Last Updated / Effective Date: August 11, 2026

Table of Contents

  1. We Collect Personal Information
  2. Types of Personal Information We May Collect
  3. How We Use Personal Information
  4. How We Disclose Personal Information
  5. Sales or Sharing of Personal Information
  6. Retention of Personal Information
  7. Children’s Privacy
  8. Links to Third-Party Websites
  9. Information Security
  10. Cookies and Similar Technology
  11. Your Marketing Preferences
  12. Privacy Rights
  13. Use of Automated Decisionmaking Technology / Profiling
  14. Updates to the Policy
  15. Contact Us

This (“Policy”) describes how Katapult Holdings, Inc.; including our affiliates and corporate entities listed here, as well as our service providers, agents, or other third parties acting on our behalf (collectively “Company,” “we,” “our,” or “us”); collects, uses, and discloses information when a person interacts with us online or offline, such as visiting one of our locations, obtaining one of our products or services, using any of our websites or our mobile applications that link to this Policy, or otherwise interacting with us in a personal or business capacity (collectively, “Services”). This Policy describes the types of information we collect, how we use and disclose that information, how we protect that information, choices regarding that information, and how to contact us with any questions.

If you apply for or obtain a financial product or service from us, we will collect, use, and disclose any information that we collect from or about you in connection with that financial product or service in accordance with our financial privacy notice available here, which offers you certain choices with respect to the use and disclosure of your nonpublic personal financial information.

Our Services are intended solely for users in the United States and Canada. If you are located outside of the United States and Canada and are accessing our Services, your personal information as described in this Policy will be processed and stored in the United States, and the laws in the United States may not be as protective of personal information as laws in your resident country. If you do not agree with the processing of your personal information in the United States, or you do not otherwise accept this Policy or any terms applicable to the Services, please discontinue your use of the Services.

  1. How We Collect Personal Information

For purposes of this Policy, personal information means information that identifies a particular individual.

We may collect personal information from the following categories of sources:

  • From you. We may collect personal information and other information that you provide to us directly, such as when you visit one of our locations (e.g., if you interact with one of our sales representatives or use in-store technology), apply for or obtain one of our Services or otherwise enter into a transaction or contractual agreement with us, sign up for our newsletters, create an online account, join one of our membership programs, fill out a form to contact us, interact with our chatbot or otherwise communicate with us, enroll in automatic payments, visit our social media pages, call us, enter a promotion, have a business relationship with us, participate in one of our events, are referred to us from a third party, or otherwise use our Services or interact with us.
  • Automatically when you interact with us online. Certain information may be collected from you automatically when you access and use the Services online. For example, we and third parties may use tracking technologies, such as cookies, web beacons, web server logs, or other technologies to collect or store usage information based on your device identifier. This information may be stored or accessed using a variety of technologies when you interact with the Services.  
  • From third parties and publicly available sources. We may collect personal information from third parties, such as credit bureaus, credit reporting service providers, lead providers, data brokers, advertising networks, social media platforms, data analytics providers, or identity verification services; our affiliates; or public sources, including, but not limited to, websites that enable social sharing, social media sites, or third-party websites. If you provide personal information to us regarding others, we rely on you to obtain their consent to disclose their personal information to us and inform them about our privacy practices, including how they may contact us.
  1. Types of Personal Information We May Collect

We may collect the following categories of personal information:

