Privacy Policy

This Privacy Policy explains how Natural AI, Inc. (“Natural”) collects, uses, and shares information about you when you interact with the Natural Technology, either directly or through your authorized AI agent(s); use your Wallet Account, provided by Column N.A., Member FDIC (“Column”); or visit Natural’s website. If you apply for or hold a Natural Card, the Cards Privacy Policy explains how we handle your Natural Card account information.

Our Commitment

At Natural, we safeguard your Personal Data and collect only what we need to provide the Natural Technology, move money at your and your authorized AI agents’ direction, keep your account secure, and meet our legal and compliance obligations.

Data We Collect

Natural categorizes the data we collect into data classes to ensure we apply appropriate security controls:

• Personal Data/PII (information that identifies you, such as your name, date of birth, email address, physical address, phone number, and Social Security number);

• Financial Data (your sensitive financial or bank account information); and

• Restricted Data (highly sensitive information, including payment-related data and cryptographic materials).

How We Collect Your Data

• From You. When you sign up for a Natural Account, we collect your name, date of birth, home address, Social Security number (or passport number if you are not a U.S. person), government-issued photo ID, email address, phone number, profession or trade, employment status, annual income, and how you plan to use your Wallet Account.

• During Identity Verification. Our identity verification provider collects a photo of your ID and, in some cases, a live photo of you to confirm they match. See “Biometric Information” below.

• From Your Devices. When you use the Natural Technology, we collect device identifiers, IP address, and approximate location, mainly to protect your account from fraud.

• From Linked Bank Accounts. If you link an outside bank account, we receive account and balance information from that bank through our account-linking provider.

• From Your Authorized AI Agents. We receive transaction instructions from the AI agents you authorize to act on your behalf.

• From Third Parties. We receive information from Column, identity verification and fraud prevention providers, and sanctions screening services.

Biometric Information

When we need additional verification, our identity verification provider may ask you to take a live photo and compare it with the photo on your ID, which involves creating a facial geometry scan. We collect this information only with your consent, which we ask for before verification begins, and use it only to verify your identity and prevent fraud. We do not sell, lease, or trade it, and we disclose it only to our identity verification provider and as required by law. We or our provider permanently destroy it once verification is complete.

How We Use Your Data

Natural does not sell your Personal Data or share it for cross-context behavioral advertising. Natural uses your Personal Data for specified, legitimate business purposes, including to:

• provide and maintain Natural’s Services;

• verify your identity and conduct required screening (KYB/KYC/AML);

• validate your financial instruments and process your transactions;

• monitor and prevent fraud, security threats, or other harmful activities;

• comply with legal requirements and requests from our bank partners; and

• improve our technology and customer support.

We use Wallet Account information more narrowly, as explained in “Wallet Accounts” below.

How We Protect Your Data

Natural safeguards your Personal Data by implementing appropriate technical and organizational measures and limiting data processing to what is necessary to fulfill our specified purposes.

We use strict technical and organizational measures to keep your data secure:

Encryption. Natural encrypts data in transit and at rest.

• Data in Transit. TLS 1.3 for external traffic and mTLS between services; and

• Data at Rest. AES-256-GCM with a qualified encryption vendor for tokenizing Restricted Data.

Tokenization. Natural tokenizes payment credentials through regulated third-party providers and does not store payment credentials within Natural’s systems.

Access Controls. We limit employee access to your data through role-based access controls. We require multi-factor authentication and manage encryption keys through secure systems.

Audits. We perform regular vulnerability tests and audits to ensure our network and systems are secure.

Wallet Accounts

Wallet Accounts are held at and provided by Column, subject to the Wallet Account Agreement between you and Column. Natural manages the Wallet Account program as Column’s service provider and provides the Natural Technology (the platform you use to access your Wallet Account). Column owns your Wallet Account information. When you instruct, or your authorized AI agent instructs, Natural to move money, we carry out those instructions on Column’s behalf.

Natural uses and shares Wallet Account information only to operate Wallet Accounts, process transactions at Natural users’ and their authorized AI agents’ direction, prevent fraud, comply with law and our obligations to Column, and tell you about Column products offered through Natural. We will share your Wallet Account information with your third-party AI agent and the developer or app that offers it only with your consent and within the access you authorize. You can opt out of marketing messages at any time, as described in Natural’s Disclosures and Consents.

