Contacting Security

Optirate, Inc. ("OptiRate") wants to hear from you. Keeping your data safe is our top priority. If you have any questions or concerns about the security of your data, please contact us at support@optirate.com. Whether you just want to know more about our policies, or you're looking for specifics about the technologies we use, we're always happy to talk about security.

We want your help. We work with leading researchers, vendors, and products to keep on the cutting edge of web security. Nevertheless, some of our best ideas come from people like you. If you believe you have discovered a security problem on the site, or if you have thoughts about how we can do a better job protecting our users, please contact security@optirate.com right away.

Our security response. We promise to respond to all reasonable reports of potential security vulnerabilities as soon as we can, usually within 24 hours. If you report a security problem, we will:

• Acknowledge your report, and provide you with contact information for our team as we investigate the problem
• Work with you to ensure that we understand the issue, and to consult with you about the best way to address it
• Work with other organizations, if necessary, to ensure other sites are protected too (since our system is based on a number of widely-used products and technologies)
• Keep you in the loop as this process takes place; and
• Give you credit, if you wish, once the issue has been resolved.

We take security issues very seriously, and are glad you do too. We hope that by working together we can keep Optirate a safe place for everyone.

Our commitment to researchers. The responsible disclosure of security problems allows us (and others) to make the online experience better for everyone. Unfortunately, legitimate researchers sometimes are unfairly blamed for the problems they uncover. To ensure a secure environment for all please be sure to adhere to the following guidelines:

• Share full details with us before making them public or telling others.
• Give us a reasonable amount of time to address the issue before disclosing the issue to anyone other than us. We will try to act quickly, but some aspects of our system are complicated and may take time to patch and test.
• Do not do anything that might harm the experience of Optirate for others. For example, do not spam public areas of the site, or do anything that might cause a denial of service.
• Under no circumstances should anyone ever attempt to view, modify, or corrupt data belonging to others.

This promise is intended to balance our requirements and responsibilities against the protections and guarantees necessary to encourage responsible and timely disclosure. This is not an invitation to test the security of our systems without authorization. It is simply a reflection of our belief that security researchers are the good guys, but that they may be wary of reporting issues to us for fear of legal consequences. If you have any questions about this commitment, or have any doubts about whether your tests are appropriate, you should contact us before proceeding.

Privacy & Security

Optirate, Inc. ("Optirate" or "we") respects your privacy and are committed to safeguarding your personal information. This policy describes the personal information we collect and how we handle and protect it, including personal information collected on Optirate.com. As part of our routine business practices, we make our policy available for review when users first register on the website. Thereafter, our policy is continually available for review on the website; we also will direct your attention to our policy annually or when significant changes are made to it. This notice applies to your personally identifiable information and your relationship with us, and continues to apply after your relationship has ended. Your relationship with us begins when you register as a user on the Optirate.com website.

Our Privacy Seal

Optirate is a licensee of the TRUSTe Web Privacy Seal Program. TRUSTe is an independent, non-profit organization whose mission is to build user's trust and confidence in the Internet by promoting the use of fair information practices. Because this Web site wants to demonstrate its commitment to your privacy, it has agreed to disclose its information practices and have its privacy practices reviewed for compliance by TRUSTe.

If you have questions or concerns regarding this statement, you should first contact us using our contact us form. If you do not receive acknowledgement of your inquiry or your inquiry has not been satisfactorily addressed, you should contact TRUSTe at http://www.truste.org/consumers/watchdog_complaint.php. TRUSTe will then serve as a liaison with us to resolve your concerns.

Why and How We Collect Personal Information

We collect personal information to enable us to provide products and services to you and to improve and conduct our business. For example, we collect personal information to:

• Handle your requests and transactions.
• Provide you with information about products and services that may be of interest to you.
• Provide you with effective and efficient customer service.
• Evaluate products and services.

We collect information from a variety of sources, including:

• Account inquiries, applications, and other forms that you submit to us, which may provide information such as your name, address, email address, and telephone number.
• Your transactions or experiences with us.
• Outside companies, such as consumer reporting agencies, regarding your credit history or employment status.
• Information automatically received from your computer and browser, including your IP address, and software and hardware attributes, which we may record.

