Privacy Policy

1. Who we are and what this policy covers

Exit Global, Inc., a Delaware corporation ("Exit Global," "we," "us," or "our"), operates ExitGlobal Private Office. This policy explains how we collect, use, disclose, retain, and protect personal information through Private Office, websites that display or link to this policy, and related account and support communications (the "Services").

Private Office supports entity management, contracts, financial records, documents, and connected financial account information. Personal information includes information about identifiable individuals contained in business or financial records.

Exit Global is responsible for the processing described in this policy. Where we process records solely on a business customer's instructions, our agreement with that customer also governs that processing. Questions and privacy requests can be sent to hello@exitglobal.app.

2. Information we collect

• Account and contact information: name, email address, company, account identifiers, invitation and membership status, and access permissions.
• Business records and documents: information you enter or upload about entities, ownership, contracts, payments, transactions, profit-sharing arrangements, and supporting records. Documents may contain tax, identification, or other sensitive information if you choose to include it.
• Connected financial information: account and transaction information from connections you authorize, described in Section 4.
• Security information: authentication events, passkey public keys and credential identifiers, device labels you provide, and session information. If you use a device fingerprint or face recognition to unlock a passkey, that biometric verification occurs on your device; Exit Global does not receive the fingerprint or face template through the passkey process.
• Communications and technical information: support messages, IP addresses, browser and device information, and operational and security logs generated by the Services and their infrastructure.

We obtain information from you, people authorized to provide it, sign-in providers, financial institutions and connection providers you authorize, and operation of the Services. Provide information about other people only when you have authority to do so and have given any notices required by law. Avoid uploading sensitive information that is unnecessary for your use of the Services.

3. How we use information

We use personal information to create and administer accounts; authenticate users and manage access; organize and display the records you provide; retrieve authorized financial account information; respond to support requests; send account and security communications; troubleshoot and maintain the Services; prevent fraud and unauthorized access; and comply with legal obligations, resolve disputes, and enforce agreements.

We do not sell personal information collected through the Services or share it for cross-context behavioral advertising. We do not use connected financial information for targeted advertising. The current Private Office does not use connected bank information to make automated lending, employment, housing, or insurance eligibility decisions.

4. Plaid and financial account connections

When you choose to connect an account through Plaid, we use Plaid Inc. ("Plaid") to facilitate the connection and retrieve information for the features you select. Depending on your authorization, institution, and available data, we may receive:

• Institution and account names, account identifiers, account types, and masked account numbers.
• Current and available balances and currencies.
• Transaction amounts, dates, descriptions, merchants, categories, pending status, and available payment references.

The current integration displays balances and transaction history. It does not initiate payments or move money. Historical coverage depends on your financial institution and connection.

You authorize access through Plaid Link and, where applicable, your financial institution's authorization process. Exit Global does not receive your bank login password through this integration. We store connection identifiers, account summaries, and encrypted access tokens needed to retrieve authorized information. Transactions are retrieved on demand for display; they are not automatically imported into your manually maintained bookkeeping register.

Plaid's collection, use, and disclosure of information is described in its End User Privacy Policy. Your financial institution's terms govern its own processing.

Connecting a financial account is optional. While your connection remains authorized, we may retrieve updated information when you use connected features. Features that depend on the connection will be unavailable if you decline or disconnect.

Disconnecting and requesting deletion

Use the disconnect control in Private Office's Connections area or email hello@exitglobal.app for assistance. A successful Plaid disconnection revokes the application's connection through Plaid and removes its stored connection record and access token. If disconnection reports an error, contact us or manage access through your financial institution or Plaid.

Disconnecting does not automatically delete separately entered records, uploaded documents, or copies you exported. Request deletion of information held by Exit Global using the contact above. You may also use the Plaid Portal to manage supported connections and request deletion of information held by Plaid. Deleting information with one provider does not necessarily delete copies held by another.

If you use another available financial connection, such as a direct Mercury connection, we process the authorized account information for the same display and record-management purposes. That provider's own privacy terms apply to its processing. For a direct Mercury connection, disconnecting removes Exit Global's stored credentials; you can also revoke authorization through Mercury.

5. Consent and legal grounds

We obtain your authorization before connecting a financial account. Where consent is legally required for another activity, we request it separately. This policy provides notice of our practices and does not itself constitute consent to every processing activity.

Where applicable law requires a legal basis, we process information as necessary to provide contracted Services, comply with legal obligations, or pursue legitimate interests in administering, maintaining, and protecting the Services, subject to your rights and interests. We rely on consent where required.

You may withdraw consent through available controls or by contacting us. Withdrawal does not affect earlier lawful processing. We may retain information where another legal basis permits or requires it. If information is needed for a requested feature, declining to provide it may prevent us from providing that feature.

