Privacy Policy

01Purpose and Scope

This Privacy Policy (the “Policy”) describes how Fiscor and its affiliates (together, “Fiscor,” “we,” “our,” or “us”) collect, use, disclose, retain, and protect personal information when we service and collect on consumer debt accounts on behalf of creditor clients, and when individuals visit our websites, applications, and other digital properties (the “Services”).

Fiscor operates an artificial-intelligence-assisted debt-resolution platform. This Policy explains what personal information we handle, the legal bases on which we rely, how long we keep it, the third parties that may receive it, and the rights available to borrowers and other individuals whose personal information we process.

This Policy applies to processing of personal information in the United States (including under the California Consumer Privacy Act as amended by the California Privacy Rights Act, the Fair Debt Collection Practices Act and Regulation F, the Gramm-Leach-Bliley Act Safeguards Rule, and applicable state laws), the United Kingdom (UK GDPR and the Data (Use and Access) Act 2025), and Australia (the Privacy Act 1988 (Cth) as amended by the Privacy and Other Legislation Amendment Act 2024 and the Australian Privacy Principles).

This Policy is a control under the Privacy category of the AICPA SOC 2 Trust Services Criteria. It supports controls related to notice (P1.1), choice and consent (P2.1), collection (P3.1–P3.2), use, retention, and disposal (P4.1–P4.3), access (P5.1–P5.2), disclosure to third parties (P6.1–P6.7), quality (P7.1), and monitoring and enforcement (P8.1).

02Definitions

The following terms have the meanings given below. Where a term is defined in an applicable law, that statutory definition controls for the relevant jurisdiction.

Personal Information / Personal Data

Any information that identifies, relates to, describes, or is reasonably capable of being associated with an identified or identifiable natural person, including unique identifiers, account information, communications, and online identifiers. In Australia, this corresponds to “personal information” under the Privacy Act.

Borrower

A consumer whose account is serviced by Fiscor on behalf of a creditor client.

Sensitive Personal Information

Special-category personal data under UK GDPR (Article 9); sensitive personal information under CCPA (e.g., Social Security number, financial-account credentials, precise geolocation); sensitive information under the Australia Privacy Act (e.g., health information, biometric data).

Processing

Any operation performed on personal information, including collection, storage, use, disclosure, and deletion.

Sub-processor

A third party engaged by Fiscor that processes personal information on our behalf under written contract.

Automated Decision-Making Technology (ADMT)

Any technology, including AI and machine-learning systems, that processes personal information and uses computation to execute, assist, or replace human decision-making, as defined in the California Privacy Protection Agency ADMT regulations and analogous frameworks under UK GDPR Article 22 and Australia Privacy Act APP 1.

03Roles and Responsibilities

Fiscor is the data controller for personal information processed in connection with the operation of our business (including our own employees, vendors, and website visitors) and is generally a data processor (UK GDPR) or service provider (CCPA) for borrower personal information processed on behalf of our creditor clients, except where we use that information for our own purposes such as compliance, audit, fraud prevention, model improvement (within contractual limits), and defending legal claims, in which case Fiscor is a controller.

The Document Owner identified in the Document Control table is accountable for maintaining this Policy. The Approver authorizes its issuance. The Fiscor privacy program is led by the Data Protection Officer (DPO) / Chief Privacy Officer.

04Personal Information We Collect

The categories of personal information we collect, and the CCPA categories under Cal. Civ. Code §1798.140(v), are summarized below.

4.1 Borrower identification and contact information

Full name; mailing and billing addresses; telephone numbers (mobile and landline); email addresses; date of birth; and government identifiers where lawfully required, including Social Security number (US), National Insurance number (UK), or Tax File Number (Australia, only where mandated). These fall within CCPA Categories A (identifiers) and B (Cal. Civ. Code §1798.80 customer records), and constitute “sensitive personal information” under CCPA to the extent they include SSN or equivalent identifiers.

