may contact us at privacy-requests@paywithextend.com. For European Residents, please note that the personal information we obtain from or about you may be transferred, processed, and stored outside of the EEA or United Kingdom for the purposes of the Privacy Policy, including in the United States of America. We take the privacy of our users seriously and therefore take steps to safeguard your information, including ensuring an adequate level of data protection in accordance with E.U. and United Kingdom standards in effect as of the date of this Privacy Policy. These steps include the use of Standard Contractual Clauses for transfers of personal information within Extend and with our third party, which require all companies to protect European Residents' personal information in accordance with applicable data protection laws.

X. Data Retention Policy, Managing Personal Information

We will retain your information for as long as you use the Service and for a reasonable time thereafter. Extend is a regulated entity and must retain order records under certain regulations. We may maintain anonymized or aggregated data, including usage data, for analytics purposes. We may retain and use your information as necessary to comply with our legal obligations, resolve disputes, and/or for the period required by laws in applicable jurisdictions. Please note that some or all the information we have collected may be required for the Service to function properly.

XI. Links to Other Services or Applications

This Privacy Policy applies only to the Service. The Service may contain links to other websites or apps or may forward users to other websites or apps that we may not own or operate and to which this Privacy Policy does not apply. The links from the Service do not imply that we endorse or have reviewed these websites or apps. The policies and procedures we describe here do not apply to these websites or apps. We neither can control nor are responsible for the privacy practices or content of these websites or apps. We suggest contacting these websites or app providers directly for information on their privacy policies.

XII. Minors' Privacy

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from an individual under age 13. If you are under the age of 13, please do not submit any personal information through the Service. If you have reason to believe that we may have accidentally received personal information from an individual under age 13, please contact us immediately at privacy-requests@paywithextend.com.

XIII. Terms and Conditions

Please also visit the Extend Terms & Conditions, which state the terms, disclaimers, and limitations of liability governing your use of the Service.

XIV. Contact Us

If you have any questions about our Privacy Policy or practices, please contact us:

• Email: privacy-requests@paywithextend.com
• Mailing Address: Extend, 50 West 23rd Street, New York NY 10010

The Privacy Policy was reviewed and approved by Extend Legal & Compliance.

Last updated March 31, 2025