Privacy Policy

Introduction

Harvest App LLC ("Harvest," "we," "us," or "our") is a registered investment adviser committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile application, educational (Learn) services, investment advisory services (Invest), and Harvest for Advisors (collectively, the "Services").

Please read this Privacy Policy carefully. By using our Services, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy. Our Services are intended for U.S. persons. Harvest does not custody client assets; custody and brokerage are provided by independent qualified custodians, as described below.

Information We Collect

Personal Information You Provide

We collect personal information that you voluntarily provide when you register for an account, complete onboarding or identity verification, fund an account, contact us, or otherwise use the Services. Depending on the product you use, this may include:

• Name, email address, phone number, and mailing address
• Social Security Number (for tax reporting and identity verification)
• Date of birth and citizenship / residency information
• Employment information
• Financial information (income, net worth, investment objectives, risk tolerance, and other suitability responses)
• Bank account information for funding your investment account
• Government-issued identification (including images collected during identity verification)
• Trusted contact and beneficiary information, when you provide it
• Faith-based or values screening preferences used to align portfolios with biblically responsible investing criteria

Information from Third Parties

We may receive information about you from:

• Identity-verification and bank-linking providers (including Plaid), such as identity document results, watchlist / KYC outcomes, and linked-account details
• Sign-in providers (Google or Apple), such as name and email associated with that account
• Qualified custodians — account status, balances, holdings, transactions, tax documents, and related brokerage records
• Your referring advisor or advisory firm, if you are a Harvest for Advisors client

Automatically Collected Information

When you access our Services, we automatically collect certain information, including:

• Device information (type, operating system, unique device identifiers)
• IP address and approximate location derived from IP
• Browser type and version
• Usage data (pages visited, time spent, features used)
• Cookies and similar tracking technologies
• Mobile push-notification tokens, if you enable notifications, so we can send account and product messages

If you enable Face ID, Touch ID, or similar biometric unlock on our mobile app, that biometric data is processed by your device. Harvest does not receive or store your biometric templates.

How We Use Your Information

We use your information for the following purposes:

• To provide, operate, and maintain our Services
• To open and manage your investment or educational account
• To process transactions, deposits, withdrawals, and related notices
• To complete identity verification, CIP/KYC, and fraud prevention
• To assess suitability and assign or maintain a model portfolio
• To apply faith-based screening to holdings where that feature applies
• To comply with legal and regulatory requirements, including books-and-records rules
• To communicate with you about your account and our Services
• To provide customer support
• To send marketing communications (with your consent, where required)
• To improve and personalize our Services, including product analytics
• To diagnose errors and maintain the security of the Services

Information Sharing and Disclosure

We share your information with the following categories of recipients as needed to operate the Services. Harvest does not sell your personal information to third parties for marketing purposes.

• Qualified custodians and broker-dealers: Brokerage and custody will be provided by a qualified custodian. We share the information with your custodian as required to open, maintain, fund, trade, tax-report, and service your account. Your relationship with a custodian is also governed by that custodian's own agreements and privacy notices.
• Referring advisors and advisory firms: If you are onboarded through Harvest for Advisors, we share client, household, account, and portfolio information with your advisor and its representatives so they can serve you.
• Bank linking and identity verification: We use Plaid to connect bank accounts and, where applicable, to verify identity. Harvest does not receive your bank login credentials. Plaid's collection and use of information is described in Plaid's End User Privacy Policy.
• Payment processors: Stripe processes subscription and related payments. Harvest does not store full payment-card numbers.
• Communications providers: We use third party services to send transactional email, in-app, and mobile push messages, including using a device push token when you opt in.
• Infrastructure, analytics, and support: Cloud hosting and authentication, error monitoring, and customer-support tools to process information as needed to run and support the Services.
• Sign-in providers: If you choose Google or Apple sign-in, those providers authenticate you according to their own terms and privacy policies.
• Regulatory authorities: As required by law, including the SEC, state regulators, and tax authorities.
• Legal compliance: To comply with legal obligations, enforce our terms, or protect rights, safety, and the integrity of the Services.
• Professional service firms: To help us comply with our legal and regulatory obligations and establish, enforce, and otherwise exercise our rights and defend against claims, including, for example, auditors, law firms, and consultants.
• Business transfers: In connection with a merger, acquisition, or sale of assets, subject to appropriate confidentiality protections.

Data Security

We implement technical and organizational measures designed to protect personal information, including encryption in transit (TLS), access controls, and encryption of certain sensitive fields at rest. Harvest for Advisors requires multi-factor authentication for advisor login. Consumer accounts use password, magic-link, or third-party sign-in, and may use on-device biometric unlock. No method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

Data Retention

We retain personal information for as long as your account is active and thereafter as required by securities, tax, and other recordkeeping laws applicable to registered investment advisers (typically at least five years after the information is created or last used, and longer where a custodian, regulator, or legal hold requires it). We then delete or de-identify information when we no longer have a legal or operational need to keep it.

Your Rights and Choices

You have the right to:

• Access and review your personal information
• Request correction of inaccurate information
• Request deletion of your personal information (subject to legal requirements)
• Opt out of marketing communications
• Disable cookies through your browser settings
• Disable push notifications in your device or in-app settings

Some information cannot be deleted while we are required to retain it for regulatory recordkeeping or to complete a pending transaction. To exercise these rights, please contact us at privacy@harvest-app.co.

California Privacy Rights

California residents have additional rights under the California Consumer Privacy Act (CCPA), as amended by the CPRA, including the right to know the categories of personal information we collect and the purposes for which we use it, the right to delete personal information (subject to legal exceptions), the right to correct inaccurate information, and the right to opt out of the sale or sharing of personal information for cross-context behavioral advertising. Harvest does not sell personal information, and we do not share personal information for cross-context behavioral advertising. We may collect sensitive personal information (such as Social Security Number, government ID, financial account information, and, where you provide them, faith-based investing preferences) only as reasonably necessary to provide the Services and meet legal obligations.

Virginia Privacy Rights

Harvest App LLC is based in Virginia. Virginia residents may have additional rights under the Virginia Consumer Data Protection Act (VCDPA), including the right to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling. We do not sell personal data or engage in targeted advertising as those terms are defined in the VCDPA. To exercise VCDPA rights, contact privacy@harvest-app.co.

Children's Privacy

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will delete that information promptly, subject to any legal retention requirements.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last Updated" date. When we make material changes, we will ask existing users to review and accept the updated policy before continuing to use the Services. We encourage you to review this Privacy Policy periodically.