How We Protect Personal Information

We maintain physical, electronic and procedural safeguards to protect your personal information to comply with applicable laws and regulations. Personal information that we collect from you is stored on servers in our United States data centers, and protected by network firewalls, encryption, and multiple levels of physical access control. When transmitting personal information to and from your browser, we encrypt data using secure socket layer (SSL). Only authorized employees who need to have access to personal information to perform their jobs are permitted to use your personal information, and may do so only for permissible business reasons. Employees who have access to your personal information are required to maintain and protect the confidentiality of that information and must follow established procedures.

At a minimum, we require that you use numbers and letters, as well as uppercase and lowercase characters in your password. We will never ask for your password as a means of identifying you. Do not share your password with anyone, and if you ever receive an email purporting to come from us that asks for your password, you should immediately report this development to us at privacy@optirate.com

We follow generally accepted industry standards to protect the personal information submitted to us, both during transmission and once we receive it. No method of transmission over the Internet, or method of electronic storage, is 100% secure, however. Therefore, while we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

Why and How We Share Information With Our Affiliates

We may share your personal information (as described above in "Why and How We Collect Personal Information") with our affiliates as required or permitted by applicable laws. Our affiliates are companies controlled or owned by us, or companies that control us, or are under common control with us. For example, we may share information with our affiliates in order to service your account, process transactions relating to your account, or provide you with products and services that you have requested.

We may share with our affiliates your name, contact information and information about our transactions and experiences with you so that they or we may offer products or services that may be appropriate for you and to conduct business. We may also share with our affiliates personal information we collected to determine your eligibility for products and services you previously requested from us ("eligibility information"), unless you choose to opt out of such sharing. (See "How You Can Direct How Your Information Is Shared and Presented", which describes what it means to "opt-out" and contains a link to our opt-out form).

Why and How We Share Information With Non affiliated Third Parties

We do not and will not rent or sell your personal information. However, we may share your personal information with any of Optirate's participating financial institutions. (See "Why and How We Collect Personal Information"). We may also share your personal information with companies that we hire to perform services for us, such as vendors that provide data processing, computer software maintenance and development, transaction processing and marketing services. In addition, to help us service your account or to offer products and services that may meet your financial needs, we may share your name, contact information, and information about our transactions and experiences with you with non affiliated financial service institutions with which we have agreements to market financial services or products that we jointly offer, endorse or sponsor. If we do share your personal information, we require these nonaffiliated financial service institutions, which may include banks, credit unions, credit card issuers or mortgage companies, to agree to limit the use of such information to the purposes for which it was provided. Finally, we may disclose personal information to others, including non affiliated companies and regulatory authorities, as required or permitted by applicable law. For example, we may disclose personal information to:

• Respond to subpoenas or comply with investigations by regulatory authorities or law enforcement agencies.
• Protect against or prevent actual or potential fraud, unauthorized transactions, claims or other liabilities.

If we believe it is necessary, we may also share personal information as permitted by applicable law in order to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our terms of use or other agreements you enter into with us, or as otherwise required by law.

We may post customer testimonials on our web site which may contain personally identifiable information such as customer's names. We always obtain customer's consent prior to posting testimonials with their names along with their testimonials.

You should be aware that any personally identifiable information you submit to blogs on our site can be read, collected, or used by other users of these forums, and could, among other things, be used to send you unsolicited messages. We are not responsible when you choose to submit personally identifiable information to these forums.

We may transfer information about you if all or part of our business is acquired by or merged with another company. In this event, we will notify you before information about you is transferred and becomes subject to a different privacy policy.

How You Can Direct How Your Eligibility Information Is Shared

If you do not want us to share eligibility information about you with our affiliates, you have the right to opt out of these disclosures. (For a definition of "eligibility information," see "Why and How We Share Information With Our Affiliates"). By opting out, you are instructing us not to share eligibility information with our affiliates. Please note, however, that even if you direct us not to share eligibility information with our affiliates, we may still share your personal information-including eligibility information-with our affiliates as permitted by law, such as to process transactions or to service your account. Moreover, we may also share certain other types of non eligibility information with our affiliates, such as your name, contact information, and information about your transactions and experiences with us.

If you wish to opt out of the disclosure of your eligibility information, please contact our Privacy department at privacy@optirate.com.

Newsletters and Emails

At registration and at various times as you use our website, you may be given the option of receiving informational or promotional emails. At any time after registration, you may change your email and newsletter preferences by updating your profile on our website, or following the unsubscribe instructions included in these emails.

