Privacy Policy
Kora Financial Inc. (“Kora,” “we,” “us,” or “our”) respects your privacy and is committed to protecting the information we collect, use, maintain, and disclose in connection with our websites, applications, products, services, and platforms, including KoraConnect.
This Privacy Policy describes how Kora collects, uses, maintains, protects, and discloses information about consumers and explains certain rights and choices available to consumers.
Because KoraConnect includes services that involve the collection, maintenance, processing, and furnishing of information that may constitute a consumer report under the Fair Credit Reporting Act (“FCRA”), additional federal requirements apply to Kora's collection, use, disclosure, accuracy, security, retention, and disposal of information used for consumer-reporting purposes.
Nothing in this Privacy Policy is intended to provide Kora or any KoraConnect subscriber with authority to obtain, use, or receive a consumer report except for a purpose permitted by the FCRA and other applicable law.
Where a provision of this Privacy Policy conflicts with a non-waivable requirement of applicable law, the applicable law will control.
1. ABOUT KORA
Kora provides financial technology, data, analytics, lending-related, account-related, and consumer reporting products and services.
KoraConnect is a Kora product that may collect, receive, organize, analyze, maintain, and furnish information about consumers to authorized subscribers for purposes permitted by applicable law.
Depending on the particular product, service, data element, and use, information maintained by Kora may be subject to different legal and regulatory requirements, including the:
- Fair Credit Reporting Act, 15 U.S.C. §§ 1681 et seq. (“FCRA”);
- Fair and Accurate Credit Transactions Act (“FACTA”);
- Gramm-Leach-Bliley Act (“GLBA”), where applicable;
- applicable federal and state privacy and data-security laws;
- applicable state consumer reporting and credit-reporting laws;
- applicable state comprehensive privacy laws;
- applicable data-security and breach-notification requirements; and
- other applicable financial-services, consumer-protection, and information-security laws.
Kora maintains policies, procedures, systems, and controls designed to address these requirements.
2. INFORMATION WE COLLECT
The types of information Kora collects depend on the product or service you use, how you interact with us, and the purposes for which the information is collected.
Information may include:
A. Identity and Contact Information
- Name;
- Former or alternative names;
- Postal address;
- Email address;
- Telephone number;
- Date of birth;
- Government-issued identification information;
- Social Security number or other government identification number, where permitted and necessary;
- Account credentials and authentication information.
B. Financial and Account Information
Depending on the product or service, we may collect:
- Bank account information;
- Account balances;
- Transaction history;
- Deposit and withdrawal information;
- Payment information;
- Income information;
- Employment information;
- Loan and repayment information;
- Account ownership information;
- Debt and payment information;
- Financial obligations and payment performance information; and
- information obtained from financial institutions or financial-data providers.
C. Consumer-Reporting Information
In connection with KoraConnect, we may collect, receive, maintain, process, and furnish information that may constitute a consumer report or information contained in or derived from a consumer report.
This may include information relating to:
- identity;
- financial accounts;
- income and employment;
- transaction activity;
- payment history;
- loan performance;
- repayment behavior;
- account status;
- outstanding obligations;
- credit-related information;
- public-record information, where legally permitted;
- information received from furnishers;
- information received from subscribers or other authorized sources; and
- other information permitted to be collected, maintained, or furnished under applicable law.
Not all information maintained by Kora is a consumer report, and whether information constitutes a consumer report depends on the information, its source, its use, and the circumstances in which it is disclosed.
D. Device, Technical, and Usage Information
We may collect:
- IP address;
- browser type and version;
- operating system;
- device identifiers;
- mobile-device information;
- pages viewed;
- access dates and times;
- referring websites;
- application activity;
- diagnostic information;
- authentication information; and
- other technical or usage information.
E. Information From Third Parties
We may receive information from:
- financial institutions;
- data aggregators;
- service providers;
- identity-verification providers;
- fraud-prevention providers;
- subscribers and customers;
- furnishers of information;
- public records;
- government agencies;
- business partners;
- authentication providers;
- analytics providers; and
- other sources permitted by law.
Where information is furnished to Kora for inclusion in a consumer report, Kora maintains procedures designed to identify, evaluate, and address information that may be inaccurate or incomplete as required by applicable law.
3. INFORMATION COLLECTED THROUGH CONNECTED ACCOUNTS
Certain Kora products may allow you to connect a financial account or other account to Kora through a third-party data provider.
