QNulla
Request NDA

QNULLA PRIVACY POLICY

Effective Date: September 8, 2026 Last Updated: September 8, 2026

Version 5.0

This Privacy Policy (“Privacy Policy”) describes how BPS Digitals US Inc., a Michigan corporation doing business as QNulla (“QNulla,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects information in connection with the QNulla Network, QNulla mobile application, websites, permissioned blockchain infrastructure, and related products and services (collectively, the “QNulla Platform”).

QNulla operates a proprietary permissioned blockchain-based payment network through which eligible consumers may obtain revolving credit lines issued by participating financial institutions and use that credit to purchase goods and services from participating QNulla merchants.

QNulla is the operator of the QNulla Platform and payment network. QNulla is not the lender. Each QNulla Credit Line is underwritten and issued by a participating financial institution (the “Issuer”). The Issuer remains the lender of record and holder of the consumer credit account. QNulla does not purchase, own, guarantee, or assume the consumer's repayment obligation.

The Issuer may provide separate privacy notices applicable to information the Issuer collects and processes in connection with its lending and deposit-account activities.

By accessing or using the QNulla Platform, you acknowledge the practices described in this Privacy Policy.

1. THE QNULLA PLATFORM

The QNulla Platform enables eligible consumers to apply for revolving credit issued by participating Issuers and use approved credit at participating QNulla Merchant Partners.

A consumer's available and outstanding credit is represented within the QNulla Network through NFLOW.

One NFLOW unit represents one U.S. dollar of credit.

NFLOW is a credit instrument reflecting available or outstanding revolving credit. NFLOW is not cryptocurrency, a token, coin, currency, prepaid product, stored-value product, or investment product.

QNulla operates the technology, permissioned blockchain, consumer application, merchant infrastructure, transaction-processing systems, onboarding functionality, repayment infrastructure, fraud-monitoring systems, and QNulla Dispute Center.

The Issuer determines whether to approve a consumer for credit, establishes the applicable credit terms, holds the resulting credit account, and bears the credit risk associated with that account.

2. INFORMATION WE COLLECT

The information we collect depends on how you interact with QNulla and which QNulla services you use.

2.1 Identity and Contact Information

We may collect:

  • full name;
  • date of birth;
  • residential address;
  • email address;
  • telephone number;
  • Social Security Number or Individual Taxpayer Identification Number;
  • government-issued identification information; and
  • other information necessary to identify or contact you.

2.2 Identity Verification and Compliance Information

We may collect or receive information used to verify your identity and satisfy legal, regulatory, fraud-prevention, anti-money laundering, and sanctions-screening requirements, including:

  • government-issued identification documents;
  • photographs or facial images;
  • liveness-verification information;
  • biometric verification information;
  • address-verification information;
  • identity-verification results;
  • sanctions-screening results;
  • anti-money laundering risk information;
  • fraud-risk indicators; and
  • related verification information.

2.3 Financial Account Information

When you connect an external bank account through QNulla, we may receive information from Plaid, your financial institution, or other authorized providers, including:

  • financial institution name;
  • account type;
  • account and routing information;
  • account ownership information;
  • account identifiers;
  • account verification status;
  • account balance information where applicable;
  • information necessary to originate repayments; and
  • other information necessary to establish or maintain the authorized bank-account connection.

2.4 Credit Application and Credit Account Information

We may collect or receive information relating to your application for and use of a QNulla Credit Line, including:

  • information submitted as part of your application;
  • application status;
  • Issuer identity;
  • approved credit limit;
  • annual percentage rate and other credit terms;
  • NFLOW Available balance;
  • NFLOW Active balance;
  • outstanding balance;
  • payment history;
  • repayment information;
  • account status;
  • statement information;
  • delinquency or default status where applicable; and
  • other information necessary to operate the QNulla Platform in connection with your Credit Line.

2.5 Credit Bureau Information

The Issuer may obtain information from one or more consumer reporting agencies, including Experian, Equifax, TransUnion, or another consumer reporting agency, in connection with its underwriting and ongoing account-management activities.

