Dino Privacy Policy

This Privacy Policy applies to Personal Information we process in connection with our websites (including dino.id), our dashboard, our APIs, and any other products and services we offer (collectively, the "Services"). "Personal Information" in this Policy means information about you, including your identity, contact details, financial information, and online behavior.

This Privacy Policy does not apply to:

• Enterprise Data. Any Personal Information or other data that we process on behalf of our enterprise or business customers ("Enterprise Data") as a service provider or data processor. Our processing of Enterprise Data is governed by contracts we have in place with our customers, not this Privacy Policy. Any questions or requests relating to the privacy practices of our customers should be directed to the applicable customer.
• Workers and applicants. Details about how we process Personal Information of employees, contractors, or job applicants at Dino are covered in a separate workforce privacy notice.

This Privacy Policy is incorporated into our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

The categories of Personal Information we collect depend on how you interact with us, our Services, and the requirements of applicable law. We endeavor to collect information only relevant for our business needs. We collect information that you provide to us directly, information we obtain automatically when you use our Services, and information from other sources such as third-party services and organizations, as described below.

We use your Personal Information for a variety of business purposes, including to provide our Services, for administrative purposes, and to market our products and Services, as described below.

We disclose your Personal Information to third parties for a variety of business purposes, including to provide our Services, at your request or with your permission, to protect us or others, or in the event of a major business transaction, as described below.

Your privacy choices

The privacy choices you may have about your Personal Information are determined by applicable law and are described below.

• Email communications. If you receive an unwanted email from us, you can use the unsubscribe link found at the bottom of the email to opt out of receiving future promotional emails. Note that you will continue to receive transaction-related emails regarding products or Services you have requested. We may also send you certain non-promotional communications regarding our Services, and you will not be able to opt out of those communications (e.g., communications regarding our Services or updates to our Terms of Service or this Privacy Policy).
• "Do Not Track" / "Global Privacy Control." Do Not Track ("DNT") is a privacy preference that users can set in certain web browsers. Additionally, some browsers or plug-ins offer a "Global Privacy Control" ("GPC"), which you can learn more about at globalprivacycontrol.org. Please note that we do not respond to or honor DNT signals. However, if we detect a GPC signal from your device, we will interpret it as a request to stop or limit the sale or sharing of Personal Information for certain purposes, depending on the circumstances and law applicable to your jurisdiction.
• Cookies. You may stop or restrict the placement of Technologies on your device or remove them by adjusting your preferences as your browser or device permits. However, if you adjust your preferences, our Services may not work properly.
• Connected integrations. You can disconnect Gmail, Microsoft Outlook, and other third-party integrations at any time from within your account settings. Upon disconnection, we will cease accessing new data from those integrations.

Your privacy rights

Depending on where you live, you may be entitled to exercise certain privacy rights related to your Personal Information. If you would like to exercise any privacy rights granted to you under applicable law, please contact us at any time. We will process such requests in accordance with applicable laws and will not discriminate against you for exercising any privacy rights to which you are legally entitled. To protect your privacy, we will take steps to reasonably verify your identity before fulfilling your request.

• Right to access and portability of Personal Information about you, including: (i) confirming whether we are processing your Personal Information, and (ii) obtaining access to, or a copy of, Personal Information we may hold about you.
• Right to request correction of your Personal Information where it is inaccurate, incomplete, or outdated. In some cases, we may provide self-service tools that enable you to update your Personal Information directly.
• Right to request deletion of your Personal Information when processing is based on your consent or when processing is unnecessary, excessive, or noncompliant, subject to applicable law and our legal obligations (including banking and financial recordkeeping requirements).
• Right to request restriction of or object to our processing of your Personal Information where the processing is based on our legitimate interest or for direct marketing purposes, including (i) the right to opt out of the sharing of Personal Information, (ii) the right to object to or restrict our use of your sensitive Personal Information, and (iii) the right to opt out of the processing of your Personal Information for targeted advertising and profiling.
• Right to withdraw your consent to our processing of your Personal Information. Please note that your withdrawal will only take effect for future processing and will not affect the lawfulness of processing before the withdrawal. If you withdraw consent to processing, you may not be able to use aspects of the Services.
• Right to work with an authorized agent. Only you, or someone legally authorized to act on your behalf, may make a verifiable request related to your Personal Information. To designate an agent, please provide written authorization signed by you and contact us for additional instructions.
• Right to file a complaint. If your Personal Information is subject to certain data protection laws, you have the right to lodge a complaint with the competent supervisory authority if you believe our processing of your Personal Information violates applicable law.

