Scope of This Notice
This State Law Privacy Notice supplements our main Privacy Policy and applies to residents of states that have enacted comprehensive consumer privacy legislation: California, Colorado, Connecticut, Minnesota, Montana, Oregon, Texas, and Virginia.
This notice also contains our federal financial privacy notice required under the Gramm-Leach-Bliley Act (GLBA), which applies to all users of our Services regardless of state of residence.
This notice covers your use of shopifund.com, including visiting our website, submitting a funding inquiry, signing up for email alerts, or otherwise interacting with our platform. Information you submit in connection with a lending application may be subject to additional federal financial privacy protections described in Section 2.
If you submitted a loan inquiry through shopifund and were matched with a lender, that lender's own GLBA notice applies to the financial account information they collect and process. This notice governs shopifund's handling of your data only.
Federal GLBA Privacy Notice
Facts: What shopifund Does with Your Personal Information
Federal law requires financial companies to tell you how they share your personal financial information. Read this notice carefully to understand what we do.
| Question | Facts |
|---|---|
| Why do we share personal information? | Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do. |
| What information do we collect? | The types of personal information we collect and share depend on the product or service you have with us. This information can include: Social Security number and income, account balances and payment history, credit history and credit scores, business revenue and financial statements, and contact and identification information. |
| How do we protect your information? | To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards, secured files, and a limited-access employee policy. We contractually require our service providers to maintain similar protections. |
| How does shopifund collect my personal information? | We collect your personal information when you: apply for a business loan or funding through our platform; give us your contact information; and visit our website, from which we may collect device and browsing information automatically. |
| Why can't I limit all sharing? | Federal law gives you the right to limit only: sharing for affiliates' everyday business purposes (information about your creditworthiness); affiliates from using your information to market to you; and sharing for non-affiliates to market to you. State laws and individual companies may give you additional rights to limit sharing. |
Sharing Practices
| Reasons we can share your personal information | Does shopifund share? | Can you limit this sharing? |
|---|---|---|
| For our everyday business purposes: such as processing your inquiry, maintaining your account, and responding to court orders and legal investigations | Yes | No |
| For our marketing purposes: to offer our products and services to you | Yes | No |
| For joint marketing with other financial companies | No | We don't share |
| For our affiliates' everyday business purposes: information about your transactions and experiences | Limited | No |
| For our affiliates' everyday business purposes: information about your creditworthiness | No | We don't share |
| For non-affiliates to market to you | No | We don't share |
Definitions
- Affiliates: companies related by common ownership or control. shopifund currently has no affiliates.
- Non-affiliates: companies not related by common ownership or control. These include the independent lending partners in our network, analytics providers, and service vendors.
- Joint marketing: a formal agreement between non-affiliated financial companies to market financial products or services to you. shopifund does not engage in joint marketing.
Personal Information Categories
The table below describes the categories of personal information we collect, the sources from which we collect them, the third parties with whom we disclose them, and whether we sell or share them for targeted advertising purposes.
"Sell" means exchanging personal information for monetary or other valuable consideration. "Share" in this context means disclosing personal information for cross-context behavioral advertising (targeted advertising). shopifund does not sell personal information. We share certain categories with analytics and advertising partners for targeted advertising as noted below.
| Category | Examples | Source | Disclosed To | Sold | Shared for Ads |
|---|---|---|---|---|---|
| Identifiers | Name, email address, phone number, IP address | Directly from you; automatically via your device | Matched lenders; service providers; analytics partners | No | Limited |
| Business & financial information | Business name, entity type, industry, revenue, funding amount, credit range, bank account data | Directly from you | Matched lenders; service providers | No | No |
| Commercial information | Products or services considered; funding purpose; loan amount requested | Directly from you | Matched lenders; service providers | No | No |
| Internet & network activity | Pages visited, time on site, form steps completed, referral URL, click paths | Automatically via your device and browser | Analytics providers; advertising partners | No | Yes |
| Geolocation data | City and state inferred from ZIP code or IP address | Directly from you (ZIP); automatically (IP) | Analytics providers; matched lenders | No | Limited |
| Inferences | Lead quality score, funding likelihood, product match category | Derived from information you provide and automated analysis | Matched lenders; internal operations only | No | No |
| Communications | Emails, support messages, feedback submitted | Directly from you | Service providers (CRM, support tools) | No | No |
"Limited" sharing for targeted advertising means we use advertising platform pixels (such as Google and Meta) that may associate your visit with advertising audiences. You can opt out of this using the mechanisms in Section 5.
