CNote | Privacy Policy

Last modified: May 29, 2026

At CNote Group, Inc. (“CNote” or “we”), we respect your privacy and are committed to protecting your personal information through our compliance with this privacy policy (this “Policy”).

What This Policy Covers

This Policy describes the types of information we may collect from each user (“user” or “you”) or that you may provide when you visit the website at www.mycnote.com (our “Website”), as well as when you use applications, software, tools and other services provided by us when you create a CNote account for yourself or your organization, and/or when a CNote account is created for you or your organization, and when you email us or respond to our emails (collectively, our “Platform Services”), and our practices for using, maintaining, protecting and disclosing that information.

This Policy does not apply to practices of companies we do not own or control or people we do not manage. If you are not our client but have any questions or concerns about how your information is handled or would like to exercise your rights as a data subject, you should contact the person or entity who has contracted with us to use the Platform Services to process your information. We will provide assistance to our clients to address any concerns you may have, in accordance with the terms of our contract with them and applicable law.

Please read this Policy carefully to learn how we treat your personal information. If you do not agree with our policies and practices, you may choose not to use our Website or our Platform Services. By accessing or using the Website and/or our Platform Services in any manner, you accept the practices and policies in this Policy. This Policy may change from time to time. Your continued use of this Website and/or our Platform Services after we make changes is deemed to be acceptance of those changes, so please check the Policy periodically for updates.

Information We Collect About You and How We Collect It

We may collect several types of information from and about users of our Website and our Platform Services. When you provide it to us when using our Platform Services, we collect information by which you may be personally identified, such as name, postal address, email address, and telephone number, and if you invest in a CNote promissory note, your date of birth, bank account information, social security number, and information and documentation related to your status as an accredited investor or certified investment professional (collectively, “Personal Information”). We collect Personal Information when you provide it to us at the time of indicating interest in our Platform Services, and also when registering and setting up a user profile for yourself or your organization, as applicable, subscribing to newsletters or emails, or requesting further services. We may also ask you for Personal Information when you report a problem with the Website and/or the Platform Services or abuse by another user. In addition, we collect information that is about you but that does not individually identify you, such as aggregated information regarding the usage patterns of all users. We collect information about your internet connection, your geographic location, the equipment you use to access the Website and/or the Platform Services, your IP address, and your usage details. We collect this information automatically as you use the Website and/or the Platform Services, through cookies and other tracking technologies.

In addition, third parties, such as credit rating agencies, may provide us with information about you or your organization, as applicable. We will obtain a credit score for any business, corporation or other entity interested in using our Platform Services to become an investor only with the permission of an authorized representative or agent of that entity. We may also obtain additional commercially available information about you or your organization from third parties or public sources.

The collection of Personal Information is necessary for the functionality of your account or your organization’s account, as applicable, with respect to the Platform Services and/or to comply with applicable laws and regulations related to the Platform Services. We may keep records and copies of all correspondence if you contact us. We may keep details of transactions you carry out through the Platform Services.

Information We Collect Through Automatic Data Collection Technologies

As you navigate through and interact with our Website and/or Platform Services, we may use automatic data collection technologies to collect certain information about your equipment, location, browsing actions and patterns, as further described in this Policy.

We may use these technologies to collect information about your online activities over time and across third-party websites or other online services (behavioral tracking). We honor browser-based opt-out preference signals, such as the Global Privacy Control (“GPC”), as described in the “Managing Your Cookie Preferences” section below.

Use of Cookies and Tracking Technologies

What Are Cookies

A cookie is a small text file placed on your computer or mobile device when you visit a website. Cookies allow websites to recognize your device, remember your preferences, and collect information about how you interact with the site. Cookies may be set by us (“first-party cookies”) or by third parties that provide services on our behalf (“third-party cookies”). Some cookies expire at the end of your browsing session (“session cookies”), while others remain on your device for a set period or until you delete them (“persistent cookies”).

