Last Modified Date: June 30, 2026

This policy provides a public facing privacy policy.

This policy applies to customer facing applications and systems.

SpendMend LLC (“SpendMend”) values your patronage and is firmly committed to protecting your privacy. This Privacy Policy (“Policy”) describes the information collection, use, protection, and sharing practices of SpendMend websites, mobile applications, electronic communications, social media pages, and services. This Policy sets forth the principles that govern our treatment of personal data. We expect all employees and those with whom we share personal data to adhere to this Policy. This Policy applies to all personal data in any format or medium, relating to all customers, prospective customers, employees, suppliers, and others who do business with SpendMend.

California Residents: For California residents, please see the “Additional Information for California Residents” section at the end of this Policy, which discusses the categories of personal information we collect, how we use that information, and California residents’ rights with respect to the personal information we collect. If you have any questions or concerns about this Policy, please contact us using the methods in the “Contact Us” section.

Our Commitment To Data Security

SpendMend strives to take appropriate precautions to keep your personal information secure. We have put in place physical, electronic, and managerial procedures designed to safeguard the information we collect including encryption of information in transit, technological safeguards such as firewalls for protection and monitoring, advanced endpoint security, and processes for handling of information.

While we cannot guarantee that loss, misuse, or alteration of information will never occur, we strive to prevent it. Please keep in mind that no method of storage or transmission over the Internet is completely secure, so your use of our products and services and provision of information to us is at your own risk.

Information We Collect

Contact and Other Personal Information

When a client engages with SpendMend services, these providers may provide Accounts Payable, billing claims, or other information that contains personal data. Examples may include names, date of birth, postal address, serial number, coded billing information, prescription drugs, or medical device types. SpendMend has redaction processes which review and redacts information before processing.

Employment Application Information

If you apply for a job with us, we might ask for certain information about you including, for example, your work and education history, and your profile/résumé.

Browser and Device Information

When you use the Internet, your computer may transmit certain information to the servers that host the websites you visit. The information may include: (i) your computer’s operating system, (ii) your web browser, (iii) your IP address, (iv) the duration of your use; (v) the pages viewed; (vi) search words; and (vii) dates and times that our site is accessed.

Cookies are alphanumeric identifiers that we transfer to your computer’s hard drive through your web browser for record-keeping purposes. Some cookies allow us to make it easier for you to navigate our website, while others are used to enable a faster log-in process or to allow us to track your activities at our websites.

Most web browsers allow some control of cookies through your browser settings. If you do this, however, you may have to manually adjust preferences every time you visit our website(s), and it may not be possible to use the full functionality of the website(s). To learn more about your ability to manage cookies, please consult the privacy features in your browser.

Clear GIFs are tiny graphics with a unique identifier, similar in function to cookies. In contrast to cookies, which are stored on your computer’s hard drive, clear GIFs are embedded invisibly on web pages. We may use clear GIFs (a.k.a. web beacons, web bugs or pixel tags), in connection with our websites to, among other things, track the activities of visitors to our websites, help us manage content, and compile statistics about website usage. We and our vendors also use clear GIFs in HTML emails to our customers, to help us track email response rates, identify when our emails are viewed, and track whether our emails are forwarded.

Social Media Information

When you use integrated social media features on SpendMend products, or other social media websites or mobile applications, or when interacting with SpendMend on social media platforms, we may obtain information such as your name and e-mail address, and videos, recordings, and images of you.

Online Surveys

Occasionally, we may also ask you to fill out an online survey to obtain your suggestions or feedback.

Video Surveillance Information

Any individuals visiting SpendMend facilities are subject to video surveillance on closed circuit camera system. Video surveillance cameras are used to protect us, our visitors, and our employees. We monitor our surveillance cameras and may share surveillance footage with law enforcement and/or regulatory authorities.

Wi-Fi and Location Information

When you use Wi-Fi services that we make available at SpendMend for our visitors, we might collect information about the websites you visit, the type of device, the browser you are using, your device identification number, your precise physical location, bandwidth used, session time, etc.

How We May Use Your Information

Your privacy is important to us. We collect and use information we believe is necessary for our business, and provide you with the products, services, and experiences you expect when you interact with us. When we collect and use your information, we take your privacy and security very seriously.

Use of Information

We use the information you provide primarily to fulfill the purpose for which it was collected. In addition, we may use your information to support a range of internal business operations and legal obligations, including but not limited to:

• Responding fully to your inquiries, requests, or communications
• Providing you and authorized third parties with our products and services
• Considering and processing job applications
• Complying with applicable laws, regulations, and legal obligations
• Developing and enhancing our products, services, and offerings
• Improving, personalizing, and optimizing the customer experience
• Conducting audits, research, and analysis to maintain service quality and protect our customers
• Performing marketing activities, market research and analysis, and customer satisfaction or quality assurance surveys
• Ensuring that third parties handling your information do so with appropriate protection in place
• Maintaining the technical integrity, performance, and security of our systems and networks
• Protecting the rights, property, or safety of SpendMend, our employees, customers, or others
• Supporting and executing corporate transactions such as mergers, acquisitions, reorganizations, or financings
• Administering essential business functions, including accounting, auditing, compliance, recordkeeping, and legal processes

We take care to ensure that all uses of your information are consistent with our privacy commitments and in accordance with applicable data protection laws.

