Via Pay, LLC (dba Transi) Privacy Policy

Effective date: September 30, 2026 · Last updated: September 30, 2026

This Privacy Policy explains how Via Pay, LLC, doing business as Transi (“Transi,” “we,” “us,” or “our”), collects, uses, shares, and protects your personal information when you use our services (the “Services”), such as when you:

• Visit https://www.transi.com/ or any other website of ours that links to this Policy;
• Download and use the Transi mobile application (the “Transi App”) or any other application of ours that links to this Policy; or
• Send money through the Services or otherwise engage with us, including through customer support, sales, marketing, or events.

Via Pay, LLC, doing business as Transi, is a money services business registered with the Financial Crimes Enforcement Network (FinCEN), NMLS ID 2493750. Transi operates the technology platform through which the Services are offered. The money transmission services are provided by Spectrum Global Payment Solutions, Inc., a licensed money transmitter, or any successor or replacement licensed money transmitter we identify to you (the “Licensed Transmitter”). The Licensed Transmitter for your transfer is identified in the Transi App, in the Terms and Conditions you accept, and on your receipt.

We collect your information through the Transi App and our website and share it with the Licensed Transmitter so that it can process your transfer and meet its own legal obligations. The Licensed Transmitter is an independent financial institution. To send money you must also accept its Terms and Conditions and Privacy Policy, which are presented to you in the Transi App and govern its use of your information. This Policy describes how Transi handles your information. The U.S. Consumer Privacy Notice in Annex A is the notice federal law requires us to give you about our financial services. If you do not agree with this Policy, please do not use the Services. Questions or concerns can be sent to support@transiapp.com.

This Policy applies to people who use the Transi App to send money and to the information those senders give us about recipients. Recipients are not users of the Transi App. Information that payout partners collect directly from recipients in the Dominican Republic is governed by their own notices and local law.

Summary of key points

What personal information do we process? Depending on how you use the Services, we process identifiers, government ID and verification data, payment and transaction information, recipient details, and device and usage data (Section 1).

Do we process sensitive personal information? Yes, when necessary to provide the Services, verify your identity, prevent fraud, and comply with law, with your consent or as otherwise permitted by law (Section 1).

Do we collect information from third parties? Yes, including identity verification and fraud prevention providers, public databases, marketing partners, and social media platforms (Section 1).

How do we use your information? To provide and improve the Services, verify your identity, comply with anti-money laundering, sanctions, and other laws, prevent fraud, communicate with you, and, where permitted, market to you (Section 2).

Who do we share it with? The Licensed Transmitter, affiliates, payout and financial-institution partners, service providers, and government authorities, and in other limited situations (Sections 3 and 4).

Do we transfer it outside the United States? Yes. Sending money to a recipient abroad requires us to disclose sender and recipient information to partners in the destination country (Section 4).

What are your rights? Depending on where you live, you may have rights to access, correct, delete, and obtain a copy of your information and to opt out of certain uses (Sections 9, 11, and 14). Some rights are limited where we must keep records to comply with law.

How do you exercise your rights? Call 1-855-545-0925, email support@transiapp.com, or contact us as described in Section 14.

1. What Information Do We Collect?

We collect personal information that you provide to us, that we collect automatically, and that we obtain from other sources. The categories below also serve as our notice at collection for residents of California and other states.

Information you provide. When you register, send money, contact us, or otherwise use the Services, we may collect:

If you give us information about another person, such as a recipient, you confirm that you are authorized to do so and, where required, that you have told that person how we will use it.

Sensitive information. When necessary, with your consent or as otherwise permitted by applicable law, we process sensitive personal information, including financial account and payment card data and government identifiers (such as Social Security, driver’s license, and passport numbers). We do not collect or process sensitive personal information to infer characteristics about you.