How We Use Cookies

We use cookies and similar technologies on our Website and Platform Services for the following purposes:

Strictly Necessary. These cookies are essential to the operation of our Website and Platform Services, including enabling security features, preventing fraud, and authenticating users. Because they are necessary for our sites to function, they cannot be disabled.
Functionality. These cookies enhance your experience by remembering your preferences and choices, such as language settings or form entries. Without them, certain features may be unavailable or may not operate as intended.
Performance (Analytics). These cookies help us understand how visitors use our Website, monitor site performance, identify errors, and improve our services. Information collected through these cookies is generally aggregated and does not directly identify you.
Targeting (Advertising). These cookies are used by us and our advertising partners to deliver advertising that is relevant to your interests, measure the effectiveness of advertising campaigns, and limit the number of times you see an advertisement. These cookies may collect information about your browsing activity across websites and over time.

Third-Party Tracking Technologies

Our Website uses third-party analytics, advertising, and marketing technologies that may collect information about your browsing activity, including your IP address, device and browser identifiers, pages visited, and interaction data. Each third-party service processes information in accordance with its own privacy policy.

You can view the types of cookies and tracking technologies used on our Website on our Transparency Page.

Web Beacons and Pixels

In addition to cookies, we may use web beacons (also known as clear GIFs, pixels, or tracking pixels) in our Website pages and emails. Web beacons are small, transparent image files that allow us to monitor traffic patterns, track email engagement, and compile aggregate statistics about site usage. Information collected through web beacons may be associated with your personal information.

Managing Your Cookie Preferences

You have several options for managing how cookies and tracking technologies operate on your device:

Cookie Settings Panel. You can manage your cookie preferences at any time through the Cookie Settings panel, accessible via the “Manage Cookies / Do Not Sell or Share My Personal Information” link in the footer of our Website. The Cookie Settings panel allows you to accept or decline non-essential cookies by category (Functionality, Performance, and Advertising). Strictly Necessary cookies are always active and cannot be disabled. Depending on your location, certain non-essential cookies may be blocked by default until you provide consent, or may load by default and can be removed when you decline them.
Browser Settings. Most web browsers allow you to control cookies through their settings. You can typically set your browser to refuse all cookies, accept all cookies, or notify you when a cookie is set. Please note that disabling cookies through your browser may affect the functionality of certain features of our Website and Platform Services.
Opt-Out Preference Signals. We honor browser-based opt-out preference signals, such as the Global Privacy Control (“GPC”). When we detect a recognized opt-out signal, we will treat it as a valid request to opt out of the sale or sharing of personal information and of targeted advertising, to the extent required by applicable law. You can learn more about GPC at globalprivacycontrol.org.
Industry Opt-Out Tools. You may also opt out of interest-based advertising through tools maintained by the Network Advertising Initiative and the Digital Advertising Alliance. Please note that opting out through these tools does not prevent you from receiving advertising; you will continue to receive non-targeted advertisements.
“Manage Cookies / Do Not Sell or Share My Personal Information.” You may opt out of the sale or sharing of your personal information by using the “Manage Cookies / Do Not Sell or Share My Personal Information” link in the footer of our Website. For more information about this right, see the Your Consumer Privacy Rights section of this Policy.

Your cookie preferences are specific to the browser and device you are using. If you clear your cookies or use a different browser or device, you may need to set your preferences again.

How We Use Your Information

We use information that we collect or that you provide to us about you or your organization, as applicable, including any Personal Information, to present the Website and the Platform Services to you, for the following purposes:

To provide you with information, products or services requested by you or your organization, as applicable;
To fulfill any other lawful purpose for which you specifically provide it;
To carry out our obligations and enforce our rights arising from any contracts entered into between you or your organization, as applicable, and us, including for billing and collection;
To notify you about changes to the Website and/or the Platform Services;
To contact you about the Platform Services and other news or information that may be of interest to you or your organization, as applicable;
To better understand the behavior of our users and improve the Website and our Platform Services;
To advertise, market, and promote our products, services, and other offerings. You may opt-out of receiving this promotional content by following the instructions contained in each communication that we send to you. If you unsubscribe from our marketing lists, we will continue to contact you regarding administrative and transactional matters, and to respond to your requests;
In any other way we may describe when you provide the information; and
For any other purpose with your express consent.

