VIABLY PRIVACY POLICY

Viably recognizes the importance of privacy, security, and data protection to each user of our Services (as defined below). Moreover, data protection laws may give you certain rights over your personal data, no matter when or where it is being processed.

This privacy policy (the “Privacy Policy”) explains what personal data we collect about you, how we use it, why we use it, and of the choices you can make and rights you can exercise in relation to your personal data. The Privacy Policy does not apply to information that we process as a service provider on behalf of our business customers. The Privacy Policy applies to personal information that may be collected from you when using our Services, including during your conversations with our support chatbot and during interactions you might have with Viably offline, such as when you engage with our customer support representatives.

The Basics: Who We Are, Our Role, and Definitions

Who We Are

Viably Capital Inc.  ("Viably," "we," "us," or "our") provides financial products and services to growing companies. Our offices are located at 215 East Chatham Street, Suite 215, Cary, NC 27511, United States. If you have questions about our company, your privacy, or if you want to exercise your rights, you can contact us at Privacy@RunViably.com.

EU and UK Data Protection Representative

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact, if you are in the EU or the UK. Prighter Group gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative Prighter Group or make use of your data subject rights, please visit the following Site: https://app.prighter.com/portal/17160132039.

Our Role: Controller and Processor

Certain data protection laws, including the laws in the EU and UK, differentiate between a party that determines why and how personal data is processed (called a "controller") and a party that processes personal data solely on the controller's behalf and according to the controller's instructions (called a "processor"). Viably is the controller in respect of the processing described in this Privacy Policy.

Definitions and Recommendations

When we refer to "Services," we mean our websites at www.runviably.com and https://beprofit.co/, including their subdomains, collectively, the “Sites”) and our applications and platforms offering our banking and funding products and services (“Financial Services”) and our financial management and analysis products and services (“Platform Services”).

When we refer to "Personal Data" or “Personal Information,” we mean information that is defined as personal data under applicable law. This includes any information that may be used to identify an individual, directly or indirectly, either alone or in combination with other information, including, for example, your phone number, location, time zones, including unique identifiers like Internet Protocol (IP) addresses or cookie IDs and any information that you may provide when you interact with us.

We may also use other analytics tools to collect information about the use of the Services and types of technical data in the context of the use of the Services, including information about your device or any other system, software, language preference, etc.

We may also collect statistical data, which means data that is not directly associated with or linked to your personal data; statistical data does not, by itself, permit the identification of individual people. Such information may be derived or generated from the personal data you may share with us through the Services. However, as stated above, it shall not identify you personally and shall be used by us to promote our legitimate interests, service improvement, research, analysis, and statistical purposes.

When we refer to "you,” we mean visitors to our Sites, job applicants, and any user of the Services, as applicable.

When we refer to “our support chatbot,” we mean our support assistant found on the Sites that provides customer support and account management services by issuing responses (including in certain circumstances, artificial intelligence (AI) responses) to your support and services inquiries.

A Note on Legal Bases

Certain jurisdictions only allow the processing of personal data where a legal basis has been established. Under the EU's General Data Protection Regulation ("GDPR"), the possible legal bases include: your consent, the processing is necessary to perform a contract with you, the processing is necessary to fulfill our legal obligations, or a company has a legitimate business interest to process your personal data. Where we are a controller, we only collect and process data where we have established a legal basis. Below you can find more details about specific legal bases.

Personal Information We Collect as a Controller, How We Use It, and Why

Depending on the Services you use, we may collect a variety of information from or about you or your devices from various sources, as described below.

Personal Information You Provide to Us.

