Client Central Privacy Policy

Effective date: October 12, 2026 • Version: 1.0

This Privacy Policy explains how Financial Gravity Companies, Inc. (“Financial Gravity,” “we,” “us,” or “our”) handles personal information in connection with Client Central, including registration, account access, documents, support, and sign-in verification texts. It covers the portal and its related operational communications.

Your investment adviser, custodian, insurer, or other financial institution may separately collect and use information under its own privacy notice and legal obligations. This Policy supplements those notices; it does not replace a required financial privacy notice, change an existing sharing election, or expand our authority to disclose information. Where a separate notice applies to your financial-service relationship, that notice continues to govern the information and activities it covers. Affiliate marketing is described below and remains subject to applicable notices, consents, and privacy elections. Viewing this Policy or accepting the Terms does not substitute for a consent required by law.

1. Information we collect

1.1 Depending on your relationship, permissions, and use of Client Central, personal information may include:

(a) Identity and contact information, such as your name, email, mobile number, account identifiers, and information needed to verify your identity or representative authority.

(b) Account and financial information, such as account ownership, household relationships, balances, holdings, transactions, performance, financial goals, planning inputs and results, risk profiles, and tax-related information displayed or provided through the portal.

(c) Documents and communications, including materials you upload, documents made available by your financial-service providers, support requests, correspondence about your account or portal access, and prompts, uploaded material, and responses exchanged with an AI feature you use.

(d) Authentication and consent records, such as registration records, verification-message activity, sign-in attempts, changes to contact information, and records of acceptance, consent, and withdrawal.

(e) Technical and usage information, such as internet protocol addresses, browser and device information, timestamps, session activity, errors, and security logs generated when you access the service.

1.2 We receive information from you and your authorized representatives; from your adviser, custodian, and other institutions involved in your authorized service relationship; from data-integration and other operational providers; and from the operation of Client Central. Financial information may originate in other Financial Gravity systems or institutional records before appearing in the portal. Information about another household member is not made available merely because you share a household or contact information.

2. How we use information

2.1 We use personal information to establish and administer authorized access; display account information and documents; provide planning summaries and communications; authenticate users and deliver requested verification codes; respond to support requests and correct records; maintain, troubleshoot, and secure the portal; prevent and investigate fraud or misuse; and satisfy recordkeeping, regulatory, and other legal obligations.

2.2 Information used to provide investment advice or other financial services remains subject to the agreement and privacy notice for that relationship. We may also use contact, relationship, and other information we are legally permitted to use to communicate about products and services offered by us and our affiliates, evaluate interest in those offerings, and administer permitted marketing activities, subject to applicable privacy notices, required consents, and opt-outs. We do not treat acceptance of this Policy as permission to send marketing texts.

2.3 If an AI feature is provided, we may process your inputs, the resulting outputs, relevant information the feature is authorized to access, and technical records to provide and support that feature, maintain security, and satisfy legal obligations. Authorized personnel and service providers may review these records for those purposes. The restrictions in Section 16 of the Terms of Service apply; this Policy does not authorize general-purpose model training or a use unrelated to the disclosed service. We will identify the AI interaction and provide any additional notice or consent required before collecting information through it.

3. When we disclose information

3.1 We disclose information only as permitted by applicable law and the privacy notices governing the information. Relevant recipients and purposes include:

(a) Service providers supporting hosting, authentication, message delivery, financial-data integration, document services, technical support, AI functionality, and operational security. Their access is limited to the information reasonably needed for their work and must be subject to confidentiality, permitted-use, and security protections. Providers acting on our behalf may not use that information for their own unrelated advertising or sale.

(b) Financial Gravity affiliates and authorized personnel for operational and financial-service purposes and, where permitted, to advertise or market products and services offered by us or our affiliates. Information disclosed for those purposes may include contact details, the nature of your relationship with us, product or service interests, and other information permitted by applicable law, subject to required notices, consents, and privacy elections.

(c) Your adviser, custodian, other institutions serving you, and representatives you have authorized, as needed for the relevant service or at your lawful direction. Independently acting institutions have their own responsibilities and privacy notices.