Disclosure of Your Information

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction. We may disclose Personal Information that we collect or you provide as described in this Policy as follows:

To our subsidiaries and affiliates;
To contractors, service providers and other third parties we use to support our business, including service providers who help us analyze the behavior of our users, process payments, and improve the Website and/or the Platform Services. Our contractors, service providers, and other third-parties are prohibited from using your Personal Information except to provide the services needed to support the CNote business or to comply with legal obligations;
To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us about our Website and/or Platform Services users is among the assets transferred;
To fulfill the lawful purpose for which you provide it;
To comply with any court order, law or legal process, including to share required information with the Internal Revenue Service (as described further below) and to respond to any government or regulatory request;
To enforce or apply our Terms of Use and other agreements, including for billing and collection purposes;
If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of CNote, our users or others;
For any other purpose disclosed by us when you provide the information; and
With your express consent.

If you or your organization invest in a CNote promissory note, we will share Personal Information, including information relating to your or your organization’s identity and bank account(s), as applicable, with our financial services partner, Dwolla, Inc. (“Dwolla”), for the purpose of allowing you or your organization, as applicable, to fund your or your organization’s, as applicable, CNote account. In this instance, your use of the Website and the Platform Services is subject to Dwolla’s Privacy Policy and our contract with Dwolla. By registering and funding a CNote account using the Platform Services, you agree to be bound by Dwolla’s Privacy Policy. The foregoing does not apply if you or your organization have agreed in writing with CNote to independently fund a CNote account without using the Website.

By using our Platform Services, if you receive interest income reportable by CNote on Form 1099-INT, you agree that CNote and its designated tax reporting service provider will transmit to the Internal Revenue Service (“IRS”) and other applicable state and/or local tax authorities your name, address, tax identification number, interest income and any other personal or financial information required by the IRS on Form 1099-INT. Such information will be transferred, stored, and processed by our service provider in accordance with its privacy policy and our contract with that provider. The foregoing does not apply to organizations that receive interest but are exempt from receiving Form 1099-INT, including but not limited to corporations and tax-exempt organizations.

Choices About How We Use and Disclose Your Information

We strive to provide you with choices regarding the information you provide to us. We have created mechanisms to provide you with the following control over your information:

Tracking Technologies and Advertising. You can manage your cookie preferences through the Cookie Settings panel, accessible via the “Manage Cookies / Do Not Sell or Share My Personal Information” link in our Website footer. You may also opt out of the sale or sharing of your personal information by using the “Manage Cookies / Do Not Sell or Share My Personal Information” link in our Website footer.
Emails from CNote. If we have sent you a promotional e-mail, you may opt-out from receiving future promotional emails through the link in the e-mail or send an e-mail to support@mycnote.com requesting to be omitted from future promotional e-mail distributions.

Accessing and Correcting Your Information

You can review and change your Personal Information by calling us at (510) 431-2422 or emailing us at support@mycnote.com. For information about additional rights you may have under applicable state privacy laws, see the “Your Consumer Privacy Rights” section below.

Your Consumer Privacy Rights

Depending on your state of residence, you may have certain rights regarding your personal information under applicable privacy laws, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), and similar laws in other states. This section describes those rights and how to exercise them.

Categories of Personal Information We Collect and Disclose

The following describes the categories of personal information we have collected, the sources of that information, our business purposes for collecting it, and how we have disclosed it in the preceding twelve (12) months.

