PRIVACY POLICY

Last Revised: November 26, 2025

At Strategic Funding Source, Inc. (d/b/a Kapitus) and its subsidiaries and affiliates, including Kapitus Servicing, Inc., Invision Funding LLC, Kapitus Equipment Finance LLC, and Kapitus LLC (collectively, “Kapitus,” “we,” “us,” or “ours”), we take seriously protecting the privacy of personal information. Kapitus provides this Privacy Policy to its website visitors, users, and businesses that access services and products provided by or through Kapitus. We encourage you to read this notice to understand our privacy practices.

When you use, access, or interact with a Kapitus website (including all sub-sites) or other interface that links to this Privacy Policy, (collectively, “the Sites”) or otherwise apply for or use our business financial products and related services (together with the Sites, the “Services”), you are agreeing to thisPrivacy Policy and Terms of Use Agreement. Among other terms, you affirm that you are over the age of 18 and are fully able to form a binding, legal agreement with Kapitus.

Kapitus reserves the right at its sole discretion, to change, modify, add, or remove portions of these terms, at any time. It is your responsibility to check these terms periodically for changes. Your continued use of the Sites following the posting of changes will mean that you accept and agree to the changes. As long as you comply with these terms, Kapitus grants you a personal, non-exclusive, non-transferable, limited privilege to enter and use the Sites.

We are committed to protecting your personal information (i.e., information that identifies an individual, such as a name and email address) and have implemented controls to protect information that is furnished to us directly, as well as information that we may obtain, with authorization, from third party sources. This Privacy Policy is designed to be accessible to users with disabilities and follows the Web Content Accessibility Guidelines – a recognized industry standard. Text elements are designed to be accessible and audible through voice assistant programs, such as JAWS, NVDA, and Orca. All graphic elements are designed to contain properly descriptive alternate text to assist disabled consumers with audio assist needs.

If you have any questions or complaints regarding our Privacy Policy, or if you need assistance in exercising any privacy choices under this Privacy Policy, please contact us at [email protected]. You can also send questions or comments to:

Strategic Funding Source, Inc., d/b/a Kapitus

ATTN: Compliance Department

2500 Wilson Boulevard, Suite 350

Arlington, VA 22201

I. Site Security

As a condition of your use of the Sites, you agree that you will not take any action intended to: (i) access data that is not intended for you; (ii) invade the privacy of, obtain the identity of, or obtain any personal information about any customer or user of the Sites; (iii) probe, scan or test the vulnerability of the Sites or the Kapitus network or breach security or authentication measures without proper authorization; (iv) attempt to interfere with service to any user, host or network or otherwise attempt to disrupt our business, including, without limitation, via means of submitting a virus to the Sites, overloading, “flooding,” “spamming,” “mail bombing” or “crashing;” or (v) send unsolicited mail, including promotions and/or advertising of products and services. Violations of system or network security may result in civil or criminal liability.

We take reasonable measures, including administrative, technical, and physical safeguards to protect your information from loss, misuse, unauthorized access, disclosure, alteration, and destruction. These security measures include firewalls, data encryption, physical access controls to our data centers, and information access authorization controls.

II. Information We Collect

Information Collected Directly From You

In connection with our provision of Services, we collect business information, as well your personal financial information that you voluntarily provide to us by using our Sites and Services. We may gather additional information during your subsequent use of the Sites or when we communicate with you via telephone, email, or other means.

Certain personal information must be supplied during the application processes in order to meet our legal obligations, verify your identity, facilitate determinations for credit eligibility, protect against fraud, and complete your transaction. The following categories of information may be collected:

1. Your identifying information (for example, your name, account name, driver’s license information, address, email, telephone number, and date of birth) or similar identifiers;

2. Basic business information (for example, business name, address, email, website URL, telephone number, company structure, industry type, ownership information, and date of formation) or similar identifiers;

3. Full or partial social security number and/or business identification numbers;

4. Annual revenue and sources of revenue; and

5. Financial information (for example, bank statements, credit card statements, average bank balance, and credit score).

We may also collect information that you provide to us about your co-applicant in connection with a joint application. By submitting information about someone other than yourself, you represent that (i) you are authorized to provide us with that person’s information for the purposes identified in this Privacy Policy and/or in connection with our Services and (ii) the information provided is true and accurate to the best of your knowledge.

