MidPay Privacy Policy

Last Updated: June 25, 2025

MidPay, Inc. ("MidPay" or "we", "us" or "our") is committed to respecting your privacy. We will only use your Personal Data in accordance with the terms of this Privacy Policy ("Policy"). This Policy describes how we collect, use, protect and disclose Personal Data received from your use of our websites, including, but not limited to, midpay.ai, app.midpay.ai, along with the features, functionalities, applications, browser extensions and other services available through our website (collectively, our "Websites") and your use of our products and services (our "Services"). We refer to our Websites and Services collectively as our "Platform."

You can access and interact with our Platform in many ways, including from a computer or mobile device. This Policy applies regardless of how you access or interact with our Platform. Depending on how you interact with our Platform, there may be some cases where we need to provide you with additional information about how we use your Personal Data and/or what options you have regarding our use of your Personal Data. We may provide this additional information via notices on the Platform or via direct communications with you. If we do this, unless we tell you otherwise, the additional information will apply in addition to what is described in this Policy.

Please read this Policy carefully. If you do not want us to collect, use or disclose your Personal Data in the ways described in this Policy, please do not use our Platform, provide us with your Personal Data or authorize a third party to make your Personal Data available to us. By using the Platform, providing us with your Personal Data or otherwise making your Personal Data available to us, you acknowledge that you understand that we may use your Personal Data as described in this Policy. If you have any questions about how we collect, use, protect, disclose or otherwise process Personal Data, including whether we have received your Personal Data from a third party, please contact us by email at support@midpay.ai.

1. PERSONAL DATA WE COLLECT

Our primary goals in collecting Personal Data are to provide and improve our Platform, to conduct our operations, to communicate with you and to enable visitors to our Platform to enjoy and easily navigate it. This section describes what Personal Data we collect.

When we refer to "Personal Data" in this Policy, we mean information that identifies, relates to, describes or is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a specific person. This might be information that directly identifies someone, such as their name, or it may be information that identifies someone only when combined with other information available to us. Please note, except as provided under applicable laws, Personal Data does not include information that is publicly available through government records or information that has been deidentified or aggregated in a way that it cannot be used to identify a specific individual.

1.1 Categories of Personal Data We Collect

Depending on the type of activity you are performing on the Platform or how you use or interact with our Platform, we may collect and disclose the following Personal Data:

(a) identifiers and contact information, such as your real name, alias, email address, telephone number, postal address, physical address, unique personal identifier, government-issued identification numbers, date of birth, online identifier, IP address and other similar information;

(b) financial information, such as bank account number, account balances, income, expenses, purchases, credit card number, debit card number, digital wallet information and similar types of information;

(c) Platform account information, such as your username, password, account activity and similar information;

(d) online identifiers you use, such as your username, social media handles and similar information;

(e) communication information, such as information contained in voice mails, chats, emails, and other similar information;

(f) third-party financial account information, such as your user IDs, passwords and similar information; and

(g) other information you or third parties provide us.

1.2 Usage Information

We may collect information about the devices that access or interact with our Platform ("Usage Information"), which may include:

(a) device information, such as the IP address, general geographic location, operating system, browser type, language preferences, mobile phone number, device identifier and other similar information associated with a computer or mobile device used to access or interact with our Platform;

(b) information about interactions with our Platform, such as links that are clicked, pages or screens that are viewed, access and session times, interactions with emails we send, and other similar information associated with activities on our Platform;

(c) information about Internet and network activity, such as websites visited, search engine results and similar information associated with a computer or mobile device that accesses or interacts with our Platform;

(d) information automatically collected by cookies and other technologies on our Platform; and

(e) any other information that a computer or mobile device automatically sends whenever connected to a website or an online application.

Usage Information, by itself, generally does not identify the specific person using the computer or mobile device that generated it. This means that Usage Information usually will not be considered Personal Data and our use of such Usage Information is not subject to this Policy. However, if we link Usage Information directly with other Personal Data or other information that could identify a specific person, we will treat the linked Usage Information as Personal Data and use the linked Usage Information in accordance with this Policy.

For more information about how we collect Usage Information, please see the "How We Collect Usage Information" section below.

2. HOW WE COLLECT PERSONAL DATA

2.1 Directly From You

When you engage with us in connection with our Platform, such as requesting information, creating an account, signing up to receive communications, communicating with us or otherwise interacting with us, we may ask you to provide certain Personal Data. Some of the Personal Data we request may not be required, however, we will specifically indicate what Personal Data is required to engage in such activity.

