Privacy Policy

AHLC Holdings LLC, doing business as ReturnFold · Version 1.0 · Effective November 1, 2026

Privacy notice: what does ReturnFold do with your personal information?

This summary follows the model privacy form under the Gramm-Leach-Bliley Act. The full policy below explains each line.

Why?	Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share and protect your personal information. Please read this notice carefully to understand what we do.
What?	The types of personal information we collect and share depend on the product or service you have with us. This information can include: Social Security number and date of birth; government identification and photographs; bank account and routing numbers; account balances and transaction history; contact information and device information. When you are no longer our customer, we continue to share your information as described in this notice.
How?	All financial companies need to share customers' personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers' personal information, the reasons ReturnFold chooses to share, and whether you can limit this sharing.

Reasons we can share your personal information	Does ReturnFold share?	Can you limit this sharing?
For our everyday business purposes, such as to process your transactions, maintain your account, respond to court orders and legal investigations, or report to credit bureaus	Yes	No
For our marketing purposes, to offer our products and services to you	Yes	No
For joint marketing with other financial companies	No	We don't share
For our affiliates' everyday business purposes, information about your transactions and experiences	No	We don't share
For our affiliates' everyday business purposes, information about your creditworthiness	No	We don't share
For our affiliates to market to you	No	We don't share
For nonaffiliates to market to you	No	We don't share

Questions? Email privacy@returnfold.com or write to AHLC Holdings LLC d/b/a ReturnFold, 30 N Gould St, Suite R, Sheridan, WY 82801.

Who we are
Who is providing this notice?	AHLC Holdings LLC, a Wyoming limited liability company doing business as ReturnFold.

What we do
How does ReturnFold protect my personal information?	To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include encryption of data in transit and at rest, multi-factor authentication for every employee and for customers before money moves, access limited to the people who need it, and written security policies reviewed every year.
How does ReturnFold collect my personal information?	We collect your personal information, for example, when you open an account, verify your identity, link a bank account, add or withdraw money, or contact us. We also collect your personal information from others, such as Plaid, identity verification providers and public records.
Why can't I limit all sharing?	Federal law gives you the right to limit only sharing for affiliates' everyday business purposes (information about your creditworthiness), affiliates from using your information to market to you, and sharing for nonaffiliates to market to you. State laws and individual companies may give you additional rights to limit sharing.

Definitions
Affiliates	Companies related by common ownership or control. They can be financial and nonfinancial companies. Our affiliates include the companies owned or controlled by our principals, some of which borrow from us; we do not share your personal information with them.
Nonaffiliates	Companies not related by common ownership or control. They can be financial and nonfinancial companies. We do not share with nonaffiliates so they can market to you.
Joint marketing	A formal agreement between nonaffiliated financial companies that together market financial products or services to you. ReturnFold does not jointly market.

1. Who we are and what this policy covers

This Privacy Policy explains how AHLC Holdings LLC, a Wyoming limited liability company doing business as ReturnFold ("ReturnFold," "we," "us" and "our"), collects, uses, shares and protects personal information when you visit returnfold.com, use the ReturnFold mobile application, open or hold a ReturnFold account, or contact us (together, the "Services"). It applies to customers, applicants, people on our waitlist and visitors to our website.

It is part of the ReturnFold Cash Account Terms of Service. Plaid Inc., Apple, Google and the other companies named in Section 4 have their own privacy policies, which govern what they do with information they collect directly from you.

ReturnFold is not a bank. Your Balance is not insured by the Federal Deposit Insurance Corporation or any government agency. That does not change how we protect your information: we follow the Gramm-Leach-Bliley Act and the Federal Trade Commission's Privacy Rule (16 CFR Part 313), Safeguards Rule (16 CFR Part 314) and Disposal Rule (16 CFR Part 682), which apply to us as a financial institution under the Federal Trade Commission's jurisdiction.

2. Information we collect

Category	What it includes	Where it comes from
Identity	Legal name, date of birth, Social Security number or Individual Taxpayer Identification Number, residential address, images of your government-issued identification, a selfie, and the results of identity, document and watchlist checks	You, Plaid Identity Verification, public and sanctions records
Contact	Email address, mobile phone number, mailing address	You
Linked bank account	Bank name, account and routing numbers, account type, the name on the account, and balance information at the time of a transfer	Plaid, with your consent in Plaid Link
Account and transaction	Your Balance, every transfer in and withdrawal, Term Buckets, interest posted, Auto-Transfer settings, referral activity, statements and tax forms	Generated by your use of the Services
Security	Password hash, one-time codes, authenticator enrollment, sign-in history, device identifiers, network address, browser and operating system, and the record of each authorization you give us	Your device and your use of the Services
Communications	Messages, emails, calls and chats with us, including recordings, and any documents you send us	You
Website	Pages visited, referring site, time on page, and the cookie data described in Section 6	Your browser
Waitlist and marketing	Email address and, if you give it, your name and how you heard about us	You

We do not collect your online banking username or password; Plaid Link handles bank sign-in and does not pass credentials to us. We do not collect precise geolocation, biometric templates beyond the one-time selfie comparison performed by our identity verification provider, or information from data brokers for marketing.

