Privacy Policy

This Privacy Policy describes how Forward Technology, Inc. DBA Worthy ("we," "us," or "our") collects, uses, discloses, protects, and retains your personal information when you access or use our website and technology platform that provides debt settlement services, credit-monitoring, and educational debt-coaching (collectively, the "Services"). By using the Services, you agree to the terms of this Privacy Policy and our Terms and Conditions. If you do not agree with this policy, please do not use the Services.

1. Information We Collect

1.1 Information You Provide

We collect information you directly provide when you enroll, use, or interact with our Services, including:

• Your name, address, email address, phone number, date of birth, Social Security number (or other government ID), citizenship or residency status, and other identifiers.

• Your credit profile data, information you supply about your financial goals or credit history, coaching/referral preferences, and your responses to questionnaires or surveys.

• Payment and billing information if you purchase any paid aspect of the Services or affiliated product offer.

• Communications you send us (e-mail, chat, support requests, feedback, forum posts if applicable).

1.2 Information We Automatically Collect

When you use our Services, we may automatically collect information about your device, usage, and interactions, including:

• IP address, browser type, operating system, and device identifiers.

• Usage data (pages visited, features used), logs, error reports, crash logs.

• Location data if/where permitted.

• Cookies, web beacons and similar technologies to support the Services, enhance user experience, and deliver offers or referrals.

1.3 Credit & Consumer-Report Data

Because our Services include credit-monitoring and analysis, we obtain and process credit report data, consumer-reporting agency data, credit-score information, alerts about changes or events in your credit report, and other data about your credit profile or identity (for example: new accounts, inquiries, public records, collections, tradeline changes). We use this data to provide you with educational tools, alerts, offers, coaching/referral matches, and other Services.

We collect and use this data under permissible purposes and applicable laws (including the Fair Credit Reporting Act) as applicable.

2. How We Use Your Information

We use your information for a variety of business and operational purposes, including:

• Providing and administering the Services to you (including account setup, debt resolution, monitoring, alerts, coaching tools, referral offers).

• Matching you with products, offers or referrals for affiliated third-party products (where you have opted-in or allowed us to do so) and determining eligibility for offers.

• Personalizing your experience, generating insight, and coaching recommendations.

• Communication and marketing: sending you alerts, educational materials, promotional offers, updating you about new features or affiliated products.

• Fraud detection, identity-theft monitoring, security, and compliance with legal/regulatory obligations.

• Improving our Services, internal analytics, research, product development, and aggregated de-identified reporting.

• Legal and business purposes: investigating issues, enforcing our Terms and Conditions, responding to law-enforcement or regulatory requests, mergers/acquisitions, transfers of business.

3. Disclosure of Your Information

We may disclose or share your information as follows:

• To creditors with whom we may be tasked with negotiating your debts.

• To credit-reporting agencies and other third parties who supply data necessary to monitor your credit profile or enable alerts.

• To third-party service providers, vendors, contractors and agents who perform services on our behalf (host, cloud, data-analytics, marketing, etc.) under confidentiality obligations.

• To affiliated businesses, partners or third parties providing referral/offers (only when you have opted in for such offers).

• To comply with legal obligations, respond to subpoenas, regulatory requests, or investigations; or to protect our rights, property or safety of users.

• In connection with a merger, acquisition, sale of assets, reorganization, or financing (your data may be transferred to successor entity).

• With your consent or as you direct (for example, you ask us to share data with a particular third-party).

We will not sell your personal data for monetary consideration to unaffiliated third parties unless you have expressly opted in (or as required by applicable laws/disclosures).

4. Mobile Information & SMS Consent

When you sign in to or use Worthy's Services, we may send you SMS text messages, including one-time verification codes and other service-related messages. The following applies to mobile information you provide in connection with these messages — including your phone number and any consent or opt-in data:

• We will not sell your mobile information, and we will not share your mobile information — including your phone number and SMS opt-in or consent data — with any third parties or affiliates for their own marketing or promotional purposes.

• We use your phone number and SMS consent data to deliver verification codes and service-related messages from Worthy, and we share it with subprocessors (such as our SMS service provider) strictly to operate that messaging service under confidentiality obligations.