4.2 Financial and account information

Account number with the creditor; current and historical balances; payment history; charge-off date; original-creditor information; arrangements, settlements, and outstanding amounts; bank-account or payment-card information collected solely for processing borrower-initiated payments (tokenized at our payment processor; Fiscor does not store full primary account numbers in its own systems). This is CCPA Category D (commercial information) and Category L (professional or employment-related information) where applicable, and is “non-public personal information” (NPI) for GLBA purposes.

4.3 Communication records

Voice recordings and transcripts of inbound and outbound calls, SMS and email correspondence, in-application chat messages, and case notes generated by agents or by our AI. Recording is conducted where lawful, with appropriate notices and, where required, consent (e.g., two-party-consent states in the US). This is CCPA Category J (audio, electronic, visual, and similar information).

4.4 Technical and online data

Device identifiers, IP address, browser type, operating system, referring/exit pages, timestamps, application telemetry, and cookies and similar technologies when you interact with our websites or applications. This is CCPA Category F (internet or other electronic network activity information) and Category G (geolocation data) — we do not collect precise geolocation absent your explicit, informed consent.

4.5 Inferences and derived data

Account segmentation, risk and fraud signals, propensity scores, and other inferences derived from the categories above to deliver, evaluate, and improve our Services. This is CCPA Category K (inferences).

4.6 Sensitive personal information

Where lawful and necessary, we may process Social Security number or equivalent identifier, account credentials together with access codes, and information about racial or ethnic origin, religion, health, or membership in a vulnerable category — for example, where a borrower discloses a medical hardship, a deceased-borrower notification, or a financial-difficulty status — solely to apply mandated protections (such as Regulation F Section 1006.34(c) special protections, UK FCA TCF principles on vulnerable customers, and Australian financial-hardship guidance). We apply heightened access controls and shorter retention for these records, and we do not use sensitive personal information for marketing, profiling unrelated to hardship handling, or inferring further characteristics about you.

4.7 Sources of personal information

We collect personal information directly from you (when you communicate with us, log in to our borrower portal, or submit a dispute) and from third-party sources, including: our creditor clients (who provide your account file at placement and updates thereafter); the original creditor; credit bureaus and other data-furnisher networks; address- and identity-verification services; skip-trace and locator services; courts and public records (in connection with judgment accounts only); and your authorized representative or agent.

05Why We Collect Your Personal Information

We process personal information only for the specific, lawful purposes set out below, on the legal bases set out by the law of the borrower’s jurisdiction.

We do not sell personal information for monetary consideration, and we do not “share” personal information for cross-context behavioral advertising under CCPA. We do not use borrower personal information for marketing without an applicable consent or legal basis.

06How Long We Keep Personal Information

We retain personal information only for as long as necessary for the purposes for which it was collected, to comply with our legal obligations (including the FDCPA dispute window, AML/KYC retention rules, and tax and audit requirements), to defend or assert legal claims, and to support our SOC 2 evidence record. Industry-standard defaults applicable to Fiscor are summarized below; specific retention periods may be longer where law requires or shorter where the data is no longer needed.

When the retention period for a record ends, Fiscor deletes, anonymizes, or de-identifies the record in accordance with our Data Retention and Disposal Procedure. Backups containing personal information are deleted on the standard backup-rotation cycle following primary deletion, except where a legal hold applies.

07Disclosures to Third Parties and Sub-processors

We disclose personal information only as described below, and in each case under written contract that imposes confidentiality and data-protection obligations consistent with this Policy and applicable law.

7.1 Creditor clients and downstream rights-holders

We return personal information to the creditor that placed the account, and to any subsequent assignee or rights-holder of the account, as required to perform our services.

7.2 Sub-processor categories

Fiscor engages sub-processors in the following categories. A current sub-processor list is maintained on our trust portal and is provided to customers and regulators on request.

7.3 Legal and regulatory disclosures

We disclose personal information to government authorities, regulators, courts, and law-enforcement bodies when we are required or permitted by law (for example, in response to a valid subpoena, court order, or regulator request, or under our obligations to the CFPB, FTC, ICO, OAIC, or state attorneys general).

