U.S. State Privacy Notice

Effective September 13, 2026

Published by NAS Innovation LLC, a Massachusetts limited liability company, 82 Wendell Ave Ste 100, Pittsfield, MA 01201.

---

1. About This Notice

This notice describes the privacy rights we extend to U.S. residents and how to exercise them. It is maintained separately from our Privacy Policy; both describe the same practices.

Bao Budget is a financial institution for purposes of the Gramm-Leach-Bliley Act, because we access consumer account and transaction data through a bank aggregation provider. Some state privacy laws exempt such businesses in whole or in part. Rather than apply a different process in every state, we extend the rights set out in §4 to every U.S. resident wherever we reasonably can.

Read this notice alongside our Privacy Policy, which describes what we collect and why, and our GLBA / Regulation P Privacy Notice, which describes our financial-information sharing practices.

---

2. Categories of Personal Information We Collect

California requires the statutory category labels set out at Civil Code §1798.140(v)(1)(A)–(K). We use them as written.

We do not collect device GPS location, biometric information, or sensory data. The geolocation we hold is the city and region your financial institution attaches to a transaction. Our Privacy Policy describes the sources of each category and the purposes for which we use it.

---

3. Categories of Third Parties We Share With

We disclose personal information to the following categories of recipients, each of which is engaged to perform services for us:

• our bank data aggregation provider;
• our payment processor;
• our cloud hosting and infrastructure providers;
• our analytics and performance-monitoring providers;
• our email delivery provider;
• our error-monitoring and customer support providers; and
• our professional advisers, and law enforcement or regulators where the law requires it.

Our Privacy Policy names the individual providers behind these categories. We do not disclose personal information to third parties for their own purposes.

---

4. Your Rights

Subject to your state's law and to verification, you may:

1. Know and access. Request the categories and specific pieces of personal information we have collected about you, the sources, the purpose, and the categories of third parties to whom we disclose it.
2. Obtain a copy. Receive a copy of your personal information in a portable, machine-readable format.
3. Delete. Request that we delete personal information we have collected about you. See §9.
4. Correct. Request that we correct inaccurate personal information about you.
5. Opt out of sale, sharing, and targeted advertising. We do not sell or share personal information and we do not conduct targeted advertising, so there is nothing to opt out of. See §5.
6. Limit the use of sensitive personal information. See §7.
7. Opt out of profiling that produces legal or similarly significant effects. We do not conduct such profiling. See §8.
8. Non-discrimination. We will not deny you service, charge you a different price, or give you a lower quality of service because you exercised a privacy right.
9. Appeal. If we decline your request, you may appeal. See §4.3.

4.1 How to Submit a Request

Email privacy@baobudget.com. You do not need a Bao Budget account to use that address, so a former user whose account has been deleted can still reach us.

Signed in, you can also export your data and delete your account directly in the product. A public account-deletion page is available at https://app.baobudget.com/delete-account and is reachable while signed out, so it remains open to a user who has lost access to their account.

4.2 Verification and Authorized Agents

We will verify your identity before acting on a request, in a manner proportionate to what you have asked for. For a request made by email we may ask you to confirm information we already hold, or to send the request from the email address on your account.

You may designate an authorized agent to submit a request on your behalf; we will ask for written authorization signed by you, or a valid power of attorney, and may verify your identity directly with you.

4.3 Response Times and Appeals

We will acknowledge and respond within the period your state's law requires — generally 45 days, with a single extension of up to a further 45 days where reasonably necessary, and we will tell you if we extend.

If we decline your request we will state the reason and explain how to appeal. Reply to our response, or write to us again, saying that you are appealing. We will respond to an appeal within the period your state's law requires — generally 60 days — and if we deny the appeal we will give you a method of contacting your state Attorney General.

---

5. We Do Not Sell or Share Your Personal Information

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We do not use your financial data for advertising. We have not sold or shared personal information in the preceding twelve months.

Bao Budget is funded by subscriptions. There is no advertising technology, attribution technology, or data-broker integration anywhere in the product.

---

6. Opt-Out Preference Signals and Do Not Track

Global Privacy Control. We honor the Global Privacy Control (GPC) opt-out preference signal on the Bao Budget web application. When your browser sends it, we record your do-not-sell-or-share and analytics opt-out preferences, and our analytics providers are not loaded. GPC is a signal sent by a browser: the Bao Budget mobile apps do not receive it, and our marketing site is hosted separately and is not served by the web application.

Do Not Track. We do not respond to browser Do Not Track signals, because no common standard for interpreting them was ever settled. This disclosure is made under California Business and Professions Code §22575(b)(5). Do Not Track and Global Privacy Control are not interchangeable, and we treat them differently.

---

7. Sensitive Personal Information

We treat the access credentials for your connected financial accounts as sensitive personal information. California Civil Code §1798.140(ae)(1)(B) covers credentials allowing access to an account, and New Jersey expressly classifies financial account credentials as sensitive data.