Device biometrics. If you use your device’s fingerprint or face recognition to log in to the Transi App, that biometric data stays on your device. We do not collect, receive, or store it. If we add features that collect biometric data, we will update this Policy and obtain your consent before collecting it, where the law requires.

Payment data. We collect the data necessary to process your payment, such as your payment instrument number and security code. Card data is handled by our payment processors.

Application data. If you use the Transi App, we may ask for permission to push notifications. Location information, collected continuously or only while you use the app, helps us provide location-based services and detect fraud. You can change these permissions in your device settings. Turning off a permission may limit what the Services can do. Biometric data stays on your device, as described under “Device biometrics.”

Information collected automatically. When you visit or use the Services, we automatically collect certain technical information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and information about how and when you use the Services. This information is primarily needed to maintain the security and operation of the Services and for internal analytics and reporting. It includes:

• Log and usage data: diagnostic, usage, and performance information our servers record, such as IP address, device information, browser type and settings, pages and features used, date and time stamps, and error reports.
• Device data: device and application identifiers, hardware model, internet service provider or mobile carrier, operating system, and system configuration.
• Location data: precise or imprecise device location, based on technologies or your IP address. You can opt out by refusing access or disabling location services on your device, but some features may then be unavailable.

Like many businesses, we also collect information through cookies and similar technologies (Section 5).

Information from other sources. We may obtain information about you from the Licensed Transmitter (for example, the status of your transfer), identity verification and fraud prevention providers, sanctions and watchlist screening providers, public databases, joint marketing partners, affiliate programs, data providers, social media platforms, and other third parties. This information includes mailing addresses, job titles, email addresses, phone numbers, IP addresses, social media profiles, and intent (user behavior) data, and is used for verification, fraud prevention, and, where permitted, our own marketing and event promotion.

All personal information you provide must be true, complete, and accurate, and you must tell us promptly of any changes.

2. How Do We Process Your Information?

We process your personal information to provide, improve, and administer the Services, communicate with you, verify your identity, prevent fraud, and comply with law. We may also process it for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Specifically, we process it:

• To create and manage your account, including authenticating you and keeping your account in working order.
• To provide the Services, including processing and delivering your transfers, processing payments, and handling refunds and corrections.
• To verify your identity and comply with the law, including our and the Licensed Transmitter’s customer identification, anti-money laundering and counter-terrorist financing programs, sanctions screening, recordkeeping, and reporting under the Bank Secrecy Act and applicable state money transmission laws. Federal law may prohibit us from telling you that we have made a report to, or responded to a request from, a government authority.
• To detect, investigate, and prevent fraud and other malicious, deceptive, or illegal activity, and to protect the security of the Services and your account.
• To respond to your inquiries and provide support, including by recording calls and chats for quality assurance and training.
• To send administrative and service information, such as transaction confirmations, receipts, and changes to our products, terms, and policies.
• To send marketing and promotional communications, where permitted and consistent with your preferences. You can opt out at any time (Section 9).
• To enable user-to-user communications, if you choose to use an offering that allows communication with another user.
• To evaluate and improve the Services, including identifying usage trends, measuring the effectiveness of our promotions, and improving your experience.
• To comply with our legal obligations, respond to legal requests, and exercise, establish, or defend our legal rights.

Automated decision-making. We use automated tools, including identity verification checks and transaction monitoring, to help detect fraud, identity theft, and suspicious activity. These tools may cause a transaction to be delayed, held, or declined, or an account to be restricted. If you believe an automated decision affected you in error, contact us as described in Section 14 and we will arrange a review by our staff.

