Privacy Notice

Last Updated: October 2026

The purpose of this Privacy Policy (also referred to as a Privacy Notice) is to inform you about how we use Personal Data (as defined below) in compliance with applicable privacy laws, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), and other relevant regulations.

Throughout this Privacy Notice, the terms "we," "us," and "our" collectively refer to DASTA, Inc. and its subsidiaries, dub Financial, LLC and dub Advisors, LLC (referred to as "dub").

Online Privacy Notice

This Privacy Policy applies to all individuals who use dub's mobile app and website. Please see below for additional information related to Personal Data collected through dub's AI-powered Support Assistant and through our text messaging program.

Personal Data

Personal Data refers to personally identifiable information that can reasonably identify you as an individual. This includes information you provide about yourself as well as personal information of individuals associated with you, such as trustees, representatives, investors, clients, beneficial owners, or agents. A "Data Subject" is an individual who is identified or can be directly or indirectly identified. Personal Data includes pseudonymized identifiers, such as a hashed version of your email address, where those identifiers can be matched back to you.

dub acts as a "business" or "data controller" for Personal Data under various legal frameworks, including the CCPA. dub's affiliates and delegates may act as "data processors" or "service providers." This directly applies to you as a natural person.

What Personal Data do we collect and how?

We collect the following types of Personal Data:

• Identifiers such as your name, postal address, social security number, mobile phone number, email address, and contact details, as well as a hashed (pseudonymized) version of your email address that we generate for advertising measurement and audience management. We do not create or use hashed versions of your mobile phone number for advertising or marketing.
• Device and online identifiers, including IP address, mobile advertising identifiers (such as IDFA and IDFV), device identifiers, and session identifiers.
• Information classified as personal or protected by state or federal law, including nationality, place, and date of birth.
• Commercial information, including tax information, bank account details, source of funds details, investment activity-related information, and transaction history.
• Internet or electronic network activity information, including browsing history, search history, interaction with websites, applications, advertisements, and in-app behavior such as which portfolios you view, copy, or interact with.
• Visual information, including your signature.
• Professional or employment-related information, including your employment, employer's name, and income.
• Inferences drawn from your personal information to create a profile reflecting your preferences, used for personalization, win-back campaigns, and targeted marketing.

We collect this Personal Data through various means, including:

• Directly from you: when you create a profile, invest in securities, subscribe to services, opt in to text messages, or provide customer service communications.
• Indirectly from other sources: including public records, the Internet, or social media.
• Automatically through our app, website, and advertising technology: including software development kits (SDKs), pixels, and similar technologies that record your use of the app and website and, in some cases, convert an email address you enter into a web form into a hashed identifier. We do not collect your mobile phone number through advertising pixels or SDKs.
• Financial Account Linking: through Plaid, to link bank accounts. Plaid's privacy policy governs their use of data.
• Payments: through Stripe, which processes subscription payments.
• Data Routing and Marketing: through Segment, which routes customer data to our service providers and advertising partners, and Braze, which manages lifecycle email, push, and text message campaigns on our behalf. Text messages are delivered through Twilio.
• Attribution and Measurement: through AppsFlyer, which measures app installs, conversion events, and referral activity.
• Google Maps APIs: to offer address autocomplete and verification, subject to Google's Privacy Policy.

How and on what basis do we use Personal Data?

We use Personal Data for the following business purposes:

• Fulfilling obligations under the Customer Brokerage Agreement, Client Advisory Agreement, Terms of Use, and related agreements.
• Complying with legal and regulatory obligations, including AML, FATCA/CRS compliance, fraud and crime prevention, and tax reporting.
• Managing and maintaining customer relationships, providing service, and improving financial products.
• Communicating with you by email, push notification, and text message, including account alerts, security and verification codes, service notices, and, where you have opted in, marketing messages.
• Marketing and communications, including lifecycle email and text campaigns, targeted ads, cross-promotions, referral tracking (via AppsFlyer), and win-back campaigns.
• Advertising measurement and audience management, including measuring whether our advertising led to app installs, sign-ups, account approvals, deposits, or subscriptions; building audiences of existing customers so that we can exclude them from acquisition advertising; and, where permitted, building audiences for advertising. For these purposes we use only a hashed version of your email address and device identifiers. We never use your mobile phone number, in raw or hashed form, for advertising measurement, audience building, or any marketing purpose other than text messages you have opted in to receive. We record and honor your advertising consent choices, including device-level settings such as Apple's App Tracking Transparency.
• Sharing aggregated engagement data for the purpose of calculating creator/sponsor compensation.
• Investigating and asserting legal rights.
• Financial and regulatory accounting and reporting.
• Conducting compliance monitoring, training, and quality assessments, including Hadrius for securities transaction monitoring and Alloy for transaction monitoring of deposits/withdrawals.
• Recording certain user communications, including portfolio descriptions, user bios, and rebalance notes.
• Other purposes with your consent, when required.