• If you have opted in to advertising cookies, we may share your phone number in a securely hashed (pseudonymized) form — hashed by us, or by the provider's own software before transmission — with our advertising and measurement providers (such as Google, Meta and TikTok) solely to measure and improve the performance of Worthy's own advertising. These providers are contractually restricted from using it for their own marketing or for any purpose other than performing measurement services for us. We do not do this if you have not opted in, or if you later opt out, and this is never a sale of your information.

• Except for the limited, consent-based advertising measurement described above, this restriction applies regardless of any other consent, sharing permission or referral arrangement described elsewhere in this Privacy Policy.

• Message and data rates may apply. You may reply STOP to any message to opt out of further non-essential SMS, or HELP for help.

5. Your Privacy Rights

Depending on your jurisdiction and applicable law, you may have the following rights regarding your personal information:

• The right to access or obtain a copy of the personal information we hold about you.

• The right to correct or update your personal information.

• The right to request deletion of your personal information (subject to legal/contractual retention obligations).

• The right to object to or restrict certain processing of your information.

• The right to opt-out of marketing communications or affiliate product offers.

• The right to withdraw consent where processing is based on consent, to the extent permitted by law.

To exercise your rights, please contact us at privacy@askworthy.ai or via your account settings (if applicable). We may require identity verification and will respond within applicable timelines.

6. Data Retention

We retain your personal information only as long as necessary for the purposes set out in this Privacy Policy, to provide the Services to you, and to comply with legal/regulatory obligations. Once no longer required, we will securely delete, anonymize or aggregate your information.

For credit-report data or alerts, we will retain data in accordance with our monitoring contract obligations, regulatory requirements, and legitimate business needs.

7. Security

We employ reasonable organizational, technical, and administrative safeguards designed to protect your personal information from unauthorized access, use, disclosure, alteration or destruction. These measures include encryption (in transit and at rest), authentication, access-controls, secure infrastructure, and regular review of our security practices. However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your information.

8. International Transfer

Our Services are intended for U.S. residents (and U.S. territories). If we transfer your personal information to jurisdictions outside the U.S. (for example, our service providers abroad), we will implement appropriate protections and safeguards to ensure the transferred data continues to benefit from adequate privacy protections consistent with this policy.

9. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected such information, we will take steps to delete it.

10. Affiliate & Referral Offers / Third-Party Products

Because part of our business may involve offering affiliate or referral opportunities or upsold products through third-parties, we include the following:

• We may share some of your information (such as basic profile, eligibility data or consented information) with third-party partners for the purpose of presenting you with offers or referrals — only if you have opted in or given us consent.

• You should review separate privacy or terms provided by those third-party partners when you click or accept an offer. We do not control those third-parties' actions or their privacy practices.

• Our offering of referral/affiliate opportunities does not mean we endorse or guarantee the services/products of the partner. Your relationship and agreement is directly with the partner when you accept an offer.

11. Changes to This Privacy Policy

We may update or modify this Privacy Policy at any time. When we do, we will post the revised version on our website and update the "Last updated" date. If changes are material, we will provide notice per applicable law (e.g., via e-mail or in your account). Your continued use of our Services after changes constitutes acceptance.

12. California Privacy Policy & Notice (CCPA/CPRA) For California Residents

This section supplements the Worthy Privacy Policy and applies only to California residents. It is provided pursuant to the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA").

California law requires us to disclose the categories of personal information we collect, the purposes for which we collect it, and the categories of third parties with whom we share it. Because we collect different types of information depending on how you use Worthy's Services, not every category listed below will apply to every user.

We may disclose any of these categories to government entities or other third parties as required by law, to protect against fraud or illegal activity, or to comply with legal obligations.

Worthy does not sell personal information for monetary consideration, and has not sold personal information in the past 12 months. Worthy may "share" personal information for cross-context behavioral advertising only if you opt-in (and you may opt-out at any time).

Categories of Personal Information Collected & Categories of Recipients

Category 1 — Identifiers

Includes: name, alias, postal address, email address, account name, IP address, unique identifiers.

Categories of Recipients:

• Creditors (for debt settlement services)

• Consumer reporting agencies (for credit monitoring)

• Affiliates or subsidiaries

• Service providers (IT, hosting, cloud, analytics, support)

• Data analytics providers

• Internet service providers

• Operating systems & platforms

• Third-party product partners who provide financial or credit-related offers

• Payment processors (if you purchase paid products)

• Professional service firms (law firms, auditors)

Category 2 — Government-Issued Identification

Includes: Social Security number (required for credit monitoring), driver's license number, state ID number, passport number.

