Online Privacy Notice
Effective Date: May 21, 2026
OUR COMMITMENT TO PRIVACY
This Website is developed and maintained by Barri Money Services, LLC. (“Barri”, “We,” “Our,” or “Us”). The data controller is Barri and can be contacted as explained below in the “How to Contact Us” section of this notice. Barri, Our subsidiaries, and affiliates care about Your privacy and are committed to processing Your personal information in accordance with all applicable privacy and data protection laws.
When You visit Our Website, official social media sites, or other online properties, (collectively "Sites" or "Services"), Barri may collect and use certain information about You. We recognize that You care about how Your information is used, and Your privacy is important to Us.
This Privacy Notice ("Notice") explains how We may collect and use Your information, particularly Your personal information, and the choices You can make about what information You share.
This Privacy Notice applies to all Services offered by Barri to U.S. consumers, except where a product or service has a separate privacy notice that does not incorporate this Privacy Notice. Certain individuals also may be provided with additional privacy notices as described below.
UPDATES TO OUR PRIVACY POLICY
We ask that You read this Privacy Notice from time to time. Barri may modify this Privacy Policy at any time at its sole discretion. If we make material changes to this Privacy Notice that increase Our rights to use personal information that We have previously collected about You, we will first obtain Your consent where required by law. If Barri intends to further process collected personal data for a purpose other than that for which the personal data was collected, prior to that further processing, We will provide You with information on that other purpose with additional information necessary to ensure fair and transparent processing.
INFORMATION COLLECTION
INFORMATION YOU PROVIDE TO US
Barri collects information about You when You interact with Our Sites and Services. When You use Our Sites and Services, We may collect information automatically about one or more devices associated with You that You use to access Our Sites and Services, such as Your Internet domain and IP address, type of browser or device and operating system, device advertising identifier, the location of Your mobile device, and the date and time of Your visit.
Information that We collect may include:
INFORMATION COLLECTED VIA TECHNOLOGY
Information We Automatically Collect
We automatically collect information about the devices You use to interact with Our Sites. We automatically collect Your device identifier, Web browser type and version, IP address, precise geolocation, and browsing information collected through cookies and beacons. We also automatically collect information about how You use the Sites, such as what You have searched for and viewed on the Sites. The information automatically collected will be associated with any personal information You have provided.
We collect certain information by automated means when You visit Our Sites, such as how many users visited Our Sites and the pages accessed. By collecting this information, We learn how to best tailor Our Sites to Our visitors. We collect this information through various means such as "cookies" and other similar technologies. Refer to the Digital Advertising & Analytics section of this Notice to learn more about the use of this information and the choices available to You.
If You contact Us, such as by sending an email or calling Our customer service line, We will collect the information You submit to Us in Your communication. We may also obtain information about You, including personal information, from third parties where permitted by law.
We may combine any information that We collect, including device information, with any information that You choose to provide to Us.
HOW WE USE THE INFORMATION WE COLLECT ABOUT YOU
We may use the information that We collect and process with Your consent, as otherwise disclosed at the time of collection or use for any lawful commercial or business purpose, including the following:
TO COMMUNICATE WITH YOU
TO MANAGE AND IMPROVE OUR BUSINESS OPERATIONS
TO ENSURE A SECURE ONLINE ENVIRONMENT AND TO COMPLY WITH OUR LEGAL OBLIGATIONS
AUTOMATED PROCESSING AND ARTIFICIAL INTELLIGENCE
Barri uses automated processing and artificial intelligence technologies for the following purposes: (i) Identity Verification: automated document authentication, facial recognition liveness detection, and database matching during digital channel onboarding; (ii) Fraud Prevention and Transaction Monitoring: automated rule-based and machine-learning models to detect unusual transaction patterns and potentially suspicious activity, as required under BSA/AML regulations; and (iii) Lifecycle Communications: automated trigger-based email communications sent based on Your product usage activity, such as completing registration or initiating a first transfer. Automated identity verification decisions that affect Your ability to access Barri's services may be subject to human review upon Your request. Residents of Colorado, Connecticut, and Virginia have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, and to request human review of automated decisions.
HOW WE SHARE YOUR INFORMATION
We may disclose Your personal information to Our affiliates as well as with third parties, for any of the following:
We may disclose information that has been deidentified or aggregated so that it does not identify You or Your device, without limitation.
No mobile information is shared with third parties or affiliates for SMS marketing or promotional purposes.
Your information is handled in accordance with applicable privacy laws and only shared when necessary to deliver services or comply with legal obligations.
We may also disclose Your personal information to other entities whose products may be of interest to You. If You do not want Us to disclose Your personal information for such offers, please contact Us at 1-800- 926-2277 or by email: optout@barri.com.
