Privacy Notice — Cash Advance by JST

This Privacy Notice ("Notice") explains how Cash Advance by JST Inc. ("JST," "we," "us," or "our") collects, uses, discloses, sells, and safeguards personal information when you access or use the Cash Advance by JST mobile application, related website cashadvancebyjst.com, and associated services (collectively, the "Service"). By accessing or using the Service, you confirm that you have read, understood, and agreed to this Notice. If you do not agree, do not use the Service.

In plain English. JST is a lead-generation platform — not a lender. We collect your application information and forward (sell) it to third-party lender and marketing partners. We receive compensation for those connections. The detailed rules below explain exactly what we collect, what we sell, to whom, and how you can opt out under California and other state laws.

1. Who we are and what the Service does

Cash Advance by JST Inc. is a Texas corporation operating the Cash Advance by JST mobile application, a loan-matching and lead-generation platform that connects US-resident borrowers with third-party financial partners (collectively, "lenders" or "partners").

We are not a lender. We do not originate loans, make credit decisions, set interest rates, or disburse funds. Final approval, APR, term, fee structure, and any contractual lending relationship are determined exclusively by the lender. This Notice applies to US residents aged 18 or older.

2. Laws and regulatory framework

This Notice is designed to comply with applicable US federal and state privacy and consumer-protection laws, including:

Gramm-Leach-Bliley Act ("GLBA") — SSN, bank-account, and other financial information you submit is "nonpublic personal financial information" under GLBA.
California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA") — including its broad definitions of "sale" and "sharing."
Fair Credit Reporting Act ("FCRA").
Federal Trade Commission ("FTC") rules and guidance on data brokers and lead generators.
CAN-SPAM Act and the Telephone Consumer Protection Act ("TCPA").
Other applicable federal and state privacy and consumer-protection laws.

GLBA-covered nonpublic personal financial information has separate notice requirements and may limit certain state-law rights described below. Where federal sectoral laws apply, those laws control.

3. Information we collect

3.1 Information you provide directly

When you use the Service, you may provide some or all of the following:

Personal identifiers: full legal name (first, middle, last), date of birth, email address, mobile or home phone number, and full residential address (street, city, state, ZIP).
Government and identity documents: the last four digits of your Social Security Number (referred to as "SSN4") — collected by JST for identity verification, KYC matching with lender partners, and fraud prevention; driver's license number and issuing state — for identity verification and state-eligibility checks. JST does not collect your full nine-digit SSN at the pre-qualification stage. A lender may request your full SSN separately if you decide to proceed with a formal application; the lender — not JST — collects that information directly under its own privacy practices.
Financial and employment information: bank account number, bank routing number (ABA), bank name and account type (checking / savings); debit or credit card number and the last four digits of the card PIN, where you choose to add a card as a payout or payment method; employer name; employer phone number; employment status and job title; monthly or annual gross income; source of income (employment, self-employment, benefits, other); and purpose of the loan or cash advance request. Bank-account and card information is collected for lender verification and for potential disbursement or repayment setup.
Login and security information: usernames, passwords, PINs, one-time passcodes, and security challenge responses (stored using accepted cryptographic methods).
Communications: messages, documents, uploads, and identity or income documentation submitted through Support.
Consents and acknowledgments: electronic signatures, checkbox confirmations, and acknowledgments related to disclosures or agreements.

3.2 Information collected automatically

Device and technical information: IP address, device type, operating system, App version, language settings, time zone, diagnostic and crash data.
Usage data: pages or screens viewed, features used, session duration, timestamps, clickstream, referral sources.
Approximate location: derived from IP address or device signals for fraud prevention, eligibility, and compliance.
Cookies, mobile SDKs, and pixels for authentication, security, session management, preferences, and analytics.

3.3 Information from third parties

Identity-verification and fraud-prevention vendors.
Credit bureaus and alternative data providers, where permitted by law and, when required, with your express authorization (FCRA context).
Marketing or referral partners that direct users to the Service or receive referrals from us.
Public databases or government sources, when required for verification or compliance.