6. When we disclose information

We disclose information as appropriate for the purposes described in this policy to:

• Service providers supporting hosting, storage, authentication, communications, technical support, and security.
• Financial connection providers, including Plaid, when you authorize a connection.
• Authorized recipients you instruct or permit us to share information with.
• Professional advisers and authorities, where necessary for legal advice, lawful requests, compliance, or protecting rights and safety.
• Business transaction parties, in connection with a proposed or completed merger, acquisition, financing, or asset transfer, subject to appropriate confidentiality protections and applicable law.

Access to Private Office records is restricted by account and workspace permissions. Provider access is limited to the purposes for which the provider is engaged, subject to applicable agreements and any independent obligations described in the provider's privacy terms.

7. Cookies and similar technologies

Private Office uses cookies and related technologies for authentication, financial connection authorization, security, and session management. We do not embed advertising pixels or third-party behavioral analytics in the current Private Office application or this policy page. Hosting and connection providers may process technical information to operate and protect their services.

You can manage cookies through your browser. Blocking essential cookies may prevent sign-in or account connections from working. Plaid Link and financial institution pages may use their own technologies under their respective privacy notices.

8. Retention and deletion

We use the following criteria to determine how long information is needed:

• Account profiles and workspace records: retained while needed to provide your account and preserve the records you maintain through the Services. Account closure or a verified deletion request triggers a review for deletion, subject to the exceptions below.
• Uploaded documents: retained to support the records and services for which they were provided. Removing a reference to a document or resetting workspace records does not itself erase the stored file; contact us to request deletion of stored documents.
• Financial connections: connection credentials and account summaries are retained while needed for the authorized connection. A successful disconnect removes the active connection record. Separately saved records are handled under the workspace and document criteria above.
• Authentication and security records: retained as needed to administer access, detect and investigate misuse, and resolve security incidents. Expired sessions no longer authorize access; expiration does not necessarily mean immediate physical deletion of every associated record.
• Support, compliance, and dispute records: retained while needed to resolve the matter, satisfy applicable recordkeeping obligations, or establish, exercise, or defend legal claims.

Send account closure or deletion requests to hello@exitglobal.app. Requests are handled through support and may require identity verification. We assess the records involved, remove information that is no longer needed, and explain any lawful reason for retaining information. We respond within the time required by applicable law.

Information subject to legal obligations, fraud investigations, disputes, or legal holds may be retained for those purposes. Residual copies may remain in service-provider backups until overwritten or expired under the provider's recovery process. Deletion from active systems does not promise immediate erasure of every backup. Copies you export or share outside the Services remain under the control of their recipients.

9. Security

We use safeguards designed to protect personal information, including authenticated access, workspace restrictions, passkey verification, and encryption of stored financial connection tokens. No system is completely secure. Protect your email account, devices, and credentials, and notify us promptly of suspected unauthorized access.

10. Your choices and privacy rights

Depending on your location and applicable law, you may have rights to access or obtain a copy of personal information, correct inaccuracies, request deletion, receive information in a portable format, restrict or object to processing, withdraw consent, or opt out of certain uses or disclosures. These rights are subject to applicable exceptions.

Email hello@exitglobal.app with your request and enough information to identify your account. Do not send bank passwords or unnecessary sensitive documents. We may verify your identity and, where relevant, an authorized representative's authority. If we deny a request, you may ask us to review the decision by replying with the subject "Privacy appeal." We will explain available appeal rights and respond within applicable legal time limits.

You may also complain to your state attorney general or other relevant privacy regulator. Where European or UK data protection law applies, you may complain to the supervisory authority in your place of residence, work, or the alleged infringement. We will not unlawfully discriminate against you for exercising privacy rights.

If a business customer controls the records involved, we may refer your request to that customer and assist as required by our agreement and applicable law.

11. International processing

Exit Global is based in the United States. Information may be processed in the United States and other countries where our service providers operate. Privacy laws in those countries may differ from those in your country. We do not promise that information stays in a particular country.

Where international transfer restrictions apply, transfers must have a permitted legal basis and any required safeguards, such as applicable contractual protections. Contact us for information about the arrangements relevant to your data. This policy does not claim that Exit Global holds a privacy certification or that use of the Services alone constitutes consent to an international transfer.

12. Children

The Services are intended for adults and business users, not children under 18. We do not knowingly collect personal information directly from children using the Services. If you believe a child has provided personal information to us, contact us so we can investigate and take appropriate action.

13. Changes to this policy

We may update this policy as our Services or practices change. We will publish the updated policy with a revised effective date and provide additional notice or request consent where required by law.

14. Contact us