Privacy policy

Effective June 17, 2026

1. Scope

This policy applies to information we process as a business for our own websites and platform. When we process personal information on behalf of an institution that builds on A8 Core™, we act as a service provider / processor, and that institution’s privacy notice and our data-processing agreement govern that processing.

2. Information we collect

We collect information you provide directly (such as name, email, company, and content of messages), information collected automatically (such as device, log, and usage data, and cookies — see our cookies policy), and information from third parties (such as identity-verification, fraud-prevention, and analytics providers).

For account-related processing on the platform, we may handle identity, financial-account, and transaction data as directed by the institution that owns the account.

3. How we use information

• To provide, secure, and improve the Services;
• To authenticate requests and prevent fraud and abuse;
• To meet legal, regulatory, and compliance obligations (including KYC/AML and recordkeeping);
• To communicate with you about the Services; and
• With your consent, for marketing — which you can withdraw at any time.

4. How we share information

We share information with service providers and subprocessors under contract, with financial-institution partners as needed to deliver the Services, to comply with law or valid legal process, and in connection with a merger, acquisition, or financing. We do not sell personal information.

5. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to opt out of certain sharing. California residents have rights under the CCPA/CPRA, and EEA/UK residents under the GDPR. To exercise a right, email privacy@a8core.com. We will not discriminate against you for exercising these rights.

6. Data security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest and least-privilege access controls. See our security policy and trust center. No method of transmission or storage is completely secure.

7. Retention

We retain personal information for as long as needed to provide the Services and to satisfy legal, accounting, and compliance obligations — which, for certain financial records, may be several years — after which we delete or de-identify it.

8. International transfers

We may process information in the United States and other countries. Where required, we use appropriate safeguards such as Standard Contractual Clauses for cross-border transfers.

9. Children

The Services are not directed to children under 13 (or the age defined by local law), and we do not knowingly collect their information except in the context of lawful custodial-account processing directed by an institution.

10. Changes

We may update this policy from time to time. Material changes will be posted here with a new effective date.

Questions about this policy? Contact legal@a8core.com or write to Financial Infrastructure, Inc., PO Box 1410, Menlo Park, California 94026-1410.