Firn, Inc. (“Firn”)

Effective November 12, 2022

Firn, Inc. (“Firn”) provides online tools to assist companies, potential investors, and others who are interested or involved in the acquisition, development, leasing, management, and/or financing of clean energy projects and other related assets. This privacy policy (our “Privacy Policy”) describes our data practices regarding Personal Information (defined below). This Privacy Policy applies to Personal Information collected through our website, located at www.firninvestments.com (the “Site”), or through our mobile apps (collectively, the Site and mobile apps are the “Services”). This Privacy Policy does not apply to any Personal Information collected by third party websites or apps not operated by Firn.

As a financial company, federal law (the Gramm-Leach-Bliley Act, or “GLBA”) also requires us to tell you how we collect, share, and protect your Personal Information. Please see the GLBA Appendix at the end of this Privacy Policy to learn more about how we treat your Personal Information under GLBA.

By accessing the Site and/or using our Services, you are consenting to our use of your Personal Information in accordance with this Privacy Policy. Further, your access to and use of the Services is subject to the Firn Terms of Use.

Information Firn Collects About You

Personal Information You Provide. We use the term “Personal Information” to mean any information that could be used to identify you, including your name, address, email address, birth date, financial information, cell or land-line phone number, or any combination of information that could be used to identify you. What Personal Information we collect from you depends on what Services you choose to use and how you interact with the Site:

Site Visitors. We have structured our Site so that, as a casual site visitor, you may come to our Site and review selected information about our Services without registering or providing Personal Information. However, if you wish to become an Investor, then we require you to provide certain Personal Information.

Investors. If you choose to access our Services as an Investor, we require that you complete a registration form. An Investor is an individual who is over the age of 18 and has completed the registration process on the Site. Our registration forms will specify the information which you must provide in order to enjoy the particular features to which you wish to subscribe, which may include such items as (i) name; (ii) email address; (iii) phone number(s); (iv) mailing address; (v) Social Security number (for IRS tax reporting purposes); (vi) bank account number; and (vii) birth date. Our registration forms may additionally request information that you may, at your option, choose to provide or withhold. To the extent this additional information constitutes Personal Information, we will treat it in the manner specified in this Privacy Policy.

We may require each Investor to provide information designed to verify his, her, or their identity. This information may include (i) information from a successfully completed electronic check transaction, (ii) a credit report, or (iii) other similar information designed to authenticate and confirm your identity or to otherwise comply with applicable law. We also require each Investor to provide certain financial information. For example, we require that each Investor also provide Internal Revenue Service Form W-9 data, which includes your Social Security number (or Taxpayer Identification number, where applicable). We also require that Investors provide us with certain account and other payment information, such as information needed to make payments via ACH, wire, or electronic checks. Our registration process for Investors provides additional details on the types of payment information needed.

Users also may choose to upload media files such as videos, photos, text, and other content to the Site to share with Firn and other users. When you upload this content, we may also collect metadata associated with these media files including date, time, location and device information. Firn’s use of such content will be governed by our user-generated terms and conditions which are provided at the time of collection of such content.

Location Data. We may collect your location information through our mobile apps by capturing the location (e.g. latitude/longitude) of your mobile device. If you have given the app permission to access your location, we may collect your device’s location even if you are not using the Service and store your location history. If you want to opt-out of the collection of your location data, please adjust your settings in your mobile device to restrict the app’s access to your location data. Geolocation data may be used to enhance the Services, for example to offer additional functionality and information regarding your location in connection with the location of Firn properties.

Automatically-Collected Information. We, our service providers, and marketing partners, may automatically log information, such as the type of computer or mobile device accessing our Services, interactions over time with our Services, our communications (including emails and alerts), and other online services, such as:

Device data, such as the computer or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., WiFi, LTE, 4G), and general location information such as city, state or geographic area.
Online activity data, such as pages or screens viewed, how long was spent on a page or screen, browsing history, navigation paths between pages or screens, information about activity on a page or screen, access times, and duration of access, and whether marketing emails were opened or links within them clicked. We may use Google Analytics, a web analytics service provided by Google LLC (“Google”) to help collect and analyze Usage Information. For more information on how Google uses this information, click here.