  • Identifiers, such as a real name, alias, home address, work address, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers, or similar technologies; customer number, unique pseudonym, or user alias; telephone number or other forms of persistent or probabilistic identifiers), online identifier, IP address, email address, account name, Social Security number, signature, physical characteristics or description, state identification card number, financial account numbers, or other similar identifiers.
  • Biographic and demographic information, such as date of birth, age, gender, photo, disability status, or veteran or military status, citizenship status, some of which may be characteristics of protected classifications under applicable law.
  • Financial and payment information, such as credit card details, financial account information, or information about income, assets, credit history, or payment preferences. For loan applications, we may collect additional financial information such as primary source of income, pay frequency, use of direct deposit, date of most recent paycheck, or other primary income payment information or estimated monthly or pay period expenses.
  • Commercial information, such as records of personal property (for example, vehicle information if used to secure a loan); products and Services purchased, obtained, or considered; payment histories, receipts, or balances in connection with Services; or other purchasing or consuming histories or tendencies.
  • Account information, such as a user name and password, profile details, or feedback and reviews about our Services.
  • Internet and other electronic network activity information, such as information we collect when a person accesses and interacts with our Services, including browser or device model and settings, operating system, UDID or other unique identifiers related to a device, device characteristics, hardware information, clickstream data and information about preferences, cookies and localStorage, browsing history, search history, web-based location, IP address, browser information, mobile network information, or any other Internet usage information our Services may automatically record when you visit. For more information about cookies and similar technologies, please refer to the “Cookies and Similar Technologies” section below.
  • Geolocation, including general location information (e.g., IP address, city/state, or postal code associated with an IP address) and precise geolocation information from devices enabled with location-based services.
  • Biometric information, such as faceprints or fingerprints.
  • Professional information, such as information about job function and role, title, professional affiliations, employer, employment history, or any other information that may be obtained from third-party background checks and feedback.
  • Educational information, such as institutions attended or degrees conferred.
  • Audio, visual, electronic, and similar information, such as CCTV footage at our physical locations or call recordings of telephone communications.
  • Other personal information you provide, such as the content in your communications with us online, in-person, or on the telephone.
  • Inferences, which are drawn from any of the personal information identified above to create a profile, for example, reflecting preferences.
  • Sensitive personal information, such as Social Security number, driver’s license number, passport number, other government-issued identification number, account log-in credentials, precise geolocation, biometric information, racial or ethnic origin, citizenship or immigration status, medical history or condition, or status as a victim of crime. 
  1. How We Use Personal Information

We may use personal information for the following reasons:

  • To provide our products and Services, including to verify identity, determine eligibility to enter into a transaction, process payments, or fulfill and track purchases and other transactions.
  • To enforce contractual and payment obligations, including repossessing items for accounts in default and collecting fees and account balances.
  • To deliver communications, such as when responding to inquiries and sending other communications, including our newsletter; regarding our products and Services; about an application for Services; use of our “click-to-chat” or equivalent functionality for customer service purposes; or promotions offered, such as sweepstakes, contests, special events, or other events. This may also include when we send administrative e-mail notifications, such as security or support and maintenance advisories.
  • To market products and Services, including to serve targeted advertising or content.
  • To send news and/or marketing communications (by email, phone, text, or mail) subject to marketing preferences and choices, including information about us or third-party offerings we think may be of interest to recipients.
  • To understand interactions with our Services and personalize product and Services experiences and content (including advertising and messaging campaigns), including remembering preferences and creating profiles based on personal information.
  • To provide location-based services, such as delivering relevant content and ads based on location.
  • To obtain information about credit history from consumer reporting agencies to process an application for Services, market products and Services, service accounts, or prevent fraud and illegal activity.
  • To enable participation in surveys or other research efforts.
  • To conduct market research and develop quality assurance, including to study, develop, and improve our products and Services. This may include measuring and analyzing audience traffic, including tracking user interests, trends, and patterns.
  • To provide, maintain, and develop our products and Services, including to maintain our websites, troubleshoot, provide customer and technical support, conduct data analysis, testing, and research to better understand the interests of our customers, stores, and website visitors who use our products and Services.
  • To maintain the safety, security, and integrity of our Services, for example, by authenticating users and providing account security and fraud detection. We may also use information to monitor, detect, and prevent fraud and improper or illegal activity.
  • To secure and debug our systems and Services, including our network, websites, and information technology infrastructure.
  • To comply with legal or contractual obligations, protect our rights or the rights of others, and/or to investigate or address claims or disputes relating to the use of our Services. This may include the use of information to comply with legal and regulatory requirements, to defend ourselves in litigation and investigations, or to prosecute litigation.
  • To evaluate or maintain our business relationships if associated with one of our service providers, collaborators, or other business partners.
  • For our other internal business purposes not otherwise prohibited by applicable law.