If you authorize such a connection, we may receive information made available through that connection, which may include:
- account ownership information;
- account balances;
- transaction history;
- account type;
- deposits and withdrawals;
- payment activity;
- income-related information; and
- other financial information made available by the connected account provider.
We use connected-account information only for purposes permitted by the applicable authorization, our agreements, applicable law, and the requirements applicable to the particular Kora product.
Where connected-account information is used in connection with KoraConnect's consumer-reporting activities, additional FCRA requirements may apply.
4. HOW WE USE INFORMATION
We may use information we collect for the following purposes, subject to applicable law and the restrictions described below.
A. Providing and Maintaining Services
We may use information to:
- provide our products and services;
- establish and maintain accounts;
- authenticate users;
- process transactions;
- provide customer support;
- operate and maintain our systems;
- communicate with consumers and customers;
- administer our products; and
- provide requested functionality.
B. Security, Fraud Prevention, and Risk Management
We may use information to:
- verify identity;
- detect and prevent fraud;
- identify unauthorized activity;
- protect consumers and customers;
- protect Kora's systems and information;
- investigate suspected misuse;
- detect cybersecurity threats; and
- maintain the security and integrity of our services.
C. Product Development and Improvement
We may use information to analyze, evaluate, maintain, improve, modify, and develop our products, services, technologies, and systems, subject to applicable law.
D. Aggregated, De-Identified, or Anonymized Information
Kora may create, derive, collect, use, retain, disclose, and share information that has been aggregated, de-identified, or anonymized in a manner that is not reasonably capable of being used to identify you personally, for any purpose permitted under applicable law.
This may include using aggregated, de-identified, or anonymized information to:
- develop, maintain, improve, modify, enhance, optimize, and evaluate existing products, services, technologies, systems, and features;
- develop new products, services, features, technologies, applications, and business offerings;
- conduct research, testing, experimentation, analytics, benchmarking, and statistical analysis;
- develop insights, models, algorithms, scores, and other analytical or predictive tools;
- develop, train, test, validate, evaluate, improve, and deploy artificial intelligence (“AI”), machine-learning, statistical, and other automated systems and technologies;
- improve the speed, accuracy, performance, functionality, reliability, security, and quality of Kora's products and services;
- detect, prevent, investigate, and mitigate fraud, unauthorized activity, cybersecurity threats, and other risks;
- improve data quality and develop data-management, data-matching, and data-enrichment capabilities;
- create products, services, insights, analyses, or other offerings for Kora, its affiliates, customers, subscribers, business partners, and other authorized parties; and
- otherwise support Kora's research, development, innovation, operations, and commercial activities.
Kora may share aggregated, de-identified, or anonymized information with its affiliates, service providers, technology providers, business partners, customers, subscribers, researchers, and other third parties, and may permit such parties to use that information, for any purpose permitted under applicable law.
Kora may combine information from multiple consumers, products, services, sources, datasets, or time periods in creating aggregated, de-identified, or anonymized information.
Kora may retain aggregated, de-identified, or anonymized information indefinitely, including after the closure of an account or termination of a consumer's relationship with Kora, to the extent permitted by applicable law.
Where Kora has aggregated, de-identified, or anonymized information in a manner that is not reasonably capable of being associated with or used to identify an individual consumer, Kora may use that information without further notice to or consent from the consumer, except where additional notice or consent is required by applicable law.
Kora may also use information to create aggregated, de-identified, or anonymized datasets, models, statistics, insights, or other information products that may be incorporated into, used to develop, train, test, validate, operate, or improve Kora's products, services, technologies, AI systems, machine-learning models, and other systems.
Kora will maintain safeguards and procedures designed to prevent unauthorized re-identification of information that Kora has represented as de-identified or anonymized. Kora will not knowingly attempt to re-identify such information except where reasonably necessary and permitted by applicable law, including for purposes such as data-quality management, security, fraud prevention, compliance, dispute resolution, legal obligations, or protection of Kora's rights.
Nothing in this Section limits Kora's ability to use information that is not subject to restrictions applicable to identifiable consumer-report information, and nothing in this Section creates, expands, or substitutes for a permissible purpose under the Fair Credit Reporting Act.