(d) Regulators, courts, law enforcement, professional advisers, and other recipients when disclosure is legally required or permitted for compliance, investigations, protection against fraud, or the establishment or defense of legal rights.

(e) A lawful successor in a merger, reorganization, or transfer of the relevant business, subject to applicable confidentiality, use, notice, consent, and other restrictions. A business transfer does not eliminate protections for your information.

3.2 The separate Service Providers and Subprocessors Addendum identifies operational providers, their functions, and relevant processing details. A provider's legal role depends on the actual arrangement; not every recipient is a subprocessor. We may change providers, subject to applicable contractual and legal requirements. A provider listing is not authorization for additional uses or unrestricted sharing.

3.3 We may disclose information within our affiliated group for the marketing purposes described above. Where a disclosure or advertising practice constitutes a sale or sharing under applicable privacy law, the applicable notice, opt-out, and consent requirements apply. You may request an applicable opt-out through clientsuccess@financialgravity.com or the methods in your financial institution’s privacy notice. We may rely on lawful exceptions to consent or opt-out requirements where they apply. The separate protections for verification-text information in Section 4 continue to apply.

4. Verification text messages

4.1 If you affirmatively enroll, we use your mobile number to send automated, one-time Client Central sign-in verification codes. Message frequency depends on sign-in activity, and message and data rates may apply. This enrollment covers verification messages, not marketing or unrelated alerts.

4.2 We do not sell or share mobile numbers collected for the verification program, SMS opt-in records, or SMS consent information with third parties or affiliates for their marketing or promotional purposes. This restriction does not prohibit otherwise lawful marketing based on information independently collected for that purpose, subject to applicable consent and opt-out requirements. Authorized providers may process this information only as needed to deliver, secure, support, and administer the verification program, subject to confidentiality and use restrictions. We may retain consent, delivery, and opt-out records to honor your choices and satisfy legal obligations.

4.3 Reply STOP to cancel or contact clientsuccess@financialgravity.com to withdraw consent. We honor other reasonable withdrawal requests where required by law. You may receive one non-promotional cancellation confirmation. Reply HELP for assistance or email that address. A new affirmative opt-in is required to resume verification messages. Opting out may prevent use of the SMS sign-in method; contact Client Success about obtaining your account information. It does not terminate your advisory relationship. Additional program terms appear in Section 9 of the Terms of Service.

5. Cookies and similar technologies

5.1 Cookies and similar technologies. Client Central uses only the cookies and browser storage needed to sign you in, keep your session secure, and remember your display preferences. These include a session cookie that keeps you signed in for up to two hours and is cleared when you sign out, and settings such as light or dark mode stored in your browser. Client Central does not use analytics, advertising cookies, tracking pixels, or session recording, and does not sell or share your personal information for cross-context behavioral advertising.

Because Client Central uses only essential technologies, it does not ask for cookie consent, and there is no sale or sharing for an opt-out preference signal, such as Global Privacy Control, to turn off. You can block or delete cookies in your browser settings, but you will not be able to sign in without the session cookie.

5.2 Browser settings may allow you to limit cookies or local storage. Blocking technologies needed for authentication or security can affect portal functions. A browser setting does not itself cancel verification-text enrollment; use the withdrawal methods above.

6. Safeguards and service provider oversight

6.1 We maintain administrative, technical, and physical safeguards reasonably designed to protect personal information against unauthorized access, use, alteration, disclosure, and loss. Our safeguards must be appropriate to the information, risks, and applicable requirements. We assess providers before permitting access and require appropriate protections for information handled on our behalf, including restrictions on further processing providers.

6.2 We investigate suspected security incidents and provide notices to affected persons and authorities when required by applicable law. Relevant providers must report incidents promptly enough to support our investigation, response, and notification obligations. No system can guarantee absolute security; this does not excuse our legal or contractual duties. Contact Client Success promptly if you suspect unauthorized access, and do not send passwords or verification codes to support personnel.

7. Retention and processing locations

7.1 We retain personal information for as long as reasonably needed for the purposes described here, including the service relationship, security, regulatory recordkeeping, dispute resolution, and legal holds. Relevant factors include the type and sensitivity of the information, the applicable retention requirements, and whether an ongoing business or legal purpose exists. Deactivating portal access does not close a financial account or automatically delete regulated records.

