Privacy Policy

Privacy Policy
Last Updated: January 22, 2026
This Privacy Policy describes how Xoan Technology Inc. ("Xoan Technology"), Xoan Capital LLC ("Xoan Capital"), and their respective affiliates (collectively, "Xoan," "we," "us," or "our") collect, use, disclose, and safeguard information when you access or use our websites, applications, products, services, and related offerings (collectively, the "Services").
This Privacy Policy is designed to comply with applicable U.S. privacy and data protection laws and to protect Xoan to the maximum extent permitted by law.
By accessing or using the Services, you acknowledge that Xoan Technology operates the software platform and user interface, while Xoan Capital conducts lending and related financial operations, and that information may be shared between these entities as necessary to provide the Services. If you do not agree to this Privacy Policy, do not access or use the Services.

1. Scope and Applicability
   This Privacy Policy applies to information collected by Xoan Technology Inc. and Xoan Capital LLC in connection with:
   The operation of Xoan’s software platform, websites, and applications
   Lending, financing, and related financial services offered by Xoan Capital
   User onboarding, applications, account creation, and servicing
   Communications with Xoan, including email, phone, SMS, and customer support
   Third-party integrations and service providers acting on Xoan’s behalf
   This Privacy Policy does not apply to information collected by unaffiliated third parties not controlled by Xoan, including external websites, platforms, or services that may be linked to or integrated with the Services.

2. Information We Collect
   2.1 Information You Provide
   We may collect information you provide directly, including:
   Identity and Contact Information: Name, email address, phone number, mailing address, date of birth.
   Business and Entity Information: Legal entity names, EINs, formation documents, ownership information, operating agreements, business addresses.
   Financial Information: Bank account details, transaction data, funding sources, payment instructions, account balances, and yield elections.
   Verification and Biometric Information: Government-issued identification, facial scans, liveness checks, biometric identifiers, proof of address, and other information collected for identity verification, KYC, KYB, AML, fraud prevention, and regulatory compliance purposes. Such information may be collected directly by Xoan or by third-party identity verification providers acting on our behalf.
   Loan and Investment Information: Applications, underwriting materials, property data, valuations, loan performance, acknowledgments, and disclosures.
   Communications: Messages, emails, chat content, and recordings of phone calls, where permitted by law, including recordings made for training, quality assurance, and compliance purposes.
   2.2 Information Collected Automatically
   When you use the Services, we may automatically collect:
   IP address, device identifiers, browser type, operating system
   Usage data, logs, timestamps, pages viewed, actions taken
   Cookies, pixels, SDKs, and similar technologies
   Approximate location information derived from IP address
   2.3 Information from Third Parties
   We may collect information from third parties, including:
   Identity verification and fraud prevention providers, including Stripe and its affiliates
   Financial institutions, banking partners, and payment processors
   Credit bureaus and data aggregators
   Compliance and risk management providers
   Analytics providers, including Google Analytics
   Public records and lawful data sources

3. How We Use Information
   We may use information for the following purposes:
   To provide, operate, maintain, and improve the Services
   To onboard users and administer accounts
   To verify identity, eligibility, accreditation status, and compliance with legal obligations
   To originate, service, and manage loans and investments
   To process transactions, payments, and transfers
   To prevent fraud, abuse, security incidents, and unauthorized activity
   To comply with applicable laws, regulations, subpoenas, and legal processes
   To communicate with you regarding the Services, updates, and required disclosures
   To conduct analytics, research, and product development
   To enforce our terms, agreements, and policies
   We may use information for additional purposes disclosed at the time of collection or as otherwise permitted by law.

4. How We Share Information
   We may share information as follows:
   4.1 Between Xoan Entities
   We may share information between Xoan Technology Inc. and Xoan Capital LLC for internal business purposes, including operating the platform, providing financial services, complying with legal obligations, managing risk, and improving the Services.
   4.2 Service Providers and Partners
   Service providers process information solely on Xoan’s behalf, act as data processors or service providers where applicable, and are contractually restricted from using personal information for purposes other than providing services to Xoan, except as permitted by law.
   We may share information with vendors and service providers that perform services on our behalf, including banking-as-a-service providers, issuing banks, payment networks, identity verification services, cloud infrastructure providers, analytics services, and customer support tools.
   4.3 Financial and Lending Partners
   We may share information with lenders, investors, warehouse providers, originators, servicers, trustees, and related counterparties as necessary to provide the Services.
   4.4 Legal and Regulatory Disclosures
   We may disclose information if required to do so by law or in response to valid legal requests, including subpoenas, court orders, regulatory inquiries, or law enforcement requests.
   4.5 Business Transfers
   We may share or transfer information in connection with a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction.
   4.6 With Your Consent
   We may share information with third parties when you direct us to do so or provide consent.