OTHER INFORMATION ABOUT OUR PRIVACY PRACTICES

There may be places on our website where you may click on a link to access third-party websites that are not covered by this Privacy Policy. These third-party websites may collect personal information from you and, in some instances, provide us with information about your activities on those websites. We recommend that you consult the privacy statements of all third-party websites you visit.

Children's Privacy

Our website is a general audience site. We do not knowingly collect personal information from children under the age of 13. In fact, you must be 18 years old or older to register to use the site.

Cookies and Web Beacons: Web-related Information Collection

We use cookies on our web site, including session ID cookies and persistent cookies. A cookie is a text file sent by a web server to a web browser, and stored by the browser. The text file is then sent back to the server each time the browser requests a page from the server. This enables the web server to identify and track the web browser and load the pages according to a user's preferences for that particular site, including the personalization of content. Cookies are not tied to personally identifiable information.

More importantly, using cookies also helps us protect the security of your account. Session ID cookies follow your activities on our site so that we can ensure that no one is making changes to your profile, applying for loans or making loans on your behalf. This information is encrypted and no personal data about you is stored on our servers in connection with the use of cookies.

We may send a cookie that can be stored by your browser on your computer's hard drive. We may use the information we obtain from the cookie in the administration of our web site, to improve its usability and for evaluating our marketing effectiveness as described above. Most browsers allow you to refuse to accept cookies. (For example, in Internet Explorer you can refuse all cookies by clicking "Tools", "Internet Options", "Privacy", and selecting "Block all cookies" using the sliding selector). Blocking cookies, however, can also have a negative impact on the usability of many web sites.

Cookies may have long-term expiration dates and thus can stay on your hard drive for months at a time. While you can remove them as instructed by the help content in your chosen browser, disabling cookies will prevent you from using our site. As with many transactional web sites, cookies must be enabled in order to use our site.

We use a third-party tracking service that uses cookies and web beacons to track non-personally identifiable information about visitors to our site in the aggregate (such as page views and referral page information to track the success of our marketing efforts to bring people to our site as well as overall site performance). No personal or sensitive information is transmitted to advertising partners. In addition, we automatically receive and record information from your computer and browser, including your IP address, software and hardware attributes, and the page you request. This information is used for security purposes and for the design and assessment of marketing efforts.

Special Note for California and Vermont Residents

To comply with California and Vermont laws, we do not share information with non affiliated third parties for accounts with a primary mailing address in these states, except as required or permitted by applicable state law. Additionally, Vermont accounts are automatically opted out of the sharing of eligibility information with our affiliates.

If you are a resident of California, in addition to the rights set forth in this Privacy Policy, you have the right to request information from us regarding the manner in which we share certain categories of personal information with third parties for direct marketing purposes. California law gives you the right to send us a request at a designated address to receive the following information:

• The types of information we disclosed to third parties for their direct marketing purposes during the preceding calendar year;
• The names and addresses of the third parties that received that information; and
• If the nature of the third party's business cannot be determined from their name, examples of the products or services marketed.

We may provide this information in a standardized format that is not specific to you. The designated email form for these requests is privacy@optirate.com.

Accessing and Revising Your Personal Information

You are expected to review promptly information in account statements and other communications from us and to notify us if you believe any information should be corrected or updated. All of your personal and personally identifiable information that we maintain is available to you for review in the account profile section of Optirate.com. You may update your password, email address, physical address, phone number, and other information at any time. If you need to change any other information in your profile, you can contact us through our Customer Care email. To protect your privacy and security, please contact us through our Customer Care email support@optirate.com to make changes to your sensitive account information. We may require you to authenticate your identity before permitting you access to personal information. If you have any questions or concerns about your personal information or this Privacy Policy, please contact us.

Changes to this Privacy Policy

We may revise or update this Privacy Policy from time to time to reflect changes in our practices. When we make changes to this Privacy Policy, we will revise the "last updated" date at the top of this Privacy Policy. If we make any material changes in the way we collect, use, and/or share personal information, we will notify you as required by law, including by sending an email to the email address you most recently provided us in your account, profile or registration, and/or by prominently posting notice of the changes on our website. We recommend that you check our website from time to time to determine whether there have been any changes to this Privacy Policy.

If you have questions or concerns regarding this statement, you should contact us at:

Privacy Policy
Optirate, Inc.
Attn: Privacy Officer
101 Jordan Pl
Lafayette, CA 94549