3. How we use information

We use personal information to:

• open and maintain your account, verify your identity and your bank account, and screen you against sanctions lists;
• process transfers in and withdrawals, calculate and post interest, run Term Buckets and Auto-Transfers, and send statements and tax forms;
• detect and prevent fraud, unauthorized access, money laundering and abuse, including by scoring the risk that a transfer will be returned, as described in Section 5;
• secure your account, including sending one-time codes and alerts;
• respond to your questions, complaints and requests, and investigate errors under the Terms of Service;
• comply with law, including tax reporting, unclaimed-property reporting, responses to legal process and record-retention requirements;
• improve the Services, including by analyzing how the App is used in aggregate;
• tell you about ReturnFold products, features and rates, which you can opt out of under Section 9; and
• enforce our Terms of Service and protect our rights and the rights of others.

We do not sell personal information, and we do not use it to make automated decisions that have legal effects on you without a person involved, except that identity verification and transfer-risk scoring may automatically decline an application or hold a transfer pending review by our staff.

4. How we share information and with whom

We share personal information only as this section describes. Every service provider below is bound by contract to use your information only to provide its service to us and to protect it.

Who	What we share	Why
Plaid Inc.	Identity details, identification images, selfie, bank account details, transfer instructions and amounts	Identity verification, bank linking, ownership matching, balance checks, return-risk scoring and moving money by ACH
Our bank (currently CountyBank, Greenwood, South Carolina) and the ACH network operators	Your name, bank account and routing numbers, and transfer amounts	Settling transfers in and withdrawals
Cloud hosting and database providers (currently Vercel Inc. and Neon Inc.)	All account data, encrypted	Running the App and storing records
Email and text message providers (currently Resend and our text-message carrier)	Email address, phone number, the content of the message	Sending codes, alerts, statements and notices
Error-monitoring provider (currently Sentry)	Technical error data, which may include your account identifier but not your identity details	Finding and fixing faults in the App
Tax-form preparer and e-filing provider	Name, address, taxpayer identification number, interest posted	Preparing and filing Form 1099-INT
Auditors, accountants and lawyers	What they need for the engagement	Audit, tax, legal and compliance work
Government agencies, courts and regulators	What the law or order requires	Subpoenas, levies, garnishments, unclaimed-property reports, sanctions reporting, regulatory examinations
A buyer or successor	Account data	If we sell, merge or reorganize our business, your information transfers with it under this policy
Anyone, with your direction	What you ask us to share	For example, a letter confirming your account for a third party

Affiliates. The companies owned or controlled by our principals, including those that borrow from us, are our affiliates. We do not share your personal information with them for any purpose. Our lending decisions never use information about our Cash Account customers.

No marketing sharing. We do not share personal information with nonaffiliates so they can market to you, and we do not sell it. We do not share it with the social networks or advertising platforms we advertise on, except as Section 6 describes for the website.

Aggregate information. We may publish statistics that do not identify anyone, such as total Balances or the average size of a Term Bucket.

5. Plaid and your linked bank account

We use Plaid Inc. to verify your identity, connect your bank account and move money. When you use Plaid Link in the App, you give Plaid your bank sign-in directly; Plaid retrieves your account and routing numbers, the name on the account, the account type and balance information, and shares them with us. We never see your bank credentials.

Plaid also provides us with two risk services. Identity Verification compares your identification document and selfie, checks your details against identity and watchlist databases, and returns a result and the underlying checks. Signal scores the risk that a transfer in will be returned, using your bank account's history as Plaid observes it; a high score can cause us to hold or decline a transfer, and a person on our staff reviews every hold.

By using Plaid Link you grant Plaid the right to collect, use and share your information under the Plaid End User Privacy Policy at plaid.com/legal. You can see which companies you have connected through Plaid, and disconnect them, at my.plaid.com. Disconnecting ReturnFold in Plaid stops new transfers until you link again; it does not close your account or affect your Balance.

When you close your account, we delete the Plaid access token for your bank account within 30 days, after which we can no longer retrieve information about it. We keep the records of past transfers for the periods in Section 8.

6. Cookies, analytics and advertising

In the App. The App and the signed-in part of returnfold.com use only the cookies needed to keep you signed in and to protect your session. There are no advertising cookies, pixels or third-party analytics inside the App or on any page you see while signed in.

