Privacy Notice

1. Personal Data We Collect

Rank collects different categories of data based on your interaction with the platform. We collect only the information necessary to provide our services.

2. Financial Data Collection

To connect your bank accounts and financial institutions, Rank uses Paybook (operating commercially as Syncfy) and Plaid Inc., providers specializing in bank aggregation and open finance:

• Rank does not store your bank credentials in plain text or your access data
• Authentication takes place directly between the applicable connection provider and your financial institution using security and tokenization mechanisms
• Rank receives only the financial information that you explicitly authorize
• You may disconnect any financial institution from the platform at any time
• Data synchronization depends on the availability of financial institutions and the applicable connection provider’s systems; Rank does not guarantee the continuous availability of third-party connections

3. Purposes of Data Processing

Rank uses your information only for the purposes stated in this Notice. Processing distinguishes between purposes that require consent and those that do not.

4. Use of Artificial Intelligence

Rank integrates artificial intelligence technologies to analyze your financial information and provide a personalized experience.

GAIA — Financial Operating Agent

GAIA is Rank’s AI-powered Financial Operating Agent. GAIA assists with organizing your financial information, contextual analysis, personalized recommendations and operational support within the platform. You may interact with GAIA through different interfaces in the Service.

Specific AI features

• Transaction categorization: Automatic classification of expenses and income
• Contextual analysis: Identification of patterns and trends in your financial behavior
• Recommendations: Suggestions for budgets, goals and financial optimization
• Operational support: Assistance within the platform through different GAIA interfaces

Use of external language-model providers

Some GAIA features use external language-model providers to understand and generate responses. When this occurs:

• Data-minimization principles apply: only the context strictly necessary to generate the response is shared; financial calculations, balances and metrics are produced by Rank’s internal systems
• Providers are subject to contractual confidentiality and security agreements
• Rank does not use your personal information to train proprietary AI models without additional notice and consent

5. Data Sharing

Rank shares your information only when necessary to provide the service, comply with legal obligations or with your explicit consent. Rank does not sell your financial information.

6. Use of Anonymized and Aggregated Data

Rank may anonymize and aggregate your information for uses that do not permit you to be identified. This data may be used freely:

• Continuous improvement of products and features
• Financial research and trend analysis
• Optimization of recommendation algorithms
• Creation of public statistical reports

7. Security Measures

Rank implements multiple layers of technical, administrative and physical measures to protect your information:

• Encryption of data in transit (TLS/HTTPS) and at rest (AES-256)
• Server infrastructure in certified, secure data centers
• Controlled access with multifactor authentication for authorized personnel
• Continuous activity monitoring and anomaly detection
• Periodic security audits and vulnerability assessments
• Strict confidentiality policies for all personnel

8. ARCO Rights (Access, Rectification, Cancellation and Objection)

Under the LFPDPPP, you have fundamental rights concerning your personal information. You may exercise them at any time:

9. Cookies and Similar Technologies

Rank uses cookies, tracking pixels and similar technologies to improve your experience and analyze how you use the platform.

Types of cookies we use:

• Essential cookies: Necessary for the platform to function (session, security)
• Analytics cookies: Help us understand how you interact with Rank
• Preference cookies: Store your personal settings

Analytics and diagnostic tools

Rank uses the following tools, which may collect technical and usage data:

• PostHog: Product analytics tool that collects usage metrics, navigation events and aggregated behavioral data to improve the platform
• Sentry: Error-monitoring service that captures diagnostic information when a technical failure occurs to support service stability and reliability

You can control cookies: Most browsers let you accept, reject or delete cookies. Review your browser’s Help section (Chrome, Firefox, Safari or Edge). If you disable cookies, some Rank services may not function correctly.

10. Information Retention

Rank retains your information for as long as necessary to:

• Actively provide the service
• Comply with legal, tax or regulatory obligations
• Resolve disputes and enforce agreements
• Prevent fraud and protect platform security

After canceling your account: When you request deletion of your account, we immediately block your data. After 90 days (a recovery grace period), we permanently and irreversibly delete your personal information from Rank’s systems, except where retention is required by law.

Retention by providers: Some technology providers may retain records for additional periods under their own legal and regulatory obligations. For example, billing records processed by Stripe may be retained to comply with accounting and tax obligations.

11. Changes to this Privacy Notice

Rank reserves the right to update this Notice at any time to reflect changes in law, our practices or service features. We will publish any material change on this page with a new Last updated date.

Your continued use of the platform after changes means that you accept the updated terms. We recommend reviewing this Notice periodically.

12. Contact and Exercise of Rights

If you have questions about our privacy practices or want to exercise your ARCO rights, you may contact us by:

• Email: legal@rankfinance.app / support@rankfinance.app
• Telephone: +52 (33) 1234-5678
• Address: Rank Financial Technologies, S.A.P.I. de C.V., Guadalajara, Jalisco, Mexico

13. Providers and Subprocessors

To operate the platform, Rank works with the following technology providers. Each is subject to contractual confidentiality and security obligations equivalent to those in this Notice.

14. Subscriptions and Payments

Rank offers monthly and annual subscription plans processed through Stripe, Inc.

• Rank does not store complete payment-card data; processing takes place directly in Stripe’s systems
• Subscriptions renew automatically at the end of each period unless you cancel before the renewal date
• You may manage or cancel your subscription at any time through the Rank Billing Portal
• Cancellation takes effect at the end of the current period
• Stripe may retain billing records under its legal, accounting and fraud-prevention obligations

For billing questions, contact support@rankfinance.app. For formal billing disputes, contact legal@rankfinance.app.

15. International Data Transfers

Some technology providers working with Rank may process information outside Mexico. In every case:

• We maintain contractual data-processing agreements requiring levels of protection equivalent to those established by the LFPDPPP
• We select only providers with documented security and privacy practices
• We do not transfer data to third parties without a legitimate purpose directly connected to providing the service

For specific information about international data transfers or the safeguards applied, contact us at support@rankfinance.app.

16. Account Deletion and Data Portability

Account deletion

• You may delete your account directly from the application. For assistance, contact support@rankfinance.app
• We will process your request within 20 business days
• Your data is blocked immediately. After a 90-day grace period, your personal information is permanently and irreversibly deleted from Rank’s systems
• Records that must be retained for legal, tax or regulatory obligations will be kept for the period required by law
• Some technology providers may retain information for their own legal retention periods, independently of deletion within Rank
• Active subscriptions must be canceled separately before account deletion becomes effective

Data portability

You may request a copy of your personal information in a commonly used electronic format, where technically feasible. This forms part of your Access (A) right under the LFPDPPP. Send your request to support@rankfinance.app with the subject “Data portability request.”