E. Legal and Regulatory Compliance
We may use information to:
- comply with applicable laws and regulations;
- respond to lawful requests from governmental authorities;
- comply with court orders and legal process;
- meet regulatory reporting obligations;
- enforce our agreements;
- establish or defend legal claims; and
- protect the rights, safety, and property of Kora, consumers, customers, and others.
5. KORACONNECT AS A CONSUMER REPORTING AGENCY
KoraConnect may operate as a consumer reporting agency (“CRA”) as that term is defined under the FCRA.
The FCRA imposes specific restrictions on the collection, maintenance, use, and disclosure of consumer-report information. Among other requirements, consumer reports generally may be furnished only for purposes permitted by the FCRA, and users of consumer reports may not obtain or use consumer reports without a permissible purpose.
Accordingly:
- Kora will furnish consumer reports only to subscribers or other recipients for purposes permitted by the FCRA and applicable law.
- Kora will maintain procedures designed to obtain and verify representations regarding the permissible purpose for which a subscriber seeks a consumer report.
- Kora will not knowingly furnish consumer reports to a person who does not have a permissible purpose.
- Kora will maintain procedures designed to limit access to consumer-report information to persons with a legitimate business need and appropriate authorization.
- Kora will maintain procedures designed to prevent unauthorized access to, use of, or disclosure of consumer-report information.
- Kora will maintain procedures designed to assure the maximum possible accuracy of information contained in consumer reports as required by applicable law.
- Kora will investigate qualifying disputes concerning information contained in consumer reports in accordance with applicable FCRA requirements.
- Kora will maintain appropriate records concerning disputes, corrections, reinvestigations, and related consumer-reporting activity.
- Kora will maintain procedures governing the retention and secure disposal of consumer-report information.
- Kora will not rely upon a general privacy-policy authorization as a substitute for a subscriber's required FCRA permissible purpose.
A subscriber's access to KoraConnect does not, by itself, establish a permissible purpose to obtain a consumer report.
6. PERMISSIBLE PURPOSES AND PRIVACY OF CONSUMER REPORTS
The FCRA restricts when a consumer report may be obtained, used, or furnished.
Depending on the circumstances, permissible purposes may include purposes relating to:
- credit transactions;
- insurance underwriting;
- employment, where applicable requirements are satisfied;
- legitimate business transactions initiated by the consumer;
- account review;
- collection of an obligation;
- certain governmental or statutory purposes;
- certain business transactions specifically permitted under the FCRA; and
- other purposes expressly authorized by the FCRA.
Kora does not treat a consumer's general consent to this Privacy Policy as authorization for an otherwise impermissible acquisition or use of a consumer report.
A person or entity that obtains or uses a consumer report must independently satisfy applicable FCRA requirements. FCRA permissible purposes are consumer-specific, and a disclaimer cannot cure the absence of a permissible purpose.
7. YOUR FCRA RIGHTS
If Kora maintains a consumer report about you, you may have rights under the FCRA, including, depending on the circumstances:
A. Right to Request Your File
You may request disclosure of the information in your consumer file maintained by Kora, subject to applicable statutory exceptions and procedures.
B. Right to Request Information About Your File
You may have the right to receive information concerning the nature and substance of information in your consumer file, including information regarding sources and recipients as required by the FCRA.
C. Right to Dispute Inaccurate or Incomplete Information
If you believe that information maintained by Kora is inaccurate or incomplete, you may submit a dispute.
Kora will investigate qualifying disputes in accordance with applicable FCRA requirements and will correct or delete information that is inaccurate, incomplete, or cannot be verified, as required by law.
D. Right to Obtain a Description of Certain Rights
Consumers may obtain information concerning their rights under the FCRA, including rights relating to disputes, identity theft, and consumer reports.
E. Identity Theft Rights
Consumers who are victims of identity theft may have additional rights under the FCRA, including rights concerning fraudulent information and related blocking procedures.
F. Adverse Action Rights
When a consumer report contributes to an adverse action by a user of the report, the user may have obligations to provide the consumer with an adverse-action notice and certain information concerning the consumer-reporting agency and the consumer's rights.
These obligations generally apply to the user of the consumer report and are not necessarily satisfied by this Privacy Policy.
8. REQUESTING YOUR KORACONNECT CONSUMER FILE
If you believe KoraConnect maintains a consumer report concerning you and you would like to request a copy of your consumer file or exercise an FCRA right, contact:
Kora Financial Inc.