We may use sensitive personal information for the following purposes:

  • To provide our products or Services that you request;
  • To prevent, detect, and investigate security incidents;
  • To resist malicious, deceptive, fraudulent, or illegal actions directed at us or at consumers, or to prosecute those responsible for those actions;
  • To ensure the physical safety of natural persons;
  • For short-term, transient uses as part of any current interaction with you;
  • To support the Services, such as maintaining or servicing accounts or providing customer service;
  • To verify or maintain the quality or safety of our products or Services, and to improve, upgrade, or enhance our Services;
  • For other purposes that do not involve inferring characteristics about individuals.

We do not use or disclose sensitive personal information for any other purposes not described above unless permitted by applicable law.  We do not collect or process sensitive personal information for the purpose of inferring characteristics about individuals.

We may also aggregate, anonymize, and/or de-identify personal information that we collect for use with any above-described purpose, including product development and improvement activities. We will not attempt to re-identify any data that has been aggregated, anonymized, or de-identified and will contractually obligate any recipients of such aggregated, anonymized, or de-identified information also not to attempt to re-identify the data.

We do not collect, use, or sell personal information for the purpose of training large language models.

  1. How We Disclose Personal Information

We may disclose some or all of the personal information collected from or about you to any of the following entities and for any of the following purposes:

  • Merchants and retailers. We may provide personal information to merchants, retailers, and other partners in connection with the Services.
  • Service providers and other third parties providing services to us. We may provide personal information to service providers and other third parties that provide services to us or act on our behalf, such as: (i) assisting us in the operation of the Services; (ii) managing customer information databases and performing administrative services; (iii) hosting the Services or providing other information technology support; (iv) designing and/or operating the Services’ features; (v) tracking and analyzing use of the Services; (vi) sending promotional materials about products or Services (including special offers and promotions); (vii) payment processing, loan servicing providers, debt collectors, and other parties involved in processing Services or other transactions; or (viii) providing consumer reports or other information about you.
  • Professional services providers. We may provide personal information to professional services providers, such as auditors and law firms, who provide services related to the operation of our business.
  • Government, regulatory, or law enforcement agencies or other third parties for legal purposes. We reserve the right to disclose personal information in response to valid information requests from government authorities and judicial requests, to investigate potential fraud, or where otherwise required by law. We may disclose personal information where we believe the disclosure is necessary or appropriate to comply with legal or regulatory requirements.
  • In connection with protecting our rights or the rights of others. We may disclose personal information to third parties to protect the safety, rights, or property of ourselves and others or to exercise, establish, or defend our legal rights, including detecting, preventing, or otherwise addressing fraud, security, or technical issues and investigating potential violations of and enforcing our Terms of Use, agreements, or other policies.
  • In connection with a merger, acquisition, or business transfer. We may disclose personal information to third parties in connection with a proposed or actual sale of all or a part of our company, merger, consolidation, restructuring, sale of company stock, and/or sale of assets or other corporate change.
  • At your direction. We may disclose personal information at your direction or with your consent. For example, you may be presented with an option to receive certain information and/or marketing offers directly from third parties or to have us send certain information to third parties or give them access to information at your request.
  • With notice, and if applicable, your consent. We may disclose personal information to other third parties in accordance with any notice provided to you at the time we collect it and, if applicable, with your consent.
  • Affiliates, subsidiaries, divisions, and franchisees. We may disclose personal information to our affiliates, subsidiaries, other related divisions, franchisees, or other members of our corporate family.
  • Advertising or marketing providers and collaborators. We may disclose personal information to third parties, such as advertising or marketing partners or third-party collaborators with whom we jointly develop or promote our Services or other products, who may provide marketing communications to you, including special offers, sponsorships and co-branded opportunities, communications related to our loyalty programs, or promotions.
  • General public. We may disclose personal information to the general public if you choose to interact with us publicly, such as on forums, blogs, or social media, or if you include personal information in reviews or other content you contribute to the Services.
  • Business purposes. We may disclose personal information to other third parties as appropriate to further any of our other legitimate business purposes unless otherwise prohibited by applicable law.
  • Aggregate or anonymous data. We may disclose information in an aggregated, de-identified, or anonymized form to any third parties as appropriate.