4. How we use your information

To create and manage your account and deliver the Service.
To verify your identity (KYC), check eligibility, and detect and prevent fraud.
To package your data into a lead and match you with lender partners.
To sell your information to third-party lenders, financial institutions, and marketing partners (see Section 5).
To process and fulfill transactions, referrals, payments, and repayments.
To send transactional communications and, with your consent, marketing communications.
To improve performance, analyze usage, and address technical issues.
To comply with legal obligations and enforce our Terms of Service.

5. Sale and sharing of personal information

This section is intentionally prominent. JST sells personal information as defined by the CCPA/CPRA and analogous state laws. The disclosures below explain what we sell, to whom, what we receive in return, and how to opt out.

5.1 We sell your personal information

Cash Advance by JST Inc. sells personal information as that term is defined by the CCPA/CPRA — meaning we disclose your personal information to third parties for monetary or other valuable consideration. Specifically, we forward applicant information to third-party lenders, financial institutions, marketing partners, data aggregators, and other lead buyers in connection with your request through the Service.

The categories of personal information we sell include the full list of items collected directly (Section 3.1), including:

full legal name, date of birth, email, phone number, and residential address with ZIP;
SSN4 (last four digits of SSN) and driver's license number;
bank account number, routing number, and bank name;
debit or credit card number and last four digits of card PIN, where provided;
employer name and phone number, employment status, job title;
monthly or annual gross income and source of income;
purpose of the loan or cash advance request.

In exchange we may receive monetary compensation, referral fees, per-lead fees, per-funded-loan fees, revenue share, or other valuable consideration. Our compensation may influence which partners receive your data first or how offers are ranked or displayed in the Service. Compensation does not change the APR, fees, or other terms set by a lender on any offer you receive.

5.2 Categories of third parties who buy or receive your data

The categories of recipients to whom we sell or otherwise disclose personal information include:

Licensed lenders and financial institutions — including providers of personal loans, installment loans, cash advances, and lines of credit.
Insurance companies and other financial-product providers.
Debt-relief and credit-counseling companies.
Marketing partners who send offers for financial and non-financial products.
Data brokers and aggregators who may further resell your data to additional buyers. Once data has been sold to a downstream recipient, that recipient's own privacy practices govern further use and resale, and we do not control that further use.
Service providers and vendors we use for hosting, identity verification, fraud prevention, analytics, customer support, payment processing, and security — these recipients are not "third parties" for a "sale" under California law where they act under contract solely on our behalf, but they receive personal information in the course of providing services to us.

Once your personal information has been sold to a recipient, that recipient's own privacy policy governs further use. We do not control how buyers use or further disclose data after purchase.

5.3 Your right to opt out of sale

Residents of California and residents of other states with applicable rights may opt out of the sale and sharing of their personal information at any time.

How to opt out on this website: use the Do Not Sell or Share My Personal Information link in the site footer, which directs you to this section.
How to opt out by email: contact privacy@cashadvancebyjst.com with the subject line "Do Not Sell My Personal Information," and include your full legal name, state of residence, and the email/phone you used with the Service so we can locate your records.
How to opt out in the App: tap the "Do Not Sell My Personal Information" link in the App's Settings > Privacy.
Authorized agents: we accept opt-out requests from an authorized agent designated in writing where required by state law.

Processing timeline. We will process opt-out requests within 15 business days of receipt, consistent with CCPA/CPRA. We will confirm completion by email.

Important. Opting out stops future sales of your personal information. It does not delete or recall personal information we have already sold to third parties prior to your opt-out, and we cannot guarantee that data already sold can be deleted from buyers' systems. After opt-out, we may still share data as required by law or as needed to provide core Service functionality (such as completing a request you have already initiated).

