Privacy Policy

Who we are

Ezra Bridge Inc. ("Ezra Bridge", "we", "us" or "our") is a corporation incorporated in the State of Delaware, United States (registered address available on request). We operate Revaia, an invoice factoring and working capital platform, and the website at revaia.io (together, the "Site").

This policy explains what information we collect through the Site, why we collect it, who we share it with, and the choices you have. It covers two groups: businesses that apply to finance or sell their invoices ("merchants"), and the capital partners and funders who provide the capital behind an advance. Where you have signed a separate agreement with us, that agreement governs the services it covers, and this policy explains how we handle personal information alongside it.

Information we collect

We aim to collect only what we need to assess, fund and administer a facility. In practice it falls into these categories:

• Information you give us. If you email us or make an enquiry, we receive your name, business email address, and whatever you choose to put in your message.
• Business and KYB information. If you apply, we collect information about your business and the people behind it: legal and trading name, registration details, ownership and control information, and the details needed to verify directors, beneficial owners and authorised signatories.
• Identity verification records. Identity documents and the results of identity and business verification checks, including the outcome of a check and the record that it was carried out.
• Financial and accounting data. Company financial information, accounting records, transaction history and, where you choose to connect an accounting or banking provider, the data that connection makes available to us.
• Invoice data. The invoices you submit and the information on them, including amounts, dates, payment terms, and details of the customer that owes the invoice. See "Information about other people" below.
• Bank account details. The account details needed to pay out an advance and to receive settlement.
• Capital partner information. If you engage with us as a funder or capital partner, we collect the details needed to administer that relationship, including identity and eligibility information and the terms you have agreed.
• Technical information. Our hosting infrastructure records standard server logs: IP address, browser user agent, referring page, requested URL and timestamp, used for security, abuse prevention and diagnostics. Where analytics are enabled they are aggregate and privacy-preserving.

We collect sensitive or special category personal information only where identity verification requires it, and we ask that you do not send us sensitive information we have not asked for.

Information about other people

An invoice tells us about someone other than you. When you submit one, you give us information about the customer that owes it, usually a business, and often the name, role, email address and telephone number of an individual there. That person is not our user, has no relationship with us, and will not normally have visited the Site.

For that information we act as an independent controller, not as a processor acting on your instructions. We use it for the purposes set out in this policy: verifying that an invoice is genuine, assessing and administering an advance, arranging settlement, preventing fraud, and meeting our legal obligations.

You are responsible for the personal information you send us about other people. By submitting it you confirm that you are entitled to share it with us, that you have a lawful basis for doing so, and that your own privacy notice and any agreement with your customer allow it. Please do not send us information about an individual that you are not entitled to share.

Where we contact a customer of yours, for example to verify an invoice or to arrange payment, we will provide the information about our processing that applies at that point. We do not sell that information, and we do not use it for cross-context behavioural advertising.

If you are an individual named on an invoice one of our merchants has submitted, you have the same rights over that information as anyone else described in this policy, and you can exercise them by writing to us.

How we use information

We use the information described above to:

• Respond to your enquiry and assess whether there is a basis for working together.
• Verify your business and the people behind it, and meet know-your-business, know-your-customer and anti-money-laundering obligations.
• Assess an application, which includes underwriting your business, the invoice, and the customer that owes it.
• Fund, administer, monitor and collect on a facility, including verifying invoices, making payments and reconciling settlement.
• Detect, investigate and prevent fraud, misuse and credit risk.
• Administer the capital partner relationship, including reporting on the performance of funded invoices.
• Operate, secure, maintain and improve the Site.
• Comply with legal, regulatory, tax, sanctions and anti-money-laundering obligations, and enforce our Terms of Use.

Where applicable law requires a legal basis for processing, we rely on the necessity of processing to take steps at your request before entering into a contract or to perform one, on our legitimate interests in operating and securing the platform and in assessing and managing credit and fraud risk, on your consent where you have given it, and on compliance with our legal obligations.

Assessment, verification and fraud checks may involve automated processing. Where a decision that produces a legal or similarly significant effect is taken about you by automated means alone, and applicable law gives you the right, you can ask for human involvement, put your position to us, and contest the decision.

Confidentiality of business information

Financial statements, accounting records, invoices and customer lists are commercially sensitive. We treat them as confidential, limit access to the people and providers who need it to do the work, and do not disclose them outside the circumstances described in this policy. Where you have signed an agreement with us that covers confidentiality, that agreement governs the material it covers and nothing in this policy reduces the protection it gives you.