To submit a privacy request, email support@dino.id with "Privacy Request" in the subject line, and include your state of legal residence, sufficient identifying information, and a clear description of your request.

We take steps to ensure that your information is treated securely and in accordance with this Privacy Policy. We use administrative, technical, and physical measures designed to protect Personal Information against unauthorized access, use, disclosure, alteration, or destruction, including:

• Encryption in transit (TLS) and at rest
• Access controls and role-based permissions for employees
• Regular security assessments and vulnerability management
• Incident response and breach notification procedures

Unfortunately, no system is 100% secure, and we cannot ensure or warrant the security of any information you provide to us. By using our Services or providing Personal Information to us, you agree that we may communicate with you electronically regarding security, privacy, and administrative issues relating to your use of our Services. If we learn of a security system breach, we may attempt to notify you electronically by posting a notice on our Services, by mail, or by sending an email to you.

We store the Personal Information we collect as described in this Privacy Policy for as long as you use our Services or as necessary to fulfill the purpose(s) for which it was collected. Retention periods vary by data type and applicable legal requirements. In particular, we retain information as necessary to:

• Provide the Services and maintain your account
• Meet banking, financial services, and tax recordkeeping obligations under applicable law (which may require retention for five years or longer)
• Comply with AML, sanctions, and other regulatory requirements
• Resolve disputes, establish legal defenses, and conduct audits
• Pursue legitimate business purposes and enforce our agreements

When we no longer have a legitimate business or legal need to retain Personal Information, we will delete or anonymize it. You may request deletion subject to our legal obligations to retain certain records, as described in Section 5.

We are based in the United States. All information processed by us may be transferred, processed, and stored anywhere in the world, including, but not limited to, the United States or other countries, which may have data protection laws that are different from the laws where you live. We endeavor to safeguard your information consistent with the requirements of applicable laws.

If we transfer Personal Information which originates in the European Economic Area (EEA), Switzerland, or the United Kingdom to a country that has not been found to provide an adequate level of protection under applicable data protection laws, we use appropriate safeguards such as the EU Standard Contractual Clauses (SCCs), as supplemented by country-specific annexes where applicable, or other mechanisms recognized under applicable law.

If you access the Services from outside the United States, you consent to the transfer of your information to the United States and other countries where we and our service providers operate.

Where the General Data Protection Regulation (GDPR) or similar laws in the United Kingdom or Switzerland apply to our processing of your Personal Information, we rely on one or more of the following legal bases:

• Performance of a contract. Processing is necessary to provide the Services you have requested, to fulfill our contractual obligations to you, or to take steps at your request before entering into a contract.
• Legitimate interests. Processing is necessary for our legitimate interests (such as security, fraud prevention, service improvement, and direct marketing) where those interests are not overridden by your data protection rights and interests.
• Legal obligation. Processing is necessary to comply with our legal obligations, including AML, sanctions, banking regulatory requirements, and applicable tax law.
• Consent. Where we rely on your consent as a legal basis for processing, you have the right to withdraw your consent at any time. This does not affect the lawfulness of processing carried out before your withdrawal.

If you are located in the EEA, UK, or Switzerland and wish to exercise your rights, have a complaint, or would like information about our legal bases for specific processing activities, please contact us at support@dino.id. EEA residents may also lodge a complaint with the data protection authority in their country of residence.

Dino's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect your Gmail or Microsoft Outlook account to Dino, we access your mailbox data solely to identify and extract invoices, receipts, and related financial documents to help you manage your business finances. We handle your data as follows:

• We use mailbox data only to provide the receipt and invoice extraction features you have requested, not for advertising or any purpose unrelated to your financial workflows.
• We do not sell mailbox data to third parties.
• We do not use mailbox data to develop, improve, or train generalized AI or machine learning models.
• We access only the minimum data necessary to provide the features you have enabled.
• You can disconnect your Gmail or Microsoft integration at any time from your account settings. Upon disconnection, we will stop accessing new data from those integrations.