3. When and With Whom Do We Share Your Personal Information?

We share personal information only in the situations described in this Policy. The categories of recipients are:

• The Licensed Transmitter. The licensed money transmitter that provides the money transmission services for your transfer. It receives your identification, account, transaction, and recipient information to process your transfer and to meet its own legal obligations, including anti-money laundering, sanctions, recordkeeping, and reporting obligations. It is an independent financial institution, and its use of your information is governed by its own Privacy Policy and Terms and Conditions.
• Affiliates. Companies under common ownership or control with Via Pay, LLC, which process personal information on our behalf or as permitted or required by law.
• Payout and financial-institution partners. Banks, subagents, payout networks, cash pickup agents, mobile wallet providers, payment processors, and other institutions that hold, move, or deliver funds to complete your transfer. They receive sender and recipient information to complete the transfer and to meet their own legal obligations, including anti-money laundering obligations under local law, and their use of that information is governed by their own privacy practices and local law.
• Identity verification, screening, and fraud-prevention providers. Providers that verify identity documents, screen against sanctions and watchlists, monitor transactions, and investigate fraud.
• Service providers. Vendors and contractors that perform services for us, such as cloud computing, data storage and hosting, data analytics, performance monitoring, customer support, email, SMS and push notification delivery, finance and accounting tools, and user account registration and authentication services.
• Government authorities and regulators. FinCEN, OFAC, state financial regulators, law enforcement, and courts, where we are required or permitted to disclose information, including in response to subpoenas, warrants, court orders, and regulatory examinations, and to protect our rights or the safety of others.
• Professional advisers. Auditors, attorneys, and insurers that need the information to advise or serve us.
• Analytics providers. Limited to the usage data described in Section 5, under contracts that limit their use of it to providing analytics services to us.

We have written contracts with our service providers that are designed to help safeguard your personal information. They may use it only as we instruct, may not share it with anyone other than us except as permitted by the contract or law, must protect it, and must retain it only for the period we specify.

We may also share your information in these situations:

• Business transfers. In connection with, or during negotiations of, a merger, sale of company assets, financing, or acquisition of all or part of our business.
• APIs. With certain application programming interfaces, such as the Google Maps and Places APIs.
• With your consent or at your direction. For example, when you ask us to share information with another person or service.

We do not share your personal information with nonaffiliated third parties so that they can market their own products to you.

4. Do We Transfer Your Information Internationally?

Yes. The Services are designed to send money from the United States to recipients in the Dominican Republic. To complete a transfer, we must disclose sender and recipient information to the Licensed Transmitter and to payout partners in the destination country, such as banks, subagents, and other payout institutions, and to regulators there where required. Our service providers may also process information in the United States and other countries.

Data protection laws in those countries may differ from those of the United States. We limit what we disclose to what is needed to complete your transfer, prevent fraud, and comply with law, and we use contractual and technical safeguards designed to give your information a comparable level of protection.

Because delivering your transfer requires disclosing recipient information abroad, we cannot complete a transfer if you object to this disclosure.

5. Do We Use Cookies and Other Tracking Technologies?

We use cookies and similar technologies, such as web beacons, pixels, and software development kits (SDKs) in the Transi App, to gather information when you interact with the Services. Some of these technologies keep the Services secure, prevent crashes, fix bugs, save your preferences, and support basic site functions.

We use analytics service providers to understand how the Services are used and to improve them. They may use these technologies only to provide analytics services to us.

We do not use third-party advertising or retargeting technologies on the Services, and we do not sell or share personal information for targeted advertising.

If we begin to use advertising or retargeting technologies, we will first update this Policy, offer the opt-out choices required by law, and honor opt-out preference signals such as the Global Privacy Control (Section 10). You can set your browser to remove or reject cookies. Rejecting cookies may affect some features of the Services.

6. How Long Do We Keep Your Information?

We keep your personal information for as long as necessary to fulfill the purposes described in this Policy, and longer where the law requires or permits. As a regulated financial services provider, we must keep certain identity, account, and transaction records after your account is closed. We keep those records for at least ten (10) years after the end of our relationship with you, or longer where required by anti-money laundering, tax, accounting, or state and foreign money transmission laws or by a legal hold. The Licensed Transmitter keeps records of your transfers for its own legal obligations and under its own policies.