Categories of Recipients:

• Consumer reporting agencies (for credit monitoring)

• Affiliates or subsidiaries

• Identity verification providers

• Other service providers

Category 3 — Financial Information

Includes: credit card number, bank account number, payment information (only if you purchase paid products), and information contained in your credit report.

Categories of Recipients:

• Creditors (for debt settlement services)

• Affiliates or subsidiaries

• Consumer reporting agencies

• Payment processors

• Other service providers

Category 4 — Protected Classification Characteristics

Includes: age/date of birth.

Categories of Recipients:

• Creditors (for debt settlement services)

• Consumer reporting agencies

• Affiliates or subsidiaries

• Service providers

Category 5 — Commercial Information

Includes: products or services purchased, obtained, or considered; credit-coaching activity; referral/offer interaction history.

Categories of Recipients:

• Affiliates or subsidiaries

• Data analytics providers

• Service providers

• Third-party product partners who provide financial or credit-related offers

Category 6 — Internet or Other Network Activity

Includes: browsing history, search history, activity on Worthy's website/app, interactions with emails, cookies, and advertisement interactions.

Categories of Recipients:

• Internet service providers

• Data analytics providers

• Operating systems & platforms

• Service providers

• Third-party product partners who provide financial or credit-related offers

• Advertising and measurement providers (such as Google, Meta and TikTok), only where you have opted in to advertising cookies

Category 7 — Audio, Electronic, or Visual Information

Includes: customer-service call recordings (if applicable).

Categories of Recipients:

• Service providers

• Professional service firms

Category 8 — Professional or Employment-Related Information

(Only if you apply for a job with us.)

Categories of Recipients:

• Affiliates or subsidiaries

• Service providers

• Professional service firms

Category 9 — Inferences

Includes: insights derived from your credit data, simulator inputs, user preferences, predicted credit-behavior segments, and offer-eligibility assessments.

Categories of Recipients:

• Affiliates or subsidiaries

• Data analytics providers

• Service providers

• Third-party product partners who provide financial or credit-related offers

Category 10 — Additional Personal Information (California Customer Records Statute)

Includes: signature or other data you provide in forms, if applicable.

Categories of Recipients:

• Affiliates or subsidiaries

• Service providers

Your Rights under the CCPA/CPRA

As a California resident, you have the following rights (subject to certain limitations):

• Right to Know: Access the categories and specific pieces of personal information we have collected about you.

• Right to Delete: Request deletion of your personal information.

• Right to Correct: Request we correct inaccurate personal information.

• Right to Opt-Out of Sharing: Opt-out of cross-context behavioral advertising (if applicable).

• Right to Limit Use of Sensitive Personal Information: Limit the use of data such as SSN to the purposes allowed by law.

• Right to Non-Discrimination: You will not be discriminated against for exercising your rights.

You or your authorized agent may submit a request by contacting us at:

Email: privacy@askworthy.ai

Phone: +1 (754) 273-8381

18 West 18th Street
6th Floor
New York, NY 10011-4652

We will verify your identity before processing certain requests and respond within the timeframes required by California law.

Sensitive Personal Information Statement

We only use "sensitive personal information" (e.g., Social Security number) for the purposes permitted under CCPA/CPRA, including:

• Providing you with credit monitoring and credit-report access

• Verifying your identity

• Detecting fraud or preventing illegal activity

• Maintaining the security and integrity of our systems

We do not use sensitive personal information to infer characteristics about you unless necessary to provide the Services and permitted by law.

13. Other State Privacy Rights

Information unique to California residents can be found in Section 12. Certain additional states also provide consumers with privacy rights relating to their personal information. While the specific rights available to you may vary depending on your state of residence, Worthy allows all eligible users to exercise the privacy choices described below, to the extent required by applicable law.

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Delaware, and others as those laws become effective) may have some or all of the following rights:

• Right to Know / Access: You may request confirmation of whether we process your personal information and request access to that information.

• Right to Correct: You may request that we correct inaccuracies in your personal information.

• Right to Delete: You may request that we delete personal information we have collected from you, subject to legal and operational exceptions.

• Right to Opt-Out: You may have the right to opt out of certain processing activities, including targeted advertising, the sale of personal information (if applicable), or certain profiling activities.

• Right to Appeal: If we deny your request, you may have the right to appeal our decision.