7.4 International data transfers

Where personal information is transferred outside the borrower’s country of residence, we rely on a valid transfer mechanism, including: the European Commission’s Standard Contractual Clauses (SCCs); the UK International Data Transfer Agreement (IDTA) or UK Addendum to the SCCs; Australian Privacy Principle 8 reasonable-steps obligations and contractual safeguards; the EU–U.S. Data Privacy Framework (where applicable to the receiving entity); and supplementary measures including encryption in transit and at rest, access controls, and contractual audit rights. Borrowers may request a copy of the relevant transfer mechanism by contacting us at hi@fiscor.ai.

08Your Privacy Rights

Subject to verification of identity and to applicable legal limits (including required retention for collections, audit, AML, or litigation hold), Fiscor honors the following rights.

8.1 How to exercise your rights

You may submit a privacy request by emailing hi@fiscor.ai, by writing to us at the contact details in Section 17, by using the in-portal “Manage my privacy” function, or by calling our privacy line at the number listed on our website. California residents may also submit “Do Not Sell or Share My Personal Information” and “Limit the Use of My Sensitive Personal Information” requests through the dedicated links on our homepage, and we honor Global Privacy Control (GPC) signals as a valid opt-out.

We will acknowledge receipt of your request within ten business days and respond substantively within the timelines listed in the table above. We will not charge a fee for a verified request unless it is manifestly unfounded or excessive, as permitted by law.

8.2 Verification and authorized agents

To protect your information, we may ask for information necessary to verify your identity (for example, matching information we already hold on file). An authorized agent acting on your behalf must provide proof of authorization, such as a signed permission, and we may contact you to confirm. We will not require a notarized authorization unless the law specifically requires it.

09Automated Decision-Making and AI Disclosure

Fiscor uses artificial intelligence and other automated decision-making technologies as part of its debt-resolution platform. We disclose this use to comply with the California Privacy Protection Agency ADMT regulations, California AB 1008 (clarifying that “personal information” can exist within AI systems), UK GDPR Article 22 as updated by the Data (Use and Access) Act 2025, and the Australia Privacy and Other Legislation Amendment Act 2024 (transparency obligations in APP 1 for substantially automated significant decisions).

9.1 Where we use ADMT

9.2 How our AI works, in plain language

Our AI systems are trained on historical, de-identified or pseudonymized account-and-communication data to learn which actions tend to lead to fair, lawful, and successful resolutions for borrowers and creditors. At inference time the systems take as input the information we have lawfully collected about your account (balance, payment history, your stated preferences, prior communications, and similar) and produce a recommendation or a draft response. A human collections officer reviews and is accountable for any decision that has a significant effect on you, except for routine self-service actions that you initiate (for example, scheduling a payment).

9.3 Borrower rights regarding ADMT

You have the right to: (a) be informed before a significant automated decision is made (pre-use notice); (b) request a description, in plain language, of the logic involved and the meaning and likely consequences of the decision; (c) opt out of solely automated decision-making, or, where opt-out is not available because the processing is necessary for a contract or required by law, request meaningful human review and a reasoned explanation; (d) contest the decision and provide additional information; and (e) request that any personal information embedded in an AI system that produces personal information about you be accessed, corrected, or deleted to the extent technically feasible, in line with AB 1008.

9.4 Safeguards

Fiscor maintains an AI governance program that includes: documented model cards and risk assessments for each ADMT use case; fairness, bias, and disparate-impact testing on a defined cadence; data-quality controls on training data; human-in-the-loop requirements for decisions with significant effects; logging of model inputs, outputs, and human overrides; restrictions preventing borrower personal information from being used to train external foundation models without zero-retention or equivalent contractual protection; and a model-change-control process integrated with our SOC 2 change-management controls.