To decide how long to keep information, we consider the legal and regulatory retention periods that apply to us, the amount, nature, and sensitivity of the information, the risk of harm from unauthorized use or disclosure, and whether we can achieve our purposes by other means. Information that is not a required record, such as marketing and device data, is kept for shorter periods.

When we no longer have a legitimate business or legal need to keep your information, we delete or anonymize it. If that is not possible, for example because it sits in backup archives, we store it securely and isolate it from further processing until deletion is possible.

7. How Do We Keep Your Information Safe?

We maintain a written information security program with administrative, technical, and physical safeguards designed to protect the personal information we process and to meet applicable requirements, including federal data security requirements for financial institutions. These measures include encryption of sensitive data in transit and at rest, access controls that limit access to personnel with a business need, and the use of security credentials to access your account.

No electronic transmission over the internet and no information storage technology can be guaranteed to be 100% secure, so we cannot promise that unauthorized third parties will never defeat our security and improperly collect, access, steal, or modify your information. You are responsible for keeping your login credentials confidential, for using the Services only in a secure environment, and for telling us promptly if you suspect unauthorized use of your account. If a security incident affects your information, we will notify you and regulators as required by law.

8. Do We Collect Information from Minors?

You must be at least 18 years old to use the Services. We do not knowingly collect or solicit personal information from, or market to, anyone under 18, and we do not knowingly sell or share the personal information of anyone under 18. If we learn that we have collected personal information from a person under 18, we will close the account and take reasonable measures to delete the information promptly, except where the law requires us to keep it. If you believe we may have collected information from a person under 18, please contact us at 1-855-545-0925 or support@transiapp.com.

9. What Are Your Privacy Rights?

You may review, change, or close your account at any time, and, depending on your country, province, or state of residence, you may have additional rights described in Sections 11 and 14.

Withdrawing your consent. Where we rely on your consent to process your personal information, which may be express or implied depending on applicable law, you can withdraw it at any time by contacting us as described in Section 13. Withdrawal does not affect the lawfulness of processing before it, or, where the law allows, processing that relies on a legal basis other than consent. If you withdraw consent, we may no longer be able to provide some or all of the Services.

Opting out of marketing. You can unsubscribe from marketing emails by using the unsubscribe link in each message, stop SMS messages by replying “STOP” or “UNSUBSCRIBE,” turn off push notifications in your device settings, or contact us as described in Section 13. Message and data rates may apply to SMS messages. We may keep your contact details on a suppression list so that we honor your request. We will still send you service-related messages that are necessary to administer your account, respond to service requests, or meet legal obligations, and those cannot be turned off.

Account information. To review or change the information in your account, you can log in to your account settings in the Transi App, or contact us using the details in Section 13. You can close your account at any time from the Transi App (tap your profile icon, then Profile Details > Close My Account) or by visiting https://www.transi.com/delete-account. We will deactivate or delete your account and information from our active databases, but we may retain some information to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, and comply with applicable legal requirements (Section 6).

Cookies and similar technologies. Most web browsers accept cookies by default. You can usually set your browser to remove or reject cookies, which may affect certain features of the Services (Section 5).

If you have questions or comments about your privacy rights, email support@transiapp.com.

10. Controls for Do-Not-Track Features and Global Privacy Control

Most web browsers and some mobile operating systems and apps include a Do-Not-Track (“DNT”) setting that signals your preference not to have your online browsing activity monitored and collected. No uniform technology standard for recognizing DNT signals has been finalized, so we do not currently respond to DNT signals. California law requires us to tell you how we respond to DNT signals, and this is our response.

Because we do not currently sell or share personal information or use it for targeted advertising, a Global Privacy Control (“GPC”) signal does not change how we handle your information. If that changes, we will honor GPC signals as a valid request to opt out of sale, sharing, and targeted advertising, as required by law, and we will update this Policy before we do. If a standard for online tracking is adopted that we must follow, we will describe that practice in a revised version of this Policy.