Attn: Consumer Reporting / Privacy
500 W. Madison Street, Suite 1000B
Chicago, IL 60661
Email: privacy@koramoney.com
Additional authentication and identity-verification information may be required before Kora provides consumer-report information.
Kora will process qualifying requests in accordance with the FCRA and other applicable law.
9. DISPUTES CONCERNING CONSUMER-REPORT INFORMATION
If you believe information contained in a KoraConnect consumer report is inaccurate or incomplete, you may submit a dispute to Kora.
Your dispute should identify:
- the information you believe is inaccurate or incomplete;
- the reason you believe the information is inaccurate or incomplete;
- the specific change you are requesting; and
- supporting documentation, if available.
Kora may request additional information reasonably necessary to investigate the dispute.
Kora maintains procedures designed to conduct reasonable investigations of qualifying disputes and to update, correct, delete, or otherwise address information as required by applicable law.
For more information concerning how to submit a dispute, please contact Kora at privacy@koramoney.com.
10. INFORMATION WE SHARE
We may disclose information to the following categories of recipients, subject to applicable law:
Service Providers
We may disclose information to vendors and service providers that perform services on our behalf, including:
- technology providers;
- cloud-service providers;
- data-processing providers;
- identity-verification providers;
- fraud-prevention providers;
- customer-support providers;
- analytics providers;
- information-security providers;
- professional advisors; and
- other service providers necessary to operate our business.
Service providers are required to use information in accordance with applicable contractual restrictions and applicable law.
KoraConnect Subscribers
Kora may furnish consumer reports to authorized KoraConnect subscribers where the subscriber has a permissible purpose under the FCRA and otherwise satisfies applicable requirements.
Business Partners
We may disclose information to business partners where permitted by law and necessary to provide products or services, operate our business, prevent fraud, or perform other authorized functions.
Legal and Regulatory Authorities
We may disclose information when required or permitted by law, including in response to:
- subpoenas;
- court orders;
- regulatory requests;
- law-enforcement requests;
- legal process; or
- other lawful governmental requests.
Corporate Transactions
Information may be disclosed in connection with a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar transaction, subject to applicable law and contractual requirements.
11. RESTRICTIONS ON CONSUMER-REPORT INFORMATION
Consumer-report information is subject to heightened restrictions.
Kora does not authorize subscribers, vendors, employees, contractors, or other parties to:
- obtain consumer reports without a permissible purpose;
- use consumer reports for a purpose other than the purpose for which they were obtained;
- resell consumer reports except as permitted by applicable law;
- disclose consumer reports to unauthorized persons;
- use consumer reports to make decisions unrelated to the permissible purpose;
- attempt to circumvent Kora's access controls;
- retain consumer-report information longer than permitted by applicable law or contractual requirements; or
- use consumer-report information in a manner prohibited by the FCRA or other applicable law.
Kora maintains controls intended to detect and address unauthorized access and use.
12. AGGREGATED, DE-IDENTIFIED, AND ANONYMIZED DATA
Kora may transform information into aggregated, de-identified, or anonymized information and may use, retain, disclose, and share such information for any purpose permitted under applicable law, including:
- product development;
- research;
- statistical analysis;
- benchmarking;
- model development;
- model validation;
- fraud detection;
- cybersecurity;
- product testing;
- quality assurance;
- service optimization;
- business analytics; and
- development, training, testing, evaluation, and deployment of AI and machine-learning systems.
Kora may share such information with service providers, business partners, customers, researchers, or other parties when permitted by law.
Kora will maintain reasonable controls intended to prevent the resulting information from being reasonably associated with an identifiable consumer.
If information has been properly de-identified or anonymized, Kora may retain and use it after deletion or account closure to the extent permitted by applicable law.
13. ARTIFICIAL INTELLIGENCE AND MACHINE LEARNING
Kora uses and may continue to use artificial intelligence, machine learning, statistical modeling, automation, and related technologies in connection with its products, services, operations, research, analytics, fraud prevention, risk management, and product development.
Kora may use aggregated, de-identified, or anonymized information to develop, train, test, validate, evaluate, improve, maintain, and deploy AI systems, machine-learning models, statistical models, algorithms, and other automated technologies, for any purpose permitted under applicable law.
These activities may include developing new products, services, features, technologies, analytical capabilities, models, and other offerings that Kora may develop now or in the future.