On the public website. The public pages of returnfold.com use privacy-respecting analytics to count visits and pages, and, because we advertise on Meta platforms, may use the Meta Pixel to measure whether our advertising brought you to the site and to show our advertising to people who visited. The pixel receives the pages you viewed and a hashed version of your email address if you join the waitlist; it never receives your account, identity or bank information, because those pages carry no pixel. You can decline marketing cookies in the banner on your first visit, and change your choice at any time from the link in the footer.

Do Not Track and opt-out signals. We honor the Global Privacy Control signal from your browser as an opt-out of marketing cookies on the public website. The App has nothing to opt out of.

Email. Our emails may include a tracking image that tells us whether the email was opened; security and account emails are not tracked.

7. How we protect information

We maintain a written information security program under the Federal Trade Commission's Safeguards Rule, overseen by a designated Qualified Individual who reports to the company's management. Its controls include:

• encryption of personal information in transit (TLS 1.2 or higher) and at rest, with Social Security numbers, identification images and bank account numbers encrypted separately at the application level;
• multi-factor authentication for every employee and contractor on every system that holds customer data, and for customers before their first withdrawal and on every withdrawal above $1,000;
• access limited to the people whose role requires it, reviewed quarterly, and removed the day a person leaves;
• logging of every sign-in, transfer and administrative action, kept for five years;
• an annual risk assessment and a review of every service provider that handles your information;
• a written incident response plan. If a breach of security affects your unencrypted personal information, we will notify you without unreasonable delay as Wyoming law (Wyo. Stat. 40-12-502) and the law of your state require, and notify the Federal Trade Commission within 30 days if 500 or more people are affected.

No system is perfectly secure. You help protect your account by following Section 13 of the Terms of Service: keep your codes private, enroll an authenticator app, and tell us at once if something looks wrong.

8. How long we keep information

We keep personal information only as long as we need it for the purpose we collected it, to meet a legal requirement, or to defend a claim, under a written Data Retention and Disposal Policy. The main periods are:

Information	How long we keep it
Identity verification records, including identification images and selfie	5 years after your account closes
Transfer authorizations	2 years after the last transfer under them
Account ledger, statements and transfer records	7 years after the transaction
Tax forms and taxpayer identification	7 years after the year filed
Error and dispute investigations	5 years after resolution
Plaid access token for your bank account	Deleted within 30 days after your account closes
Sign-in and security logs	5 years
Website analytics and cookie data	13 months
Waitlist sign-ups that never open an account	24 months after sign-up
Messages and call recordings	3 years

When a period ends we delete the information or make it permanently anonymous, including from backups within 35 days, unless a legal hold requires us to keep it. Information kept for a legal hold is used only for that matter.

9. Your choices and rights

Marketing. You can opt out of marketing emails with the link in any marketing email, and of marketing texts by replying STOP. Security codes, account alerts, statements and legal notices continue while your account is open because the Services depend on them.

Access and correction. You can see and update your contact details and settings in the App at any time. For anything else, email privacy@returnfold.com and we will give you a copy of the personal information we hold about you, or correct it, within 45 days. We will verify that the request comes from you before acting on it.

Deletion. You may ask us to delete your personal information. We will delete everything the retention periods in Section 8 do not require us to keep, and tell you what we kept and why. Closing your account starts those periods; it does not by itself erase records the law requires us to hold.

State privacy laws. Information we collect to provide you a financial product is covered by the Gramm-Leach-Bliley Act and is exempt from most state consumer privacy laws, including the California Consumer Privacy Act. Information from the public website and waitlist is not exempt, and if you live in a state that gives you rights over it (California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and others), you may exercise those rights by emailing privacy@returnfold.com. We respond within 45 days, do not discriminate against you for making a request, and you may appeal a decision by replying to our response. We do not sell personal information or share it for cross-context behavioral advertising beyond the website measurement in Section 6, which you can decline.

Plaid. You can manage and disconnect the bank connections you have made through Plaid at my.plaid.com.

Authorized agents. An agent may make a request for you if you give us written permission or a power of attorney, and we may still ask you to confirm the request directly.

10. Children

The Services are for adults. We do not knowingly collect personal information from anyone under 18, and we do not open accounts for minors. If we learn that we hold information about a person under 18, we delete it and close any account. If you believe a minor has given us information, email privacy@returnfold.com.

11. Changes to this policy

We may update this policy. When we do, we post the new version in the App and on returnfold.com with its revision date, and, for a change that expands how we share your personal information, we email you at least 30 days before it takes effect and give you the chance to limit the new sharing where the law allows. We also send the privacy notice summary at the top of this policy to every customer once a year, as federal law requires, unless our sharing practices have not changed and the law permits us to rely on this posted version instead.

12. How to contact us

Privacy questions and requests: privacy@returnfold.com.

Mail: AHLC Holdings LLC d/b/a ReturnFold, Attention: Privacy, 30 N Gould St, Suite R, Sheridan, WY 82801.

Account help: support@returnfold.com or the message center in the App.

Our Qualified Individual for information security can be reached at security@returnfold.com.