Privacy Notice

Tbili is operated by LIKE A KING INC., a New York corporation ("Tbili," "we," "us"). For purposes of the laws that distinguish them, we are the "business" or "controller" for the personal information described in this Notice, except for financial and identity information that our Payment Partner collects for itself as a licensed provider, for which the Payment Partner is an independent business or controller.

This Notice applies to the Tbili website at tbilipay.com, the Tbili app, the waitlist, and related communications. It is part of the Agreement described in our Terms of Service. Terms in capitals that are not defined here have the meaning given in the Terms.

Contact. We communicate only through the contact form at tbilipay.com/contact. We do not publish an email address, telephone number or street address.

The categories below describe what we collect, depending on how you use the Service.

Identity verification. The Payment Partner collects and verifies identity information under the Bank Secrecy Act and other laws. We may receive the outcome of verification (for example approved, declined or pending) and limited reference data, but we do not store your identity documents.

Sensitive information. Some of the information above, such as government identification numbers and account log-in credentials in combination with a password, is "sensitive personal information" under some laws. We use it only to provide the Service, to meet legal duties, and to protect security and prevent fraud. We do not use it to infer characteristics about you.

We do not collect precise geolocation, biometric identifiers, audio, video or the contents of your contacts. We do not record calls.

We use personal information to:

• create and maintain your Account and authenticate you;
• operate Personal Transfers and Contractor payments with the Payment Partner, and show you status and receipts;
• provide Business Plans, manage trials and subscriptions, and process payment through Stripe;
• display indicative exchange rates;
• send transactional messages, such as transfer status, receipts, security alerts and billing notices;
• respond to contact form messages, privacy requests and support needs;
• detect, investigate and prevent fraud, abuse and security incidents, and enforce the Terms;
• comply with law, including sanctions, anti-money laundering and recordkeeping duties, and respond to lawful requests;
• understand how the Service is used, using first-party page counts, in order to maintain and improve it; and
• manage the waitlist and tell you when the Service becomes available.

We do not use your information to make decisions that produce legal or similarly significant effects through automated profiling, and we do not use your Content to train artificial intelligence models.

Where laws such as the GDPR or the UK GDPR apply to a person, we rely on the following legal bases.

Where we rely on consent, you can withdraw it at any time without affecting earlier processing.

We share personal information only with the following categories of recipients, as needed for the stated purposes. We do not sell personal information.

We may also disclose information with your direction or consent, with a service provider acting only on our instructions, and as needed to detect fraud or protect safety.

If you are a Business User, information about your Contractors is disclosed to the Payment Partner so that payments can be made. We do not give Contractor details to anyone else.

Financial institutions must give notice of how they handle nonpublic personal information under the Gramm-Leach-Bliley Act (GLBA). Tbili is software and is not itself a financial institution for Transfers. The financial and identity information collected to carry out Transfers is handled by the Payment Partner, which provides its own GLBA privacy notice. That notice tells you how the Payment Partner shares your information and what choices you have. Please read it when you set up a Transfer.

To the extent GLBA or a state financial privacy law applies to information we hold, those laws govern in place of any inconsistent term of this Notice.

We do not sell personal information for money or other valuable consideration, and we do not share personal information for cross-context behavioral advertising. We have not done so in the past 12 months.

We do not knowingly sell or share personal information of consumers under 16.

We honor the Global Privacy Control (GPC) browser signal and similar opt-out preference signals as a valid request to opt out of sale and sharing. Because we do not sell or share, there is nothing further to opt out of, but we treat the signal as honored. We also respect the Do Not Track setting by not tracking you across other sites.

We do not use or disclose sensitive personal information for purposes other than those permitted by the California Consumer Privacy Act and its regulations.

We keep personal information for as long as needed for the purposes in this Notice and as the law requires, and then delete or de-identify it. Periods vary with the circumstances, including legal holds. The schedule below is our standard.

We may keep information longer where needed to resolve disputes, enforce agreements, comply with a legal hold or prevent fraud.

We use only essential cookies (for sign-in sessions, security and your preferences). We do not use advertising or cross-site tracking cookies or pixels. Our analytics are first-party and cookieless: they count page views and do not build profiles of individuals. Details are on our Cookies page.

Depending on where you live, you may have the rights below. We offer them to all users in the United States, whether or not a specific state law requires it.