How We Share Information

We may share information about you with third parties, including as indicated below:

Affiliates: We may share your personal data with our other services, corporate affiliates, subsidiaries, and investors.

Service Providers: We use others to help us provide some of our products and services (e.g., maintenance, IT support, analysis, payments, marketing, development, and security).

Third Party Marketing and Analytics Providers. We may also disclose your personal information, such as device and browsing, and activities and usage information, and other similar information, to third party marketing and data analytics providers, and other companies who provide marketing, advertising, campaign management, or analytics services on our behalf.

Business Transfers: If we are or may be acquired by or merged with another company, if any of our assets are transferred to another company, if someone invests in us, or as part of a bankruptcy proceeding, we may disclose or transfer the personal information we have collected from you to the other company and we may share your information in the course of the transaction. We may also disclose certain personal information as necessary prior to the completion of such a transaction or other corporate transactions such as financing or restructuring, to lenders, auditors, and third-party advisors, including attorneys and consultants.

Legal Requests: We may be required to respond to legal requests for your information, including from law enforcement authorities, regulatory agencies, third party subpoenas, or other government officials.

Compliance with Legal Obligations: We may have to disclose certain information to auditors, government authorities, or other authorized individuals to comply with laws that apply to us or other legal obligations such as contractual requirements.

Other Tracking Technologies

Third-Party Analytics and Tools. We use third party tools, which are operated by third party companies. These third-party analytics companies may use cookies, pixels, and other similar tools to collect usage data about our services to provide us with reports and metrics that help us evaluate usage of our services and improve performance and user experiences.

Do-Not Track: Currently, our systems do not recognize web browser “do-not-track” requests. You may, however, disable certain tracking (e.g., by disabling cookies) as discussed above.

Your Choices Regarding Your Information:

For all personal data that we have about you, you have the following rights and/or choices that we will strive to accommodate where your requests meet legal and regulatory requirements and do not risk making other data less secure or changing other data:

Opt Out, Object, Withdraw Consent: You can always choose not to disclose certain information to us. Where we rely on your consent to process your personal data, you have the right to withdraw or decline consent at any time. If you have provided us with your email address and you would like to stop receiving marketing emails from us, click on the unsubscribe link at the bottom of any of our email communications. If you do not wish to receive marketing communications from us via direct mail, or if you want to request that we do not share your contact information with our marketing partners, please contact us using the methods in the Contact Us section and include your name, address, and any other specific contact information that you wish to restrict. Please do not email any sensitive information such as social security number or date of birth.

External Links

The SpendMend website(s) may provide links to other websites. We do not endorse the materials disseminated at other websites. We are not responsible for the content, validity, privacy policies or reliability of any website linked to the SpendMend website(s).

Changes To This Policy

We reserve the right to modify or change this policy at any time, simply by posting such changes on the SpendMend websites. Any such change, update, or modification will be effective immediately upon posting. If a change is made, the last modified date at the top of this policy will be updated to reflect the change. Visitors to this website are advised to check back periodically for any changes.

Contact

For questions regarding this Privacy Policy or to submit any of the requests mentioned above relating to your personal data, contact us using any of the following options:

Mail:

SpendMend Data Privacy Officer

2680 Horizon Drive SE

Grand Rapids, MI 49546

Email: privacy@SpendMend.com

Phone: 1-616-729-0255

Additional Information for California Residents

This section of the Policy provides additional information for California residents and describes our information practices pursuant to applicable California privacy laws, including the California Consumer Privacy Act (the “CCPA”). This section does not address or apply to our handling of publicly available information or personal information that is otherwise exempt under the CCPA. Depending on how you interact or engage with us, we may provide you with other privacy notices with additional details about our privacy practices.

Categories of Personal Information Collected and Disclosed. The following identifies the categories of personal information we may collect about you (and may have collected in the prior 12 months), as defined by the CCPA, as well as the categories of other entities to whom we may disclose this information. Depending on how you interact with us, we may collect and disclose the following categories of personal information:

• Includes direct identifiers such as name, email, phone number, address, IP address, or other similar identifiers.
• Internet or Other Electronic Network Activity Information. Includes information regarding interactions with our website, advertisements, or emails, including other
• Location Data. Such as general location information about a particular individual or device.
• Professional Information. Includes, but is not limited to, job title, company name, business email, business phone number, current and former employer, and other similar professional-related information.
• Education Information. Includes information about an individual’s educational history, [such as the schools attended, degrees you were awarded, and associated dates].
• Protected Classifications. We may collect some information that is considered a protected classification under California or federal law, such as your date of birth.