State-Specific Consumer Rights
Select your state to view the rights available to you under applicable law. These rights are in addition to any rights provided under federal law.
California: CCPA / CPRA
Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), California residents have the following rights:
- Right to Know: request disclosure of the categories and specific pieces of personal information we have collected, the sources, our purposes, and the third parties with whom we share it
- Right to Delete: request deletion of your personal information, subject to legal exceptions
- Right to Correct: request correction of inaccurate personal information
- Right to Opt Out of Sale or Sharing: opt out of the sale of your personal information or its sharing for cross-context behavioral advertising. shopifund does not sell personal information. Limited sharing for targeted advertising can be opted out of as described in Section 5.
- Right to Limit Use of Sensitive Personal Information: limit our use of sensitive personal information (including financial account data) to purposes necessary to provide our Services
- Right to Non-Discrimination: we will not discriminate against you for exercising any of your rights
California residents may also designate an authorized agent to submit requests on their behalf. We may require written proof of authorization and identity verification before processing such requests.
Shine the Light: California Civil Code Section 1798.83 allows California residents to request information about personal information disclosed to third parties for direct marketing purposes during the preceding calendar year. shopifund does not disclose personal information to third parties for their own direct marketing purposes.
Colorado: CPA (Colorado Privacy Act)
Under the Colorado Privacy Act, Colorado residents have the following rights:
- Right to Access: confirm whether we process your personal data and request a copy
- Right to Correct: request correction of inaccurate personal data
- Right to Delete: request deletion of personal data we hold about you
- Right to Data Portability: receive a copy of your personal data in a portable, readily usable format
- Right to Opt Out: opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling for decisions that produce legal or similarly significant effects
Colorado residents may appeal a denied privacy request by contacting us at privacy@shopifund.com with the subject "CPA Appeal." We will respond within 45 days of the appeal.
Connecticut: CTDPA (Connecticut Data Privacy Act)
Under the Connecticut Data Privacy Act, Connecticut residents have the following rights:
- Right to Access: confirm whether we process your personal data and request a copy
- Right to Correct: request correction of inaccuracies in your personal data
- Right to Delete: request deletion of personal data you have provided or that we have collected about you
- Right to Data Portability: obtain a copy of your personal data in a portable format
- Right to Opt Out: opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling for significant decisions
Connecticut residents may submit an appeal to a denied privacy request within 90 days of receiving our decision. Contact us at privacy@shopifund.com with "CTDPA Appeal" in the subject line.
Minnesota: MCDPA (Minnesota Consumer Data Privacy Act)
Under the Minnesota Consumer Data Privacy Act, Minnesota residents have the following rights:
- Right to Access: confirm whether we process your personal data and request a copy, including a list of third parties to whom your personal data has been disclosed
- Right to Correct: request correction of inaccurate personal data
- Right to Delete: request deletion of personal data we hold about you
- Right to Data Portability: receive a portable copy of personal data you have provided to us
- Right to Opt Out: opt out of processing for targeted advertising, sale of personal data, and profiling for significant decisions affecting you
- Right to Appeal: appeal our decision if we decline to act on a privacy request
The MCDPA requires us to provide, upon request, a list of specific third parties (not just categories) to whom we have disclosed your personal data. Submit this request to privacy@shopifund.com.
Montana: MCDPA (Montana Consumer Data Privacy Act)
Under the Montana Consumer Data Privacy Act, Montana residents have the following rights:
- Right to Access: confirm whether we process your personal data and obtain a copy
- Right to Correct: request correction of inaccurate personal data
- Right to Delete: request deletion of personal data we process about you
- Right to Data Portability: receive a portable copy of your personal data
- Right to Opt Out: opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce significant effects
Montana residents may appeal a denied privacy request within a reasonable period. Contact us at privacy@shopifund.com with "Montana Privacy Appeal" in the subject line.
Oregon: OCPA (Oregon Consumer Privacy Act)
Under the Oregon Consumer Privacy Act, Oregon residents have the following rights:
- Right to Access: confirm whether we process your personal data, obtain a list of specific third parties to whom we have disclosed personal data, and request a copy of your personal data
- Right to Correct: request correction of inaccurate personal data
- Right to Delete: request deletion of personal data we hold about you
- Right to Data Portability: receive a portable copy of your personal data
- Right to Opt Out: opt out of targeted advertising, sale of personal data, and profiling for significant decisions
Like Minnesota, Oregon requires us to disclose a list of specific third parties upon request. Oregon residents may also appeal a denied request within 45 days of our response. Contact privacy@shopifund.com with "OCPA Appeal" in the subject.