With whom do we share Personal Data?

We do not sell Personal Data for money, and we have not done so in the past twelve (12) months. We do, however, "share" certain Personal Data for cross-context behavioral advertising as that term is defined under the CCPA. Specifically, in the past twelve (12) months we have disclosed hashed email addresses, device and online identifiers, and internet or electronic network activity information to advertising platforms for the purposes of measuring our advertising and managing advertising audiences. Your mobile phone number is never included in this sharing. You have the right to opt out of this sharing; see "Your Right to Opt Out of Sale or Sharing" below.

Your mobile phone number. We do not sell, share, rent, or otherwise disclose your mobile phone number, in raw or hashed form, to any third party for that party's marketing, advertising, or promotional purposes. We disclose your mobile phone number only to service providers acting on our behalf to verify your identity, secure your account, and deliver the messages you have requested, and to regulators or law enforcement as legally required.

We disclose Personal Data as follows:

• With service providers (e.g., accountants, attorneys, consultants, IT providers) who are contractually prohibited from using it for any purpose other than providing services to us.
• With service providers that operate our platform and communications, including Stripe, Plaid, Segment, Braze, Twilio, AppsFlyer, Hadrius, Alloy, and cloud providers such as AWS and Google Cloud Platform (GCP).
•  
• With advertising agencies that manage campaigns inside dub's own advertising accounts on our behalf, such as Newform and Juice. These agencies act under our instructions and do not receive your Personal Data for their own use.
• With advertising platforms, including Meta, Google, TikTok, Reddit, and tvScientific, which receive hashed email addresses, device identifiers, and conversion event information through tools such as the Meta Conversions API and website pixel, Google Enhanced Conversions and Customer Match, platform customer-list and custom-audience features, and AppsFlyer attribution postbacks. These platforms may use this information in accordance with their own privacy policies, which is why we treat this disclosure as "sharing" under the CCPA.
• With sponsors/creators, but only on an aggregated, non-identifiable basis (e.g., number of copiers, AUM, subscription revenue). Future versions of the platform may provide aggregated dashboards to creators/sponsors, without sharing identifiable user data.
• With regulators, law enforcement, or oversight bodies as legally required.
• With venture partners and investors, in connection with fundraising, but only aggregated metadata.
• In the case of a corporate transaction (e.g., merger, acquisition, financing, or sale of assets), in which case Personal Data may be transferred to the acquiring or successor entity subject to this Privacy Notice.

Text Messaging (SMS) Program

If you provide your mobile phone number and opt in, dub may send you text messages. These include transactional and account messages, such as verification codes, security alerts, trade and transfer confirmations, and service notices, and, only if you separately opt in, marketing and promotional messages. Message frequency varies [confirm: e.g., "up to X messages per month"]. Message and data rates may apply.

You can opt out of marketing text messages at any time by replying STOP to any message. You may continue to receive transactional and security messages necessary to service your account. For help, reply HELP or contact support@dubapp.com. Carriers are not liable for delayed or undelivered messages.

We use Braze to manage text message campaigns and Twilio to deliver messages. Both act as service providers on our behalf and may not use your information for any other purpose. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the sharing categories described in this Privacy Notice exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Your Right to Opt Out of Sale or Sharing

California residents, and residents of other states with similar laws, have the right to opt out of the "sale" or "sharing" of their Personal Data. You can exercise this right by [visiting the "Do Not Sell or Share My Personal Information" link in the app settings and website footer / emailing support@dubapp.com with the subject line "Do Not Sell or Share"]. We also honor opt-out preference signals such as Global Privacy Control (GPC) sent by your browser. Once we receive your request, we will stop sharing your hashed email address and device identifiers with advertising platforms and remove you from advertising audiences we have uploaded, except where retention is required by law. Opting out does not affect transactional communications or our use of your information to provide services to you.

