Last updated: May 12, 2026

Privacy

In this Privacy Policy (“Policy”), we describe how Fortify Education, Inc. (“Fortify,” “we,” “us,” or “our”) collects, uses, and discloses information that we obtain about visitors to our website (the “Site”), users of any of our technology platforms, including https://apply.fortifyedu.com, https://schools.fortifyedu.com, and the Site (collectively, the “Software”) and the services available through our Site and Software (collectively, the “Services”).

By visiting the Site, using the Software, or using any of our Services, you agree that your personal information will be handled as described in this Policy. Your use of our Site or Services, and any dispute over privacy, is subject to this Policy and to our Terms of Service, including its applicable limitations on damages and the resolution of disputes. In addition, if you have executed a customer agreement with us, we will use your information in accordance with both this Policy and the terms of our agreement. If there is a conflict between your customer agreement and this Policy, then your customer agreement will govern.

Information We Collect About You

We collect information about you directly from you, from third parties, and automatically through your use of our Site, Software or Services.

Information We Collect Directly from You

The information we collect from you depends on how you use our Services.

We collect information from you when you register an account with the Software. Registration with us is mandatory in order to be able to use the basic features of the Software. When you register with us and use the Software, you generally provide (a) your name, email address, password and other registration information; (b) information you provide us when you contact us for help, and; (c) information you enter into our system when applying for a loan, such as your name, phone, personal contact information, your social security number, street address, citizenship status, and proof of your identity via linking your bank account and providing Fortify with your official government ID.
If you are a student, we collect information about you when you apply for a loan about the qualifying educational courses you are enrolled in or considering enrolling in. We may also collect information about when you start (or plan to start) and complete these courses.
If you are a school, when you use the Site or Software, we will collect your name, email address, user name, password, bank information, and other registration information.
We collect information about you when you contact us through the Site. For example, if you request a demo or submit an inquiry, or engage in a chat, we will collect your name, contact information, information about your Company, and your communications with us.

Information We Collect From Other Entities

We also may collect information about you from other organizations and sources.

We may license or otherwise obtain information about our potential users from public records databases and private sources of information. This information may include licensure and certification records, credit profiles, and risk scoring from other third-party identities.
All information used in underwriting your application for a loan is in compliance with the Fair Credit Reporting Act and other required acts as specified by law. Read these acts to know your rights. If you have any questions, please contact us at help@fortifyedu.com.

Information that We Collect About You from Social Media Services

You also may log into our Services through your social media accounts. If you log into our Services using your social media account's credentials, you must enter your social network login information. We then collect your name, email address, phone number, and profile picture from your social media profile. If you allow us to have access to this information, then we will have access to this information even if you have chosen not to make that information public on your social media account.

We store the information that we receive from your social media account with other information that we collect from you or receive about you. Any third-party social media site controls the information it collects from you. For information about how a social media site may use and disclose your information, including any information you make public, please consult their respective privacy policies. We have no control over how any social media site uses or discloses the personal information it collects about you.

Information We Collect Automatically

We automatically collect information about your use of our Site and Software through cookies, web beacons, and other technologies, including technologies designed for mobile applications. We may make inferences from other data, including inferences created from the personal information collected from you above. We also may use tools that allow us to monitor how you navigate the Site, Software and Services, to help us improve the Site, Software and Services and to identify and diagnose bugs. By agreeing to the terms of service, you consent to the collection and monitoring of your navigation of the Site, Software, and Services in this manner. To the extent permitted by applicable law, we combine this information with the other information we collect about you, including your personal information. Please see the section “Cookies and Other Tracking Mechanisms” below for more information.

Site:

Domain name;
Your browser type and operating system;
Web pages you view on the Site; links you click on the Site; your IP address; your location data;
The length of time you visit our Site and or use our Services;
The referring URL, or the webpage that led you to our Site.

