Privacy Policy

This Privacy Policy ("Policy") describes how High Yield Vault, LLC ("High Yield Vault," "HYV," "we," "us," or "our") collects, uses, shares, and protects personal information when you:

• Visit our website at highyieldvault.com (the "Website")
• Submit a form, request a consultation, or otherwise communicate with us
• Engage our services as a policy seller, investor, or advisor partner
• Interact with us by phone, email, or other electronic means

(Collectively, the "Services").

Our role

HYV is a life settlement consulting and brokerage firm. We evaluate life insurance policies, educate sellers and investors, and broker matches between policyholders who want to sell and qualified investors who want to acquire policies as part of their investment portfolio. HYV does not purchase policies for its own account.

Legal framework

This Policy is designed to comply with, among other applicable laws:

• California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), Cal. Civ. Code §§ 1798.100 et seq.
• Gramm-Leach-Bliley Act (GLBA), 15 U.S.C. §§ 6801-6809, and its implementing regulations
• Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., where applicable
• Health Insurance Portability and Accountability Act (HIPAA), where health information is processed
• State insurance privacy laws, including NAIC Model Act on Privacy of Consumer Financial and Health Information (Model Act 672)
• General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, for EU residents
• State consumer privacy laws in Virginia, Connecticut, Colorado, Utah, and other jurisdictions where applicable

Your acceptance

By accessing or using our Services, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, please do not use our Services.

We collect the following categories of personal information, as defined under the CCPA/CPRA. Not all categories apply to every interaction — what we collect depends on how you engage with us.

Sensitive Personal Information under CPRA

Under the CPRA, certain data is classified as "Sensitive Personal Information" (SPI) and subject to enhanced protections. We may collect the following SPI only as necessary to provide our Services:

• Government identifiers — Social Security Number, driver's license number, or state ID (for sellers, at closing only, to comply with transfer requirements)
• Financial account information — bank account details (for sellers, only to receive settlement payment)
• Health information — medical records relevant to life expectancy underwriting (for sellers only, with explicit written consent)
• Log-in credentials — for investors accessing secure portals (not used for other purposes)

What we do NOT collect

• We do not collect personal information from children under 13 (see Section 12)
• We do not collect biometric identifiers (fingerprints, face scans, etc.)
• We do not collect precise geolocation beyond general region (IP-level)
• We do not collect genetic information
• We do not collect information about religious beliefs, political opinions, or union membership

Directly from you

We collect information you provide when you:

• Complete a form on our Website (contact, evaluation request, partner application)
• Communicate with us by phone, email, video call, or chat
• Provide documentation during a consultation (policy documents, medical records with consent)
• Enroll as an Advisor Partner and sign our Channel Partner Agreement
• Subscribe to email communications

Automatically when you use our Website

When you visit our Website, we and our service providers automatically collect certain information through cookies, pixels, and similar technologies. See our Cookie Policy for complete details. This may include:

• IP address, browser type, operating system, device identifiers
• Pages viewed, time spent on pages, referring URLs
• General geographic location (derived from IP address)
• Interaction data (clicks, scrolls, form submissions)

From third parties

We may receive information about you from third parties, including:

• Insurance carriers — policy verification, in-force status (with seller's written authorization)
• Medical underwriting firms — life expectancy reports (with seller's written authorization)
• Financial institutions — for verification purposes at closing
• Advisor partners — when they refer a client with that client's consent
• Publicly available sources — regulatory filings, business directories (for advisor partners and investor verification)
• Analytics providers — aggregated usage data about our Website

We use the personal information we collect for the following business purposes, as that term is defined under the CCPA/CPRA:

To provide our Services

• Respond to your inquiries and consultation requests
• Evaluate life insurance policies and explain your options
• Present qualifying policies to investors in our network
• Facilitate the transaction between policy sellers and investors
• Coordinate documentation, underwriting, and closing logistics
• Process referrals from Advisor Partners and calculate referral compensation
• Communicate status updates throughout each transaction

To operate our business

• Maintain internal records and comply with internal policies
• Conduct analytics, testing, and Website improvements
• Prevent fraud and maintain security of our systems
• Train our team and improve service quality
• Enforce our Terms of Service and other agreements

To comply with legal obligations

• Comply with applicable federal, state, and local laws
• Respond to lawful requests from government authorities, including subpoenas and court orders
• Meet recordkeeping requirements under insurance, financial, and tax laws
• Support regulatory examinations and audits
• Protect our rights, property, and safety, and those of our clients and the public

For communications (with your consent where required)

• Send transactional communications about your inquiry or consultation
• Send you our newsletter "Investor Insights" (opt-in only — you may unsubscribe at any time)
• Notify you of significant updates to our Services or this Policy

We share personal information only as described in this Section. We do not sell personal information in the traditional sense of the word. However, some of the disclosures described below may be considered a "sale" or "sharing" under the CCPA/CPRA's broad definitions, and we treat them with the corresponding safeguards.