A credit inquiry may affect your credit score.

QNulla may receive information regarding the status or outcome of the Issuer's underwriting process and other credit-related information necessary to operate the QNulla Platform.

The Issuer, rather than QNulla, makes the final underwriting decision.

2.6 Transaction Information

When you conduct a transaction through the QNulla Platform, we may collect and maintain information including:

  • consumer identity;
  • merchant identity;
  • transaction amount;
  • transaction date and time;
  • transaction status;
  • authentication information;
  • cryptographic transaction identifiers;
  • NFLOW balance adjustments;
  • transaction records;
  • settlement information; and
  • related technical and audit information.

2.7 Dispute Information

If you use the QNulla Dispute Center, we may collect:

  • the transaction being disputed;
  • the basis of the dispute;
  • supporting documents;
  • photographs or other evidence;
  • communications relating to the dispute;
  • Merchant responses;
  • Merchant evidence;
  • Issuer communications;
  • QNulla's determination; and
  • any resulting credit, reimbursement, or settlement adjustment.

2.8 Device, Usage, and Security Information

We may automatically collect information including:

  • IP address;
  • device type;
  • device identifiers;
  • operating system;
  • browser type;
  • application version;
  • language settings;
  • login and authentication events;
  • access logs;
  • approximate location derived from IP address;
  • session information;
  • security events;
  • diagnostic information;
  • fraud-risk indicators; and
  • information concerning your interaction with the QNulla Platform.

2.9 Communications

We may collect communications you send to or receive from QNulla, including customer-support requests, complaints, compliance communications, security reports, and Dispute Center communications.

3. IDENTITY VERIFICATION AND PLAID IDENTITY VERIFICATION

QNulla uses Plaid Identity Verification as an identity-verification, KYC, AML, and compliance service provider.

As part of QNulla onboarding, consumers are required to complete identity verification that may include:

  • government-issued identification verification;
  • biometric liveness verification;
  • address verification;
  • sanctions and OFAC screening; and
  • anti-money laundering risk screening.

We use information generated through this process to verify your identity, prevent fraud and identity theft, satisfy compliance requirements, determine eligibility to participate on the QNulla Network, and provide verified information to the Issuer where necessary for its own onboarding and underwriting processes.

Completing QNulla's identity-verification process does not guarantee approval for a Credit Line.

4. BIOMETRIC INFORMATION

QNulla's identity-verification process may require you to provide a photograph, selfie, video, facial image, or participate in a liveness-verification process.

These processes may involve the collection, generation, or processing of information that qualifies as a biometric identifier or biometric information under applicable law.

Where required by applicable law, QNulla will provide a separate Biometric Information Notice and Consent before biometric information is collected.

The separate notice describes:

  • the biometric information collected or generated;
  • the purpose for which the information is collected and used;
  • the period for which the information will be collected, stored, or used;
  • the service providers involved in processing the information;
  • applicable retention and destruction practices; and
  • any consent required by applicable law.

QNulla does not sell, lease, trade, or otherwise profit from biometric information.

QNulla and its authorized service providers may disclose or process biometric information only as permitted by applicable law and for authorized identity-verification, security, fraud-prevention, compliance, or legal purposes.

Biometric information will be retained and destroyed in accordance with QNulla's published biometric retention and destruction policy and applicable law.

Where Illinois law applies, biometric identifiers and biometric information will be permanently destroyed when the initial purpose for collecting or obtaining the information has been satisfied or within three years of the individual's last interaction with QNulla, whichever occurs first, unless retention is otherwise required or permitted by applicable law.

QNulla applies this destruction schedule to biometric identifiers and biometric information collected from every consumer, regardless of state of residence, and applies it to information held by QNulla and by its authorized identity-verification service provider.

The QNulla Privacy Policy does not replace any separate Biometric Information Notice and Consent required during onboarding.