11. Do United States Residents Have Specific Privacy Rights?

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and details about the personal information we maintain about you and how we have processed it, correct inaccuracies, obtain a copy, or delete it. You may also have the right to withdraw consent to our processing. These rights may be limited in some circumstances by applicable law.

Financial information covered by federal financial privacy law. Some state privacy laws exempt financial institutions or information that is subject to federal financial privacy law. To the extent an exemption applies, information we collect to provide our financial services is governed by federal financial privacy law and by Annex A rather than by those state laws. The rights described below still apply to information that is not exempt, such as information collected from visitors to our website and app, marketing and advertising data, and online identifiers. We may decline a request, in whole or in part, where an exemption or a legal obligation to keep records applies, and we will tell you why.

Categories of personal information we collect. In the past twelve (12) months we collected the following categories, for the purposes in Section 2, from the sources in Section 1. We keep each category for the period described in Section 6.

We do not sell or share personal information, and we do not use it for targeted advertising. We do not knowingly sell or share the personal information of anyone under 18. We use sensitive personal information only to provide the Services, verify your identity, prevent fraud, and comply with law, and we do not use it to infer characteristics about you.

Your rights. Depending on your state, you may have the right to:

• Know whether we process your personal data, and access it.
• Correct inaccuracies in your personal data.
• Delete your personal data.
• Obtain a copy of the personal data you previously provided, in a portable format.
• Opt out of the sale or sharing of your personal data, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects.
• Limit the use and disclosure of your sensitive personal data, and withdraw consent where we process it on the basis of consent (as permitted by applicable law, including California’s).
• Obtain a list of the categories of third parties to which we have disclosed personal data (California and Delaware), or of specific third parties (Oregon).
• Opt out of the collection of sensitive data and of data collected through a voice or facial recognition feature (Florida).
• Appeal our decision if we decline your request.
• Not be discriminated against for exercising your rights.

How to exercise your rights. Call us toll-free at 1-855-545-0925 or use the other channels in Section 14. We do not currently sell or share personal information or use it for targeted advertising. If that changes, we will provide an opt-out link, honor GPC signals, and update this Policy before we do.

Authorized agents and verification. Under certain state laws you may designate an authorized agent to make a request for you. We may deny a request from an agent who does not submit proof of valid authorization. We must verify your identity before acting on a request (Section 14).

California “Shine the Light.” California Civil Code Section 1798.83 lets California residents request, once a year and free of charge, information about the categories of personal information we disclosed to third parties for their direct marketing purposes in the preceding calendar year and the names and addresses of those third parties. To make a request, write to us using the details in Section 13.

12. Do We Make Updates to This Notice?

Yes. We review this Policy at least once every twelve (12) months and update it whenever our practices or the law change. The updated version will carry a new “Last updated” date at the top. If we make material changes, we will notify you by prominently posting a notice, by email, or in the Transi App, and, where the law requires, we will seek your consent or give you a revised privacy notice. If the Licensed Transmitter changes, we will update this Policy and notify you as described above. We encourage you to review this Policy regularly.

13. How Can You Contact Us About This Notice?

If you have questions or comments about this Policy, you may contact our Data Protection Officer by email at support@transiapp.com, by phone at 1-855-545-0925, or by post at:

Via Pay, LLC

Data Protection Officer

489 5th Avenue, 29th Floor

New York, NY 10017

If we have not addressed your concern, you may also contact the Consumer Financial Protection Bureau at www.consumerfinance.gov/complaint or 1-855-411-2372, the Federal Trade Commission at www.ftc.gov, your state attorney general, or your state financial regulator. Complaint information for the Licensed Transmitter, including contact details for the state regulators that license it, is provided in the Transi App and on your receipt.