• Registration and Profile Information. When you register to use our Services, we ask you to provide your name, email address, username, and a password or connect through a single-sign on service. During the onboarding process, we may also ask you for information about your company and personnel, such as the names and email addresses of individuals who you would like to authorize to use our Services, a photo for your individual account, as well as other relevant information we and our service providers may require integrating your company’s business information with our Services.
• Financial Services. When you apply for and/or use one of our Financial Services, we need to process certain information about you, your company, and individuals associated with your company (including owners, shareholders, and personnel), such as your name, job title or role, address, social security number, tax identification number, date of birth, phone number, email address, and other relevant information necessary to process your application and/or provide your company with the Financial Services requested.
• Communications. If you contact us directly, we receive additional information about you. For example, if you contact us for customer support, we may receive your name, email address, the contents of the message and any attachments you send to us, and any other information you choose to provide. If you subscribe to our newsletter, we will collect certain information from you, such as your name and email address. When we send you emails, we may track whether you open them to learn how to deliver a better customer experience and improve our Services.
• Careers. If you decide that you wish to apply for a job with us, you may submit your contact information and your resume online. We will collect the information you choose to provide on your resume, such as your education and employment experience. You may also apply through LinkedIn. If you do so, we will collect the information you make available to us on LinkedIn.
• Platform Services. When you use our Platform Services, we need to process certain information about you and your company, including bank account information, marketplace account information (e.g. sales and other transactions), payment information (e.g. credit and debits), and other relevant information necessary to provide your company with the Platform Services.  

Legal Basis: We process this Personal Data based on the performance of a contract with you, to take steps at your request before entering a contract, or our legitimate interest to answer your inquiries and provide customer support. Processing your Personal Data to share our newsletters and promotional materials is based on your consent. You may withdraw your consent at any time by contacting us at Privacy@RunViably.com.

Personal Information We Collect When You Use Our Services.

• Location Information. When you use our Services, we receive your precise location information. We also infer your general location information, for example, by using your internet protocol (IP) address.
• Device Information. We receive information about the device and software you use to access our Services, including IP address, web browser type, operating system version, phone carrier and manufacturer, application installations, device identifiers, mobile advertising identifiers, and push notification tokens.
• Usage Information. To help us understand how you use our Services and to help us improve them, we automatically receive information about your interactions with our Services, like the pages or content you view and the dates and times of your visits.

• ChatBot Technology.  We use chatbots to help provide customer service and support, including through the use of a virtual assistant. A chatbot is a software application that mimics human conversations in text interactions on our website. It enables the communication between a human and a machine, which can take the form of messages or voice commands. The chatbot is designed to work without the assistance of a human operator. It responds to questions posed to it in natural language as if it were a real person using a combination of pre-programmed scripts, machine learning, and generative artificial intelligence (“AI”). When asked a question, the chatbot will answer using the knowledge database that is currently available to it. If the conversation introduces a concept the chatbot is not programmed to understand, it will advise of its limitations. The chatbot functionality may not be monitored in real time. If you use our chatbot service, we will collect and maintain any information you provide to us when using the chatbot. You are responsible for the information you share with the chatbot, and we strongly advise you not to input sensitive or personal information, such as financial or account details or other confidential information. We will also create and store a transcript of your chat interaction with us, which will be stored by our third-party service provider. We may use these transcripts and the information you provide for quality control, customer service, fraud prevention, and security.
• Information from Cookies and Similar Technologies. We and our third-party partners collect information using cookies, pixel tags, or similar technologies. Our third-party partners, such as analytics and advertising partners, may use these technologies to collect information about your online activities over time and across different services. Cookies are small text files containing a string of alphanumeric characters. We may use both session cookies and persistent cookies. A session cookie disappears after you close your browser. A persistent cookie remains after you close your browser and may be used by your browser on subsequent visits to our Services.  Please review your web browser’s “Help” file to learn the proper way to modify your cookie settings. Please note that if you delete or choose not to accept cookies from the Services, you may not be able to utilize the features of the Services to their fullest potential. 
• Purchases, Transactions, Accounts, and Information About Your Business. When you use our Services, we may receive information about your business, payments, sales, transactions, and accounts, either directly from you or from, for example, our financial partners, card network partners, merchants, or service providers. For example, we may receive your payment method information, transaction amount, transaction date, transaction location, information generated when a payment or purchase is made, account balances, revenues, income, expenses and other relevant information about your use of our Services. Without this information, we cannot process your transactions, which may prevent you from purchasing our products or services.

Third-Party Account. If you choose to link the Services to a third-party account, you authorize us to collect, store, and use any information they may give us. For example, we may receive additional information about you and your company, such as email address, information about your company’s financial accounts and transaction data, business records, and other relevant information about your business.

Legal Basis: When we process this Personal Data that is generated from cookies and similar technologies for the purpose of developing and improving our products and services and/or to advertise to you, we do so based on your consent. When we process this Personal Data, which is not generated from cookies and similar technologies, and/or for the purpose of preventing fraud, we do so based on our legitimate interests to develop and improve our products and services, market our own products and to prevent fraud. We will only use your Personal Data for marketing third parties' products and Services if you have given your consent.