Information Collected From Third Parties

In connection with an application, we may also collect information from credit bureaus and other third parties to make determinations for financing eligibility, perform analyses, and assess risks related to your potential financing. If you are approved for financing, we also collect information throughout the life of our business relationship with you in order to assess risks associated with your financing and perform analyses. We may also receive information about you from one of our referral providers or lead vendors. The following categories of information may be collected from third parties:

1. Your identifying information (for example, your name, account name, driver’s license information, address, email, telephone number, and date of birth) or similar identifiers;

2. Basic business information (e.g., business name, address, email, URL, telephone number, company structure, industry type, ownership information, and date of formation) or similar identifiers;

3. Credit score, credit history, and other information relating to creditworthiness and identity;

4. Bank account information; and

5. Financial, tax, and transactional information about your business from third parties such as financial institutions, credit card processors, vendors and service providers, and publicly available sources.

Information Gathered Based on Your Activity on the Sites

In addition to the above, Kapitus may collect information about your visits to the Sites and the computer or device through which you access the Sites, such as your IP address, geographical location, operating system, browser type, referral source, time and length of visit, button clicks and/or page views, and your mobile device identifier (IDFA or AAID).

We may use technologies such as but not limited to cookies, beacons, tags, and scripts, to analyze trends, administer the Sites, track users’ movements around the Sites, and gather information about our user base. We may receive reports on this activity on an individual and aggregated basis.

We may use cookies when you interact with the Sites to keep track of your personal session, help authenticate your account, and detect fraud. Cookies are also used to gather statistical data, such as which pages are frequently visited, and what is downloaded, as well as for marketing and advertising purposes. You can control the use of cookies within your web browser. However, if you reject cookies, your ability to use some features or areas of the Sites may be limited.

III. How We Use Your Information

We may use the information we collect in a number of ways, including the following:

1. To process your business’s application and determine its qualification for financial products;

2. To facilitate servicing and collections activities;

3. To verify your identity, conduct appropriate diligence, and keep your information current;

4. To provide customer support;

5. To understand, personalize, and enhance your experience;

6. To show advertisements for our products and/or offers to you on third party sites;

7. To measure and improve the performance and functionality of the Sites;

8. To manage the security of the Sites;

9. To compile and generate data analytics reports to better understand our customers and to improve the user experience;

10. To operate, maintain, improve, and provide to you the Services and to conduct our business activities, including our own financing products and referring you to third party financing providers;

11. To comply with applicable legal requirements, contractual obligations, and our policies, as well as to protect our legal rights;

12. For any other purposes that we may specifically disclose at the time you provide, or we collect, your information; and

13. For any other purpose with your consent.

IV. How We Disclose Your Information

We may disclose your personal information with non–affiliates (companies not related by common ownership or control) and among affiliates (companies related by common ownership or control, including but not limited to the companies covered by this policy) only in the ways that are described in this Privacy Policy. By law, you are permitted to limit some types of disclosure, but not others.

Kapitus may disclose the information we collect about you in the following ways:

1. With your co-applicant in order to process your business application and as needed to our Services;

2. With our service providers who help us conduct our business, advertising and marketing activities, such as maintaining our files and records, offering customer service, sending marketing communications, fraud prevention, identity verification, credit checks, collections, and payment processing;

3. Among our subsidiaries and affiliates, including as needed for the provision of the Services;

4. With our referral sources, lead vendors, advertising partners, bank partner, other business partners, and third–partyfinancing providers, including lenders, purchasers of accounts receivables, factoring companies, equipment finance or leasing companies, or other similar sources of commercial financing. If you enter into a financing relationship with any of these third parties, your personal information will be subject to the privacy policy of that third-party, which may differ from this Privacy Policy. We encourage you to review the governing privacy policies of any third parties with whom you establish a relationship;

5. With Credit bureaus to meet credit reporting obligations;

6. To comply with, or to allow investors or potential investors to comply with, any applicable law, regulation, legal process or governmental request, or contractual obligation; or for the purposes of limiting fraud;

7. In connection with a legal proceeding;

8. In connection with any actual or potential merger, acquisition, financing, due diligence, reorganization, bankruptcy, receivership, sale of company assets, transition of service to another provider, or other similar corporate transaction or event;

9. For any other purposes disclosed by us when you provided the information; and

10. With any other person or entity where you consent to the disclosure.

V. Third Party Links

We may provide links to websites that are owned or operated by other companies. When you use a link to visit a third-party site, you will be subject to that website’s privacy and security practices, which may be different from ours. Linked websites are not under our control and we expressly disclaim any responsibilities or liability for those other websites, including all content made available to you on those sites. We encourage you to carefully read the privacy policies and terms and conditions of any website you visit, including any linked third-party website.