With qualified investors in our network

For policy sellers, we share policy details and, with your explicit written authorization, related underwriting information (including health information) with qualified investors in our network who are evaluating your policy for potential acquisition. These investors are contractually required to use your information solely for transaction evaluation and to protect its confidentiality.

With service providers

We share information with service providers that perform functions on our behalf, under written contracts that restrict use to those functions. These include:

• Technology providers — hosting (WordPress-compatible hosting), email (transactional delivery), CRM, analytics
• Payment processors — for processing settlement payments to sellers
• Operational partners — including Settlement Group, which handles post-acquisition policy administration and servicing
• Legal, accounting, and compliance advisors
• Medical underwriting firms — for life expectancy assessment (with your explicit written consent)
• Background and verification services — limited to advisor onboarding

With your referring advisor (if applicable)

If you were referred to us by a financial advisor, CPA, attorney, or insurance professional in our Advisor Partner Program, we share transaction status information with that referring advisor. This is necessary for them to manage their client relationship and for us to calculate their referral compensation.

When legally required

• In response to valid legal process (subpoenas, court orders, warrants)
• To comply with insurance department or other regulatory examinations
• To comply with tax reporting requirements (e.g., IRS Form 1099 at closing)
• To report suspected fraud to appropriate authorities
• To enforce or defend our legal rights

In business transactions

If HYV is involved in a merger, acquisition, reorganization, sale of assets, or bankruptcy, personal information may be transferred as part of that transaction. We will provide notice on the Website if such a transaction occurs and the data is materially affected.

With your consent

We may share information in any other manner with your explicit consent.

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

Right to Know

You have the right to request that we disclose:

• The categories of personal information we have collected about you
• The categories of sources from which the information was collected
• Our business or commercial purpose for collecting or sharing it
• The categories of third parties with whom we have shared it
• The specific pieces of personal information we have collected about you

You may exercise this right up to twice in any 12-month period, free of charge.

Right to Delete

You have the right to request that we delete personal information we have collected from you, subject to certain statutory exceptions (such as completing a transaction, detecting security incidents, complying with legal obligations, or maintaining information required by insurance recordkeeping laws).

Right to Correct

You have the right to request that we correct inaccurate personal information we maintain about you.

Right to Opt-Out of Sale or Sharing

You have the right to direct us not to sell your personal information or share it for cross-context behavioral advertising. HYV does not sell personal information for monetary consideration. If our practices change, we will update this Policy and provide a clear opt-out mechanism.

To make a "Do Not Sell or Share My Personal Information" request, email info@highyieldvault.com with "Do Not Sell or Share" in the subject line.

Right to Limit Use of Sensitive Personal Information

You have the right to direct us to use Sensitive Personal Information only for the purposes necessary to provide the Services. As described in Section 2, we already limit the use of SPI to transaction-necessary purposes.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny services, charge different prices, or provide a different level of service based on your exercise of rights, unless the difference is reasonably related to the value provided by the personal information.

Right to Appeal

If we deny your request, you have the right to appeal our decision. Submit your appeal to info@highyieldvault.com with "CCPA Appeal" in the subject line within 45 days of our denial.

How to exercise your rights

To exercise any of these rights, contact us:

• Email: info@highyieldvault.com (subject line: "CCPA Request")
• Phone: (833) 250-9677
• Mail: Privacy Request, High Yield Vault, LLC, Irvine, CA 92614

Verification process

To protect your information, we will verify your identity before fulfilling a Request to Know or Delete. Verification typically requires matching at least two pieces of personal information you provide with information we already have. For sensitive requests, we may require a signed declaration under penalty of perjury. We will respond within 45 days of a verifiable request, with one 45-day extension if reasonably necessary, with notice to you.

Authorized agents

You may designate an authorized agent to make a request on your behalf. The agent must provide written permission signed by you. We may contact you to verify the agent's authority.

Shine the Light Request

California Civil Code § 1798.83 permits California residents to request information regarding the disclosure of personal information to third parties for direct marketing purposes. HYV does not disclose personal information for third-party direct marketing.

Global Privacy Control (GPC)

We honor opt-out preferences signaled through Global Privacy Control (GPC) and similar universal opt-out mechanisms, as required by CPRA regulations effective January 2023. If you visit our Website with a GPC signal enabled, we treat it as a valid opt-out of sale/sharing request.

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or other states with comprehensive privacy laws, you may have rights similar to those described in Section 6, including rights to access, correct, delete, obtain a portable copy of your data, and opt out of certain processing.

To exercise these rights, contact us using the methods in Section 6. We will respond within the timeframes required by your state's law.

State-specific notes

• Virginia (VCDPA) — Right to appeal; response within 45 days
• Colorado (CPA) — Universal opt-out mechanism recognition required July 2024
• Connecticut (CTDPA) — Similar to VCDPA with opt-out for sale, targeted advertising, and profiling
• Utah (UCPA) — Limited to access and deletion rights; no right to correct
• Texas (TDPSA) — Effective July 2024; similar rights to VCDPA

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) or equivalent law applies to your personal data.