5. Cookies and Tracking Technologies
   We use cookies, pixels, SDKs, and similar technologies to operate the Services, understand usage, improve performance, and analyze traffic patterns. This includes the use of Google Analytics and similar tools.
   You may control cookies through your browser settings. Disabling cookies may limit certain features or functionality of the Services.
   We do not respond to browser "Do Not Track" signals.

6. Data Retention
   We retain information for as long as reasonably necessary to provide the Services, comply with legal and regulatory obligations, resolve disputes, enforce agreements, and protect Xoan’s legitimate business interests.
   Retention periods may extend beyond account closure where required by law or for compliance, audit, or risk management purposes.

7. Data Security
   We implement commercially reasonable administrative, technical, and physical safeguards designed to protect information, including encryption, access controls, and monitoring practices aligned with industry standards and partner requirements.
   However, no system is completely secure. To the maximum extent permitted by law, Xoan disclaims all warranties, express or implied, relating to data security and does not guarantee that information will be free from unauthorized access, disclosure, alteration, or destruction.
   You acknowledge that you provide information at your own risk.

8. Your Rights and Choices
   Depending on your jurisdiction, you may have certain rights regarding your personal information, including the right to request access to, correction of, or deletion of information.
   Such requests may be denied, limited, or delayed where permitted or required by law, including where retention is necessary to comply with financial services, lending, securities, tax, anti-money laundering, recordkeeping, audit, or regulatory obligations, or to protect Xoan’s legal interests.
   We do not sell personal information.

9. Children’s Privacy
   The Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

10. International Users
    The Services are operated in the United States. If you access the Services from outside the United States, you consent to the transfer and processing of information in the United States and other jurisdictions where Xoan or its service providers operate.

11. Changes to This Privacy Policy
    We may update this Privacy Policy at any time in our sole discretion. Changes are effective when posted. Your continued access to or use of the Services after changes are posted constitutes acceptance of the revised Privacy Policy.

12. Relationship to Other Agreements
    This Privacy Policy is incorporated by reference into, and forms part of, Xoan’s Terms of Service, E-Sign Consent, and any other agreements governing your use of the Services (collectively, the "Agreements").
    Any disputes, claims, or controversies arising out of or relating to privacy, data use, or data security shall be resolved exclusively in accordance with the dispute resolution, arbitration (if applicable), governing law, and venue provisions set forth in the Terms of Service, which are incorporated herein by reference.

13. California Privacy Notice (Appendix)
    This section applies solely to residents of California and supplements the Privacy Policy above. In the event of a conflict, this Appendix controls only with respect to California residents.
    Categories of Personal Information Collected
    In the preceding 12 months, Xoan may have collected the following categories of personal information as defined under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"):
    Identifiers (e.g., name, email address, IP address)
    Personal records (e.g., contact information, business records)
    Financial information
    Commercial information
    Internet or network activity information
    Geolocation data (approximate)
    Biometric information (for identity verification and fraud prevention)
    Professional or employment-related information
    Inferences drawn to provide or improve the Services
    Purposes for Collection
    Xoan collects and uses personal information for the business and commercial purposes described in this Privacy Policy, including providing financial services, verifying identity, preventing fraud, complying with legal obligations, and improving the Services.
    Disclosure of Personal Information
    Xoan may disclose personal information to service providers and third parties for business purposes, including identity verification, payment processing, analytics, compliance, security, and operational support.
    Sale or Sharing of Personal Information
    Xoan does not sell personal information as defined by the CCPA or CPRA and does not share personal information for cross-context behavioral advertising.
    Sensitive Personal Information
    Xoan collects sensitive personal information only as reasonably necessary to provide the Services, ensure security, prevent fraud, and comply with legal obligations. Xoan does not use or disclose sensitive personal information for purposes other than those permitted by law.
    Your California Rights
    California residents may have the right to request access to, correction of, or deletion of personal information, subject to exceptions permitted by law. Xoan may deny requests where retention is required for legal, regulatory, or operational purposes.
    To submit a request, contact privacy@xoancapital.com. Xoan may verify your identity before responding.
    Xoan will not discriminate against you for exercising your privacy rights.

14. Contact Us
    If you have questions or concerns about this Privacy Policy, contact us at:
    Xoan Technology Inc.
    One Sansome Street, Suite 1400
    San Francisco, CA 94104
    privacy@xoancapital.com