• Know and access: to know what personal information we collect, use and disclose, and to receive a copy;
• Correct: to correct inaccurate information;
• Delete: to ask us to delete personal information, subject to exceptions for legal duties, security and disputes;
• Portability: to receive information in a portable format;
• Opt out: of sale, sharing, targeted advertising and certain profiling (we do none of these);
• Limit: the use of sensitive personal information (we use it only for permitted purposes);
• Non-discrimination: not to be treated differently for exercising a right;
• Appeal: to appeal a decision on your request.

How to exercise. Submit a request through the contact form and choose the topic "Privacy request." Tell us which right you want to use and give the name and email address on your Account, so that we can match your request. We will confirm receipt within 10 business days and respond within 45 days, and may extend by a further 45 days where permitted by law, with notice to you.

Verification. We verify requests by matching the information you give with the information in your Account, and we may ask for more where needed to protect you. We do not require an Account to make a request, and we will not ask for identity documents unless necessary for a sensitive request.

Authorized agents. You may use an authorized agent to make a request. The agent must provide written permission from you, and we may ask you to verify your identity directly with us.

Appeal. If we decline your request, you may appeal by using the contact form with the topic "Privacy request" and the word "Appeal" at the start of your message. We will respond in writing within 45 days (60 days in some states), with an explanation. If the appeal is denied, you may contact your state attorney general, and we will give you the details in our response.

Information held by the Payment Partner or Stripe is subject to their processes, and we will help you reach them. Some information we must keep by law.

This section is our notice at collection and privacy policy under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and the California Online Privacy Protection Act (CalOPPA).

Sources, purposes and recipients are described in Sections 2, 3 and 5 above. Retention is described in Section 8.

Shine the Light. California Civil Code Section 1798.83 permits California residents to ask a business that shares personal information with third parties for their direct marketing purposes for details of those disclosures. We do not share personal information with third parties for their direct marketing purposes. You may confirm this by contacting us through the contact form.

Do Not Track. We do not track you across other sites, so we do not respond to a Do Not Track signal in a different way.

California minors. If you are under 18 you may not use the Service.

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states with comprehensive privacy laws may have rights to access, correct, delete and obtain a copy of their personal information, to opt out of targeted advertising, sale and certain profiling, and to appeal. We treat the rights in Section 10 as available to residents of every state. We do not process personal data for targeted advertising or sale, and we do not profile in furtherance of decisions with legal or similarly significant effects.

Nevada residents may opt out of the sale of certain information. We do not sell information as defined by Nevada law.

Washington, Nevada and some other states have consumer health data laws. We do not collect consumer health data.

If the GDPR, the UK GDPR or a similar law applies to you, you also have the right to access, rectify, erase, restrict or object to processing, to data portability, to withdraw consent, and to lodge a complaint with your data protection authority. Use the contact form to exercise those rights.

The Service is intended for US residents. We do not target the Service to people in the European Union or the United Kingdom, but we apply these rights to visitors who contact us from there.

Our servers are in data centers in Germany, in the European Union, operated for us, and hold data of US users. Personal information of US users is therefore processed in the European Union. Transfers to Recipients abroad, by their nature, send Recipient information to the receiving country through the Payment Partner and banks.

Where we transfer personal information across borders, we apply safeguards such as contractual protections with our providers, encryption in transit and access controls.

We use administrative, technical and physical safeguards that are appropriate to the sensitivity of the information, including encryption in transit, access controls, separation of duties, logging and monitoring. No system is perfectly secure, and we cannot promise absolute security.

You help protect your Account by choosing a strong password, keeping credentials private, and telling us promptly through the contact form if you suspect unauthorized access.

If a security breach affects your personal information, we will notify you and the authorities as required by law, including New York General Business Law Section 899-aa and the breach laws of other states. Notice will be given without unreasonable delay and within the period that the law requires, by email to the address on your Account, or by a notice in the Service.

The Service is for people who are at least 18 years old. We do not knowingly collect personal information from anyone under 18, and we do not collect any information from children under 13. If we learn that we have collected information from someone under 18, we will delete it. If you believe a minor has given us information, contact us through the contact form.

Identity verification and transaction screening by the Payment Partner may involve automated checks. A person reviews any result that blocks a user where the Payment Partner's process provides for it. We do not make other automated decisions with legal or similarly significant effects.

We may update this Notice. We will post the new version with an updated date. For a material change, we will give you notice by email or in the Service before it takes effect, and where the law requires, we will ask for your consent.

Use the contact form at tbilipay.com/contact. Choose the topic "Privacy request" for any request or question under this Notice. LIKE A KING INC., New York, is the entity responsible for this Notice.