Any personal information collected through a short code/SMS program for servicing purposes, including mobile numbers, SMS consent, or message data will not be shared, sold, or rented to unaffiliated or affiliated third parties for their own marketing or promotional purposes. We may share this information only with service providers (e.g., carriers, messaging platforms) to operate our SMS program. Message frequency may vary. Message and data rates may apply. Reply STOP to cancel texts; HELP for help.

  1. Sales or Sharing of Personal Information

We do not sell personal information in exchange for monetary compensation. We may share (as such term is defined under applicable law) personal information by allowing certain third parties, such as online advertising services, to collect personal information via automated technologies on our websites and mobile apps for cross-context behavioral advertising purposes.

We may share for cross-context behavioral advertising purposes (and may have shared during the preceding 12-month period) the following categories of personal information with ad tech companies, online advertising services, collaborators, and other advertising or marketing partners:

  • Identifiers
  • Protected characteristics
  • Commercial information
  • Online activity
  • Sensory information
  • Inferences

We do not have actual knowledge of any sale or sharing of the personal information of minors under 16 years of age.

You may have the right to opt out of the sharing of personal information as detailed in the “Privacy Rights” section.

  1. Retention of Personal Information

We will retain personal information from or about you as reasonably necessary and proportionate to achieve the purpose(s) for which the personal information was collected or processed, unless a longer retention period is required or allowed by law.

  1. Children’s Privacy

You must be 18 years or older to use our Services. Our Services are for a general audience, but we do not direct any of our Services to children. We do not knowingly collect personal information from children under 18 years of age. If you believe that we may have collected the personal information of a child, please contact us.

We may provide links to websites and other third-party content (e.g., social media platforms) that are not owned or operated by us. These websites and third-party content may have privacy practices that differ from this Policy. If you provide any personal information through a third-party website or other third-party content, your interaction with such third party and your personal information will be collected by and controlled by the privacy policy of that third party. We recommend that you familiarize yourself with the privacy policies and practices of any such third parties, which are not governed by this Policy. We are not responsible for the privacy practices of these third parties.

  1. Information Security

We use commercially reasonable administrative, technical, and physical measures designed to safeguard personal information against loss, theft, unauthorized use, disclosure, or modification. However, the confidentiality of information transmitted over the Internet cannot be guaranteed. We urge you to exercise caution when transmitting personal information over the Internet. WE CANNOT GUARANTEE THAT UNAUTHORIZED THIRD PARTIES WILL NOT GAIN ACCESS TO YOUR INFORMATION; THEREFORE, WHEN SUBMITTING PERSONAL INFORMATION TO US, YOU DO SO AT YOUR OWN RISK.

It is our policy to protect the confidentiality of Social Security numbers in our possession from misuse and improper disclosure by maintaining and enforcing policies and physical and electronic safeguards against misuse and improper disclosure. Our internal policies prohibit unlawful disclosure of Social Security numbers, and we maintain measures designed to limit access to Social Security numbers to personnel who need access to such information in order to perform their job functions.

  1. Cookies and Similar Technology

We and our partners use various technologies, including cookies, web beacons, web server logs, pixels, localStorage, and other similar technologies, to automatically collect data when you visit or interact with our Services. Some of these technologies store data in the browser or on your device. Other technologies may use network-related or other information to recognize your device (e.g., IP address). Our Services use these technologies, for example, when you first request a web page; data is then stored on your device and accessed when you make subsequent requests for pages from that Service. These technologies may also be used to collect and store information about your usage of the Services, such as pages you have visited, content you viewed, and search history. Additionally, we may use these technologies to collect analytics and measure the use of our Services. The use of these technologies helps us serve you better by understanding what you are interested in, tracking trends, measuring the effectiveness of ads, saving your preferences, and storing information you may want to retrieve on a regular basis.

We and our partners may collect personal information about your online activities over time and across different websites when you use the Services. For example, one of the third-party analytics services we use is Google Analytics. For more information about Google Analytics, you may go to www.google.com/policies/privacy/partners/. To opt out of Google Analytics, you may go to https://tools.google.com/dlpage/gaoptout

We and our third-party advertising partners, social media providers, and analytics providers may also use these technologies to collect personal information about how you view and use our Services and content to connect your activity with other data we store about you or your online activity on third-party websites to serve you interest-based advertising. To learn how to opt out of interest-based advertising, you may go to: https://optout.aboutads.info/, http://preferences-mgr.truste.com, or https://www.networkadvertising.org/choices. Please note that if you opt out, you may continue to receive generic ads that are not based on your preferences.