Category of PersonAL Information	Sources	Business Purpose	Disclosed to Service Providers/Contractors	Shared for Advertising	Retention Criteria
Identifiers (name, email, mailing address, phone, SSN for investors)	Directly from you or your designated agent	Account creation, Platform Services, investor verification, communications, KYC/AML/CIP	Yes — payment processors, tax reporting providers, identity verification, financial institutions	No	Duration of account plus period required by law and our internal record keeping
Financial information (bank account numbers, investment details, tax ID)	Directly from you	Processing investments, funding accounts, tax reporting, billing	Yes — Dwolla (payments), tax reporting provider, IRS, financial institutions	No	Duration of account plus period required by tax/securities regulations and our internal record keeping
Internet or network activity (browsing history, pages visited, interaction data)	Automatically from your device via cookies and tracking technologies	Website analytics, performance monitoring, advertising measurement	Yes — analytics providers (e.g., Google Analytics)	Yes — advertising identifiers shared with Google Ads, LinkedIn, and similar companies via cookies	As set by cookie expiration; see Transparency Page
Geolocation data (IP address)	Automatically from your device	Security, fraud prevention, consent management, analytics	Yes — security and analytics providers, regulatory bodies, and law enforcement	Yes — IP address may be shared via advertising cookies	As set by cookie expiration; see Transparency Page
Other personal information (correspondence, support interactions)	Directly from you	Customer support, improving Platform Services, regulatory compliance	Yes — support platform providers	No	Duration of account plus reasonable period for support purposes our internal record keeping

We do not sell personal information for monetary consideration. However, our use of certain advertising and targeting cookies (including Google Ads and LinkedIn technologies) may constitute “sharing” of personal information for cross-context behavioral advertising as defined under the CCPA/CPRA and similar state laws. The categories of personal information shared in this manner are limited to internet or network activity information and geolocation data (specifically, identifiers such as IP addresses, device identifiers, and browsing activity transmitted through cookies). You may opt out of this sharing at any time as described below. We have not sold or shared the personal information of consumers we know to be under the age of 16.

Right to Opt Out of the Sale or Sharing of Personal Information

Under the CCPA/CPRA and certain other state laws, you have the right to opt out of the “sale” or “sharing” of your personal information. Under these laws, a “sale” is broadly defined and may include the disclosure of personal information to a third party in exchange for monetary or other valuable consideration. “Sharing” generally refers to the disclosure of personal information to a third party for purposes of cross-context behavioral advertising, even where no monetary exchange takes place.

How to Opt Out

You may exercise your right to opt out of the sharing of your personal information through any of the following methods:

“Manage Cookies / Do Not Sell or Share My Personal Information” Link. Click the “Manage Cookies / Do Not Sell or Share My Personal Information” link in the footer of our Website.
Opt-Out Preference Signals. Enable a recognized opt-out preference signal, such as the Global Privacy Control (“GPC”), in your browser or through a browser extension. When we detect a GPC signal, we will process it as a valid opt-out request for the browser and device on which it is enabled, to the extent required by applicable law.

When you opt out, we will cease sharing your personal information for cross-context behavioral advertising prospectively. We will also direct our service providers and contractors to do the same, to the extent applicable. Please note that opting out does not affect disclosures that do not constitute a sale or sharing under applicable law, such as disclosures to our service providers for business purposes.

Scope and Limitations

Please be aware of the following:

Your opt-out is specific to the browser and device on which it is exercised. If you use multiple browsers or devices, you will need to opt out on each one separately.
If you clear your cookies, your opt-out preferences set through the Cookie Settings panel may be reset. However, opt-out preference signals such as GPC are browser-based and will continue to be honored each time you visit our Website.
Opting out of the sharing of your personal information does not mean you will stop seeing advertisements. You will continue to receive non-targeted advertisements.

Additional Consumer Rights

Depending on your jurisdiction, you may also have the right to:

Access the categories and specific pieces of personal information we have collected about you.
Delete personal information we have collected from you, subject to certain exceptions.
Correct inaccurate personal information we maintain about you.
Limit the use of sensitive personal information to purposes authorized by applicable law.
Opt out of targeted advertising and, where applicable, profiling in furtherance of decisions that produce legal or similarly significant effects.
Data portability, receive a copy of your personal information in a portable and, to the extent technically feasible, readily usable format.