• We never see or store your bank username or password. You authenticate directly with your institution through our aggregation provider's hosted flow. What we hold is an access token issued to us.
• No account numbers, routing numbers, account masks, Social Security numbers, or tax identification numbers exist anywhere in our database.
• Access tokens and multi-factor authentication secrets are additionally encrypted at the application layer with per-record keys. Other data is protected by our database provider's encryption at rest and by TLS in transit.

Transaction data is not, by itself, sensitive personal information under the California definition. We still treat it as confidential, and we do not use it for advertising or sell it.

We use sensitive personal information only to provide the service you asked for: connecting your accounts, importing your transactions, and securing your account. We do not use or disclose it to infer characteristics about you. Because our use is limited to purposes for which the right to limit does not apply, there is nothing further to limit — but if you ask us to limit, we will confirm in writing exactly what we use it for.

---

8. Automated Decision-Making and Profiling

We do not make decisions about you that produce legal or similarly significant effects. California's rules define a significant decision as one concerning the extension of credit, the transmission of funds, deposit or checking accounts, check cashing, or installment plans. Bao Budget does none of these: we are read-only, we cannot move money, and we do not lend.

Bao Budget produces budgets, categorizations, projections and progress indicators. These are informational outputs; they determine nothing about your access to credit or financial services.

---

9. Deletion and Export

Deletion. When you delete your account we attempt to revoke the connection to your financial institution, deactivate your account immediately, and permanently delete your data 30 days later. The 30-day window exists so that an accidental or coerced deletion can be recovered.

Some records survive a deletion: security audit records, so that the log of who did what remains tamper-evident; records subject to a legal hold; and information we are required to keep for tax, accounting or anti-fraud purposes, including information held by our payments processor under its own obligations.

Inactive accounts. If your account is inactive for three years we email you a warning, and if it is still inactive 30 days later we permanently delete the account and all of its data.

Export. You can export your data from within Bao Budget in a machine-readable format. If you need information the export does not contain, ask us at privacy@baobudget.com and we will provide it.

Disconnecting a financial institution stops new data from flowing in; it does not delete the history already imported, because your budgets, goals and projections are built on that history. Deleting your account deletes it.

---

10. California-Specific Disclosures

10.1 Notice at Collection

At or before the point of collection, California requires us to disclose what we collect, why, whether it is sold or shared, and how long we keep it.

• Categories collected: those marked "Yes" in §2.
• Purposes: to create and secure your account; to connect your financial accounts and import and categorize your transactions; to build your budgets, goals and projections; to bill your subscription; to support you; to measure and improve the product; and to meet our legal obligations.
• Sensitive personal information: collected as described in §7 and used only for the purposes stated there.
• Sold or shared: no. See §5.
• How long we keep it: for as long as your account is active, subject to the inactive-account rule in §9. If you ask us to delete your account, 30 days and then permanent deletion. Analytics data is kept for the period our analytics providers' plans allow; those periods are set by the providers and are not retention periods we configure.

10.2 "Do Not Sell or Share My Personal Information"

We do not display this link. California's regulations permit a business to omit it where the business states that it does not sell or share personal information, which we state in §5. If that ever changes, the link will be displayed.

10.3 Shine the Light (Civil Code §1798.83)

We do not disclose personal information to third parties for their own direct marketing purposes.

10.4 CalOPPA (Business and Professions Code §22575)

CalOPPA applies to us regardless of our size. The categories of personal information we collect are in §2 and the categories of third parties with whom we share it are in §3; our effective date is at the top of this document; how we notify you of material changes is in §11; and our treatment of Do Not Track is in §6.

Cal. Bus. & Prof. Code §22575(b)(2) requires us to describe the process by which you may review and request changes to your information. That process is:

• Review. Sign in and use the in-app data export, or ask us at privacy@baobudget.com for anything the export does not contain.
• Request changes. Edit your account and financial records directly in the product, or exercise the correction right in §4 by writing to privacy@baobudget.com.
• Deletion. Use the in-app account deletion control, or write to privacy@baobudget.com.

Requests made by email are handled on the timetable and appeal terms in §4.3.

We do not permit third parties to collect personal information about you across different websites over time for advertising purposes. Our analytics providers measure activity on Bao Budget properties only.

10.5 Security Contact

Vulnerability reports and suspected breaches are coordinated through security@baobudget.com and handled under our incident-response runbook.

---

11. Changes to This Notice

We will update this notice as state privacy laws change or as our practices change. Every version carries a version number and an effective date, and previous versions appear in the changelog below, so that we can always show what a given user was told on a given day.

If we make a material change, we will notify you by email to the address on your account at least 30 days before the change takes effect, matching Terms of Service §22.

---

12. Contact

Privacy requests and questions: privacy@baobudget.com Postal: 82 Wendell Ave Ste 100, Pittsfield, MA 01201

To ask about the personal information of a person under 13, or to request its deletion, contact us at the address above and state that you are a parent or guardian.

---

13. Changelog

---