Our Services are designed for businesses and business users and are not directed to persons under 18 years of age. We do not knowingly collect Personal Information from children under the age of 13. If you are a parent or guardian and believe your child has provided us with their Personal Information without your consent, please contact us at support@dino.id. We will delete any Personal Information we may have inadvertently collected from your child unless we have a legal obligation to keep it.

We may revise this Privacy Policy from time to time at our sole discretion. If there are any material changes to this Privacy Policy, we will notify you as required by applicable law — for example, by posting a notice in the Services dashboard, sending an email to the address associated with your account, or updating the "Last Updated" date at the top of this page.

You understand and agree that you will be deemed to have accepted the updated Privacy Policy if you continue to use our Services after the new Privacy Policy takes effect. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

Dino Technologies, Inc. is the controller of the Personal Information we process under this Privacy Policy. If you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise your rights as detailed in this Privacy Policy, please contact us:

This section provides additional disclosures required by California law, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and applies to residents of California and, where feasible, we extend equivalent rights to all U.S. users.

Categories of personal information collected (last 12 months)

Sources of personal information

We collect Personal Information directly from you when you interact with us, automatically when you use our Services (for example through cookies and other online technologies), and from third parties such as banking partners, identity verification providers, and integrations you authorize.

Business purposes for collecting personal information

We collect Personal Information to:

• Provide our Services to you
• Meet AML, KYC/KYB, banking regulatory, and legal compliance obligations
• Prevent fraud, ensure security, and protect our platform
• Communicate with you and provide customer support
• Improve and develop our Services
• Marketing and advertising our Services, with opt-out rights

Your California rights

• Right to know. You have the right to know what Personal Information we collected, used, disclosed, sold, or shared about you over the past 12 months.
• Right to delete. You have the right to request deletion of Personal Information we collected from you, subject to legal exceptions (including our banking and financial recordkeeping obligations).
• Right to correct. You have the right to request correction of inaccurate Personal Information we maintain about you.
• Right to opt out. We do not sell or share Personal Information for cross-context behavioral advertising. No opt-out is required because we do not engage in such activities.
• Right to limit sensitive personal information. You have the right to request that we limit our use and disclosure of sensitive Personal Information to purposes permitted by the CPRA. We use sensitive Personal Information only to provide the Services, prevent fraud, ensure security, and comply with law.
• Right to non-discrimination. We will not discriminate against you for exercising any of the rights described in this section.

Authorized agents

Agents may submit requests on your behalf by providing written authorization signed by you and proof of their authority to act on your behalf. We may require direct verification from you as well. To submit a California privacy request, email support@dino.id with "California Privacy Request" in the subject line. We will respond within the timeframes required by the CCPA and CPRA.

California "Shine the Light"

The California "Shine the Light" law permits California residents to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their Personal Information (if any) for their direct marketing purposes in the prior calendar year. Dino does not disclose Personal Information to third parties for their independent direct marketing purposes.

This notice is provided to consumers who use Dino's banking, card, or payments products in accordance with federal financial privacy law requirements.

Definitions

• Affiliates. Companies related to Dino by common ownership or control. Our affiliates may include companies that provide complementary financial technology services.
• Nonaffiliates. Companies not related to Dino by common ownership or control. Dino does not share with nonaffiliates so they can market to you.
• Joint marketing. A formal agreement between nonaffiliated financial companies that together market financial products or services to you. Our joint marketing partners may include other financial services companies or banks.

How does Dino protect my personal information?

To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards, encrypted data transmission, secured facilities, and access controls.

How does Dino collect my personal information?

We collect your personal information, for example, when you:

• Open an account or provide account information
• Use your business card, initiate a transfer, or give us your contact information
• Tell us who receives the money or tell us where to send the money

We also collect your personal information from our banking partners, identity verification providers, and other companies with which we work.

Questions?

Contact us at support@dino.id or visit dino.id.