To exercise any of these rights, you may contact us at privacy@askworthy.ai, through your account settings, or via the contact methods listed in this Privacy Policy.

We will authenticate your identity and respond within the timeframe required under your state's law.

Worthy does not discriminate against users for exercising their privacy rights.

14. What is Worthy’s Cookie Policy?

We use tracking technologies ("Cookies") including cookies, pixels, and tracking scripts to collect, store, and track information about you and your use of the website or Services.

A. Cookies Explained

Worthy may use the following tracking technologies on its website or in providing the Services:

• Cookies: Small text files stored on your device for months; deletable through browser settings. Cookies can be stored on your device for months, but you can choose to delete cookies stored on your device at any time through your browser settings.

• Pixels/Web Beacons: Tags on web pages/emails recording activities; stop tracking when you navigate away. We may also allow some third parties to place web beacons on our website or in our communications. Pixels are not stored on your device and will stop tracking you once you navigate away from the website.

• Tracking Scripts: Small piece of code, typically in JavaScript, monitoring user behavior, such as page visits, time spent on pages, clicks, and device information. Tracking scripts usually work with cookies to website users across sessions.

B. Cookie Classifications

Cookies are classified by their purpose (their primary function on the website) and generally fall into one or more of the following categories:

• Essential: Required for the website to function. You cannot disable these.

• Targeted Advertising: Deliver targeted ads and measure effectiveness.

• Personalization: Remember preferences (such as your username, language, or the region you are in) and provide enhanced features.

• Analytics: Understand website performance and visitor interactions.

Worthy uses cookies for all of the above purposes.

C. How Worthy Uses Third Party Cookies

Worthy may also use third party cookies or analytics tools for the following purposes:

• Third Party Analytics Tools: Worthy uses third party analytics tools to collect information about how consumers use our platforms. This information is collected in aggregated form only. Some third party analytics tools, such as Google, allow you to control your privacy preferences across all websites by allowing you to download an extension for your browser.

• Third Party Ad Servers: Worthy may use other third-party tracking technologies (“Ad Servers”) to either re-target relevant advertising about our products or services, or enable third parties to serve their ads and monitor users’ responses to their advertisements. Ad Servers may re-direct you to other websites not associated with Worthy. The use of Ad Servers may be considered a “sale” or “sharing” under certain data protection laws. Ad Servers have their own privacy practices, we do not control these third parties’ use of cookies, or how they manage the information they gather through them. You should review the privacy policies of other websites you visit or link to from our website to understand how these other websites use cookies and how they use the information they collect through the use of cookies on their own websites.

D. Blocking, Disabling, or Opting Out of Cookies

You may have choices about the collection of information by cookies we use on the website.

• Manage your cookie preferences: Clicking on the “Cookie preferences” link and selecting the cookies you wish to disable. You cannot disable essential cookies. Disabling cookies may impact your ability to use all of the features and functionality of the website.

• Browser Settings: Most browsers allow you to reject cookies by default. You may also be able to delete our cookies as soon as you leave the website. Disabling cookies may impact your ability to use all of the features and functionality of the website.

• Google Ad On: For Google Analytics, you may download an Opt-out Browser Add-on. Please note that the Add-on does not prevent information from being sent to Worthy. To learn more about the Add-on tool for Google Analytics, click here.

• Subscribe to Opt-Out Lists: Some advertisers and service providers that perform advertising-related services for us and for third parties may participate in the self-regulatory programs. See the below links to learn more:

• Digital Advertising Alliance’s (“DAA”) Self-Regulatory Program for Online Behavioral Advertising, visit http://www.aboutads.info/choices/, and http://www.aboutads.info/appchoices.

• Network Advertising Initiative (“NAI”), see http://www.networkadvertising.org/choices/.

• Request to “Opt-Out Of The Sale Or Sharing Of Personal Information”: Visit our Privacy Choices page.

• Do Not Track Signals: Some browsers allow you to turn on Do Not Track signals (DNTs), which sends a signal to the websites you visit telling those sites that you do not wish to allow third-party cookies. There is no standard technology at this time for companies to receive these signals. Our website does not currently consistently respond to DNTs received from web browsers.

15. Contact Us

If you have questions or concerns about this Privacy Policy or our practices, please contact us at:

Worthy Privacy Team

18 West 18th Street
6th Floor
New York, NY 10011-4652

Email: privacy@askworthy.ai

Phone: +1 (754) 273-8381