Column’s Privacy Notice explains how Column collects and shares your Wallet Account information and the choices federal law gives you. Column’s California Consumer Privacy Policy explains how Column handles information and rights California consumers may have under the California Consumer Privacy Act. Natural will not use or share your Wallet Account information in any way that Column’s Privacy Notice does not allow. If you live in California, we share your Wallet Account information with other companies only as California’s Financial Information Privacy Act allows, which in practice means only for everyday business purposes such as processing your transactions and servicing your account.

Natural Cards

If you apply for or hold a Natural Card issued by Column, the Cards Privacy Policy explains how Natural handles your Natural Card information and controls over this Privacy Policy with respect to Natural Card information.

Our Role in Handling Your Data

This section describes Natural’s role in processing Personal Data other than Wallet Account and Natural Card information. Depending on the activity, Natural assumes the role of a “Data Processor” (“Service Provider” under the CCPA) or a “Data Controller”. The nature of the data processing activity determines which role Natural assumes.

The Data Processor is an entity acting on behalf and under the instructions of a Data Controller in processing Personal Data. Natural acts as a Data Processor when it processes Personal Data about people who are not Natural users, such as payees, payers, or a business user’s customers, at a Natural user’s direction. This includes where a Natural user instructs its AI agent(s) to provide that information, in which case the Natural user and its AI agent(s) are collectively the Data Controller.

The Data Controller is the entity that determines the purposes and means of a data processing activity. Natural is required to act as a Data Controller as a part of providing services to the Natural users. Examples of when Natural must act as a Data Controller include:

• Financial Partner Integrations (Natural selects and manages third-party banking relationships and payment method connections);

• Fraud Prevention (Natural detects and blocks fraudulent activity across the Natural Technology);

• Risk Mitigation (Natural monitors, prevents, and attempts to mitigate financial losses, security risks, and other potential harms);

• Regulatory Compliance (Natural complies with KYB/KYC/AML legal requirements and obligations to bank partners and governmental authorities);

• Operational Management (Natural implements and adheres to its internal processes to enable its services, provide customer support, and perform billing and invoicing); and

• Product Evolution (Natural analyzes, maintains, and improves its products and services).

Apps and AI Agents You Authorize

When you connect an app or AI agent to your Natural Account, you set that app or AI agent’s authorization parameters. Natural shares only the Natural Account information your authorized AI agent needs to carry out your instructions, such as your available balance, transaction status, and the card credentials needed to make a payment. We show you what each app or AI agent can access before you approve it.

Third-party apps and AI agents you connect to your Natural Account are governed by your agreement with the developer of the authorized app or AI agent, not by this Privacy Policy. Natural does not control how those third parties use or handle the information Natural shares at your direction.

You can see and revoke any AI agent’s delegated authority at any time in your Natural Dashboard. Once you revoke an AI agent’s delegated authority, we stop sharing new information with that app or AI agent.

Data Retention and Disposal

Natural retains your Personal Data for only as long as we need it to fulfill the purposes described in this Privacy Policy or meet legal requirements. When we no longer need your Personal Data, we delete it using methods that comply with applicable law. Even after we stop providing services directly to you, and even after you close your Natural Account, we may continue to retain your Personal Data to:

• comply with our legal and regulatory obligations;

• enable fraud monitoring, detection, and prevention activities; and

• comply with our tax, accounting, and financial reporting obligations, including when bank partners require specific retention and where data retention is mandated by the payment method(s) you’ve used.

Your Rights

You have the following rights regarding your Personal Data:

• Access and Correction (you may ask to see the data we have about you or fix inaccuracies);

• Deletion (we will delete your Personal Data upon request, except that we may keep certain information to comply with the law or our internal policies); and

• Objection (you may object to how we process your Personal Data in certain circumstances).

Some rights relating to your Wallet Account and Natural Card are limited. Natural and Column must retain certain records to comply with anti-money laundering and other laws. If you are a California consumer, Personal Data that we collect and share under federal financial privacy law is not covered by the California Consumer Privacy Act. Your California rights apply to other Personal Data Natural may collect from and about you.

Updates to the Privacy Policy

Natural may update the Privacy Policy at any time by notifying you of the update and publishing the new version on Natural’s website. Your continued use of the Services means you accept the updated Privacy Policy.

If you are an individual consumer with a Wallet Account or Natural Card, we will notify you before any change that expands how we share your Wallet Account or Natural Card information, and we will give you any choice the law requires. We will not treat your continued use of the Services as acceptance of this type of change.

Contact Natural

If you have questions about this Privacy Policy or your Personal Data, please email Natural at privacy@natural.com.

For questions about Column’s Privacy Notice, please email Column at privacy@column.com.