DIGITAL ADVERTISING PLATFORMS AND CUSTOMER MATCH
Barri may share certain customer information with approved digital advertising platforms, including but not limited to Meta, Google, TikTok, and other approved platforms, for the purpose of Customer Match audience creation, lookalike audience modeling, and related digital advertising activities to support targeted marketing campaigns. The currently approved platforms are: Meta Platforms, Inc. (Meta Ads), Google LLC (Google Ads), and TikTok Inc. (TikTok Ads — pending DPA execution prior to activation). The list of approved platforms is maintained as a living schedule by the Compliance Department and may be updated without requiring a full revision of this Privacy Policy, provided all new platforms undergo our standard approval and Data Processing Agreement process. In addition to Customer Match, We may also employ the following digital advertising technologies: pixel-based retargeting, website custom audiences, conversion APIs and server-side tracking, enhanced conversions, audience suppression, and event-based remarketing — each subject to the same data minimization, consent verification, and DPA requirements that apply to Customer Match. The categories of data shared are limited to: hashed email address, hashed phone number, first name, last name, city, state, country, and ZIP code. All sensitive identifiers (email and phone) are cryptographically hashed using SHA-256 before being transmitted to any advertising platform. No financial transaction data, Social Security Number, biometric data, or BSA/AML monitoring information is ever included in advertising platform uploads. This sharing may constitute a "sale" or "sharing" of personal information under the California Consumer Privacy Act (CCPA/CPRA) and the Texas Data Privacy and Security Act (TDPSA). Customers may opt out of this sharing at any time by calling 1-800-926-2277, emailing optout@barri.com, or using the "Do Not Sell or Share My Personal Information" link on Our website. All advertising platforms are bound by Data Processing Agreements limiting their use of customer data to the approved purposes only.
CRM AND LIFECYCLE COMMUNICATION PLATFORMS
Barri may share customer data with approved Customer Relationship Management (CRM) and lifecycle automation platforms for the purpose of sending transactional and marketing communications across email, SMS, push notification, WhatsApp, and in-app channels. Currently approved platforms include Insider One (customer engagement and lifecycle automation). Data shared with CRM platforms is limited to: contact information (name, email, phone), account registration channel, product usage flags (e.g., whether a first transfer has been completed), activity-derived behavioral signals (aggregated transaction frequency, recency), engagement signals (app last open, push notification status, onboarding step), and communication preferences including per-channel opt-in/opt-out status and global marketing suppression flag. Financial transaction amounts, Social Security Numbers, bank account numbers, and BSA/AML monitoring data are never shared with CRM platforms. Any lifecycle segmentation scores or behavioral models derived from CRM data are used solely for communication personalization, timing optimization, and engagement prioritization — never for compliance decisions, transaction limits, pricing, or any regulatory purpose. We may also use analytics platforms to measure the effectiveness of our lifecycle programs (e.g., email opens, conversion rates, cohort retention); analytics use is subject to the same data restrictions and vendor DPA requirements that apply to CRM platforms. SMS marketing requires Your prior express written consent (opt-in); You may opt out at any time by replying STOP. All CRM vendors are bound by Data Processing Agreements that limit their use of Your data to the purposes specified by Barri and prohibit onward transfer or sale. Commercial email communications are sent from the domain hello.barri.com and comply with the CAN-SPAM Act, 15 U.S.C. §§ 7701–7713. You may opt out of lifecycle marketing emails at any time by using the unsubscribe link in any email communication or by emailing optout@barri.com. To opt out of all marketing channels simultaneously, contact optout@barri.com with the subject line "Global Marketing Opt-Out."
DIGITAL ADVERTISING & DATA ANALYTICS
We may partner with ad networks and other ad serving providers ("Advertising Providers") that distribute advertising on Our behalf and others on non-affiliated platforms. Some of those ads may be personalized, meaning that they are intended to be relevant to You based on information Advertising Providers collect about Your use of the Services and other sites or apps over time, including information about relationships among different browsers and devices. This type of advertising is known as interest-based advertising.
You can visit www.aboutads.info to learn more about interest-based advertising and how to opt-out of this advertising on Your browser by companies participating in the Digital Advertising Alliance (DAA) self- regulatory program.
To learn more about interest-based advertising in mobile apps and to opt out of this type of advertising by companies that participate in the DAA's AppChoices tool, please download the version of AppChoices for Your device, available at:
Advertising Providers may also collect and use information through Our apps about the precise location of Your mobile device, in order to provide ads that are more relevant to You. If You do not want Advertising Providers to collect information through Our apps about Your device's precise location, You can turn off location services on Your device.