6. Legal basis for processing

Consent — obtained where required, including for marketing communications and for the sale of personal information; you may withdraw consent at any time, noting the effect on Service availability.
Contractual necessity — to provide the matching services you have requested.
Legal obligation — KYC/AML, recordkeeping, response to lawful requests.
Legitimate business interest — fraud prevention, system security, integrity, and Service improvement.

7. Data retention

We retain personal information only as long as needed for the purposes described in this Notice and as required by law. Typical retention periods include:

Full applicant profile (name, SSN4, address, bank info, income): duration of the business relationship plus 5 to 7 years after last activity, or longer if required by law or active legal hold. Example: if a user last used the Service in January 2025, the profile is retained until at least January 2030–2032.
Lead and sale records (which partner received which data, when, and for what consideration): 5 to 7 years to meet FTC recordkeeping expectations and to support dispute resolution.
Marketing and communication records (consent logs, opt-ins, campaign responses): 2 to 3 years after last interaction or until opt-out, plus 90 days.
Device and usage logs (IP, session, clickstream): 12 to 24 months.
Opt-out records (Do Not Sell requests): a minimum of 5 years to demonstrate compliance. Example: an opt-out received in March 2025 is logged and retained until at least March 2030.
Support communications: 3 years after ticket resolution.

Specific periods may vary by data type and applicable law. Where law requires longer retention, the legal minimum applies.

8. Data security

Encryption in transit using TLS 1.2 or higher, and at rest using AES-256 where applicable.
Role-based access controls and least-privilege principles.
Ongoing system monitoring and periodic security audits.
Vendor security due diligence and contractual data-security obligations on partners and service providers.
User responsibility: safeguard your credentials, and notify us immediately at support@cashadvancebyjst.com if you suspect unauthorized access.

No system is 100% secure. In the event of a data breach affecting your sensitive information, we will notify affected users and applicable regulators as required by law.

9. Your privacy rights

Right to know / access: request what personal information we hold about you, the categories of sources, the business purposes for collecting it, and the categories of third parties to whom we sold or disclosed it (and, where technically feasible, the specific third-party buyers).
Right to delete: request deletion of personal information we have collected, subject to legal and contractual exceptions. Personal information already sold to third-party buyers prior to your request cannot be "undeleted" from those buyers' systems, and we cannot require buyers to delete it on your behalf in all cases.
Right to correct inaccurate personal information.
Right to portability: obtain a copy of certain personal information in a structured, commonly used, machine-readable format where required by law.
Right to opt out of sale and sharing (see Section 5.3).
Right to limit use of sensitive personal information to extents permitted by the CPRA.
Right to non-discrimination: exercising these rights will not result in denial of service, though some features inherently require data processing.

How to submit a request: email privacy@cashadvancebyjst.com with subject "Privacy Request." Include your full name, state of residence, and a brief description of the request. Verification is required. Authorized agents are permitted where state law allows. We aim to respond within 45 days for California requests and within 30 days where another state's law applies.

10. Marketing opt-outs

You have the following choices regarding marketing communications:

Email marketing: unsubscribe link is included in every marketing email; processed within 10 business days per CAN-SPAM. Transactional and service messages will continue.
SMS / text marketing: reply STOP to opt out; reply HELP for help. Message and data rates may apply. Opting out of marketing SMS does not affect transactional or one-time-passcode messages necessary to operate the Service.
Push notifications: manage in your device operating-system settings.
Phone marketing calls: contact support@cashadvancebyjst.com to opt out. Under TCPA, prior express written consent is required for autodialed marketing calls; that consent is not required to apply for a loan and you may withdraw it at any time.

Note: opting out of marketing does not stop the sale of your personal information unless you also submit a separate "Do Not Sell" request (Section 5.3).