Kora may also use aggregated, de-identified, or anonymized information to create datasets, model inputs, model outputs, statistical analyses, insights, benchmarks, synthetic data, and other information used in connection with AI and machine-learning development.
Kora may provide aggregated, de-identified, or anonymized information to service providers, technology providers, business partners, affiliates, customers, subscribers, researchers, and other authorized parties for purposes including AI and machine-learning development, training, testing, validation, evaluation, deployment, and improvement.
Kora's use of information in connection with AI and machine learning remains subject to applicable law, including laws governing consumer reporting, privacy, data security, discrimination, and automated decision-making.
Where information has been properly aggregated, de-identified, or anonymized so that it is not reasonably capable of being associated with or used to identify an individual consumer, Kora may use such information for the purposes described in this Policy without obtaining additional consumer consent, except where additional consent is required by applicable law.
Nothing in this Section creates a permissible purpose under the FCRA or authorizes Kora to furnish or disclose an identifiable consumer report for a purpose not permitted by the FCRA.
14. DATA SECURITY
Kora maintains administrative, technical, and physical safeguards designed to protect information against unauthorized access, acquisition, use, disclosure, alteration, destruction, or loss.
These safeguards may include:
- access controls;
- authentication requirements;
- encryption;
- network security controls;
- logging and monitoring;
- vulnerability management;
- incident-response procedures;
- employee training;
- vendor-management controls;
- data-classification requirements;
- data-retention controls; and
- secure disposal procedures.
Because no security system can guarantee absolute security, Kora cannot guarantee that information will never be accessed, disclosed, altered, or destroyed in violation of our safeguards.
15. RETENTION OF INFORMATION
Kora retains information for periods reasonably necessary to:
- provide products and services;
- fulfill the purposes for which information was collected;
- satisfy legal and regulatory requirements;
- maintain records required by law;
- resolve disputes;
- enforce agreements;
- prevent fraud;
- protect security;
- maintain business records; and
- fulfill FCRA and other consumer-reporting obligations.
Retention periods may vary based on the type of information and the purpose for which it is maintained.
Kora may retain information beyond the closure of an account where retention is required or permitted by law.
Information that has been aggregated, de-identified, or anonymized so that it is not reasonably capable of identifying an individual may be retained and used for permitted purposes.
16. SECURE DISPOSAL
Kora maintains procedures designed to securely dispose of consumer-report information and other sensitive personal information when retention is no longer required or permitted.
Consumer-report information will be disposed of using reasonable measures designed to prevent unauthorized access to or use of the information.
The FCRA Disposal Rule requires covered entities to take reasonable measures to protect against unauthorized access to or use of consumer-report information in connection with its disposal.
17. YOUR PRIVACY RIGHTS UNDER STATE LAW
Depending on where you reside, you may have additional privacy rights under applicable state law.
These rights may include, subject to statutory exceptions:
- the right to know what personal information is collected;
- the right to access personal information;
- the right to correct inaccurate personal information;
- the right to request deletion of personal information;
- the right to obtain certain information in a portable format;
- the right to opt out of certain sales or sharing of personal information;
- the right to opt out of certain targeted advertising;
- the right to limit certain uses of sensitive personal information; and
- the right not to receive discriminatory treatment for exercising applicable privacy rights.
Important FCRA Limitation
State privacy rights may be subject to exceptions for information maintained, used, or disclosed pursuant to federal law, including the FCRA, the GLBA, or other applicable financial-services laws.
A request to delete information does not necessarily require Kora to delete information that Kora is legally required or permitted to maintain, including information necessary to satisfy FCRA obligations, investigate disputes, maintain the integrity of consumer reports, prevent fraud, comply with legal obligations, or establish or defend legal claims.
Where applicable law provides a separate process for exercising rights relating to consumer reports, that process will apply.
18. CALIFORNIA PRIVACY RIGHTS
California residents may have rights under the California Consumer Privacy Act, as amended (“CCPA”), subject to applicable exemptions and exceptions.
Kora may collect categories of information including:
- identifiers;
- commercial information;
- financial information;
- internet or network activity;
- geolocation information, where applicable;
- professional or employment information;
- inferences derived from information; and
- other categories of personal information described by applicable law.
California residents may have rights to request access, correction, deletion, and other disclosures concerning their personal information, subject to applicable exceptions.
Certain information maintained by Kora may be subject to exemptions or exclusions under applicable law, including information governed by the FCRA or GLBA.