We use the following tools for automatic data collection:

Cookies, which are text files that websites store on a visitor‘s device to uniquely identify the visitor’s browser or to store information or settings in the browser for the purpose of helping navigate between pages efficiently, remembering preferences, enabling functionality, helping us understand user activity and patterns, and facilitating online advertising.
Local storage technologies, like HTML5, that provide cookie-equivalent functionality but can store larger amounts of data, including on devices outside of browsers in connection with specific applications.
Web beacons, also known as pixel tags or clear GIFs, which are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked.

How We Use Personal Information

We may use your Personal Information for the following business purposes:

to process transactions that you have authorized us to make;
to facilitate your activities with respect to our Site;
to contact you regarding administrative issues, such as questions about your specific request, or otherwise respond to your comments or requests;
to verify and authenticate your identity, to help us ensure that the individuals who use the Site and Services are who they claim to be; to prevent, detect, mitigate, and investigate fraud, security breaches, and potentially prohibited or illegal activities, including, for example, activities prohibited by the Anti-Money Laundering Act;
to help us operate our Site;
to deliver notices regarding your account;
to comply with IRS requirements and for tax reporting purposes;
to provide you with information, such as notices of investment opportunities via our Site or updates concerning investments that you have participated in;
to send you information we believe is relevant to you, such as news, bulletins, or other information;
to enforce this Privacy Policy and our Terms of Use;
to conduct user surveys and questionnaires; and
to comply with applicable law.

Marketing and advertising. We and our advertising partners may collect and use Personal Information for marketing and advertising purposes, including:

Direct marketing. We may from time-to-time send direct marketing communications including, but not limited to, communications about special promotions, offers and events. Recipients may opt out of our marketing communications as described in the “Opt out of marketing communications” section below.
Interest-based advertising. We may engage third-party advertising companies and social media companies to display ads promoting our services across the web. These companies may use cookies and similar technologies to collect information about interactions (including the data described above) over time across the Internet and use that information to serve online ads that they think will be of interest. This is called interest-based advertising.

We use aggregated information to analyze the effectiveness of our Site, to improve our Services, and for other similar purposes. In addition, from time to time, we may undertake or commission statistical and other summary analyses of the general behavior and characteristics of users participating in our Services and the characteristics of visitors at our Site, and may share aggregated information with third parties, including advertisers. We may collect aggregated information through features of the software that support our Services, through cookies, and through other means described in this Privacy Policy.

To enable us to better understand the characteristics of our Investors and/or to provide services tailored to your needs, we may combine the Personal Information an Investor provides with certain automatically-collected information that would not otherwise be personally identifiable. If we combine or link any automatically-collected, non-individually identifiable information with your Personal Information, the resulting combination will be treated as Personal Information under this Privacy Policy.

How We Share Personal Information

We do not disclose your Personal Information to unaffiliated third parties except as provided in this Privacy Policy, as follows:

Service Providers. We may share Personal Information with third party companies and individuals that provide services on our behalf or help us operate our Services, such as hosting services, cloud services, information technology services, email communication software, email newsletter services, advertising and marketing services, payment processors, customer relationship management and customer support services, and web analytics services.

Plaid. For users who choose to link their bank accounts, we are planning to use Plaid Technologies, Inc. (“Plaid”) to facilitate the automatic connection with, and gather required transaction data from, your financial institution. In addition to facilitating transactions, we use Plaid to prevent overdrafts on your account and to prevent, detect, and mitigate fraud. By using our joint services, you grant us and Plaid the right, power, and authority to act on your behalf to access and transmit your Personal Information (including bank account information) from the relevant financial institution. You agree to your Personal Information (including bank account information) being transferred, stored, and processed by Plaid in accordance with the Plaid Privacy Policy (located at https://plaid.com/legal/#privacy-policy).

Stripe. We may use Stripe, Inc. (Stripe) as a payment processor to facilitate the processing of certain payment transactions for our Services. Stripe collects the financial information necessary to process your payments for the Service. We may disclose your Personal Information to Stripe to prevent, detect, mitigate, and investigate potentially illegal acts, fraud and/or security breaches and to assess and manage risk, including to alert you if fraudulent activities have been detected on your Firn or Stripe accounts; and provide customer services, including to help service your account or resolve disputes. Accordingly, in addition to this Privacy Policy and our Terms of Use, your financial information is also processed pursuant to Stripe’s services agreement and privacy policy (located at https://stripe.com/privacy).

Advertising Partners. We may share Personal Information with third party advertising companies for interest-based advertising purposes as described above.

IRA. We may team up with third-party custodians to allow you to invest your IRA funds in diversified commercial real estate investments. These parties are not affiliated with Firn, but act as a directed custodian for IRAs and other custodial accounts. If you elect to initiate the opening of a self-directed IRA account with Firn, we streamline the enrollment process by sharing certain Personal Information with these custodians, including but not limited to your name, Social Security number, date of birth, and contact information. You are not required to invest your IRA funds as a condition of using the Services.

Affiliates. We may share information with our affiliates, meaning an entity that controls, is controlled by, or is under common control with Firn. Our affiliates may use the Personal Information we share in a manner consistent with this Privacy Policy.

For Legal Reasons. We may share your Personal Information to the extent we reasonably believe we are required to do so by law or to comply with legal or regulatory requirements, or to protect against fraud, illegal activity, or to otherwise protect Firn against liability.

In Connection with a Corporate Transaction. In the event of a transaction or proposed transaction involving the transfer of substantially all of the assets of Firn or one or more of its businesses to another entity, whether an affiliate or a third party, or in connection with a bankruptcy, we may share your Personal Information in the diligence process or to otherwise facilitate the transaction, and with individuals assisting in the transaction or in connection with a bankruptcy. Your Personal Information may also be one of the transferred assets as part of the transaction or bankruptcy.

For Safety & Security. We may reveal your Personal Information to third parties, including law enforcement agencies, in order to protect the safety and security of our employees and employees of our affiliates, users or of any third party.

Feedback, Questionnaires and Surveys

Our Site may allow site visitors and Investors to participate in surveys and questionnaires, which from time to time we may post on the Site. We also encourage our users to provide feedback to us about our Site and our Services. You are free to choose whether you participate in these activities. We may ask that, in addition to providing your responses, you also provide us with your contact information. In these instances, we use any Personal Information you choose to provide to us in connection with these activities for the purposes for which you submit the information.

We aggregate information derived from survey and questionnaire information – with your Personal Information removed – for monitoring or improving the use and appeal of this Site (with no other obligation to you and, specifically, with no obligation to compensate you for these uses). You are not obligated to participate in any of these activities.

Links to Other Sites

This privacy statement applies only to Personal Information collected by our Site. Our Site contains links to other sites that are not owned or controlled by Firn. Firn is not responsible for the privacy practices of such other sites, and we encourage you to be aware when you leave our Site and to read the privacy statements of each and every web site that collects Personal Information.

Data Security

We have put in place commercially-reasonable security systems intended to prevent unauthorized access to or disclosure of Personal Information, and we take reasonable steps to secure and safeguard this Personal Information against loss, theft, and unauthorized use, disclosure, or modification. With that said, there is no such thing as 100% security of the networks, servers, and databases we operate or that are operated on our behalf. For example, email sent to or from the Site may not be secure. Before submitting any Personal Information via the Site, please be aware of these inherent risks and understand that you do so at your own risk.

Data Retention

We keep your Personal Information for as long as reasonably necessary for the purposes described in this Privacy Policy, while we have a legitimate business need to do so in connection with your account, or as required by law (e.g., for tax, legal, accounting or other purposes), whichever is longer.

Your Choices

In general, you may browse the Site without providing Personal Information. However, if you choose not to provide certain Personal Information through our Site, we may not be able to provide certain services or process certain of your requests. You will not be able to become an Investor or use all of the features and products that we offer through this Site.

Depending on the functionality associated with the Site feature you are using, you may be able to update or delete certain of your Personal Information on the Site. Accordingly, at your request, we will take reasonable steps to remove your Personal Information from our databases. However, please note that:

we may not be permitted to delete your Personal Information completely, due to IRS and regulatory reporting requirements, investments on the platform and the rights thereof, and data backups and records of deletions;
if you request deletion of your Personal Information, you may be unable to use certain features of the Site and any associated Services;
certain of your Personal Information may remain in our databases following the deletion of your account; and,
we may not be able to remove de-identified, anonymous, or aggregate data from our databases.

Any deletion requests may be sent to info@firninvestments.com.

Opt out of marketing communications. If you no longer wish to receive marketing emails from us, you can opt out of these communications by clicking on the “unsubscribe” link included in those emails, or by contacting us at info@firninvestments.com. Please understand that you will not be allowed to opt-out of transactional notices or other legal and related notices concerning your relationship to the Site or your account.

Online tracking opt-out. There are a number of ways to opt out of having online activity and device data collected through our Services, which we have summarized below:

Blocking browser cookies. Most browsers let users remove or reject cookies, including cookies used for interest-based advertising. To do this, follow the instructions in the browser settings. Many browsers accept cookies by default until users change their settings. For more information about cookies, including how to see what cookies and other technologies have been set on a device and how to manage and delete them, visit allaboutcookies.org or http://preferences-mgr.truste.com. Use the following links to learn more about how to control cookies and online tracking through the following browsers: Firefox; Chrome; Microsoft Edge; and Safari.
Blocking advertising ID use in mobile settings. Mobile device settings may provide functionality to limit use of the advertising ID associated with the mobile device for interest-based advertising purposes.
Using privacy plug-ins or browsers. Another way to block our Services from setting cookies used for interest-based ads is by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, DuckDuckGo, Ghostery, or uBlock Origin, and configuring them to block third party cookies/trackers. You can also install a browser add-on to opt out of Google Analytics.
Platform opt-outs. The following advertising partners offer features to control the use of Personal Information for interest-based advertising: Google; Twitter; Facebook; and Microsoft.
Advertising industry opt-out tools. The following opt-out options also limit use of information for interest-based advertising by participating companies: Digital Advertising Alliance for Websites; Digital Advertising Alliance for Mobile Apps; and Network Advertising Initiative.

Note that, because these opt-out mechanisms are specific to the device or browser on which they are exercised, they will need to be separately configured on every browser and device that accesses the Services.

Children’s Privacy

Our Site is not directed to children under the age of 18. We do not knowingly seek to collect or maintain Personal Information or other information from children under the age of 18. We will use commercially reasonable efforts to delete any Personal Information or other information later determined to be provided by a child under the age of 18. Use of the Site by children under the age of 18 is not permitted. If you become aware that a minor has provided Personal Information through our Site, please email us at info@firninvestments.com.

Changes to This Privacy Policy

We reserve the right to alter, modify, update, add to, subtract from or otherwise change this Privacy Policy at any time, which will become effective as of posting on the Site. We encourage you to periodically review this Privacy Policy to stay informed about how we collect, use, and share Personal Information.

Additional Notice to California Residents

We are required by the California Consumer Privacy Act of 2018 (“CCPA”) to provide this CCPA notice (“CCPA Notice”) to California residents to explain how we collect, use, and share their Personal Information, and the rights and choices we offer California residents regarding our handling of their Personal Information.

CCPA Scope And Exclusions. This CCPA Notice, including the description of our privacy practices and California residents’ privacy rights, apply only to California residents whose interactions with us are limited to:

visiting our consumer websites;
signing up for email alerts; and
applying for our job openings on our websites (however, note that the CCPA limits some of the privacy rights for job applicants).

This CCPA Notice does not apply to the Personal Information we collect, use, or disclose about:

consumers who initiate or complete the process of becoming an investor through Firn. This is because this information is subject to the federal Gramm-Leach-Bliley Act and implementing regulations, or the California Financial Information Privacy Act (for additional information relating to your choices about this information specifically, see the GLBA Appendix at the end of this Privacy Policy); or
representatives of businesses that seek to obtain our products or services, or to provide products or services to us.

Privacy Rights. The CCPA grants California residents the following rights:

Information. California residents can request information about how we have collected, used and shared their Personal Information during the past 12 months. We have made this information available to California residents without having to request it by including it in this Privacy Policy.
Access. California residents can request a copy of the Personal Information that we maintain about them.
Deletion. California residents can ask us to delete the Personal Information that we collected or maintain about them.
Opt out of sale of Personal Information. We do not sell Personal Information. Like many businesses, we use services that display interest-based ads to users around the web. We offer instructions on how to limit online tracking in the “Your Choices” section above.

