CCPA Privacy Notice for California Residents

HGIJersey LLC Effective Date: February 23, 2026 Last Updated: February 23, 2026

This Privacy Notice for California Residents ("Notice") supplements the information contained in the Tack Privacy Policy and applies solely to visitors, users, and others who reside in the State of California ("consumers" or "you"). This Notice is provided pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA").

HGIJersey LLC ("Tack," "we," "us," or "our") operates the Tack mobile application ("App"), accessible at https://trytack.app. This Notice describes your rights under the CCPA and how to exercise them.

1. Categories of Personal Information Collected

We have collected the following categories of personal information from consumers within the last twelve (12) months:

Category Examples Business Purpose Third Parties Shared With
A. Identifiers Name, email address, unique personal identifier, IP address, account name, device identifiers Account creation and authentication; customer support; communications; fraud prevention Supabase (authentication & database), Firebase (push notifications & analytics), Google AdMob (advertising, device identifiers only)
B. Financial Information Bank account numbers (tokenized via Plaid), account balances, transaction history, account types, institution names Providing financial insights and analysis; generating savings comparisons; surfacing personalized information about your finances Plaid (bank data aggregation), Anthropic (insight generation — transaction data is sent without direct identifiers)
C. Internet or Other Electronic Network Activity Browsing history within the App, interaction with App features, search queries within the App, device type, operating system, app version Improving App functionality; analytics; debugging; personalizing user experience; serving relevant advertisements Firebase (analytics & crash reporting), Google AdMob (ad personalization), Supabase (event logging)
D. Geolocation Data Approximate location derived from IP address (city/region level only) Fraud prevention; compliance with applicable law; regional content relevance Firebase (analytics), Supabase (security logs)
E. Inferences Spending patterns, savings potential, financial health indicators, product suitability assessments Generating financial insights; surfacing relevant comparisons; improving recommendation relevance Anthropic (used as context for AI-generated insight generation)

Sources of Collection: - Directly from you: Information you provide when creating an account or contacting support. - From Plaid: Financial account data you authorize us to access through Plaid Link. - Automatically: Device information, usage data, and approximate geolocation collected through the App and our service providers (Firebase, Google AdMob). - Generated by us: Inferences drawn from the above categories to provide financial insights.

2. Business Purposes for Collection and Use

We collect and use personal information for the following business purposes:

3. Categories of Third Parties With Whom Data Is Shared

We share personal information with the following categories of third parties for the business purposes described above:

Third Party Type Data Shared Purpose
Plaid Inc. Financial data aggregator Bank credentials (tokenized), account and transaction data Securely connecting your bank accounts and retrieving financial data on your behalf
Anthropic (Claude AI) AI service provider Transaction summaries, account balances, spending patterns (without direct personal identifiers such as name or email) Generating natural-language financial insights and analysis
Google AdMob Advertising network Device identifiers, general usage data, approximate location Serving advertisements within the App
Google Firebase Analytics & infrastructure Device information, App usage data, crash reports, push notification tokens Analytics, crash reporting, push notification delivery
Supabase Cloud database & authentication Account information, user-generated data, application data User authentication, data storage, backend infrastructure

We may also share personal information with legal and regulatory authorities when required by law, and with professional advisors (attorneys, accountants) as needed to operate our business.

4. We Do Not Sell or Share Your Personal Information

We do not sell your personal information. HGIJersey LLC has not sold personal information of California consumers in the preceding twelve (12) months and has no plans to do so.

We do not "share" your personal information for cross-context behavioral advertising as that term is defined under the CCPA/CPRA, except to the extent that serving personalized advertisements through Google AdMob may constitute "sharing." You may opt out of personalized advertising at any time (see Section 5 below).

5. Your California Privacy Rights

Under the CCPA, California residents have the following rights:

Right to Know (Right to Access)

You have the right to request that we disclose the following to you, for the 12-month period preceding your request: - The categories of personal information we collected about you. - The categories of sources from which personal information was collected. - The business or commercial purpose for collecting or selling personal information. - The categories of third parties with whom we shared personal information. - The specific pieces of personal information we collected about you.

Right to Delete

You have the right to request that we delete personal information we have collected from you, subject to certain exceptions provided by law (for example, if the information is necessary to complete a transaction, detect security incidents, comply with a legal obligation, or for certain internal uses compatible with the context in which you provided the information).

Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you.

Right to Opt-Out of Sale or Sharing

As stated above, we do not sell your personal information. To the extent that personalized advertising through Google AdMob may constitute "sharing," you may opt out by: - Adjusting your ad personalization preferences in the App under Settings > Privacy > Ad Preferences. - Adjusting your device-level ad tracking settings (e.g., "Limit Ad Tracking" on iOS or "Opt out of Ads Personalization" on Android).

Right to Limit Use of Sensitive Personal Information

We only use sensitive personal information (financial account data) for purposes authorized under the CCPA, specifically to provide the services you have requested. You may request that we limit the use of sensitive personal information by contacting us at the address below.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Specifically, unless permitted by law, we will not: - Deny you goods or services. - Charge you different prices or rates for goods or services. - Provide you a different level or quality of goods or services. - Suggest that you may receive a different price or rate for goods or services, or a different level or quality of goods or services.

6. How to Exercise Your Rights

You may exercise your rights in the following ways:

Email

Submit a request to privacy@trytack.app with the subject line "CCPA Request" and specify the right(s) you wish to exercise.

In-App

Navigate to Settings > Account > Privacy Rights to submit a data access, deletion, or correction request directly within the App.

We will acknowledge receipt of your request within ten (10) business days and respond to verifiable consumer requests within forty-five (45) calendar days. If we need additional time (up to an additional 45 days), we will notify you in writing of the reason and the extended timeline.

7. Verification Process

To protect your privacy and security, we must verify your identity before fulfilling your request. Our verification process includes:

  1. Identity confirmation: We will ask you to confirm the email address associated with your Tack account. If you submit a request via the in-app settings while logged in, your identity is verified through your authenticated session.
  2. Additional verification for sensitive requests: For requests to access specific pieces of personal information, we may require you to re-authenticate by signing in to your account and confirming your request via a verification email sent to your registered email address.
  3. Inability to verify: If we cannot verify your identity to a reasonable degree of certainty, we will explain why and inform you of your options.

We will match at least two data points you provide with data points we maintain that we have determined to be reliable for verification purposes.

8. Authorized Agent

You may designate an authorized agent to make a request on your behalf. To do so:

  1. Provide the authorized agent with signed, written permission to act on your behalf.
  2. The authorized agent must submit the request to privacy@trytack.app, including proof of their authority to act on your behalf (such as a power of attorney or a signed written authorization from you).
  3. We may still require you to verify your identity directly with us before we fulfill the request.

If you have provided your authorized agent with a power of attorney pursuant to California Probate Code sections 4000 to 4465, we may not require additional written authorization or identity verification from you.

9. Data Retention

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, provide our services, and comply with our legal obligations. When personal information is no longer needed, we securely delete or anonymize it. For specific retention periods, please refer to our Data Deletion Policy.

10. Changes to This Notice

We may update this Notice from time to time. When we make material changes, we will notify you through the App or via email and update the "Last Updated" date at the top of this Notice. Your continued use of the App after such changes constitutes your acknowledgment of the updated Notice.

11. Contact Us

If you have questions about this Notice or your California privacy rights, please contact us at:

HGIJersey LLC Email: privacy@trytack.app Website: https://trytack.app