You can control certain tracking technologies, such as cookies, through your browser settings. If your browser is set to reject cookies, websites that are cookie-enabled will not recognize you when you return to the website, and some website functionality may be lost. You may also be able to use device settings to opt out of the use of certain device IDs for targeted advertising.

Some browsers permit users to send a “Do Not Track” (“DNT”) preference to websites that the user visits indicating that the user does not wish to be tracked over time and across websites. We do not currently respond to the DNT signal. We do, however, respond to opt-out preference signals when required by applicable law.

  1. Your Marketing Preferences

We may periodically send promotional materials or notifications. If you no longer wish to receive promotional marketing materials from us, you may opt out of receiving such materials. We will work to comply with requests promptly.

You may unsubscribe from receiving marketing or other commercial emails from us by following the instructions included in the email.

By opting in to receive SMS text messages, you expressly agree to receive, from us, SMS text messages (which may be auto-dialed, pre-recorded, or promotional) to the mobile number you provided, even if the phone number is on a Do Not Call List. You may unsubscribe from SMS text messages you previously consented to by following the instructions provided in our messages.

There are certain service notifications and other non-promotional emails that you may not opt out of, such as notifications of changes to our Services, policies, or other information about your orders, such as shipping information.

  1. Privacy Rights

Depending on where you reside, you may have the following rights with respect to the processing of your personal information.

  • Know and access: You may have the right to confirm whether we are processing personal information about you and to know what personal information we have collected about you, including the categories of personal information; the categories of sources from which the personal information is collected; the business or commercial purpose for collecting, selling, or sharing personal information; the categories of or specific third parties to whom we disclose or sell your personal information; and the specific pieces of personal information we have collected about you.
  • Correction: You have a right to request that we correct inaccurate personal information that we may have about you.
  • Deletion: You may have the right to request that we delete the personal information we have collected, subject to certain exceptions.
  • Opt out of “sales”, “shares”, and targeted advertising: You may have the right to opt out of the “sale” of your data and/or the “sharing” (as defined under California law) of your data for cross-context behavioral advertising or targeted advertising. We also honor opt-out preference signals, such as the Global Privacy Control. We process opt-out preference signals in a frictionless manner. Please note that we do not sell personal information for monetary consideration. To make a request to opt out of the “sale” and/or “sharing” of your data for cross-context behavioral advertising or targeted advertising
  • Profiling and automated decisionmaking: You may have the right to confirm whether we process personal information for the purposes of profiling to make a decision that produces any legal or similarly significant effect and to opt out of profiling or use of automated decisionmaking technologies. You may also have the right to access information about how we use profiling or automated decisionmaking technologies, question or appeal the result of such profiling or use of automated decisionmaking technologies, be informed of the reason that such profiling or use of automated decisionmaking technologies resulted in such decision, and review the personal information that was processed for the purposes of such profiling or automated decisionmaking technologies.
  • Withdraw consent: You may have the right to withdraw your consent to our collection, use, and disclosure of your personal information in accordance with this Policy at any time, subject to certain legal restrictions and reasonable notice to us. Please be aware that if you withdraw your consent to the collection, use, and disclosure of your personal information, we may no longer be able to provide you with certain products or Services.
  • Non-discrimination: You may have the right to be free from unlawful discrimination or retaliation for exercising any of these privacy rights.
  • Appeal: You may have the right to request an appeal of an action we take in response to your request to exercise any of the above privacy rights.

In order to exercise a privacy right, please use the contact information below.

To the extent permitted by applicable law, we may charge a reasonable fee to comply with your requests.

To exercise your right to appeal an action in response to a prior request, please email us using the email address in the “Contact Us” section below.