5. CREDIT UNDERWRITING AND CONSUMER REPORTING AGENCIES

Your application for a QNulla Credit Line is submitted to the applicable Issuer.

The Issuer has full and exclusive authority over credit underwriting decisions. QNulla is not the lender and does not make the final credit decision.

The Issuer may obtain a consumer report or other information from Experian, Equifax, TransUnion, or another consumer reporting agency where permitted by applicable law.

The Issuer may use this information to determine:

  • whether to approve your application;
  • your Credit Line amount;
  • your annual percentage rate;
  • other applicable credit terms; and
  • ongoing account-management decisions.

The Issuer may also furnish information concerning your account, payment history, delinquency, or account status to consumer reporting agencies as permitted by applicable law.

QNulla may transmit information among you, the Issuer, consumer reporting agencies, and authorized service providers where necessary to facilitate the application and operation of the QNulla Platform.

6. PLAID AND YOUR EXTERNAL BANK ACCOUNT

QNulla uses Plaid Inc. (“Plaid”) to enable consumers to connect and verify eligible external U.S. bank accounts.

Maintaining a verified linked external bank account is a condition of QNulla Credit Line activation and continued spending eligibility.

The external linked bank account may also be used to originate consumer repayments.

When you choose to connect a financial account using Plaid, you may be presented with Plaid's interface, commonly known as Plaid Link.

Through that interface, you may select your financial institution, authenticate with your financial institution or Plaid, and select the account you wish to connect.

By connecting an account through Plaid, you authorize Plaid, your financial institution, and QNulla to exchange the information necessary to establish, verify, and maintain the financial-account connection you requested and to provide the applicable QNulla services.

Depending on the Plaid products used, the connection method, and the information made available by your financial institution, Plaid may collect or process information including:

  • identifying information;
  • financial institution information;
  • account and routing information;
  • account ownership information;
  • account type;
  • account identifiers;
  • account balances;
  • authentication information;
  • device and technical information; and
  • other financial-account information necessary to provide the applicable Plaid service.

In some connection methods, Plaid or your financial institution may request online-banking credentials, security codes, security answers, one-time passwords, or similar authentication information.

QNulla does not receive or store your online-banking password merely because you enter that information through Plaid or your financial institution's authentication interface.

QNulla may instead receive account information, verification results, tokens, identifiers, or other information necessary to establish and maintain the authorized connection.

Information received through Plaid may be used for:

  • bank-account verification;
  • maintaining required bank-account linkage;
  • repayment processing;
  • account authentication;
  • fraud detection and prevention;
  • security;
  • risk management;
  • legal and regulatory compliance; and
  • operation of the QNulla Platform.

Plaid independently collects and processes certain information in accordance with Plaid's own privacy practices.

Plaid's End User Privacy Policy is available through Plaid's Legal page. Plaid End User Privacy Policy

Plaid's privacy policy governs Plaid's processing of information. This QNulla Privacy Policy governs QNulla's processing of information received or otherwise maintained by QNulla.

You may also be able to manage certain Plaid financial-account connections using privacy and account-management tools made available by Plaid.

7. ISSUER DEPOSIT ACCOUNT

The QNulla program may require you to open and maintain an active deposit account with the Issuer as a condition of obtaining and maintaining your QNulla Credit Line.

The Issuer deposit account is separate from the external bank account connected through Plaid.

The Issuer deposit account is provided and maintained by the Issuer.

QNulla may facilitate the connection between you and the Issuer's account-opening process, but QNulla does not itself provide the Issuer deposit account.

Information collected or processed by the Issuer in connection with that deposit account is subject to the Issuer's applicable account agreement, privacy policy, and regulatory disclosures.

8. PERMISSIONED BLOCKCHAIN AND IMMUTABLE TRANSACTION RECORDS

QNulla transactions are recorded on QNulla's proprietary permissioned blockchain.

Unlike a public blockchain, participation in the QNulla blockchain is restricted to authorized nodes operated by or on behalf of QNulla.

Confirmed QNulla transactions are cryptographically authenticated, timestamped, and permanently recorded.