Lawful basis for processing

We process personal data on one or more of the following lawful bases:

• Consent — for marketing communications and use of non-essential cookies
• Contract — to provide the Services you requested
• Legitimate interests — for operating and improving our business, preventing fraud, securing our systems (balanced against your rights)
• Legal obligation — to comply with applicable U.S. and other laws

Your GDPR rights

You have the rights to: access your personal data, rectify inaccurate data, erase your data ("right to be forgotten"), restrict processing, data portability, object to processing (including direct marketing), not be subject to automated decision-making, and withdraw consent at any time.

International data transfers

HYV is based in the United States. Personal data collected from EEA residents will be transferred to and processed in the U.S. For such transfers, we rely on appropriate safeguards, including Standard Contractual Clauses issued by the European Commission, and we assess the level of protection in the recipient country as required by Schrems II.

Right to lodge a complaint

You have the right to lodge a complaint with your local data protection authority if you believe we have not handled your data lawfully.

Our Website uses cookies and similar technologies. For complete details — including all cookies used, their purposes, durations, and how to control them — please see our Cookie Policy.

You can control most cookies through your browser settings. Disabling certain cookies may affect the functionality of our Website.

Do Not Track

Some browsers offer a "Do Not Track" (DNT) setting. There is no industry standard for how DNT signals are interpreted. We do not currently respond to DNT browser signals, but we do honor the Global Privacy Control (GPC) signal as a valid opt-out of sale/sharing under the CCPA/CPRA.

We implement reasonable administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These measures include, but are not limited to:

• Encryption — TLS/SSL for data in transit; at-rest encryption for sensitive information
• Access controls — role-based access, strong password policies, multi-factor authentication for internal systems
• Written information security program — consistent with GLBA Safeguards Rule (16 CFR Part 314)
• Regular security reviews of systems and service providers
• Employee training on privacy and security responsibilities
• Incident response procedures for detecting and responding to security events

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Specific retention periods:

• Inquiry and consultation records — 3 years from last interaction
• Transaction records (policy sales) — 7 years after closing, consistent with IRS recordkeeping requirements
• Financial records subject to GLBA — 7 years
• Advisor Partner Program records — duration of relationship plus 3 years
• Marketing preferences — until you unsubscribe or request deletion
• Website analytics data — 26 months (standard analytics retention)
• Records subject to legal hold — duration of the hold

Upon expiration of the applicable retention period, we securely delete, destroy, or anonymize personal information.

Our Services are directed to adults. HYV does not knowingly collect personal information from children under 13 years of age, consistent with the Children's Online Privacy Protection Act (COPPA). Our Website is designed for seniors, investors, and financial professionals — audiences that are adults by definition.

If you believe we have inadvertently collected information from a child under 13, please contact us at info@highyieldvault.com and we will delete the information promptly.

For California residents: we do not knowingly sell or share personal information of consumers we know are under 16 years of age.

The following notice is provided in accordance with the Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801-6809) and its implementing regulations.

Nonpublic Personal Information (NPI)

As part of providing our Services, we may collect "Nonpublic Personal Information" (NPI) about you, as defined by GLBA. This includes financial and insurance information not publicly available, collected from you, from your transactions, or from third parties.

What NPI we collect

• Information you provide: name, address, SSN, income, policy information, beneficiary details
• Transaction information: history of consultations and any transactions facilitated
• Information from third parties: verification from insurance carriers, medical underwriters, financial institutions

How we share NPI

We disclose NPI only as permitted by law, including:

• To qualified investors reviewing your policy (with your explicit authorization)
• To service providers necessary to provide the Services, under contractual confidentiality obligations
• To operational partners (e.g., Settlement Group) for post-transaction servicing
• As required by law, regulatory authorities, or valid legal process
• With your explicit consent

HYV does not sell NPI to third parties for marketing purposes.

Your right to opt-out

Under GLBA, you have the right to opt out of certain information sharing. Because HYV does not share NPI with non-affiliated third parties for marketing or joint marketing, no opt-out is applicable at this time. If our practices change, we will provide notice and an opt-out opportunity.

Safeguards

HYV maintains a written information security program designed to meet the requirements of the GLBA Safeguards Rule (16 CFR Part 314), including designated information security coordinator(s), regular risk assessments, and written security policies.

Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will:

• Update the "Last Updated" date at the top of this Policy
• Provide prominent notice on our Website (typically a banner or email notification) for material changes
• Seek renewed consent where required by applicable law

Your continued use of the Services after the effective date of any revised Policy constitutes acceptance of the revised Policy. We encourage you to review this Policy periodically.

Previous versions

Earlier versions of this Policy are available on request by emailing info@highyieldvault.com.

Contact us

If you have questions, concerns, or requests related to this Privacy Policy, please contact us using the information below. We will respond within a reasonable time, typically within 10 business days, and consistent with the response timeframes required by applicable law for rights requests.