11. California residents (CCPA / CPRA)

If you are a California resident, the following additional rights apply under the CCPA, as amended by the CPRA:

Right to know the categories and specific pieces of personal information collected; categories of sources; business or commercial purposes; and the categories of third parties to whom we sold or disclosed personal information — including the fact that we sell data and the categories of buyers.
Right to delete personal information collected, with CCPA-permitted exceptions.
Right to correct inaccurate personal information.
Right to opt out of sale or sharing. Submit via privacy@cashadvancebyjst.com or via the in-App "Do Not Sell" link. We will process within 15 business days.
Right to limit use of sensitive personal information. SSN4, bank-account, and other sensitive categories will be processed only for purposes permitted under the CPRA unless you give specific authorization for broader use.
Right to non-discrimination.

Submit California requests to privacy@cashadvancebyjst.com with subject "California Privacy Request." Authorized agents permitted where state law allows. Response within 45 days.

Global Privacy Control (GPC). If you activate the GPC signal in a supported browser while visiting our website, we will treat it as a request to opt out of the sale or sharing of personal information to the extent applicable.

Some rights described above may not apply to personal information governed by GLBA, FCRA, or other federal sectoral laws that preempt the CCPA/CPRA for certain categories.

12. Other state privacy rights

Residents of states with comprehensive privacy laws may have rights similar to those described in Section 11, including rights to access, delete, correct, obtain a copy of, and opt out of the sale or sharing of personal information, and to limit use of sensitive personal information. These laws include, without limitation:

Virginia — Virginia Consumer Data Protection Act (VCDPA)
Colorado — Colorado Privacy Act (CPA)
Connecticut — Connecticut Data Privacy Act (CTDPA)
Utah — Utah Consumer Privacy Act (UCPA)
Texas — Texas Data Privacy and Security Act (TDPSA)
Oregon, Montana, and other states with enacted consumer privacy statutes

To exercise applicable rights, email privacy@cashadvancebyjst.com with subject "Privacy Request," your full name, and state of residence. We will respond within the timeframe required by your state's law (typically 45 days). Opt-out requests are processed as described in Section 5.3.

13. GLBA and FCRA notices

Bank-account, routing, employment, and income information you submit through the Service is "nonpublic personal financial information" under GLBA. The last four digits of SSN ("SSN4") that JST collects for matching purposes may also be subject to GLBA depending on context. Where GLBA applies, our GLBA privacy notice (if provided separately) governs that information and may supersede or limit certain rights described above.

Hard credit inquiries. We do not initiate hard credit inquiries without your express prior authorization. We will clearly and prominently disclose if and when a hard credit inquiry may occur in connection with your request, before you authorize it.

14. Cookies and tracking technologies

We use cookies, mobile SDKs, and pixels to support login and session management, protect the Service, remember preferences, and analyze usage. On the website you can adjust cookie settings through your browser. On mobile devices, your operating system may provide controls to limit certain tracking. Disabling certain technologies may limit Service features (for example, staying signed in).

15. Children's privacy

The Service is intended for individuals aged 18 and older (or the age of majority in your state). We do not knowingly collect personal information from children under 13. If we discover we have collected information from a child under 13, we will take prompt steps to delete it. Contact support@cashadvancebyjst.com if you believe this has occurred.

16. International users

The Service is designed for and directed toward US residents. If you access it from outside the US, be aware that your information will be transferred to and processed in the United States, where privacy and data-protection laws may differ from those of your home jurisdiction. By using the Service, you consent to that transfer and processing.

17. Updates to this Notice

We may update this Notice periodically. When we make material changes, we will update the Effective Date above and provide additional notice within the App or by email where required by law. Continued use of the Service after the updated Notice becomes effective constitutes your acceptance of the revised Notice.

18. Contact us

Cash Advance by JST Inc.
310 W Brookside St, Colorado Springs, CO 80905-2156
Website: https://cashadvancebyjst.com
Email: support@cashadvancebyjst.com

We aim to respond to reasonable inquiries within a practical timeframe — within 45 days for CCPA/CPRA requests from California residents and within 30 days for comparable requests under other state laws where applicable.