You may withdraw your consent at any time by sending an email to the address: Privacy@RunViably.com. We will process your request as soon as reasonably possible, however it may take a few days for us to update our records before any opt-out is effective. Additional information regarding Our Marketing Activities is provided below.

How We Use the Information We Collect

We use the information we collect:

• To provide, maintain, improve, and enhance our Services;
• To personalize your experience on our Services such as by providing tailored content and recommendations;
• To understand and analyze how you use our Services and develop new products, services, features, and functionality;
• To communicate with you, provide you with updates and other information relating to our Services, provide information that you request, respond to comments and questions, and otherwise provide customer support;
• For marketing and advertising purposes, such as developing and providing promotional and advertising materials that may be relevant, valuable or otherwise of interest to you;
• To send you text messages and push notifications;
• To facilitate transactions and payments;
• To find and prevent fraud, and respond to trust and safety issues that may arise;
• For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or request by any judicial process or governmental agency; and
• For other purposes for which we provide specific notice at the time the information is collected.

How We Share the Personal Information We Collect

Viably is committed to protecting your privacy and will not share or disclose information about you, unless permitted under the following terms and/or circumstances:

• Affiliates. We may share any Personal Information we receive with our affiliates, where this is necessary to provide you with the Services and so that we can manage our business, such as to keep updated records of our users.
• Vendors and Service Providers. We may share your Personal Information we receive with vendors and service providers retained in connection with the provision of the Services, which act as an independent, separate controller of your Personal Information and may use such information to offer you third-party products and services. We share your Personal Information with vendors and service providers where this is necessary to provide you with the Services and so that we can manage our business and as part of our contractual relationships.
• Network Partners. When you use the Services to submit a funding request, we disclose your Personal Information to funding providers and other third parties in our network (collectively, “Network Partners”) as necessary to deliver the products and services that you requested. We may disclose your personal information to Network Partners to provide you with information about financial products and services that may interest you. Note that Network Partners that interact with you may use and/or retain your personal information whether or not you use their services and their handling of your personal information is subject to their privacy policies. Our Network Partner list may be updated from time to time, and we encourage you to review the list periodically to remain informed about with whom we share information. They are committed to using your Personal Data solely for the specified purposes. They implement appropriate security measures, such as encryption and access controls, to protect your data.
• Financial and Business Partners. We may share your Personal Information we receive with our financial institution and business partners, such as banks, card issuing partners, bank technology platform providers, credit bureaus and reporting agencies, marketplaces and other entities used or retained in connection with the provision of the Services. We disclose your personal information to other financial companies with whom we engage in joint marketing efforts or who offer financial-related products or services that may be of interest to you. They implement appropriate security measures, such as encryption and access controls, to protect your data.
• Analytics Partners. We use analytics services such as Google Analytics to collect and process certain analytics data. These services may also collect information about your use of other websites, apps, and online resources. You can learn more about Google’s practices by visiting https://www.google.com/policies/privacy/partners/. They implement appropriate security measures, such as encryption and access controls, to protect your data.
• Advertising Partners. We work with third-party advertising partners to show you ads that we think may interest you. Some of our advertising partners are members of the Network Advertising Initiative (https://optout.networkadvertising.org) or the Digital Advertising Alliance (https://optout.aboutads.info). If you do not wish to receive personalized ads, please visit their opt-out pages to learn about how you may opt out of receiving web-based personalized ads from member companies. You can access any settings offered by your mobile operating system to limit ad tracking, or you can install the AppChoices mobile app to learn more about how you may opt out of personalized ads in mobile apps. They implement appropriate security measures, such as encryption and access controls, to protect your data.
• As Required by Law and Similar Disclosures. We may access, preserve, and disclose your Personal Information if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety. For the avoidance of doubt, the disclosure of your information may occur if you post any objectionable content on or through the Services.
• Merger, Sale, or Other Asset Transfers. We may transfer your Personal Information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we (or any of our affiliates) are acquired by or merged with another company (in whole or in part) or we sell, liquidate, or transfer all or a portion of our (or an affiliates’) assets. The use of your Personal Information following any of these events will be governed by the provisions of this Privacy Policy in effect at the time the applicable information was collected.
• Consent. We may also disclose your information with your permission.