We do not publish the name of a business we fund without its written consent.

Cookies and similar technologies

The Site is built to work without advertising or cross-site tracking cookies. We use strictly necessary cookies and storage to make the Site work, including, where you have an account, keeping you signed in and remembering interface preferences, and privacy-preserving analytics that do not follow you across other websites.

Most browsers let you refuse or delete cookies and clear local storage. Doing so may sign you out or reset preferences, but it will not stop you reading the public pages. The Site also honours the Global Privacy Control ("GPC") signal where your browser sends one.

How we share information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

We share information only in these circumstances:

• Service providers. By category: identity and business verification providers, banking and payment providers, accounting and financial data providers you authorise us to connect to, credit and fraud risk providers, hosting, email delivery, document storage, error monitoring and analytics. They process information on our instructions and are bound to protect it.
• Capital partners and funders. Where a capital partner funds or participates in an advance, we share what they need to fund, price, monitor and report on it, including information about the invoice and the parties to it, under confidentiality terms.
• Your customers. Where it is necessary to verify an invoice, to give notice of an assignment where one applies, or to arrange settlement, we may contact the customer that owes the invoice, or a person acting for them.
• Professional advisers. Lawyers, accountants, auditors and insurers where necessary and under a duty of confidentiality.
• Corporate transactions. If Ezra Bridge or the Revaia business is merged, acquired or restructured, information may transfer as part of that transaction. We will tell you before your information becomes subject to a materially different policy.
• Legal requirements. Where we are required to do so by law or regulation, or where disclosure is necessary to protect the rights, property or safety of Ezra Bridge, the businesses we work with, or the public.
• With your authorisation. Anywhere else you ask us to send it.

How long we keep it

We keep applications, account records, verification results, invoice and transaction data, and correspondence for as long as needed to provide the service and to maintain the business, tax, accounting and regulatory record of it. Records we are required to hold under anti-money-laundering and financial recordkeeping rules are kept for the period those rules require, which is usually longer than the relationship itself. Server logs are kept for a short rolling window sufficient for security and diagnostics.

If an application is declined or withdrawn, we keep a limited record of it so that we can answer questions about the decision, prevent fraud and meet our obligations.

When information is no longer needed for the purpose it was collected for, and no legal obligation requires us to keep it, we delete it or irreversibly anonymise it.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or port the personal information we hold about you, to opt out of certain processing, and to appeal a decision we make about such a request.

United States. Residents of California, Colorado, Virginia, Connecticut, Utah and other states with comprehensive privacy laws have rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, and certain profiling. We do not discriminate against anyone for exercising them. If we decline a request you may appeal by replying to our decision, and you may then contact your state Attorney General if you are not satisfied with the outcome.

EEA and UK. If you are in the European Economic Area or the United Kingdom, you also have the right to object to processing based on legitimate interests, to withdraw consent at any time, to ask for human involvement in a decision taken solely by automated means where that decision has a legal or similarly significant effect, and to lodge a complaint with your local supervisory authority.

Some rights are limited. We may not be able to delete information we are required to keep under anti-money-laundering or financial recordkeeping rules, or that we still need while a facility is live or a balance is outstanding, and we may need to keep enough information to prevent fraud. Where we decline a request, we will tell you why.

To exercise any of these rights, email hello@revaia.io. We will verify your request and respond within the period required by applicable law.

International transfers

We are based in the United States and our service providers may process information in the United States and other countries. Where we transfer personal information out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with any additional measures required.

Security

We use encryption in transit, access controls and the principle of least privilege across our infrastructure, and we restrict access to financial, banking and invoice data to those who need it to do the work. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we will notify affected individuals and regulators of a breach where the law requires it.

If you believe you have found a security issue affecting the Site or any Revaia system, please report it to hello@revaia.io rather than disclosing it publicly, and we will work with you on it.

Children

The Site is for business use. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

Third-party links and connections

The Site links to, and connects with, services we do not control, including the identity verification, banking and accounting data providers you may be asked to authorise. Those services have their own privacy policies and we are not responsible for their practices. Review them before providing information or granting a connection.

Changes to this policy

We may update this policy as the platform changes. When we do, we will revise the date at the top of this page. If the changes are material, we will provide a more prominent notice.

Contact us

Questions, requests or complaints about this policy can be sent to hello@revaia.io, or by post to:

Ezra Bridge Inc.
Registered address available on request, and by email at hello@revaia.io.