VI. Important Privacy Choices

Blogs and other Public Forums

Our Sites offer publicly accessible blogs or community forums. You should be aware that any information you provide in these areas may be read, collected, and used by others who access them. To request removal of your personal information from our blog, community forum, or other social media, contact us by email at [email protected]. If we are unable to remove your personal information, we will let you know we are unable to do so and why.

Testimonials

We display personal testimonials of satisfied customers on our Sites in addition to other endorsements. With your consent, we may post your testimonial along with your name. If you wish to update or delete your testimonial, contact us by email at [email protected].

Marketing Communications

You may choose to stop receiving marketing emails by following the unsubscribe instructions included in those emails. You may also request that we do not call you for marketing-related purposes. In addition to following the unsubscribe instruction in relevant email communications, you may make these requests by contacting us at [email protected] or calling us at (844) 547-9396. We will respond to your request within a reasonable timeframe. In addition, if you no longer wish to receive marketing notifications through our mobile applications you can adjust your device’s privacy preferences by visiting the settings page of the device. Opting out of marketing emails or notifications will not stop your receipt of non-marketing emails and notifications related to our Services.

VII. Notice at Collection to California Residents

The California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (“CPRA”), requires that we provide California residents with a description of our practices regarding the collection, use, disclosure, sale, sharing, and retention of personal information, and of the rights of California residents regarding their personal information. This section of the Privacy Policy is intended solely for, and is applicable only to, individuals who reside in the State of California. If you are not a California resident, this section does not apply to you and you should not rely on it.

The CPRA defines “personal information” to mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. For purposes of this “Notice at Collection to California Residents” section, we will refer to this information as “Personal Information.”Personal information does not include publicly availableinformation, deidentified or aggregated information, or lawfully obtained, truthful information that is a matter of public concern.

Information We Collect

In the past 12 months, we have collected the following categories of Personal Information about California residents:

Category	Examples
Identifiers	Real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers
Categories of information described in the California Customer Records Statute	First and last name, signature, social security number, address, primary telephone number, passport number, driver’s license or state identification card, insurance policy number, employment, bank account number, or any other financial information
Commercial or transactions information	Products or services purchased, obtained, or considered
Geolocation Data	General physical location
Sensory data	Audio or similar information
Internet or other electronic network activity information	Information about your internet connection, including IP address, geographical location, operating system, browser type, referral source, time and length of visit, button clicks and/or page views, and your mobile device identifier (IDFA or AAID)
Sensitive Personal Information	Social Security number, driver’s license, state identification card,or passport number
Inferences drawn from other Personal Information	Inferences drawn from other information identified herein about your predicted characteristics and preferences
Professional or employment-related information	Job title, income

Sources of Personal Information

As set forth in Section II (“Information We Collect”) above, we collect Personal Information listed above from the following sources:

• Directly from you (e.g., when you apply for financing or interact with our website)

• Automatically from your use of our website or services (e.g., through cookies and similar technologies)

• From third parties (e.g., credit bureaus, referral providers,lead vendors, service providers).

Purposes of Collecting and Using Personal Information

We collect and may use Personal Information for business or commercial purposes as set forth with Section III (“How We Use Your Information”) above. We do not use Sensitive Personal Information for marketing purposes.

How Kapitus Discloses Personal Information

Kapitus may disclose Personal Information to service providers to help us conduct the business purposes listed above, includingto the extent needed to assist us in providing the Services. These companies are authorized to use your personal information only as necessary to provide their services to us. Kapitus may also disclose Personal Information to our bank partner, affiliates, referral sources, lead vendors, advertising partners, other business partners, including business partners who may offer products or services of interest to you, such as third–party financing providers.

Additionally, Kapitus may disclose your personal information: (i) as required by law; (ii) in connection with an audit or the sale of Kapitus to a third party; or (iii) with your consent.