14. How Can You Review, Update, or Delete the Data We Collect From You?

You can submit a request to review, correct, delete, or obtain a copy of your personal information, or to exercise any other right in Sections 9 and 11, through any of these channels: the toll-free line at 1-855-545-0925, email to support@transiapp.com, your account settings in the Transi App, or post to the address in Section 13.

1. Verification. We must confirm that the request comes from you. We match the information in your request against what we hold and may ask for more information for security and fraud-prevention purposes. We use it only to verify your identity or authority and to process the request.
2. Authorized agents. If an agent submits a request for you, we will need written and signed permission from you, and we may verify your identity with you directly.
3. Timing and cost. We will confirm receipt within ten (10) business days and respond within forty-five (45) days, extendable once by another forty-five (45) days where permitted by law, in which case we will tell you why. We do not charge a fee unless a request is excessive, repetitive, or manifestly unfounded, and we will explain before charging one.
4. What we may not delete. We cannot delete information we must keep to comply with anti-money laundering, tax, and other recordkeeping laws, to complete a transaction, to prevent fraud and security incidents, or to establish, exercise, or defend legal claims. We will tell you what we kept and why, and we will isolate it from further use until it can be deleted (Section 6). The Licensed Transmitter keeps its own records for its own legal obligations, so a request about information it holds must also be sent to it.
5. Closing your account. On a closure request we will deactivate or delete your account from our active systems, subject to item 4.
6. Appeals. If we decline your request, you may appeal by emailing support@transiapp.com and explaining why the decision should be reconsidered. We will respond in writing within the period required by your state (forty-five (45) to sixty (60) days), with the reasons for our decision. If your appeal is denied, you may submit a complaint to your state attorney general.

Annex A. U.S. Consumer Privacy Notice

This notice applies if you are an individual in the United States who uses the Services for personal, family, or household purposes. It follows the model form under Regulation P (12 CFR Part 1016).

What does Via Pay, LLC (dba Transi) do with your personal information?

Why? Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.

What? The types of personal information we collect and share depend on the product or service you have with us. This information can include:

• Social Security number and government-issued identification
• Transaction history and payment information
• Account and contact information

How? All financial companies need to share customers’ personal information to run their everyday business. In the table below, we list the reasons financial companies can share their customers’ personal information, the reasons Transi chooses to share, and whether you can limit this sharing.

Questions? Call 1-855-545-0925.

Who we are

Who is providing this notice? Via Pay, LLC, doing business as Transi.

What we do

How does Transi protect my personal information? To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings. We authorize our employees to access your personal information only when they need it to do their work, and we require companies that work for us to protect your information.

How does Transi collect my personal information? We collect your personal information, for example, when you:

• Open an account or give us your contact information
• Use Transi to send money or provide recipient details
• Verify your identity with a government-issued ID document

We also collect your personal information from others, such as identity verification providers, affiliates, or other companies.

Why can’t I limit all sharing? Federal law gives you the right to limit only sharing for affiliates’ everyday business purposes (information about your creditworthiness), affiliates from using your information to market to you, and sharing for nonaffiliates to market to you. State laws and individual companies may give you additional rights to limit sharing. See below for more on your rights under state law.

Definitions

Affiliates. Companies related by common ownership or control. They can be financial and nonfinancial companies. Our affiliates include companies with a Transi name.

Nonaffiliates. Companies not related by common ownership or control. They can be financial and nonfinancial companies. Nonaffiliates with which we share personal information include the Licensed Transmitter, service providers, payout and financial-institution partners, and identity verification providers.

Joint marketing. A formal agreement between nonaffiliated financial companies that together market financial products or services to you. Transi doesn’t jointly market.

Other important information

California and Vermont residents. If your account has a California or Vermont mailing address, we will not share information we collect about you with nonaffiliated third parties, except as permitted by law, such as with your consent or to service your account. We will limit sharing with our affiliates to the extent required by California and Vermont law.

The Licensed Transmitter. The Licensed Transmitter provides its own privacy notice, which governs its use of your information.