7.2 When information is no longer needed and no lawful retention requirement applies, we delete it or render it nonidentifiable and direct applicable providers to do so. Backup copies may remain until the ordinary secure overwrite cycle, with use restricted to recovery, security, and legal needs. The same protections apply to retained information about former portal users.

7.3 Portal information is stored and processed in the United States, at the locations listed for each provider in the Service Providers and Subprocessors Addendum: Amazon Web Services in Oregon (us-west-2), Ohio (us-east-2), and Northern Virginia (us-east-1); Zoho's United States data center; Retool Cloud in the United States; Fly.io in San Jose, California; and Transloadit and PDFCrowd in the United States. Google Workspace, which delivers phone-number change requests to Client Success, may process those messages in the United States or in other countries where Google operates. We will update the Addendum if these locations change.

8. Your choices and requests

8.1 You may contact clientsuccess@financialgravity.com to ask about our handling of information, request correction of inaccurate information, or exercise privacy rights that apply to you. Depending on the law and the information involved, those rights may include access, a copy, correction, deletion, restriction or objection, withdrawal of consent, and certain opt-outs. Financial-information and institutional exemptions may affect which rights apply. We will explain applicable limitations when responding; this Policy does not narrow rights provided by law.

8.2 We may verify your identity and an authorized representative's authority before acting. We may direct a request concerning records controlled by another institution to that institution. We respond within applicable deadlines and will not unlawfully discriminate against you for exercising a protected right. If a legally available request is denied, we will explain the reason and any applicable appeal method; you may submit an appeal through the same email address. We will provide further complaint information where required.

8.3 Existing financial privacy opt-outs remain available through the methods in your institutional privacy notice. Text-message withdrawal is described in Section 4. Portal deactivation and withdrawal of a separate electronic-delivery consent are different actions and should be directed to Client Success or the relevant institution.

8.4 For California residents, the CCPA rights described here apply to information and processing covered by that law. Qualifying information handled under the Gramm-Leach-Bliley Act or California Financial Information Privacy Act may be exempt from particular CCPA requirements; that does not exempt all information simply because a financial institution handles it, or eliminate rights that remain applicable.

8.5 Where the CCPA applies, you may request the categories and specific pieces of information collected about you, their sources and purposes, and the categories of recipients; request deletion or correction; and exercise applicable rights to opt out of sale or sharing for cross-context behavioral advertising and to limit certain uses or disclosures of sensitive personal information. You may use an authorized agent, subject to lawful verification requirements. We do not require identity verification for a sale or sharing opt-out beyond what applicable law permits. We will honor legally required browser-based opt-out preference signals, including Global Privacy Control, for processing to which they apply.

8.6 You may exercise applicable rights concerning covered automated decisions through the contact method above. Before using technology in a manner subject to additional automated-decision requirements, we will provide the required notice and explain available access, opt-out, and review procedures. We do not offer a general contractual right to human review of AI outputs or automated processing; any such right depends on applicable law or a separate written agreement. A general support chatbot does not necessarily make a decision subject to additional automated-decision requirements. Nothing in this Policy requires you to waive a California privacy right.

9. Children and external services

9.1 Client Central access is intended for adults and authorized adult representatives. Records may concern a minor whose account an adult is authorized to manage; that does not create access rights for the minor. We do not knowingly permit children under 13 to register directly. Contact Client Success if you believe a child has provided information through an unauthorized registration so we can investigate and take appropriate action.

9.2 Links to independent websites or services do not make this Policy apply to those services. Review their privacy notices before providing information. This does not reduce our responsibility for providers processing information on our behalf.

10. Changes and contact

10.1 We may update this Policy and will identify the revised effective date. We will provide prominent portal or email notice of a material change before it takes effect, except where an earlier change is required by law or needed to address an urgent security issue, in which case notice will be provided as soon as reasonably practicable. We will obtain any consent required for a materially different use of previously collected information. Continued use alone does not override a legally required consent or existing privacy election.

10.2 For privacy questions, requests, or concerns, contact clientsuccess@financialgravity.com and identify Client Central in the subject line. Do not include passwords, verification codes, or unnecessary sensitive financial information in your initial message.