We may also work with third parties that collect data about Your use of the Services and other sites or apps over time for non-advertising purposes. Barri uses Google Analytics and other third-party services to improve the performance of the Services and for analytics and marketing purposes. For more information about how Google Analytics collects and uses data when You use Our Services, visit https://www.google.com/policies/privacy/partners/, and to opt out of Google Analytics, visit https://tools.google.com/dlpage/gaoptout/.
LINKS TO THIRD-PARTY WEBSITES AND TOOLS
Our Sites and Services may provide links to third-party Websites or apps for Your convenience and information. These websites may operate independently from Our Sites. We do not control the privacy practices of those Websites or apps, and they are not covered by this Privacy Notice. Linked websites may have their own privacy notices or policies, which We strongly suggest You review if You visit any linked websites. To the extent any linked websites You visit are not part of this website, We are not responsible for their content, any use of the websites, or the privacy practices of any of those websites.
YOUR CHOICES
DO NOT SELL OR SHARE MY PERSONAL INFORMATION
California and Texas residents have the right to opt out of the sale or sharing of their personal information for targeted advertising purposes, including Customer Match audience uploads to digital advertising platforms. To exercise this right, please: (i) use the "Do Not Sell or Share My Personal Information" link on Our website; (ii) call 1-800-926-2277; or (iii) email optout@barri.com. Upon receipt of a valid opt-out request, Barri will suppress Your personal information from future Customer Match uploads and targeted advertising campaigns within fifteen (15) business days.
To opt out of Our email updates, You can use the unsubscribe link provided at the bottom of each message. You can also opt out of future marketing emails by sending a request to optout@barri.com using the subject line "Unsubscribe from email communications." To ensure your opt-out request is properly processed, be sure to send Your message using the same email account to which We sent Our correspondence. If You opt out of Our marketing emails, We will still continue to send You email messages related to Your transactions or relationship with Barri.
HOW WE PROTECT YOUR INFORMATION
We adopt appropriate data collection, storage and processing practices and security measures to protect against unauthorized access, alteration, disclosure or destruction of Your personal information, username, password, transaction information, and other data stored on Our Sites. Sensitive and private data exchange between the Sites and its users happens over a Secure Sockets Layer (SSL) secured communication channel and is encrypted and protected with digital signatures.
HOW WE PROTECT PERSONAL INFORMATION
We maintain administrative, technical, and physical safeguards to protect against loss, misuse, unauthorized access, disclosure, alteration, or destruction of the information you provide when visiting or using our Sites.
LEGAL BASIS FOR PROCESSING PERSONAL INFORMATION
Barri processes personal information on the following legal bases:
RETENTION OF INFORMATION
Barri retains personal information only for as long as necessary for the specific purpose for which it was collected, and in accordance with applicable law, applying data minimization principles throughout. Retention periods by category:
When deleting personal information based on a verified request, Barri will make reasonable efforts to ensure deletion of all instances from its own systems and will direct its service providers and vendors to do the same.
SENSITIVE PERSONAL INFORMATION — BIOMETRIC DATA
When You register for a Barri account through Our digital channel (mobile app or website), We may collect biometric information including a facial image and a photograph of Your government-issued identity document, solely for the purpose of verifying Your identity as required by applicable Know Your Customer (KYC) regulations. This biometric data is processed by Our approved identity verification vendor (currently Onfido/Entrust).
The legal bases for this processing are: (i) Your explicit consent, provided at the time of digital onboarding; and (ii) Our legal obligation to verify customer identity under federal BSA/AML regulations.
Biometric data is: (a) never sold, shared with advertising platforms, or used for any purpose other than identity verification; (b) retained only for the period necessary to complete the identity verification process; and (c) deleted within ninety (90) days of the completion of the verification process or immediately upon rejection of the application, whichever is sooner.
For Texas residents, this collection is governed by the Texas Capture or Use of Biometric Identifier Act (CUBI), and Your explicit consent is obtained before any biometric data is collected or used.
CHILDREN'S PERSONAL INFORMATION
Our Sites and Services are not directed at children under the age of 18. Barri's financial services require users to have legal capacity to enter into a contract, which in most jurisdictions requires a minimum age of 18. We neither intend nor knowingly collect or solicit personal information from children under the age of 18. If You are under the age of 18, please do not use Our Services or otherwise provide Us with any personal information either directly or by other means. If a child under the age of 18 has provided personal information to Us, We encourage the child's parent or guardian to contact Us and request that We remove the personal information from Our systems. If We learn that any personal information We collected has been provided to Us by a child under the age of 18, we will promptly delete that personal information.