10Data Security Safeguards

Fiscor maintains an information security program aligned with SOC 2 Common Criteria (CC6–CC9), the GLBA Safeguards Rule (16 CFR Part 314), the UK GDPR Article 32 obligation, and Australian Privacy Principle 11. Controls include:

• Encryption of personal information in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent).
• Role-based access control with least-privilege provisioning, multi-factor authentication on all production access, and quarterly access reviews.
• Network segmentation, web-application firewalling, intrusion detection, endpoint detection and response, and 24/7 security monitoring.
• Secure software-development lifecycle, including pre-merge static analysis, dependency scanning, peer review, and pre-release penetration testing on a defined cadence.
• Vulnerability management with documented remediation SLAs by severity.
• Vendor risk-management program including pre-onboarding due diligence, contractual data-protection terms, and recurring re-assessment.
• Personnel controls including background checks (where lawful), confidentiality obligations, mandatory annual privacy and security training, and role-based privacy training.
• Physical security at Fiscor facilities and at sub-processor facilities under contractual flow-down requirements.
• Documented business-continuity and disaster-recovery plans with annual testing.

The Fiscor Information Security Policy (POL-INFOSEC-001) contains the full control set. This Privacy Policy is read in conjunction with that policy.

11Breach Notification

Fiscor maintains a documented Security Incident Response Plan (POL-IRP-001) that covers identification, containment, eradication, recovery, and post-incident review. The DPO and Information Security Officer jointly assess every confirmed security incident for whether it constitutes a personal-data breach under each applicable regime.

Where Fiscor acts as a service provider or processor on behalf of a creditor client, we notify the creditor without undue delay (and within the contractual timeline, typically not more than 48 hours after determination) so that the creditor can meet its own notification obligations. We also notify our cyber-insurance carrier and engage external counsel and incident-response specialists where appropriate.

12Children’s Privacy

Our Services are not directed to children, and we do not knowingly collect personal information from minors under 16 (US/UK) or 15 (Australia, in line with the OAIC Children’s Online Privacy Code under development). If we learn that we have collected personal information from a child without appropriate consent, we will delete it promptly. Borrower accounts are held only by adults party to the underlying credit agreement.

13Cookies and Online Tracking

Fiscor uses cookies and similar technologies on its websites and borrower portal. We honor cookie-banner consent in the UK, EU, and Australia, and we honor Global Privacy Control signals as opt-outs of “sale” and “share” under CCPA.

You can manage cookies through the cookie-preferences link in our website footer and through your browser settings. Disabling strictly necessary cookies may prevent core features (such as login) from functioning.

14FDCPA and Communication Restrictions

Because we are a debt collector subject to the Fair Debt Collection Practices Act and Regulation F (12 CFR Part 1006), the following protections apply in addition to the general privacy protections in this Policy:

• We will not communicate with any third party about your debt except as permitted by 12 CFR §1006.6, including communications with you, your attorney, the creditor, a consumer-reporting agency where authorized, the original creditor, and certain communications solely to obtain location information.
• We will honor a written request to cease communications and the limited-content and time-place restrictions set out in §1006.6(b) and (c).
• We will provide a validation notice meeting the requirements of §1006.34 at the outset of collection and will pause collection activity during a dispute period as required.
• Electronic disclosures are delivered consistent with §1006.42 and the E-SIGN Act, including with respect to revocation of consent.

15Changes to This Policy

Fiscor reviews this Policy at least annually and after any material change to our processing activities, our sub-processor arrangements, or applicable law. We will post the updated Policy with a revised version number and “Last Reviewed” date on our website at least 30 days before material changes take effect, and we will notify borrowers by reasonable means (in-portal banner and, for material changes, email) where required by law. Prior versions are maintained in our SOC 2 evidence repository.

16Complaints and Supervisory Authorities

If you believe Fiscor has handled your personal information unlawfully, please contact us first using the details in Section 17 — we will work to resolve your concern. You also have the right to lodge a complaint with the supervisory authority for your jurisdiction.

17Contact Us

For any question about this Policy or to exercise a privacy right, contact us at hi@fiscor.ai.

Version 1.0 · Issued 20 May 2026 · Initial issue for SOC 2 audit.