2.2 From Third Parties

We, or third parties acting on our behalf, may collect Personal Data about you from third parties, including, without limitation, online and offline sources, entities affiliated with us, our service providers, social media platforms, advertising networks and other public or commercial sources (collectively, "Third Party Sources"). In some cases, you may be able to revoke our access to your Personal Data and other content and information we receive from a Third Party Source by changing the appropriate settings for your account with that Third Party Source. The collection of Personal Data from these Third Party Sources can occur in a variety of ways, including, without limitation:

(a) We, or third parties acting on our behalf, may receive Personal Data about you from third parties that provide services to us through or in connection with our Platform ("Service Providers"). Service Providers may include, without limitation, third parties that host our Website, payment processing providers, and parties that provide us services related to emails and other communications we send and receive. In addition to others, some of our Service Providers include:

Twilio, Inc. – we use SendGrid, an email service provided by Twilio, Inc. ("Twilio"), to send out automated emails from our Platform, such as registration and welcome messages, basic notifications, and password resets. We also use Twilio to send text messages, including to remind you to make escrow deposits, provide secure links to access the MidPay application, and share project updates. We may receive certain Personal Data about you from Twilio, which may include, but might not be limited to metrics on email opens and clicks and on text message delivery. Additionally, we may provide Twilio with certain Personal Data where necessary for Twilio to provide its services, which may include, but might not be limited to phone numbers and email addresses. For more information about Twilio's practices with respect to its collection, use, disclosure, and storage of personal data Twilio receives in connection with the services it provides, please review Twilio's Privacy Notice, available at https://www.twilio.com/legal/privacy.

(b) We, or third parties acting on our behalf, may receive Personal Data about you from other Third Party Sources, such as other users of our Platform or those that refer you to us.

(c) Our collection, use, disclosure, and storage of the Personal Data we receive from Third Party Sources will be as described in this Privacy Policy.

2.3 Data Combination

Please note, we may combine the Personal Data and other content and information we receive about you from multiple sources, including, without limitation, Personal Data we collect directly from you and one or more Third Party Sources.

3. HOW WE COLLECT USAGE INFORMATION

3.1 Usage Data Collection Methods

We, and third parties acting on our behalf, collect Usage Data in a variety of ways. Some Usage Data, such as the IP address of a device attempting to access, use or interact with our Platform, is necessary for us to make certain portions of our Platform available. Other Usage Data, such as information about which features of our Platform are popular, helps us improve and advertise our Platform. This section describes the primary ways Usage Data is collected in connection with our Platform.

(a) The systems we use to make our Platform available to you. When you access, use, or interact with our Platform, these systems automatically record certain information that your browser or device sends whenever you visit a website or utilize an online application as well as information about how long your device is connected to our Platform and the activities that device engages in while connected.

(b) Cookies, which are small data files that are uploaded to the hard drive or other storage on devices that access, use, or interact with portions of our Platform. Among other things, cookies help us improve our Platform and our users' experience. We use cookies to see which areas and features are popular and to understand usage of our Platform. We use first party cookies, served directly by us to the devices that access our Platform, to recognize those devices when they revisit. We also use third party cookies, which are cookies that are placed by other parties we work with, such as Google, Plaid, and Twilio. These third parties may upload unique cookies to your device to collect information about your use of our Platform and potentially other online activities you engage in over time across different Platform and other online applications. The Options/Settings section of most internet browsers will tell you how to manage cookies and other technologies that may be uploaded to your device, including how to disable such technologies. You can disable our cookies, or all cookies, through your browser settings, but please note, disabling cookies may impact some of the features of our Platform and prevent them from operating as intended. You can learn more about cookies, including how to see what cookies have been uploaded to your device and how to manage and delete them, by visiting https://www.allaboutcookies.org/.

(c) Other tracking technologies, such as web beacons, clear gifs, and pixel tags. These technologies may be used on or in connection with our Platform, including, without limitation, in emails we send. We may use these technologies to deliver cookies, count visits, understand usage, and observe data on email delivery, open rates, click rates, bounces, unsubscribes and other information.

(d) Google Analytics. We may use tracking solutions provided through certain Third PartySources on our Platform, including, without limitation, Google Analytics, a web analytics service provided by Google, Inc. ("Google"). We use Google Analytics to assist us in understanding how our Platform is used. Google Analytics will place cookies on your computer or mobile device that will generate information that we select about your use of the Platform, including your computer's or mobile device's IP address. That information will be transmitted directly to and stored by Google. The information will be used for the purposes of evaluating use of our Platform, compiling reports on activity on our Platform for our use and providing other services relating to activity on, and usage of, our Platform. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. You may refuse the use of cookies by selecting the appropriate settings on your browser. Please note that by doing so, you may not be able to use the full functionality of our Platform. The use of cookies by Google Analytics is covered by Google's privacy policy, available at https://policies.google.com/privacy. Google allows you to opt out of Google Analytics. You may opt-out by visiting https://tools.google.com/dlpage/gaoptout.