GRAMM-LEACH-BLILEY ACT (GLBA) — INFORMATION SHARING NOTICE
Federal law (Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801–6827) requires Barri, as a financial institution, to explain how We share Your nonpublic personal information (NPI) and to provide You the opportunity to limit certain sharing. The following summarizes Our sharing practices and Your opt-out rights:
| Reason We Share Your Information | Do We Share? | Can You Limit This Sharing? |
|---|---|---|
| For everyday business purposes (processing transactions, fraud prevention, BSA/AML compliance, responding to legal requests) | Yes | No |
| For marketing Our own products and services to You | Yes | Yes — call 1-800-926-2277 or email optout@barri.com |
| For sharing customer identifier data with digital advertising platforms (Meta Platforms, Google LLC, TikTok Inc.) for Customer Match, targeted advertising, and related digital advertising technologies | Yes | Yes — call 1-800-926-2277, email optout@barri.com, or use Do Not Sell or Share link on Our website |
| For sharing with Our affiliates for their everyday business purposes | Yes | No |
| For sharing with nonaffiliated companies to market their products to You | No | We do not share |
STATE PRIVACY RIGHTS
California, Colorado, Connecticut, Utah, Virginia, and Texas residents have certain rights under state privacy laws with respect to personal data We collect. If You are a resident of such states, this section contains disclosures required by law and explains rights that may be available to You.
PERSONAL INFORMATION WE COLLECT, DISCLOSE, AND SELL
In the preceding 12 months, We collected, disclosed, and sold the following categories of personal data:
CATEGORIES OF SOURCES
We collect this personal information from the following categories of sources:
OUR PURPOSES FOR PROCESSING PERSONAL DATA
We use and disclose the personal information We collect for Our commercial and business purposes, as further described in the "Information use" and "Information Sharing" sections of this privacy notice.
RECIPIENTS OF PERSONAL INFORMATION
We sell, including by sharing for targeted advertising purposes, the categories of personal information designated above to the categories of third parties listed below:
We disclose the categories of personal information designated above to the categories of third parties listed below for Barri's business purposes:
YOUR RIGHTS
Residents of certain states have rights with respect to the personal information collected by businesses. You may be able to exercise the following rights regarding Your personal information, subject to certain exceptions and limitations:
Please note that if You opt out of certain types of practices, We may be unable to provide You with some Services. Additionally, We do not knowingly sell or share personal data of individuals under 18.
The right not to receive discriminatory treatment for the exercise of the above privacy rights.
To exercise any of the above rights, please contact Us using the following information and submit the required verifying information, as further described below:
Response timelines: Barri will acknowledge Your request within ten (10) business days and respond within forty-five (45) calendar days. We may extend this period by an additional forty-five (45) calendar days where reasonably necessary, and will notify You of the extension. If We deny Your request, You have the right to appeal the denial within thirty (30) days by submitting a written appeal to privacy@barri.com, and We will respond to Your appeal within sixty (60) days.
VERIFICATION PROCESS AND REQUIRED INFORMATION
Note that We may need to request additional information from You to verify Your identity or understand the scope of Your request, although You will not be required to create an account with Us to submit a request or have it fulfilled. We will require You to provide, at a minimum: Name, Address, Email address, Telephone number and Date of birth.
AUTHORIZED AGENT
You may designate an authorized agent to make requests on Your behalf by providing the agent a written, signed permission and a copy of Your valid government issued identification. The agent must email the signed permission to privacy@barri.com and complete the "Representatives" section of the "Consumer Rights Request" form.
TEXAS RESIDENTS — TEXAS DATA PRIVACY AND SECURITY ACT (TDPSA)
The Texas Data Privacy and Security Act (TDPSA), Tex. Bus. & Com. Code §§ 541.001 et seq., effective July 1, 2024, grants Texas residents the following rights with respect to their personal data:
To exercise any of these rights, please contact Us at 1-800-926-2277 or privacy@barri.com. Barri will respond within forty-five (45) calendar days (extendable by forty-five (45) additional calendar days with notice). If We deny Your request, You may appeal the denial within thirty (30) days by writing to privacy@barri.com; We will respond to Your appeal within sixty (60) days. You may also file a complaint with the Texas Attorney General if You believe Barri has violated Your TDPSA rights.
HOW TO CONTACT US
If You have questions or comments about this Privacy Notice, Our privacy practices, or the personal information We maintain about You, or to submit a consumer rights request, please contact Our Privacy Officer (Chief Compliance Officer). Barri will acknowledge all privacy inquiries and rights requests within ten (10) business days and respond within forty-five (45) calendar days. Please contact Us by email at privacy@barri.com.
We also accept questions by regular mail and by telephone at the locations identified below: