Privacy Policy

Effective: February 13, 2026

‍

Pave Finance, Inc. and its subsidiaries and affiliates (“Pave”, the “Company”, “we”, or “our”) arecommitted to respecting and protecting your privacy. We manage the personal information you provide inaccordance with applicable privacy laws and best practices.

This privacy notice (Notice) explains our practices regarding the collection, use, and management of yourpersonal information across all formats. This includes information collected:

• When you purchase or use Pave software or use our services.
• When you interact with us via our websites, mobile applications, social media, or Pave Prosoftware as a service platform.
• Through professional relationships you or your organization maintain with us.
• When you request promotional materials or sign up for our communications.

We encourage you to review this Notice to understand how we collect, use, share, and safeguard yourpersonal information.

How Our Privacy Notice Applies

This Notice applies to our services, including all Pave-provided offerings, such as internet, video, andphone (residential, business, and mobile) (collectively, Services). The Notice also applies to Pave’swebsite and related sites, including any microsites (collectively, Sites), your communications with Pave,and when we collect your personal information from third parties. Some Pave Services may haveadditional or unique privacy practices that may be described to you at the time of collection. To theextent there is a conflict between this Notice and a Service-specific privacy notice, the Service-specificpolicy or agreement will control with respect to that unique Service.

This Notice does not apply to non-Pave services or websites and apps that you may access or usethrough our Services. For example, if you are on a Pave internet site and you move to a third-partywebsite, the privacy practices for that website will apply, or, if you are a Pave Pro customer and youuse another company for custody or other brokerage related services, the privacy practices of thatstreaming service will apply. We encourage you to carefully review those third-party privacy policies ornotices.

Personal Information, Defined

Personal information refers to any data or information, regardless of format, that identifies, relates to,describes, or could reasonably be linked—directly or indirectly—to a specific individual or household.This includes direct identifiers, such as your name, mailing address, email address, and phone number,as well as digital identifiers like an IP address, account numbers, and online browsing history.

This definition does not include information that has been de-identified, anonymized, or aggregated ina way that it can no longer be associated with you personally.

Personal Information Collection Practices

To provide you with reliable Services, personalized experience, and update-to-date information, Pavecollects and processes various types of personal information. This section outlines the specificcategories of data we collect, as well as how and where we collect it.

To provide our Services, Pave collects information from you directly, automatically through your use ofour network or Services, or from third-party sources. The information below details:

• the categories of information we may collect;
• examples of the data points that may be involved; and
• the sources of that data, which may include information provided directly by you, informationcollected automatically from your devices and hardware as they connect to our network, informationcreated by Mediacom, and information obtained from trusted service providers and third partieswho collect or create data to support our business operations.

‍

1. How We Collect Personal Information

While the information above identifies the data sources, we use the following methods to gather this data:

• Direct Interaction: Information you provide when, for example, signing up for Service(s), paying a bill, or speaking with customer support.
• Automatic Collection: When, for example, your device(s) connect to our network, Services, or Sites, we use cookies, session replay technology, and network logs to capture technical and usage data in real-time.
• Third-Party Integration: We receive supplemental data from trusted partners to verify identity, assess creditworthiness, or better understand household demographics for marketing.

2. Personal Information We Collect Automatically

We collect personal information automatically when your device(s) connect to our network, Services, or Sites through our network infrastructure, cookies, session replay technology, and other digital tools. This information includes but is not limited to:

• IP Address: The unique address assigned to a customer account or device for a specific period.
• Device Data: Information such as device type, operating system, browser version, unique device identifiers, and metrics generated by devices on our network.
• Network & Technical Data: Technical data produced through the interaction between a device and Pave's network, including equipment addresses and signal quality metrics.
• Service-Related Usage Data: Information generated by use of our Services. Note that because many of these Services are provided to an individual, this information is typically collected at the individual level and associated with a unique account. This includes:

• Internet Service: Bandwidth usage metrics, Domain Name System (DNS) lookups (the "lookup" required to navigate to a website), and general network traffic activity.

• Preference Data: User-selected settings, including language preferences, saved credentials, and other personalized configurations.
• Interaction & Session Data: Information captured through session replay technology and similar tools that record how you interact with our Sites. This includes mouse movements, clicks, keystrokes (excluding sensitive fields), scrolling behavior, and pages visited, which we use to troubleshoot technical issues and improve user experience.