To help protect your privacy and maintain security, for certain privacy rights, we may take steps to verify your identity before processing your request. If you have an online account with us, we may verify your identity by requiring you to sign in to your account. You are not required to create an online account, so if you do not have an online account with us, we may require you to verify your identity by providing us with your email address, telephone number, and/or information about your prior transactions with us (such as the amount, date, or other details about your last transaction). We will match this information against our business records to verify your identity.  Failure to verify your identity may result in your request not being processed.

Where required by applicable law, we will notify you if we deny your request and the reasons we are unable to honor your request.

Depending on where you reside, you may have the right to submit a request through an authorized agent or legal guardian. If you are an authorized agent or legal guardian acting on behalf of another individual, you must be able to demonstrate that you have the requisite authorization to act on behalf of the individual.

  1. Use of Automated Decisionmaking Technologies / Profiling

We may use certain types of automated processing to analyze your personal information in order to make decisions related to your requests or to provide our products and Services. This type of processing may involve “automated decisionmaking technologies” (“ADMT”) or “profiling” using artificial intelligence systems (“Profiling”) as defined under applicable laws or regulations. We may use the following types of ADMT or Profiling to make significant decisions about you:

  • Loan or lease eligibility and underwriting systems: To decide whether to approve your application(s) for our products or Services.
  • Pricing and termssetting systems: To help determine the interest rate, fees, credit limit, repayment term, or other key terms of your products or Services with us.
  • Identity verification and fraud detection systems: To help detect identity theft, fraud, or misuse of your accounts.
  • Servicing, repayment, and collections prioritization systems: To support how we service and manage your accounts.

The categories of personal information that may be processed by ADMT or Profiling include: Identifiers, Biographic and Demographic Information, Financial or Payment Information, Commercial Information, or Internet and Other Electronic Network Activity Information.   

These technologies generate different types of output, including:

  • Predictions and scores, such as likelihood of repayment, probability of default, risk of fraud or identity theft, or eligibility for a particular product or Service.
  • Classifications and tiers, such as application or account risk categories or servicing and collections priority levels.
  • Recommendations and proposed decisions, such as recommended approval or denial, recommended loan or lease amount, or recommended interest rate or fee range.
  • Flags and alerts, such as fraud or high-risk flags or alerts indicating unusual or suspicious patterns.

For some decisions (e.g., certain eligibility, underwriting, pricing, or fraud decisions), the output may be the primary or determining factor in the decision, subject to applicable legal or regulatory constraints. In other situations, the output may be one important factor among others, such as documentation you provide, regulatory requirements, and information from third-party providers. The outputs may also help guide servicing, repayment, and collections, for example by helping determine the timing and nature of outreach.

The logic used by ADMT or Profiling generally involves applying rules-based models, statistical models, machine-learning models, or other automated analytical techniques to personal information and other relevant data to evaluate factors such as application information, account history, transaction activity, identity verification, fraud indicators, payment behavior, and similar information. These systems may compare that information against pre-defined criteria, historical patterns, risk indicators, and business rules to generate scores, classifications, recommendations, flags, alerts, or proposed decisions. We may review, test, monitor, and update these systems over time to support accuracy, consistency, fairness, security, and compliance. Our use of ADMT and Profiling is essential to the provision of our products and Services. Depending on where you reside, you may also have the right to appeal ADMT or Profiling decisions or to request information about the use of ADMT or Profiling, as described in the “Privacy Rights” section. Please note that ADMT or Profiling provides benefits to our customers by offering more efficient and more timely business operations. If we use ADMT or Profiling and you would like a decision about you to be made without the use of ADMT or Profiling, you may opt out of the use of ADMT or Profiling by contacting us through the applicable methods listed below. 

If you opt out of ADMT or Profiling, our provision of our products and Services or other interactions with you may be delayed. If we do not use ADMT or Profiling, we will notify you of that fact after we after we receive your opt out request.

  1. Updates to the Policy

We may update this Policy from time to time. When we make changes to this Policy, we will notify you as required under applicable law, which may include by email or by posting the updated Policy with its effective date. Your continued use of the Services following the posting of any such changes will constitute your acceptance of such changes.

  1. Contact Us

If you have any questions or comments regarding our use of your personal information, your choices and rights regarding such use, or this Policy, please contact: