Privacy Policy

1 Who We Are

Change Refund Corp ("Company," "we," "us," or "our") is a Wyoming corporation with its principal place of business in Houston, Texas. We operate the Climb platform — a Stored Value Wallet System and Alternative Payment Platform (collectively, the "Service") — that enables consumers to make zero-fee payments at enrolled merchants via their Climb Wallet and to digitize cash change from in-store purchases into their Climb Wallet balance.

This Privacy Policy explains what personal information we collect, how we use it, with whom we share it, and how you can exercise your rights. If you have questions, contact us at admin@savewithclimb.com.

2 Information We Collect

2.1 Information You Provide

• Phone number. Collected at registration, stored encrypted using AES-256, used to authenticate you via SMS one-time passcode.
• Identity information. First name, last name, date of birth, and last four digits of your Social Security Number, collected to complete identity verification (KYC) required for cashout compliance.
• Email address. Collected for account security notifications and cashout PIN management.
• Payment method information. Bank account details for ACH cashout, linked via Plaid. Climb does not issue payment cards and does not store full account numbers on our servers.

2.2 Information Collected Automatically

• Device information. Operating system, device model, app version, and unique device identifiers.
• Usage data. Features accessed, timestamps, and actions taken within the app.
• IP address. Collected on each API request for fraud detection and security monitoring.
• Device fingerprint. A hashed device identifier used for fraud prevention and receipt deduplication.

3 How We Use Your Information

• Provide the Service. Process Climb Wallet payments at enrolled merchants, credit cash change amounts to your wallet balance, and process cashouts to your bank account or debit card.
• Authenticate you. Send SMS OTPs to verify your identity at login.
• Verify your identity. Confirm your identity as required for cashout compliance (KYC).
• Fraud detection and compliance. Detect suspicious activity, duplicate transactions, and comply with AML/BSA requirements.
• Customer support. Respond to your inquiries and resolve disputes.
• Communications. Send transaction confirmations and important account notices via SMS or email. We do not send marketing messages without your consent.
• Improve the Service. Analyze aggregate usage patterns to improve app performance and features. This analysis uses anonymized or aggregated data and does not identify you individually.
• Legal obligations. Comply with applicable law, respond to lawful requests from authorities, and enforce our Terms of Service.

4 Third-Party Service Providers

We share your data with the following third parties solely to provide the Service. We do not sell your personal information to third parties for their own marketing or advertising purposes.

Each provider is bound by its own privacy policy and data processing agreements. We do not authorize providers to use your data for any purpose other than providing services to us.

5 Data Security

We implement industry-standard technical and organizational measures to protect your personal information:

• Phone numbers are stored encrypted using AES-256 at rest.
• Bank account data is handled via Plaid. We do not store full account numbers on our servers. Climb does not issue payment cards of any kind.
• API communications are encrypted in transit using TLS 1.2 or higher.
• Cashout PINs are stored as bcrypt hashes. We cannot retrieve your PIN — only verify it.
• Access controls restrict employee access to personal data on a need-to-know basis.

No security measure is perfect. If you believe your account has been compromised, contact us immediately at admin@savewithclimb.com.

6 Data Retention

• Account data (name, phone, KYC status) is retained for as long as your account is active and for 7 years after closure to meet financial recordkeeping requirements.
• Transaction records are retained for 7 years to comply with AML/BSA regulations.
• Usage logs and IP data are retained for up to 12 months.

You may request deletion of your account by contacting admin@savewithclimb.com. We will delete your personal data to the extent not required by law. Transaction records required for legal compliance cannot be deleted on request.

7 Your Rights

Depending on your state of residence, you may have the following rights regarding your personal information:

• Access. Request a copy of the personal information we hold about you.
• Correction. Request correction of inaccurate personal information.
• Deletion. Request deletion of your personal information, subject to legal retention requirements.
• Portability. Request your data in a structured, machine-readable format.
• Opt-out of SMS. Reply STOP to any Climb SMS to stop wallet balance notifications. You may also email admin@savewithclimb.com with "SMS Opt Out" in the subject line. OTP messages may still be sent when you initiate a login. See our SMS Messaging Policy for full details.

To exercise any of these rights, email admin@savewithclimb.com with "Privacy Request" in the subject line. We will respond within 30 days. We may need to verify your identity before processing your request.

We do not discriminate against you for exercising your privacy rights.

8 SMS Communications

By entering your phone number at a participating merchant's Climb cashier tablet and checking the SMS consent checkbox, you expressly consent to receive SMS text messages from Climb (operated by Change Refund Corp).

8.1 Opt-In

Consent is captured at the point of sale on the Climb cashier tablet. You must check a disclosure box confirming that you agree to receive SMS messages from Climb per the SMS Messaging Policy. Your consent is recorded in our system with the merchant location and timestamp.

8.2 Message Types

• Wallet balance notifications. One SMS per change credit transaction confirming the amount added to your Climb wallet.
• One-time passcodes (OTPs). Sent when you initiate a login to view your balance or cash out. OTPs expire in 10 minutes.

8.3 Frequency and Cost

Message frequency varies based on your account activity. We do not send recurring marketing or promotional SMS campaigns. Msg & data rates may apply based on your mobile carrier.

8.4 Opt-Out

Reply STOP to any Climb message at any time to stop wallet notifications. Reply START to re-subscribe. Reply HELP or email admin@savewithclimb.com for assistance. See our SMS Messaging Policy for the complete program description.

9 Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us at admin@savewithclimb.com and we will delete it promptly.

10 Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via SMS or email. The "Last Updated" date at the top of this page reflects the most recent revision. Your continued use of the Service after the effective date of any update constitutes acceptance of the revised policy.

11 Contact

For privacy questions or to submit a data request:

Change Refund Corp
Houston, Texas
Email: admin@savewithclimb.com