3. Personal Information We Collect from Third Parties

Sometimes we obtain personal information from third parties, such as our trusted service providers that support our business or our Services. This information includes, but is not limited to:

• Contact & Identity Information: Your name, email address, physical address, and phone number used to verify your identity or update our records.
• Supplemental Professional Data: Information regarding your employer or occupation used to verify eligibility for specific service programs or discounts.

How We Use Your Personal Information

We use your personal information to power and provide our Services, protect our network, and keep you updated. This includes everything from processing your monthly billing to personalizing the way you interact with our brand. We are committed to using your personal information responsibly and in compliance with the law, as detailed in the specific use cases below:

• Service Delivery & Management: To provide and maintain your Services, including account setup, billing and collections, identity verification, technical support, and software maintenance.
• Operational Communications: To send essential Service-related information, such as billing statements, outage alerts, appointment reminders, and updates to terms and conditions.
• Business Analytics & Improvement: To generate reports on customer usage and trends that help us evaluate service performance, study subscribership, and develop new offerings.
• Customer Feedback & Engagement: To contact you for feedback, surveys, or market research to better understand your needs and improve our customer service.
• Product Research, Development, and Innovation: To conduct research and development for new features, products, or services, or to improve user experience through testing and pilot programs.
• Security & Policy Enforcement: To secure our network and protect our legal rights by investigating fraudulent activity, preventing unauthorized service use, and verifying identity.
• Safety, Fraud, and Abuse Prevention: To detect, investigate, and prevent activities that may violate our policies or be illegal, cyber threat actor behavior, harassment, or fraudulent transactions.
• Marketing & Targeted Advertising: To deliver personalized advertisements and promotional offers based on your Service history, demographic data, and tracking technologies, such as cookies. For information about how to limit the use of your personal information for these purposes, see Your Privacy Rights and Choices section below.
• Legal Compliance: To comply with applicable federal, state, and local laws and regulations, as well as other applicable legal and contractual requirements.

How We Share Your Personal Information

To deliver our Services effectively, protect our customers and our network, and keep you informed, we share certain personal information with authorized users, service providers, and business partners. This allows us to, for example, process payments, provide technical support, and offer personalized experiences. The list below details when and why your information is shared:

• User-Authorized Sharing: Information shared based on your consent, whether provided through digital click-through agreements, written documents, verbal confirmation over the phone, or, where permissible, implied consent based on the activity.
• Authorized Account Access: Access provided to the primary account owner and any other individuals you have specifically designated as authorized users.
• Essential Service Providers: Information shared with service providers and business partners who help run our business, including those handling billing and collections, technical support, IT hosting, marketing, security, and professional advisors (such as legal, tax, auditing, and insurance).
• Analytics & Experience Optimization: Sharing with partners who analyze network traffic, service usage, and viewing habits (such as video popularity and device preferences) to improve and tailor the Service and Site experience.
• Marketing & Social Media Platforms: Information shared with advertising partners and social media companies (like Meta and Google) to facilitate interactive features, such as "like" buttons, and to deliver targeted promotions.
• Legal, Safety, & Regulatory Compliance: Disclosures made to law enforcement, public safety officials, or credit agencies to satisfy legal obligations, verify identities, protect property and safety, prevent fraudulent activity, or respond to lawful subpoenas, warrants, or court orders.
• Business Transfers: Information shared as a corporate asset during significant business events, such as a merger, acquisition, reorganization, insolvency, or sale of assets.

Finally, state privacy laws require us to disclose when we 'sell' or 'share' personal information, as those terms are broadly defined. In the preceding 12 months, Pave has 'sold' or 'shared' the following categories of personal information to third parties for the following purposes:

‍

Federal Privacy Disclosures

1. We retain certain personal, financial, and transactional information about users that become clients and certain prospective clients as required to comply with applicable federal securities laws and regulations, including the Investment Advisers Act of 1940 (the "Advisers Act") and the Securities Exchange Act of 1934 (the "Exchange Act"), as well as rules promulgated thereunder by the U.S. Securities and Exchange Commission ("SEC").
2. Such information may include, without limitation, account records, communications, advisory agreements, trade confirmations, client instructions, suitability and know-your-customer documentation, and other records relating to advisory services and securities transactions. These records are maintained for the periods required by applicable law, including SEC Rules 204-2 under the Advisers Act and Rules 17a-3 and 17a-4 under the Exchange Act, and may be retained longer where necessary to address legal, regulatory, compliance, or business requirements.
3. Information retained for regulatory purposes may be stored in electronic or physical form and may be accessible to regulators, examiners, auditors, or other governmental authorities in connection with examinations, investigations, or enforcement actions, as permitted or required by law. We implement reasonable administrative, technical, and physical safeguards designed to protect the confidentiality and security of retained information, consistent with applicable legal and regulatory obligations.
4. Once information is no longer required to be retained under applicable laws and regulations, and absent a legitimate business or legal need to retain it longer, we will take reasonable steps to dispose of such information in a manner designed to protect your confidentiality.

5. The Communications Act & CPNI

Section 222 of the Communications Act protects Customer Proprietary Network Information (CPNI). This includes details about your call patterns, technical configurations, and billing information.

• Our Duty: Pave has a legal duty to protect the confidentiality of your CPNI.
• Accessing Records: You can access your CPNI in writing or via phone/online after authenticating your identity. We generally do not provide call records without a court order.
• Directory Listings: We cannot correct errors in directory lists (published by us or third parties) until the next available publication cycle.

6. General Provisions

• Fees: Where permitted by law, Pave may charge reasonable costs for retrieving and photocopying records you request.
• Arbitration: These disclosures do not modify any existing arbitration agreements you have with Pave.

Notice of Financial Incentive

Pave does not provide financial incentives for sharing information.

How Long We Keep Your Information

Pave retains personal data only for as long as needed to satisfy legal, contractual, or business needs. This includes:

• Active Contracts: Kept for the duration of your Service, plus any post-contract warranty or billing periods.
• Legal Mandates: Kept for durations required by accounting, consumer protection laws, or other legal mandates.
• Pursuant to the Advisers Act, most information is required to be retained for five years, the first two years in an easily accessible place. Certain other records may be required to be kept for a longer period, such as information related to performance claims. Pursuant to the Exchange Act, most records are required to be retained for six years. Certain other records, such as order tickets, trade confirmations and other related information, is required to be retained for three years.
• Business Protection: Retained for a reasonable window to manage legal claims or resolve disputes.
• Consent-Based Data: Kept until you opt out of marketing or withdraw consent.
• Safety & Auditing: Retained for risk management, security audits, and breach prevention.

We purge personal information that is no longer necessary by destroying, de-identifying, or anonymizing it.

How We Secure Your Information

Pave is committed to protecting the personal information we collect. We maintain a comprehensive security program that includes technical, physical, and administrative safeguards designed to protect personal information from unauthorized access, use, or disclosure. However, because no security framework is entirely impenetrable, we cannot warrant or guarantee that our protections will prevent every unauthorized attempt to circumvent these measures.

Your Privacy Rights and Choices

Depending on your state of residence, applicable privacy laws may provide you with certain privacy rights in relation to the personal information we collect and maintain about you. To the extent one or more of the below privacy rights does apply to you, you can find more information about how to exercise that right in the Exercising Your Privacy Rights section.

• Right to Access & Know: You can request a report on the categories and specific pieces of personal information we collect, the sources of that data, our business purposes for using it, and the third parties with whom we share it.
• Right to Correct: You may request that we fix inaccurate personal information held in our records.
• Right to Delete: You can request the removal of your personal information, though we may retain certain information to complete transactions, maintain security, debug systems, or comply with legal obligations.
• Right to Opt-Out of Sale or Sharing of Personal Information: You may opt-out of our ability to share your information with third parties. If you decide to opt-out, you will not be permitted to use the website or related websites and you will not be able to use our services.
• Right to Limit the Use of Sensitive Personal Information: You have the right to direct Pave to limit the use of your sensitive personal information to only those purposes necessary to perform the services or provide the goods reasonably expected by an average consumer, or as otherwise permitted by law. However, please know that Pave does not use sensitive personal information for any purpose other than those for which it was collected to provided its Services or as otherwise permitted by law.
• Right to Opt Out of Automated Decision-Making: You have the right to opt out of the use of automated decision-making technology, including profiling. Additionally, if such technology is used to make a significant decision regarding your services, you have the right to access information about the logic involved and the potential consequences of that decision.
• Right to Non-Discrimination: We will not penalize you, such as by denying service or changing your pricing, for exercising any of your privacy rights.
• Federal law rights. Under the Cable Act and Communications Act, you have certain rights. To learn more, see Federal Law Disclosures.
• Opting Out of Promotional Messages or Communications: To stop receiving promotional messages, offers, or other communications from Pave, use the opt-out link in any text or email, or contact us to be added to our "Opt Out" list.
• Mobile Account Deletion: You may delete your Pave mobile app account and associated data through the Pave App. While you will retain your primary Services, deletion will disable your Pave ID and any related access and features. Upon request, we will initiate a 90-day purge of your Pave ID, subject to legal retention needs. App-specific data (e.g., login history) may be kept for up to 12 months for fraud prevention, security, and legal compliance. After 180 days, data may be anonymized and aggregated; once anonymized, this data is no longer personal information and is excluded from deletion requests. The information to be retained and deleted pursuant to this provision is subject to the record retention requirements of the Advisers Act or the Exchange Act, as applicable.
• Online Advertising & Analytics Opt-Out: You can decide to opt-out of our Cookies and data capture and tracking program. If you choose to opt-out, you will no longer be able to use the website or related websites.
• CPNI Rights: When you contact us, we may request oral consent to use your CPNI to offer additional products during that interaction. For existing subscribers, we may also use your CPNI to market new communications services. If you opt-out of providing this consent, you will no longer have access to the website or related websites and will not be able to use our services.
• Google Analytics: Our Sites use Google Analytics and features like Enhanced Conversions to analyze user interaction and ad effectiveness. Google uses cookies to collect data, such as IP addresses and visit history, but does not personally identify you without affirmative consent. This data is stored by Google and subject to its privacy policies. To opt out, you can visit Google's Partner Site Policies or contact us directly. If you opt-out, you will no longer be able to access our website or related websites and you will no longer be permitted to use our services.

Exercising Your Privacy Rights

To exercise any privacy rights described above that apply to you, please submit a consumer request to us by either:

• Calling our Consumer Request Team at 646-690-2800.

Submission Limits & Requirements

Unless otherwise mandated by your state's laws, you may submit each type of consumer request up to two times within a 12-month period. To process your request, you must:

• Provide Sufficient Information: We must be able to reasonably verify that you are the data subject or an authorized representative.
• Specify the Request Type: Clearly state whether you wish to access, correct, or delete your personal information so we can properly evaluate and respond.

Identity Verification Process

We cannot fulfill requests if we are unable to verify your identity or authority. Personal information provided for verification will be used solely for that purpose.

• Existing Customers: We verify your identity by matching your provided information against your Pave account records.

Response Timelines & Delivery

We aim to respond to all verified requests within forty-five (45) days. If an extension is necessary, we will notify you in writing of the reason and the additional time required.

Delivery Options: You may choose to receive our response via mail or email.

Pave Customers: Responses will be delivered through your chosen method (mail or electronic).

Fees: While most requests are processed free of charge, Pave reserves the right to charge a fee for requests that are excessive, repetitive, or manifestly unfounded. If a fee is warranted, we will provide a written explanation and a cost estimate before proceeding.

Authorized Agents

If you are an authorized agent making a privacy rights request on behalf of a consumer, please download the following two forms and follow the instructions on each form:

• CCPA California Consumer Permission to Authorized Agent
• CCPA California Consumer Request by Authorized Agent

Privacy Rights Request Appeals Process

If you disagree with our decision regarding a privacy rights request, you may initiate an appeal. This process allows us to reevaluate your request and ensure all information was considered correctly.

1. Starting the Appeals Process

You may formally start the appeals process by:

• Emailing support@pavefinance.com (use "NOTICE OF APPEAL" in subject line)

Please include your privacy right request ticket number, fully describe your concerns or disagreement, and include any documentation necessary to validate the claims you are making.