California residents may submit privacy requests by contacting:
Kora may be required to verify the identity of a person submitting a request before responding.
19. FINANCIAL PRIVACY
To the extent Kora is subject to the Gramm-Leach-Bliley Act and Regulation P, Kora will provide applicable privacy notices and honor applicable restrictions and consumer choices concerning the collection, use, and disclosure of nonpublic personal information.
The rights and disclosures applicable under Regulation P are separate from, and may supplement, the FCRA and other privacy rights described in this Policy. Regulation P requires covered financial institutions to provide consumers with information concerning their privacy practices and certain disclosures and opt-out rights.
Where a separate GLBA privacy notice applies to a particular Kora product or relationship, that notice will control with respect to the information and relationship covered by that notice.
20. COOKIES AND TRACKING TECHNOLOGIES
Kora may use cookies, pixels, tags, scripts, analytics tools, and similar technologies to:
- operate websites and applications;
- authenticate users;
- maintain security;
- remember preferences;
- understand how services are used;
- measure website performance;
- improve user experience; and
- analyze traffic and usage.
Kora may use third-party analytics providers, including tools that analyze interactions with Kora websites.
Where required by applicable law, Kora will provide appropriate notice and choice mechanisms concerning cookies and similar technologies.
21. SINGLE SIGN-ON
KoraConnect may permit users to authenticate using third-party identity providers such as Google or Microsoft.
When a user chooses this functionality, Kora may receive:
- name;
- email address; and
- a unique authentication identifier.
Kora uses such information to authenticate and administer the KoraConnect account.
Kora does not use Google or Microsoft account credentials to access the user's underlying account.
Third-party authentication providers maintain their own privacy practices, which are governed by their respective privacy policies.
22. CHILDREN'S PRIVACY
Kora's services are not directed to children under 13, and Kora does not knowingly collect personal information from children under 13 except where permitted by applicable law.
If Kora learns that it has collected personal information from a child under 13 in circumstances where collection was not permitted, Kora will take appropriate steps to delete the information.
23. THIRD-PARTY WEBSITES AND SERVICES
Kora's services may contain links to websites or services operated by third parties.
Kora is not responsible for the privacy practices of third parties that operate independently from Kora.
Consumers should review the applicable third party's privacy policy before providing information.
24. DATA TRANSFERS
Kora may process and store information in the United States.
Where applicable law imposes requirements on cross-border transfers, Kora will implement appropriate safeguards.
25. BUSINESS TRANSFERS
If Kora participates in a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or other corporate transaction, information may be transferred as part of that transaction, subject to applicable legal and contractual restrictions.
Consumer-report information will remain subject to applicable FCRA requirements following any such transaction.
26. CHANGES TO THIS PRIVACY POLICY
Kora may update this Privacy Policy periodically to reflect changes in our services, technology, legal requirements, or privacy practices.
When we make material changes, we may provide additional notice as required by applicable law.
The revised Policy will identify the updated effective date.
27. CONTACT US
If you have questions regarding this Privacy Policy, Kora's privacy practices, or your privacy rights, contact:
Kora Financial Inc.
Attn: Privacy / Consumer Reporting
500 W. Madison Street, Suite 1000B
Chicago, IL 60661
Email: privacy@koramoney.com
For matters specifically concerning a KoraConnect consumer report, including requests for a consumer file or disputes regarding information contained in a consumer report, please identify your request as a “KoraConnect Consumer Reporting Request.”
28. IMPORTANT NOTICE REGARDING CONSUMER REPORTS
KoraConnect consumer reports are governed by the Fair Credit Reporting Act and applicable state consumer-reporting laws.
The FCRA is designed, among other things, to protect the privacy and accuracy of information maintained by consumer reporting agencies. Consumer reports may not be furnished to persons who do not have a permissible purpose under the FCRA, and users of consumer reports must comply with applicable restrictions on obtaining and using such reports.
Nothing in this Privacy Policy:
- creates a permissible purpose under the FCRA;
- authorizes a subscriber to obtain a consumer report without a permissible purpose;
- waives a consumer's rights under the FCRA;
- eliminates Kora's obligations as a consumer reporting agency;
- authorizes the unrestricted use of consumer-report information for advertising or unrelated commercial purposes; or
- authorizes the use of identifiable consumer-report information for AI or machine-learning development where prohibited by applicable law.
Effective Date: September 1, 2026