SpendMend may disclose the above information to the following third parties and other recipients.

• Affiliates and subsidiaries
• Service providers and vendors
• Advisors and agents
• Others as required by law

Sources of Personal Information: In general, we may collect the categories of personal information identified in the list above from the following categories of sources:

• Vendors and service providers
• Business customers and clients

Purposes of Collection, Use and Disclosure: As described in more detail above under the “How We May Use Your Information” and “How We Share Your Information” sections, we collect, use, and disclose the above personal information for the following business or commercial purposes and as otherwise directed by you:

• Services and support
• Marketing and advertising
• General business and operational support
• Legal proceedings and obligations
• In support of business transactions (e.g., if we are acquired by another company)

Sensitive Personal Information: Notwithstanding the above, we only use and disclose sensitive personal information as reasonably necessary (i) to perform our services requested by clients, (ii) to help ensure security and integrity, including to prevent, detect, and investigate security incidents, (iii) to detect, prevent, and respond to malicious, fraudulent, deceptive, or illegal conduct, (iv) to verify or maintain the quality and safety of our services, (v) for compliance with our legal obligations, (vi) to our service providers who perform services on our behalf, and (vii) for purposes that are not for inferring characteristics about you. We do not use or disclose sensitive personal information other than as authorized by the CCPA (pursuant to Cal. Civil Code § 1798.121 and § 7027(m) of the CCPA regulations).

De-identified Information: We may use, disclose, or process de-identified data. We will maintain and use the de-identified information in deidentified form, and we will not attempt to reidentify the information, except to determine whether our deidentification processes are reasonable and adequate pursuant to applicable privacy laws.]

Sale or Sharing of Personal Information: The CCPA defines “sale” as disclosing or making available personal information to a third-party in exchange for monetary or other valuable consideration, and “sharing” includes disclosing or making available personal information to a third-party for purposes of cross-context behavioral advertising. While we do not disclose personal information to third parties in exchange for monetary compensation We do not sell or share sensitive personal information, nor do we sell or share personal information about individuals we know are under age sixteen (16).

Retention of Personal Information: We retain the personal information we collect only as reasonably necessary for the purposes described above or otherwise disclosed to you at the time of collection. When deciding how long to keep your personal information, we consider whether we are subject to any legal obligations (e.g., any laws that require us to keep records for a certain period before we can delete them) or whether we have taken any legal positions (e.g., issued any legal holds or otherwise need to preserve the information). Rather than delete your data, we may also deidentify it by removing identifying details. Where we have committed to maintaining and using personal information in a deidentified form, we agree not to reidentify deidentified data except as permitted by applicable law.

California Privacy Rights. The CCPA provides California residents with specific rights regarding personal information. Subject to certain conditions and exceptions, California residents have the following rights with respect to their personal information:

• Right to Know. You have the right to request: (i) the categories or personal information we collected about you; (ii) the categories of sources from which the personal information is collected; (iii) our business or commercial purposes for collecting, selling, or sharing personal information; (iv) the categories of third parties to whom we have disclosed personal information; and (v) a copy of the specific pieces of personal information we have collected about you.
• Right to Delete. You have the right to request we delete personal information we have collected from you.
• Right to Correct. You have the right to request that we correct inaccuracies in your personal information.
• Right to Opt-Out of Sales and Sharing. You have the right to opt-out of “sales” and “sharing” of your personal information, as those terms are defined under the CCPA.
• Right to Limit Use and Disclosure. You have the right to limit use and disclose of your sensitive personal information. [We do not use or disclose sensitive personal information beyond the purposes authorized by the CCPA; thus, this right is not available to California residents.]
• Right to Non-Discrimination. You have the right not to be subjected to discriminatory treatment for exercising any of the rights described in this section.

Exercising Your Privacy Rights. California residents may exercise their CCPA privacy rights as set forth below:

• Right to Know, Delete, and Correct. California residents may submit CCPA requests to access/know, delete, and correct their personal information by emailing the privacy officer at privacy@spendmend.com or calling 1-888-257-6748.

When you submit a request, we will take steps to verify your identity and request by matching the information provided by you with the information we have in our records. In some cases, we may request additional information to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for the denial.

You may also designate someone as an authorized agent to submit requests and act on your behalf. Authorized agents will be required to provide proof of their authorization in their first communication with us, and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.

California Shine the Light Law. Under California’s “Shine the Light” law (Cal. Civ. Code § 1798.83), California residents who provide us certain personal information are entitled to request and obtain from us, free of charge, information about the personal information (if any) we have shared with third parties for their own direct marketing use. Such requests may be made once per calendar year for information about any relevant third-party sharing in the prior calendar year. To submit a “Shine the Light” request, email us at privacy@spendmend.com, and include in your request a current California address and your attestation that you are a California resident.