Selling of Personal Information

Kapitus does not sell personal information as those terms are defined under the CPRA. We do not knowingly sell or -disclose the personal information of minors under 16 years of age.

Your Rights Under the CPRA

Right to Know/Right to Access. Under the CPRA, California residents have the right to request that Kapitus disclose what information we have collected, used, disclosed, or sold over the past 12 months. Once we receive and confirm your verifiable consumer request for such information, (see “How You Can Exercise Your Rights Under CPRA”), we will disclose to you:

1. The categories and specific pieces of personal information we collected about you over the past 12 months;

2. The categories of sources from which such personal information has been collected over the past 12 months;

3. The business or commercial purpose for collecting, disclosing or selling such personal information over the past 12 months;

4. The categories of third parties with whom we disclosed your personal information over the past 12 months; and

5. If we disclosed your personal information for a business purpose, the personal information categories that each category of recipients obtained.

Right to Delete. Under the CPRA, California residents have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see “How You Can Exercise Your Rights Under CPRA”), we will delete your personal information from our records, and direct our service providers to do the same, unless an exception applies.

Right to Correct Inaccurate Information. Under the CPRA, California residents have the right to request that Kapitus correct inaccurate Personal Information that we maintain about you.

Right to Opt-Out of Sale or Sharing of Personal Information. Under the CPRA, California residents have the right to direct us to not sell or share your Personal Information. Kapitus does not sell Personal Information of consumers. You may request to direct us not to share your Personal Information for cross-context behavioral advertising by managing your cookie preferences on our website.

Right to Non-Discrimination. Under the CPRA, California residents have the right not to be discriminated against for having exercised the rights established by the CPRA. We will not discriminate against you for exercising any of your CPRArights. Unless permitted by the CPRA, we will not:

• Charge you different prices or rates for goods or services, including through granting discounts or other benefits or imposing penalties;

• Provide you with a different level or quality of goods or services;

• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

We may, however, offer you certain financial incentives permitted by the CPRA that can result in different prices, rates, or quality levels. Such financial incentives may include gift cards, credits, and other monetary offerings; additional details related to the material terms of these financial incentives will be provided to you at the time the incentive is presented to you. Any CPRA-permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time.

How You Can Submit a Request to Know, Delete and/or Correct under the CPRA

In order to exercise the right to know/right to access information, the right to request deletion, and/or the right to correct, you or your authorized agent may submit a verifiable consumer request either by contacting us by phone at (800) 780-7133 with a brief description of your request or by submitting the request online by clicking here. Please note that we may request additional information from you or your agent as needed to authenticate your request. You may only make a verifiable consumer request to know or request for access twice within a 12-month period.

The verifiable consumer request must do the following:

• Provide sufficient information to allow us to reasonably verify that you are the person about whom we collected personal information or that you are an authorized representative.

• Describe your request with sufficient detail so that we can properly understand, evaluate, and respond to it.

If we are able to verify your request, we will make our best effort to respond within forty-five (45) days of our receipt of your request. If we require more time (up to 45 additional days), we will inform you of the reason and extension period in writing.

We will not disclose information to you or delete information if we cannot verify your identity.

How California Residents Can Designate an Authorized Representative

Only you as a California resident, or a person you authorize to act on your behalf, may make a verifiable request to know/request for access, request for deletion, or request to opt-out. To appoint an authorized representative to submit requests on your behalf, please provide us with written instructions stating the identity of the authorized representative and your authorization to have the representative act on your behalf by emailing us. We may also request additional information from you as needed to authenticate your request. If an authorized representative is acting on your behalf, your representative may contact us by phone at (800) 780-7133 with a brief description of your request or may submit your request online by clicking here. Please note that we may request additional information from your representative as needed to authenticate your request.

Additional Information

For more information about our privacy practices, including additional details about how we collect, use, and disclose personal information, please review this full Privacy Policy.

VIII. Changes to Privacy Policy

By visiting the Sites or using our Services, you accept the practices described in this Privacy Policy. We may update this Privacy Policy from time to time by making available a revised, dated version on the Sites. If the revised version includes a substantial change, we will provide a more prominent notice (including, for certain services, an email or other type of notification of Privacy Policy changes) prior to the change becoming effective. Your continued use of the Sites shall constitute your acceptance of such updated Privacy Policy. We encourage you to periodically review this page for the latest information on our privacy practices.