Limit the Use of Sensitive Personal Information

We collect sensitive personal information, such as your social security number and financial account information, solely to provide our services, verify your identity, and comply with law. We do not use or disclose sensitive personal information for purposes that would require a right to limit under the CCPA.

Personal Data Collected through the AI-powered Support Assistant

When you interact with dub's AI-powered support assistant, we collect and process certain information to provide support, improve service quality, and maintain compliance with financial regulatory requirements. dub does not use the AI-powered support assistant to collect sensitive authentication information such as full Social Security Numbers, passwords, banking credentials, or payment information. The types of Personal Data collected through the AI-powered support assistant include:

• Chat content and interaction data, such as messages, inquiries, and feedback you submit through the in-app chat interface.
• Device and usage information, including timestamps, session identifiers, and interaction logs.
• Support-related account information, such as non-sensitive account metadata (e.g., account type, error messages, or platform version) needed to resolve issues.
• Verification data, such as your name and email, when applicable, to confirm your identity before providing account-specific information.
• Escalation and compliance data, such as chat transcripts that are reviewed by human support agents or retained to satisfy regulatory record-keeping obligations.

We use data from the AI Support Assistant to:

• Respond to support requests and improve the functionality of the dub platform and the AI-powered support assistant.
• Monitor and ensure compliance with regulatory requirements.
• Conduct training and quality assurance reviews of support interactions.
• Detect and prevent fraud, abuse, or unauthorized access.
• Analyze aggregated and anonymized interaction data to improve customer experience and system performance.

dub uses Zendesk AI and OpenAI to power certain chatbot functionalities.

• Zendesk AI processes chat interactions in accordance with its Trust & Security Standards (https://www.zendesk.com/trust-center/), stored in a SOC 2–compliant environment.
• OpenAI processes prompts temporarily and does not store or retain chat data after generating responses. OpenAI data security practices are available at https://openai.com/security-and-privacy/.
• Neither provider uses dub customer data to train their general AI models.

All chatbot communications are logged and retained by dub for at least seven (7) years in compliance with regulatory record-keeping requirements.

Retention of Personal Data

We retain Personal Data for at least seven (7) years after account closure or longer if required by applicable law or regulation. We will honor deletion requests unless retention is required by SEC, FINRA, or other regulatory obligations. Hashed email addresses disclosed to advertising platforms are retained by those platforms in accordance with their own policies; we periodically refresh the audience lists we upload and remove individuals who have opted out or closed their accounts. Audience lists we upload to advertising platforms do not contain phone numbers.

How do we protect Personal Data?

We and our service providers implement technical, physical, and administrative safeguards to protect Personal Data. While we take precautions, no system is completely secure.

Children's Privacy

Our services are not intended for children under 18. We do not knowingly collect data from children under 18.

Non-Discrimination

We will not discriminate against you for exercising your data rights.

California Shine the Light Disclosure

We do not disclose Personal Data to unaffiliated third parties for those third parties' own direct marketing purposes without your consent. The advertising platforms described above receive hashed email addresses to measure and manage our advertising, not to market their own products to you.

How to exercise your Data Subject Rights

Depending on where you live, you may have the right to request access to, correction of, or deletion of your Personal Data; to receive a copy of your Personal Data in a portable format; and to opt out of the sale or sharing of your Personal Data as described above. Identity verification will be required. Authorized agents may submit requests with written authorization. We will respond within the time required by applicable law (generally 45 days under the CCPA, extendable once by a further 45 days with notice).

Deletion requests will be honored, except where we are legally required to retain records.

Changes to this Privacy Notice

We may update this Privacy Notice from time to time. When we make material changes, we will update the "Last Updated" date above and notify you through the app or by email where required by law.

Complaints & Contact

If you have questions, requests, or complaints, please contact us:

DASTA Inc. (dub)

450 Broadway, Floor 2

New York, NY 10013

Email: support@dubapp.com