Once a transaction has been confirmed on the QNulla permissioned blockchain, the blockchain transaction record cannot be altered, deleted, or reversed.

Blockchain transaction records may include information or identifiers associated with:

  • the consumer;
  • the Merchant Partner;
  • the transaction amount;
  • the date and time of the transaction;
  • transaction authentication;
  • cryptographic identifiers; and
  • related transaction information.

The QNulla permissioned blockchain does not record your name, mailing address, email address, telephone number, Social Security Number or taxpayer identification number, government identification document, photograph, selfie, biometric information, bank account number, or bank login credentials.

Those categories of information are maintained in access-controlled systems separate from the blockchain and are subject to the retention, deletion, and security practices described elsewhere in this Privacy Policy. Blockchain records reference participants through cryptographic identifiers rather than through directly identifying information.

If a transaction is later refunded, credited, disputed, corrected, or otherwise adjusted, the original blockchain record is not erased or modified. A corresponding adjustment or additional transaction record may instead be created.

The immutability of blockchain transaction records does not eliminate or limit any right or remedy available under applicable federal or state law, the applicable Issuer credit agreement, the QNulla Consumer Credit Account Agreement, or the QNulla Dispute Center.

Privacy rights that allow deletion of personal information are subject to applicable legal exceptions and the technical characteristics of the QNulla permissioned blockchain.

Where QNulla receives a valid deletion request, QNulla will delete, de-identify, or otherwise address information where required by applicable law and technically possible.

Information contained in a confirmed immutable blockchain transaction record may remain permanently recorded where deletion is technically impossible or where continued retention is permitted or required by applicable law.

Where appropriate and legally required, QNulla may restrict access to or use of information associated with an immutable transaction record without altering the underlying blockchain record.

9. QNULLA DISPUTE CENTER

The QNulla mobile application provides an in-app QNulla Dispute Center through which consumers may submit eligible transaction concerns.

Depending on the nature of the concern, dispute information may be shared with:

  • the applicable Merchant Partner;
  • the applicable Issuer;
  • QNulla personnel;
  • fraud, compliance, or legal service providers; and
  • other parties reasonably necessary to investigate or resolve the dispute.

The QNulla Dispute Center may be used for eligible concerns including non-delivery of goods or services and materially defective or non-conforming goods or services.

The QNulla Dispute Center is a QNulla Network dispute-resolution process and is not a card-network chargeback mechanism.

QNulla may obtain information and evidence from both the Consumer and Merchant Partner and coordinate with the Issuer regarding any resulting account credit, reimbursement, or settlement adjustment.

The original blockchain transaction record remains permanent even if a dispute results in a subsequent credit or adjustment.

10. HOW WE USE PERSONAL INFORMATION

We may use personal information to:

  • create and maintain QNulla accounts;
  • authenticate users;
  • conduct identity verification;
  • perform KYC, AML, fraud, and sanctions screening;
  • facilitate Credit Line applications to Issuers;
  • facilitate Issuer deposit-account onboarding;
  • connect external financial accounts through Plaid;
  • maintain required bank-account linkage;
  • operate NFLOW credit functionality;
  • authenticate and process QNulla transactions;
  • maintain blockchain transaction records;
  • coordinate settlement instructions;
  • process consumer repayments;
  • display Credit Line balances and account information;
  • administer the QNulla Dispute Center;
  • detect, investigate, and prevent fraud;
  • protect consumers, Merchant Partners, Issuers, and QNulla;
  • provide statements, transaction information, and account notifications;
  • provide customer support;
  • investigate complaints;
  • maintain Network security;
  • perform accounting and audits;
  • satisfy regulatory and legal obligations;
  • respond to lawful legal process;
  • establish, exercise, or defend legal claims;
  • enforce QNulla agreements and Network rules; and
  • maintain and improve the QNulla Platform.

11. HOW WE DISCLOSE PERSONAL INFORMATION

We may disclose information to the following categories of parties where necessary or permitted by applicable law.

