Donor Privacy Notice

This Privacy Notice explains how Roster Giving Inc. ("Roster," "we," "us," or "our") and our partner bank, [PARTNER_BANK_NAME] ("Partner Bank"), collect, use, share, and protect your personal information in connection with the Roster platform and your deposit account.

1. INFORMATION WE COLLECT

We collect the following categories of nonpublic personal information ("NPI"):

• Identity information: full name, date of birth, Social Security Number or ITIN, government-issued ID
• Contact information: email address, phone number, mailing address
• Employment & income information: employer or income-source name, pay frequency
• Account information: Roster account number, deposit account balance, transaction history
• Donation information: Recipient Church name, donation percentage, donation amounts, donation dates
• Device & access information: IP address, browser type, device identifier, login timestamps

Sources of information:

• Directly from you (during account registration and ongoing use)
• From your payroll or income source (through our integration partners)
• From our Partner Bank (account status, transaction data)
• Automatically from your device (when you access our platform)

Note on income data: we do not collect or receive your full paycheck or total income. Through the payroll integration we receive only your connection details (employer or income source, pay frequency) and the deposit amounts that fund your Roster account. Your actual pay amount remains in your employer's or platform's payroll system and is not queried by Roster.

2. HOW WE USE YOUR INFORMATION

We use your information to:

• Open and maintain your deposit account at our Partner Bank;
• Process your recurring donations as instructed;
• Verify your identity as required by law (BSA/AML/KYC);
• Communicate with you about your account and transactions;
• Comply with legal and regulatory obligations;
• Detect and prevent fraud, unauthorized transactions, and abuse;
• Provide customer support; and
• Improve and maintain the security of our platform.

We do not use your information to market third-party products to you.

3. INFORMATION WE SHARE

We share your information only as described below:

• Partner Bank ([PARTNER_BANK_NAME]): identity, account, transaction, and compliance data — to maintain your deposit account, process transfers, and satisfy banking regulations.
• Payroll integration partners: limited identity and employment data — to connect your payroll and initiate deposits.
• Recipient Church: your name, mailing address, email address, phone number, and donation amount — shared when your first gift to that church is sent, and kept current if you update your contact details — to facilitate your donation, enable tax receipts, and let your church know its members.
• Service providers: information necessary for the service they perform — under contract requiring confidentiality (e.g., identity verification, cloud hosting, customer support tools).
• Law enforcement or regulators: as required — when compelled by law, subpoena, court order, or regulatory request.

We do not sell your personal information. We do not share your information with nonaffiliated third parties for their own marketing purposes.

4. YOUR RIGHT TO OPT OUT

Because we do not share your NPI with nonaffiliated third parties for marketing purposes, there is no opt-out required under GLBA/Reg P at this time. If our sharing practices change in the future, we will provide you with an updated notice and a reasonable opportunity to opt out before any new sharing begins.

5. SENSITIVE PERSONAL INFORMATION (CALIFORNIA RESIDENTS)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) provides you with additional rights. Sensitive personal information we process: your selection of a Recipient Church may reveal or be used to infer your religious beliefs. Under CPRA, this constitutes "sensitive personal information" (Cal. Civ. Code §1798.121). Your right to limit use: you have the right to limit our use and disclosure of your sensitive personal information to what is necessary to perform the services you request. Because we already use your church selection solely to direct your donation as instructed — and for no other purpose — our current use is already limited to this necessary purpose. Limit the Use of My Sensitive Personal Information: www.rostergiving.com/privacy/limit-sensitive-info

6. YOUR PRIVACY RIGHTS

All donors:

• Access a copy of your information through your account at www.rostergiving.com
• Correct inaccurate information by contacting us
• Receive this Privacy Notice at account opening and annually thereafter

California residents (CCPA/CPRA) — when applicable:

• Right to know what personal information we collect, use, and disclose
• Right to delete your personal information (subject to legal exceptions)
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising your privacy rights

To exercise any of these rights, contact us at support@rostergiving.com or +1 (302) 621 8600. We will verify your identity before processing any request. We will respond within 45 days (or 90 days with notice of extension, as permitted by law).

7. HOW WE PROTECT YOUR INFORMATION

We maintain administrative, technical, and physical safeguards designed to protect your NPI, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256);
• Access controls limiting employee access to information necessary for their role;
• Multi-factor authentication for internal systems;
• Regular security assessments and monitoring;
• Contractual requirements on service providers to maintain comparable protections; and
• Incident response procedures in the event of a data breach.

8. DATA RETENTION

We retain your personal information for as long as your account is active, plus the period required by applicable law and our Partner Bank's retention policies. After account closure, we retain records for a minimum of 5 years to satisfy BSA/AML recordkeeping requirements and applicable statutes of limitation.

9. CHILDREN'S PRIVACY

The Roster platform is not directed to individuals under 18 years of age. We do not knowingly collect information from children.

10. CHANGES TO THIS NOTICE

We may update this Privacy Notice from time to time. If we make material changes, we will notify you at least 30 days in advance via email or in-app notification. The most current version is always available at www.rostergiving.com/donor-privacy.

11. CONTACT US

For questions about this Privacy Notice or your personal information: Roster Giving Inc. 131 Continental Dr, Suite 305, Newark, DE 19713 US support@rostergiving.com +1 (302) 621 8600

12. NOTICE AT COLLECTION

Before you create an account, we ask for your phone number and date of birth so we can verify it is really you. We use that information only to verify your identity and to secure your account. We do not sell it. This Notice describes everything we collect, why, and with whom we share it.