Please note that the CCPA limits these rights by, for example, prohibiting us from providing certain sensitive information in response to an access request and limiting the circumstances in which we must comply with a deletion request. We will also respond to requests for information and access only to the extent we are able to associate with a reasonable effort the information we maintain with the identifying details in a request. If we deny a request, we will communicate our decision to the requester. California residents are entitled to exercise the rights described above free from discrimination.

How California Residents Can Submit A Request. California residents may submit a request for information, access, or deletion, by contacting us at info@firninvestments.com or at the mailing address in the “Contact Us” section of this Privacy Policy. To opt out of the sale of Personal Information we offer California residents instructions on how to limit online tracking in the “Your Choices” section above.

Extension. We will make an effort to fulfill verified requests within 45 days of receipt. However, the period for responding to verified request may be extended, based on the complexity and the number of requests received. If this extension is required, we will communicate the extension and the reason(s) for the delay within 45 days of receiving the request.

Identity Verification. We will need to confirm the identity of the requester and their California residency in order to process requests to exercise the above rights. We cannot process requests if we are not provided with sufficient detail to allow us to understand and respond to it.

Authorized Agents. California residents can empower an “authorized agent” to submit requests on their behalf. We will require the authorized agent to have a written authorization confirming that authority.

“Shine the Light” Law

California law permits users who are California residents to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their Personal Information (if any) for such third parties’ direct marketing purposes in the prior calendar year, as well as the type of Personal Information disclosed to those parties. However, Firn does not share your Personal Information with third parties for their direct marketing purposes.

How We Respond to “Do Not Track” Signals

Our Site currently does not respond to “Do Not Track” (DNT) signals and operates as described in this Privacy Policy whether or not a DNT signal is received. If we do so in the future, we will describe how we do so in this Privacy Policy.

If you have any questions about this Privacy Policy, the practices of our Site or Services, or your dealings with our Site or Services, please contact us at: info@firninvestments.com.

GLBA Privacy Notice

Rev. 10/25/2022

FACTS

WHAT DOES FIRN, INC. (“FIRN”) DO WITH YOUR PERSONAL INFORMATION?

Why?

Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.

What?

The types of personal information we collect and share depend on the product or service you have with us. This information can include:

Social Security number and income
Investment experience and assets
Account transactions and checking account information

When you are no longer our customer, we continue to share your information as described in this notice.

How?

All financial companies need to share customers' personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers' personal information; the reasons Firn chooses to share; and whether you can limit this sharing.

Reasons we can share your personal information	Does Firn share?	Can you limit this sharing?
For our everyday business purposes— such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus	Yes	No
For our marketing purposes— to offer our products and services to you	Yes	No
For joint marketing with other financial companies	No	We don’t share
For our affiliates' everyday business purposes—Information about your transactions and experiences	Yes	No
For our affiliates' everyday business purposes — information about your creditworthiness	No	We don’t share
For our affiliates to market to you	No	We don’t share
For nonaffiliates to market to you	No	We don’t share

Questions?

Email at info@firninvestments.com or to go www.firninvestments.com.

Page 2

Who we are
Who is providing this notice?	This notice is being provided on behalf of Firn, Inc. and its affiliated companies.
What we do
How does Firn protect my personal information?	To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings.
How does Firn collect my personal information?	We collect your personal information, for example, when you Open an account Give us your contact information Provide account information Show your government-issued ID Buy securities from us Give us your income information Tell us about your investment or retirement portfolio We also collect your personal information from others, such as credit bureaus, affiliates, or other companies.
Why can’t I limit all sharing?	Federal law gives you the right to limit only sharing for affiliates' everyday business purposes— information about your creditworthiness affiliates from using your information to market to you sharing for nonaffiliates to market to you State laws and individual companies may give you additional rights to limit sharing. See below for more on your rights under state law.
Definitions
Affiliates	Companies related by common ownership or control. They can be financial and nonfinancial companies. They may include companies with a Firn branded name.
Nonaffiliates	Companies not related by common ownership or control. They can be financial and nonfinancial companies. Firn does not share with nonaffiliates so they can market to you.
Joint marketing	A formal agreement between nonaffiliated financial companies that together market financial products or services to you. Firn does not currently jointly market.
Other important information
California Residents Only: Under California law, we will not share information we collect about you with nonaffiliates unless the law allows. For example, we may share information with your consent, to service your accounts. We will limit sharing among our affiliates to the extent required by California law.