11.1 Issuing Partners

We may disclose information to the applicable Issuer for purposes including:

  • account opening;
  • credit underwriting;
  • Credit Line administration;
  • transaction processing;
  • repayment;
  • fraud prevention;
  • regulatory compliance;
  • disputes;
  • servicing; and
  • account management.

11.2 Plaid

We disclose and receive information through Plaid for financial-account connectivity, bank-account verification, repayment functionality, and related authorized services.

11.3 Plaid Identity Verification

We may disclose information to Plaid Identity Verification for:

  • identity verification;
  • biometric liveness verification;
  • KYC;
  • AML screening;
  • sanctions screening;
  • fraud prevention; and
  • compliance purposes.

11.4 Consumer Reporting Agencies

Information may be exchanged with consumer reporting agencies directly or through the Issuer where permitted by applicable law in connection with underwriting, account servicing, credit reporting, fraud prevention, or other legally authorized purposes.

11.5 Merchant Partners

We may disclose information to participating Merchant Partners where reasonably necessary to:

  • process a transaction;
  • identify a transaction;
  • support order fulfillment;
  • reconcile transactions;
  • investigate disputes; and
  • administer the QNulla Dispute Center.

11.6 Financial Institutions and Payment Providers

We may disclose information to banks, financial institutions, ACH providers, payment providers, and settlement participants where necessary to process repayments, settlement, account verification, or related financial activity.

11.7 Service Providers

We may use service providers for:

  • cloud infrastructure;
  • cybersecurity;
  • fraud detection;
  • compliance;
  • analytics;
  • communications;
  • customer support;
  • identity verification;
  • accounting;
  • auditing;
  • legal services; and
  • other functions necessary to operate QNulla.

11.8 Legal and Regulatory Disclosures

We may disclose information where necessary or appropriate to:

  • comply with applicable law;
  • respond to subpoenas, warrants, court orders, or other legal process;
  • respond to regulators or governmental authorities;
  • investigate suspected fraud or unlawful activity;
  • satisfy AML or sanctions obligations;
  • protect the safety, rights, or property of QNulla or others;
  • enforce QNulla agreements; or
  • establish, exercise, or defend legal claims.

11.9 Corporate Transactions

Information may be disclosed in connection with a merger, acquisition, restructuring, financing, bankruptcy, sale of assets, or similar corporate transaction, subject to applicable law.

12. SALE AND MARKETING USE OF PERSONAL INFORMATION

QNulla does not sell consumer personal information.

QNulla does not sell financial information obtained through Plaid.

QNulla does not sell biometric information.

QNulla does not disclose nonpublic personal information to nonaffiliated third parties for those third parties' independent marketing purposes.

QNulla does not use Plaid-derived financial-account information or biometric information for unrelated advertising.

13. GRAMM-LEACH-BLILEY ACT PRIVACY NOTICE

QNulla is a financial institution for purposes of the Gramm-Leach-Bliley Act.

QNulla provides its GLBA Privacy Notice as a separate document. That notice uses the federal model privacy form and describes the categories of nonpublic personal information QNulla collects, the parties with whom QNulla shares that information, the reasons for which QNulla shares it, and your right to limit certain sharing where applicable.

The QNulla GLBA Privacy Notice is delivered to you at account opening and annually thereafter where required by applicable law. It is also available within the QNulla application, at qnulla.com, and on request at privacy@qnulla.com.

The QNulla GLBA Privacy Notice is incorporated into this Privacy Policy by reference. In the event of a conflict between this Privacy Policy and the QNulla GLBA Privacy Notice on a matter governed by the Gramm-Leach-Bliley Act, the QNulla GLBA Privacy Notice controls.

The Issuer separately provides its own GLBA privacy notice governing the Issuer’s handling of your information in connection with its lending and deposit-account activities.