2. Acknowledgment of the Appeal

We will acknowledge receipt of your written appeal within ten business days. This acknowledgment may include requests for additional information necessary for our investigation. Please note that providing a complete and substantive response is essential, as a lack of information may materially impact our ability to resolve the issues raised.

3. Scope of the Appeal

Our review will determine if the initial decision was fair and compliant with applicable privacy laws. You may only appeal a decision that affects you personally. If you are acting on behalf of another individual, you must provide valid evidence of your authorization.

The appeal is strictly limited to the specific privacy request decision in question. General concerns regarding company policies, management practices, or other unrelated matters fall outside the scope of this process and will not be considered.

4. Remedy

Clearly identifying the remedy you seek is a vital component of the process. Your written appeal must specify the desired outcome, for example, the access, correction, or deletion of your personal information. This allows our team to accurately assess your request and determine the appropriate path forward.

5. Investigation and Determination

We will conduct a reasonable investigation based on the documentation and information available. Following this review, we will reach a determination, which may include upholding or modifying the original decision. You will receive a written explanation of our determination within sixty days of our receipt of your appeal.

Depending on your state of residence, if your appeal is denied, you may have the right to file a further appeal with your state's relevant regulatory authority:

• If you reside in Delaware, you may file a complaint with the Delaware Department of Justice by using the online complaint form, calling 888-965-0146, or emailing consumer.protection@delaware.gov.
• If you reside in Iowa, you may file a complaint with the Iowa Attorney General by using the online complaint form, calling 833-399-2726 (local) or 844-977-3521 (toll-free), or emailing consumer.consumer@ag.iowa.gov.

6. Withdrawal of the Appeal

You may withdraw or end your appeal at any time by providing us written notice.

7. No Discrimination

We do not discriminate against any person who initiates an appeal.

8. Appeal Record

We will maintain a record of the appeal, including the final determination, in accordance with our record retention policies and procedures.

Law Enforcement and Legal Requests

All law enforcement requests, warrants, and subpoenas issued in connection with court proceedings should be submitted via emailed to legal@pavefinance.com.

Accepted legal process includes:

• Warrants and court orders
• Subpoenas (civil and criminal)
• Orders for Pen Register/Trap and Trace Devices or Wiretaps
• Data Preservation Requests
• Civil requests made with explicit customer consent
• General inquiries regarding customer information

Technical Requirements:

• IP Address Requests: You must provide a specific timestamp (preferred) or a precise date and time range.
• Call Detail Records: Please provide a clear date range for the requested records.
• Contact Information: All requests must include the requester's direct contact information to facilitate clarification.

Privacy Rights of Minors

You must be at least 18 to subscribe to Pave Services. Our Sites are not directed to children less than 18 years of age, and Pave does not knowingly or intentionally collect personal information from children less than 18 years of age.

Links to Third Party Sites

Our Sites from time to time may contain links to third-party websites and services. These links are provided for your convenience and information only and may operate independently from us and have their own privacy policies and notices. You are strongly encouraged to review such policies or notices. We do not endorse or make any representations or warranties concerning those third-party sites or notices or have any responsibility regarding these third-party sites.

California Shine the Light

If you are a California resident, you have the right to request information from us once per calendar year regarding the customer information we share with third parties for the third parties' direct marketing purposes. To request this information, please send an email to the address listed in the Contact Us section.

Changes to this Privacy Policy

Pave reserves the right to amend this Notice at our discretion and at any time. When updates are made, we will post the revised policy on our website and update the "Last Edited" date accordingly. If we make material changes to how we treat your personal information, we will notify you through a notice on our homepage or via email. By continuing to use our Site and Services after these changes are posted, you acknowledge and accept the updated terms of the Notice.

Accessibility

If you need a paper copy or an alternative format of this Notice, please contact us at legal@pavefinance.com.

Contact Us

If you have any questions or comments about this Notice, the ways in which Pave collects and uses your personal information described herein, or your choices and rights regarding such use, please do not hesitate to contact us at:

• Email: legal@pavefinance.com
  Phone:
• Phone: 646-690-2800
  Monday-Friday 8AM-8PM Eastern Time
  Saturday-Sunday Closed
• Postal Address:
  Pave Finance, Inc.
  Attn: Legal Department
  171 Madison Ave., Suite 1500, New York, NY 10016

‍