Texas: TDPSA (Texas Data Privacy and Security Act)
Under the Texas Data Privacy and Security Act, Texas residents have the following rights:
- Right to Access: confirm whether we process your personal data and request a copy
- Right to Correct: request correction of inaccurate personal data
- Right to Delete: request deletion of personal data you have provided to us or that we have collected about you
- Right to Data Portability: obtain a copy of personal data in a portable format
- Right to Opt Out: opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling for significant decisions
- Right to Appeal: appeal within a reasonable period if we decline to act on your request
Texas does not limit enforcement to a specific revenue or data-volume threshold for businesses that voluntarily sell personal data. If you have questions about your rights, contact privacy@shopifund.com.
Virginia: VCDPA (Virginia Consumer Data Protection Act)
Under the Virginia Consumer Data Protection Act, Virginia residents have the following rights:
- Right to Access: confirm whether we process your personal data and request a copy
- Right to Correct: request correction of inaccurate personal data
- Right to Delete: request deletion of personal data we process about you
- Right to Data Portability: obtain a portable copy of personal data you have provided to us
- Right to Opt Out: opt out of processing for targeted advertising, sale of personal data, or profiling for significant decisions
- Right to Appeal: appeal within 60 days if we decline to act on your request
Virginia residents whose appeals are denied may contact the Virginia Attorney General's Office. Contact us at privacy@shopifund.com with "VCDPA Appeal" in the subject line.
How to Opt Out
You may opt out of the sale of personal information (shopifund does not sell), the sharing of personal information for targeted advertising, or targeted advertising based on your activity on shopifund.com using any of the following mechanisms:
We will process opt-out requests within 15 business days (California: 15 business days; Colorado, Connecticut, Virginia: 15 days; Oregon, Montana, Texas, Minnesota: 45 days).
Global Privacy Control
The Global Privacy Control (GPC) is a browser-level signal that communicates a user's opt-out preference for the sale of personal information and sharing for targeted advertising. shopifund honors GPC signals where required by applicable state law.
If your browser or browser extension is configured to transmit a GPC signal when you visit shopifund.com, we will treat that signal as a valid opt-out request for targeted advertising for that browser session. The opt-out applies to information collected during that session and, to the extent technically feasible, going forward.
GPC does not override opt-ins you have explicitly granted or affect the sharing of your information with matched lenders for the purpose of fulfilling your funding inquiry, which is the core function of our Services.
You can enable GPC through browsers that support it natively (such as Brave) or by installing a browser extension. Learn more at globalprivacycontrol.org.
Identity Verification Requirements
To protect your personal information, we are required to verify your identity before fulfilling access, correction, deletion, or portability requests. The level of verification required depends on the sensitivity of the information requested and the potential risk of harm from unauthorized disclosure.
How We Verify Your Identity
When you submit a privacy rights request, we will ask you to provide information that we can match against our records. Typically, we require you to verify at least three of the following data points:
- Name (first and last)
- Email address used to submit your inquiry
- Phone number provided on your application
- Business name
- ZIP code of business location
For deletion requests or requests for highly sensitive information, we may require a higher level of verification, such as a signed declaration under penalty of perjury.
Authorized Agents
If an authorized agent submits a request on your behalf, we will require: (a) written proof of the agent's authority to act on your behalf (such as a signed power of attorney), and (b) independent verification of your identity either directly from you or through the agent with sufficient documentation. We may deny a request from an agent who does not provide sufficient proof of authorization.
Response Timeline
- We will acknowledge your request within 10 business days of receipt
- We will fulfill or deny your request within 45 days of receipt
- If we need additional time, we will notify you and may extend the response period by up to an additional 45 days
- Appeals must be submitted within the timeframes specified in Section 4 for your state
We will not charge a fee to process your request unless it is manifestly unfounded, excessive, or repetitive. In such cases, we may charge a reasonable fee or decline to respond, and we will explain our reasoning.
Contact Us
To exercise any of the rights described in this notice, submit a privacy inquiry, or ask questions about our data practices, contact us through any of the channels below. Include your name, state of residence, and a description of your request.
Privacy & Compliance Office
Miami, FL 33101
This notice was last updated on May 15, 2026. For our complete data practices, please review our main Privacy Policy.