How to Submit a Request

To exercise any of the rights described above, you may submit a request by:

Emailing us at support@mycnote.com
Calling us at (510) 431-2422

We will verify your identity before processing your request. Depending on the nature of the request, we may ask you to provide information that matches records we already maintain. You may also designate an authorized agent to submit a request on your behalf. If you use an authorized agent, we may require proof of your written authorization and verify your identity directly.

Non-Discrimination

We will not discriminate against you for exercising your privacy rights. We will not deny you goods or services, charge you different prices, provide a different level or quality of service, or suggest that you will receive any of the foregoing, as a result of your exercising your rights under applicable law.

Response Timing

We will acknowledge receipt of your request within ten (10) business days and will respond to verifiable consumer requests within forty-five (45) calendar days, or such other timeframe required by applicable law. If we need additional time, we will notify you of the extension and the reason for it.

Data Security and Retention

We seek to protect your Personal Information from accidental loss and from unauthorized access, use, alteration and disclosure using appropriate physical, technical, organizational and administrative security measures based on the type of Personal Information and how we are processing it. The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to our Platform Services, you are responsible for keeping this password confidential, limiting access to your computer and/or mobile device and browser, and signing off after you have finished accessing your account. We ask you not to share your password with anyone.

Unfortunately, no method for the transmission of information via the internet or the storing of data is completely secure. Although we employ commercially reasonable, industry-standard methods to protect your Personal Information, we cannot guarantee the security of your Personal Information provided to us. Any transmission of Personal Information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Website or provided in connection with the Platform Services.

With respect to the Platform Services, we retain Personal Information about you only as long as is necessary for the fulfillment of the relevant purposes. After the end of the purpose, we delete your Personal Information in compliance with legal retention rights and obligations and insofar as other legal regulations do not conflict with this.

Retention Periods. We will retain your information:

As long as you have an open account with us or as otherwise necessary to provide you with our Platform Services.
After your account is closed, if doing so is necessary to comply with our legal obligations (e.g., tax regulations), resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation.
As long as necessary for the fulfillment of our own purposes, to the extent the Personal Information is retained in an anonymous or aggregated form that does not identify an individual personally.

For information collected through cookies and similar tracking technologies, retention periods are determined by the expiration settings of each cookie as described on our Transparency Page.

Individuals Under the Age of 18

Our Website and Platform Services are not intended for individuals under 18 years of age. No one under age 18 may provide any Personal Information to us. We do not knowingly collect Personal Information from individuals under age 18. If you are under 18 years of age, do not provide any information on the Website or on or through any of our Platform Services, make any purchases through the Website or the Platform Services, or provide any information about yourself to us, including your name, address, telephone number, e-mail address or any screen name or user name you may use. If we learn we have collected or received Personal Information from an individual under the age of 18 without verification of parental consent, we will delete that information. If you believe we might have any information from or about an individual under 18 years of age, please contact us at support@mycnote.com.

Changes to Our Privacy Policy

It is our policy to post any changes we make to our Policy on this page. If we make material changes to how we treat or utilize our users’ Personal Information, we will notify you by e-mail to the e-mail address specified in your or your organization’s account, as applicable, and/or through a notice on the Website home page. The date the Policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable e-mail address for you, and for periodically visiting our Website and this Policy to check for any changes.

Contact Information

If you have any questions or comments about this Policy, the ways in which we collect and use your Personal Information, and/or your choices and rights regarding such use, please do not hesitate to contact us:

CNote Group, Inc.
2323 Broadway
Oakland, CA 94612
Email: support@mycnote.com
Phone: (510) 431-2422

If you are unable to access this Privacy Policy due to a disability or any physical or mental impairment, please contact us and we will arrange to supply you with the information you need in an alternative format that you can access.