International Transfers of Personal Data

If you are located in the EU, when we share your Personal Data with third party service providers based outside of the European Economic Area ("EEA"), the service provider will either be located in a jurisdiction where the EU has determined that it is acceptable to store such information in accordance with an adequacy decision or we will sign on agreements that require them to comply with applicable law, keep your Personal Data secure at similar levels to the level described in the Privacy Policy.  In such cases, we rely on the security measures taken by such providers for the physical security, integrity, redundancy, and the data protection of the data that relates to your Personal Information. You agree to such transfer and/or storage of Personal Information, and we take the necessary measures to ensure a sufficient level of protection in accordance with applicable laws. Accordingly, we will implement the following safeguards:

• When we transfer your Personal Data to Israel, we rely on the decision by the European Commission that says that those countries are considered to provide an adequate level of data protection.
• Where we transfer your Personal Data to other countries, we (i) take additional security measures to protect the data and (ii) use specific contracts approved by the European Commission, known as the Standard Contractual Clauses, to give your Personal Data the same protection it has in the EEA.

In certain cases, we may transfer your Personal Data to countries outside the EEA based on your explicit consent. You have the right to withdraw your consent at any time. For more information, please contact us at Privacy@RunViably.com. Please contact us at Privacy@RunViably.com if you would like further information on the specific mechanism used by us when transferring your Personal Data out of the EEA.

Your Choices

Marketing Communications. You can unsubscribe from our promotional emails via the link provided in the emails. Even if you opt out of receiving promotional messages from us, you will continue to receive administrative messages from us.

Location Information. You can prevent your device from sharing precise location information at any time through your device’s operating system settings.

Personal Information. You may request the deletion of your personal information that is collected or maintained by us by submitting such a request to us at Privacy@runviably.com.

Third Parties

Our Services may contain links and integrations to other websites, products, or services that we do not own or operate.  We are not responsible for the privacy practices of these third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.

Security

We make reasonable efforts to protect your information by using safeguards designed to improve the security of the Personal Information we maintain. However, as no electronic transmission or storage of information can be entirely secure, we can make no guarantees as to the security or privacy of your information. As a result, while we strive to protect your Personal information, we cannot ensure the security and privacy of your Personal Information or other content you may have provided while using the Services, and you do so at your own risk and free will. We encourage you to exercise discretion regarding the Personal Information you choose to disclose.

The security of your Personal Information also depends on the security of the devices you use and the way in which you protect your user IDs and passwords. The measures we take include:

• Technical Measures. The electronic safeguards we employ to protect your Personal Information include secure servers, firewalls, and antivirus protections.
• Access Control. We limit access to your Personal Information only to authorized personnel who have a need to know, including account managers, customer support staff, and software developers. We review these permissions regularly and revoke an employee's access immediately after his/her termination.
• Internal Policies. We maintain and regularly review and update our privacy related and information security policies.
• Personnel. We require employees to sign non-disclosure agreements according to applicable law and industry customary practice.
• Database Backup. Our databases are backed up and verified regularly. Backups are encrypted and stored within the production environment to preserve their confidentiality and integrity.

Your Rights 

How to Access and Limit Our Use of Certain Personal Data

Depending on which laws apply, you have certain legal rights over your Personal Data. Below is some general information about rights that may apply to you, but we recommend checking the law or consulting with a lawyer to understand what applies in your specific case. To exercise your rights, please contact us at Privacy@RunViably.com. If you want to exercise your rights regarding your Personal Data held by other controllers you can contact the applicable controller directly. We may ask for reasonable evidence to verify your identity before we can comply with any request.