(e) Do Not Track Signals. Please note, we have not yet developed a response to browser "Do Not Track" signals, and do not change any of our data collection practices when we receive such signals. We will continue to evaluate potential responses to "Do Not Track" signals in light ofindustry developments or legal changes.

4. HOW WE USE AND DISCLOSE PERSONAL DATA

We use and disclose Personal Data we collect for various purposes in connection with our Platform. This section describes the primary purposes for which we use the Personal Data we collect.

4.1 Operational Uses and Disclosures

We may use the Personal Data we, or third parties acting on our behalf, collect for non-marketing purposes, including:

•operating and improving our Platform;

•validating your identity;

•carrying out our obligations and enforcing our rights arising from any contracts we have entered into, including, without limitation, any contracts between you and us;

•sending you emails, text messages, or calls to provide you with alerts and updates about your engagement with our Platform;

•conducting statistical or demographic analysis;

•complying with legal and regulatory requirements;

•customizing your experience with our Platform;

•protecting and defending MidPay against legal actions or claims;

•preventing fraud;

•satisfying contractual obligations;

•cooperating with law enforcement or other governmental agencies for purposes of investigations, national security, public safety or matters of public importance when we are legally required to do so or believe that disclosure of Personal Data is necessary or appropriate to protect the public interest;

•registering or servicing your online account;

•contacting you about or in response to questions or other correspondence we receive from you;

•providing customer service;

•facilitating your use of features on the Platform, including, without limitation, linking your third party financial accounts with your account on the Platform and withdrawing funds from, and depositing funds into, those third party financial accounts;

•those you authorize or instruct us to do; and

•other business purposes permitted under applicable law.

4.2 Marketing Purposes

We may use the Personal Data we, or third parties acting on our behalf, collect to send you marketing communications about our Platform, including, without limitation, information about new features, updates, promotions, and other information we think may be of interest to you. We may send these marketing communications via email, text message, phone call, or other methods. You may opt out of receiving marketing communications from us by following the unsubscribe instructions in the communications we send or by contacting us at support@midpay.ai.

4.3 Disclosure to Third Parties

We may disclose Personal Data to third parties in the following circumstances:

(a) Service Providers: We may disclose Personal Data to our Service Providers who need access to such information to perform services on our behalf.

(b) Business Transfers: We may disclose Personal Data in connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.

(c) Legal Requirements: We may disclose Personal Data when required by law or in response to valid legal process, such as a subpoena, court order, or government request.

(d) Protection of Rights: We may disclose Personal Data to protect our rights, property, or safety, or the rights, property, or safety of our users or others.

(e) Consent: We may disclose Personal Data with your consent or at your direction.

5. DATA RETENTION

We retain Personal Data for as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention period depends on the type of Personal Data and the purposes for which it is used. When Personal Data is no longer needed, we will securely delete or anonymize it.

6. DATA SECURITY

We implement appropriate technical and organizational measures to protect Personal Data against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

7. YOUR RIGHTS AND CHOICES

Depending on your location and applicable law, you may have certain rights regarding your Personal Data, including:

•The right to access your Personal Data

•The right to correct inaccurate Personal Data

•The right to delete your Personal Data

•The right to restrict processing of your Personal Data

•The right to data portability

•The right to object to processing of your Personal Data

To exercise these rights, please contact us at support@midpay.ai. We will respond to your request in accordance with applicable law.

8. INTERNATIONAL DATA TRANSFERS

Your Personal Data may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws than your country. When we transfer Personal Data internationally, we implement appropriate safeguards to protect your Personal Data.

9. CHILDREN'S PRIVACY

Our Platform is not intended for children under the age of 18. We do not knowingly collect Personal Data from children under 18. If we become aware that we have collected Personal Data from a child under 18, we will take steps to delete such information.

10. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. When we make changes, we will post the updated Privacy Policy on our Platform and update the "Last Updated" date. Your continued use of our Platform after the changes become effective constitutes your acceptance of the updated Privacy Policy.

11. CONTACT US

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

MidPay, Inc.

971 US Highway 202 N #4103

Branchburg, NJ 08876

Phone: 551-391-2888

Email: support@midpay.ai

For legal matters:

Email: legal@midpay.ai

Last Updated: June 25, 2025

*By using the MidPay Platform, you acknowledge that you have read, understood, and agree to be bound by these Privacy Policy