14. DATA MINIMIZATION AND PURPOSE LIMITATION

QNulla seeks to collect and process personal information only to the extent reasonably necessary to:

  • provide the QNulla Platform;
  • operate the QNulla Network;
  • facilitate the Issuer relationship;
  • process transactions and repayments;
  • verify identity;
  • prevent fraud;
  • administer disputes;
  • maintain security;
  • satisfy regulatory requirements; and
  • fulfill other lawful purposes described in this Privacy Policy.

Information obtained through Plaid is used only for authorized QNulla services, QNulla's approved Plaid use cases, security, compliance, risk management, and other purposes permitted by applicable law.

15. DATA RETENTION

QNulla retains personal information for as long as reasonably necessary for the purposes for which it was collected and as required or permitted by applicable law.

Retention periods may depend on:

  • the duration of your relationship with QNulla;
  • transaction recordkeeping requirements;
  • financial-services regulations;
  • AML and sanctions requirements;
  • fraud-prevention requirements;
  • accounting and audit obligations;
  • dispute-resolution requirements;
  • legal claims;
  • statutes of limitation;
  • litigation holds; and
  • other legal or regulatory requirements.

Biometric information is subject to the applicable biometric retention and destruction policy.

Confirmed blockchain transaction records are retained as permanent records of the QNulla permissioned blockchain as described in Section 8.

Closing a QNulla account or disconnecting a financial account does not require QNulla to delete information that QNulla is required or permitted to retain.

16. YOUR PRIVACY RIGHTS

Depending on your state of residence and applicable law, you may have rights concerning personal information QNulla maintains about you.

These rights may include the right to:

  • request access to certain personal information;
  • request correction of inaccurate personal information;
  • request deletion of certain personal information;
  • obtain a copy of certain personal information;
  • obtain information about categories of personal information collected;
  • obtain information about categories of sources of personal information;
  • obtain information about purposes for which information is used;
  • obtain information about categories of recipients of personal information;
  • withdraw consent where processing is based on consent;
  • appeal certain privacy-request decisions where applicable; and
  • exercise applicable privacy rights without unlawful discrimination.

These rights are subject to applicable legal limitations and exemptions.

For example, QNulla may retain information where necessary or permitted for:

  • transaction records;
  • financial-services compliance;
  • AML obligations;
  • fraud prevention;
  • security;
  • accounting;
  • audits;
  • disputes;
  • litigation;
  • legal claims; or
  • regulatory recordkeeping.

Confirmed information recorded on the QNulla permissioned blockchain may not be capable of deletion or alteration, as described in Section 8.

QNulla may verify your identity before processing a privacy request.

Privacy requests may be submitted through the contact functionality available through the QNulla Platform or QNulla website.

Privacy requests may also be submitted by email to privacy@qnulla.com or by mail to BPS Digitals US Inc., Attention: Privacy, 3874 Rochester Rd, Troy, MI 48083.

Authorized Agents

Where applicable law permits, you may designate an authorized agent to submit a privacy request on your behalf. QNulla may require the agent to provide proof of authorization and may require you to verify your own identity directly before processing the request.

Financial Privacy Exemptions

Most comprehensive state privacy laws contain exemptions for financial institutions, or for information collected and processed under the Gramm-Leach-Bliley Act. Much of the information QNulla collects in connection with the QNulla Platform falls within those exemptions. Where an exemption applies, the corresponding state law rights may not be available with respect to that information. Where a state privacy law applies to QNulla and to the particular information at issue, QNulla will process valid requests in accordance with that law.

California

California residents may have rights under the California Consumer Privacy Act, as amended, including the rights to know, delete, correct, and opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information. QNulla does not sell personal information and does not share personal information for cross-context behavioral advertising. QNulla uses sensitive personal information, including government identification numbers and biometric information, only to perform the services, verify identity, prevent fraud, and comply with law, which are purposes for which the right to limit does not apply. California residents may designate an authorized agent and will not be discriminated against for exercising their rights.

Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and Other States

Residents of states with comprehensive privacy laws may have rights to access, correct, delete, and obtain a portable copy of personal information, and to opt out of targeted advertising, sale, and certain profiling. QNulla does not conduct targeted advertising, sell personal information, or engage in profiling that produces legal or similarly significant effects concerning consumers. Where a request is denied and applicable law provides a right to appeal, QNulla will provide instructions for submitting an appeal.

Illinois, Texas, Washington, and Other Biometric Privacy States

Residents of states with biometric privacy statutes should refer to Section 4 of this Privacy Policy, which describes QNulla’s biometric consent, use, disclosure, retention, and destruction practices, and to the separate Biometric Information Notice and Consent provided during onboarding.

17. FINANCIAL ACCOUNT DISCONNECTION

You may be able to disconnect or replace a linked financial account through QNulla, Plaid, or your financial institution.

Disconnecting an account generally prevents future access through that connection, subject to the operation of the applicable service.

Disconnecting an account does not require QNulla to delete information previously received or generated where QNulla is permitted or required to retain that information.

Because an active linked external bank account is a requirement of the QNulla Credit Line program, disconnecting your external bank account may result in suspension of Credit Line spending functionality until an eligible bank account is linked and verified again.

18. INFORMATION SECURITY

QNulla maintains administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, acquisition, loss, misuse, alteration, or disclosure.

Depending on the system and information involved, security measures may include:

  • encryption in transit and at rest;
  • authentication controls;
  • restricted system access;
  • business-need-based access controls;
  • security logging;
  • monitoring;
  • vulnerability management;
  • security patching;
  • incident detection;
  • incident-response procedures;
  • cryptographic transaction authentication; and
  • security controls associated with the QNulla permissioned blockchain.

No electronic information system, network, or transmission method can be guaranteed to be completely secure.

19. SECURITY INCIDENTS

If QNulla becomes aware of a security incident involving personal information, QNulla will investigate and respond in accordance with applicable law and contractual obligations.

Where required, QNulla will provide notifications to affected individuals, Issuers, regulators, service providers, law enforcement, or other appropriate parties.

20. CHILDREN'S PRIVACY

The QNulla consumer Credit Line program is available only to eligible adults.

Individuals under the age of 18 are not eligible to establish a consumer QNulla Credit Line account.

QNulla does not knowingly permit children under 18 to participate as QNulla Consumers.

21. THIRD-PARTY SERVICES

QNulla relies on third parties to provide portions of the QNulla Platform.

These may include:

  • Issuers;
  • Plaid;
  • Plaid Identity Verification;
  • consumer reporting agencies;
  • financial institutions;
  • payment providers;
  • Merchant Partners;
  • cloud infrastructure providers;
  • security providers; and
  • other service providers.

These third parties may maintain their own privacy policies and legal obligations.

QNulla's Privacy Policy governs QNulla's handling of information. A third party's privacy policy governs the independent handling of information by that third party.

22. CHANGES TO THIS PRIVACY POLICY

QNulla may update this Privacy Policy to reflect changes in:

  • QNulla products and services;
  • information practices;
  • technology;
  • third-party integrations;
  • applicable law;
  • regulatory requirements; or
  • security practices.

When this Privacy Policy is updated, QNulla will revise the “Last Updated” date.

Where required by applicable law, QNulla will provide additional notice or obtain consent before a material change becomes effective.

23. CONTACT QNULLA

Questions, complaints, and privacy requests concerning this Privacy Policy or QNulla's privacy practices may be submitted through the support or contact functionality available through the QNulla Platform or the QNulla website.

BPS Digitals US Inc. Doing business as QNulla 3874 Rochester Rd, Troy, MI 48083

Website: qnulla.com

Privacy: privacy@qnulla.com

Support: support@qnulla.com

Legal: legal@qnulla.com

This Privacy Policy should be read together with the QNulla Terms and Conditions, your QNulla Consumer Credit Account Agreement, your Issuer Credit Agreement and accompanying credit disclosures, and the QNulla Network Operating Rules as applicable to consumer accounts.

© 2026 BPS Digitals US Inc. d/b/a QNulla. All rights reserved.