• Right of Access. You may have a right to know what Personal Data we collect about you. In certain circumstances we may charge you with a fee to provide you with this information, if permitted by law. If we are unable to provide you with all the information you request, we will do our best to explain why. See Article 15 of the GDPR for more details, if your Personal Data is subject to GDPR.
• Right to Correct Personal Data. You may request a review and rectification (including correction and update) of your Personal Data. We update, complete, correct or delete inaccurate, incomplete, or outdated Personal Data. See Article 16 of the GDPR for more details, if your Personal Data is subject to GDPR.
• Deletion of Personal Data ("Right to Be Forgotten"). You may have the right to request that we delete your Personal Data. Note that we cannot restore information once it has been deleted. Even after you ask us to delete your Personal Data, we may be allowed to keep certain data for specific purposes under applicable law. See Article 17 of the GDPR for more details, if your Personal Data is subject to GDPR. If you wish to delete your account and Personal Data, contact us at Privacy@RunViably.com.
• Right to Restrict Processing.  If your Personal Data is subject to the GDPR, you may have the right to ask us to stop processing your Personal Data. See Article 18 of the GDPR for more details, if your Personal Data is subject to GDPR.
• Right to Data Portability. If your Personal Data is subject to the GDPR, you may have the right to request that we provide you with a copy of the Personal Data you provided to us in a structured, commonly used, and machine-readable format. See Article 20 of the GDPR for more details, if your Personal Data is subject to GDPR.
• Right to Object. If your Personal Data is subject to the GDPR, you may have the right to object to certain processing activities. See Article 21 of the GDPR for more details, if your Personal Data is subject to GDPR.
• Withdrawal of Consent. If we are processing your Personal Data based on your consent, you are always free to withdraw your consent, however, this won't affect processing we have done before you withdrew your consent by the "unsubscribe" button or contacting us at Privacy@RunViably.com. Please note that withdrawing consent may affect our ability to provide certain services. You will receive confirmation once your consent has been withdrawn.
• Right to Lodge a Complaint with Your Local Data Protection Authority. If your Personal Data is subject to the GDPR, you have the right to submit a complaint regarding the processing of your Personal Data by us to the relevant data protection authority if you have any concerns about how we are processing your Personal Data, you are entitled to report such dissatisfaction to the applicable supervisory authority in your country of residence. Although we kindly ask that, as a courtesy, you please attempt to resolve any issues with us first.

Data Retention

We may retain all or any part of the Personal Data we collect or that you share with us for as long as required for the provision of our services or if it is necessary to fulfil the purpose for which the information has been collected as stated above. In addition, we may also retain such information for as long as required to comply with our legal or business requirements or obligations, to resolve disputes, to enforce our Terms, all as permitted under any applicable laws. Statistics and analysis that have been anonymized may be saved thereafter and may remain on our servers indefinitely.

When deciding how long to store Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized access, the purposes for which the Personal Data was collected, as well as applicable legal requirements. Please note that we may delete information from our systems without notifying you first. Retention by any of our service providers or subcontractors may vary in accordance with each business's retention policy.

In some circumstances, we may store your Personal Data even after we're finished using it if required to do so by law (e.g. to fulfill tax or audit requirements) or to keep accurate records of our interactions in case there is a prospect of litigation relating to your Personal Data. In such cases, we will maintain the same security measures as described above.

Please contact us at Privacy@RunViably.com if you would like details about the retention periods for each type of Personal Data we process.

Children’s Privacy

We do not knowingly collect, maintain, or use personal information from children under 18 years of age, and no part of our Services is directed to children. If you learn that a child has provided us with personal information in violation of this Privacy Policy, then you may alert us at Privacy@RunViably.com.

Information on our Storage and Servers for our International Visitors

The Services are hosted in the United States at Amazon Web Services (AWS). The provider is the Amazon Web Services Inc., 410 Terry Avenue North, Seattle, WA 98109-5210, United States . If you choose to use the Services from the European Union or other regions of the world with laws governing data collection and use that may differ from U.S. law, then please note that you are transferring your personal information outside of those regions to the United States for storage and processing. The transfer of data to the US is based on the EU’s standard contractual clauses . For details please consult: New Global AWS Data Processing Addendum | AWS Security Blog. AWS is also certified in accordance with the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the US, which is intended to ensure compliance with European data protection standards for data processing in the US. Every company certified under the DPF is obliged to comply with these data protection standards. For more information:  https://www.dataprivacyframework.gov/participant/5776 and the AWS Data Privacy Notice: AWS Privacy. Also, we may transfer your data from the U.S. to other countries or regions in connection with storage and processing of data, fulfilling your requests, and operating the Services. By providing any information, including personal information, on or to the Services, you consent to such transfer, storage, and processing.

Changes to this Privacy Policy

We will post any adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or share personal information previously collected from you through the Services, we will notify you through the Services, by email, or other communication.

Contact Information

If you have any questions, comments, or concerns about our processing activities, please email us at Privacy@RunViably.com.

Last Updated:      February 3, 2025