Software:

Device name and model; operating system type, name, and version;
Device identifiers, your device's IP address, and your device's advertising ID.
Device language settings.
Your activities within the Software, information you enter into the Software, the length of time that you are logged into our Software, and links you click while in the in the Software.
Camera and photos. With your permission, we will access your device's camera and/or photos so you can upload your content to the Services, such as a profile picture or government ID document.
Device calendar information. With your permission, we will access your device's calendar to help you schedule interviews with potential employers.
Contact list information. With your permission, we will collect information from your device's contact list, including your contacts' names and contact information. We collect this information so you can send invites to your contacts to join the Services.

How And Why We Use Your Information

We use your information, including your personal information, for the following purposes:

Service Provisioning/Transactional Purposes

To provide our Site, Software and Services to you.
To evaluate your application for financing (if you are a Student) and approve or deny you for such financing; or, if you are a School, to facilitate the application and enrollment of Students for financing at approved and qualifying educational programs.
To provide you with financing for qualifying educational programs, if approved; and to service any loan agreements and contracts you may have executed with us in connection with such financing.
To communicate with you about your use of our Site, Software and Services; to fulfill your requests, to respond to your inquiries, and for other customer service purposes.
To tailor the content and information that we may send or display to you, to provide access to content relevant to your loan or content you have signed up for or purchased or licensed from us, to provide personalized help and instructions, and to otherwise personalize your experiences while using the Site, Software or the Services. For example, we may use the information we collect about you to aid you with financial literacy counseling or job search support at your request.

Marketing Communications

In accordance with applicable laws, we may use your information:

To send you marketing communications about our and our affiliates' products and services.
To send you news, newsletters, and event information.

Advertising

To assist us in determining relevant advertising content and media.
To evaluate the success of our advertising campaigns (including our online and offline advertising campaigns).
To create Custom Audiences and lookalike audiences for our own advertising.
See also the Ad Networks section discussed below for information about our own online advertising.

Services and Product Improvement/Research

To better understand how users access and use our Site, Software and Services, both on an aggregated and individualized basis. For example, we will evaluate which features of our Software and Services are more (or least) used by users, and we will use this information to update or add new features to our Software and Services. We may monitor your usage of the Site, Software, and Services to find bugs and improve the user experience for future users of the Site, Software, and Services. We may also use feedback provided by you to update our Services or develop new offerings.
To administer surveys and questionnaires, such as to evaluate user engagement, for market research or customer satisfaction purposes.
To create aggregated, anonymized, pseudonymized or de-identified data sets. We may use such data sets for research, product improvement and development, marketing, advertising, trend analysis and other purposes.

Legal Purposes

To comply with legal obligations and act in accordance with legal authorizations, as part of our general business operations, and for other business administration purposes, including to comply with our legal and regulatory requirements, such as authenticating your identity and maintaining customer records, to monitor your compliance with your agreements with us, to collect debts owed to us, to safeguard our business interests, and to manage or transfer our assets or liabilities, for example in the case of an acquisition, disposition or merger, as described below.
Where we believe necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person or property, or violations of this Policy, your customer agreement, and any applicable terms of use.
For other purposes we may inform you about from time to time. Where required by applicable laws and regulations, we will obtain your consent if we wish to use your personal information for purposes requiring such consent.

How We Share Your Information

We may share your information, including personal information, as follows:

Gathering information to evaluate your application for financing. The Fortify platform is a lending service that provides financing options to qualified users at qualifying educational institutions. When you create an account on our Software, you allow Fortify to share your personal information with all necessary partners and third-parties that we use in order to evaluate financing applications. You additionally allow Fortify to share that information directly with the educational institution you report that you're applying for financing at, in order to verify your personal information, tuition amounts, and your enrollment status.
Job Opportunities. If an employer that Fortify works with expresses interest in your candidacy, we will facilitate scheduling an interview, which may include sharing your and the employer's contact information.
Service Providers. We disclose the information we collect from you to service providers, contractors or agents who perform functions on our behalf.
Affiliates. We disclose the information we collect from you to our affiliates or subsidiaries.
Acquirers of your loan. If you sign a loan agreement with Fortify, your loan may be sold or held to a third-party. You allow us to share your personal information with third parties that acquire or are considering acquiring your loan. In scenarios where your loan is sold, a federal regulation called the Holder Rule applies which additionally protects your rights in such a scenario. Please reference your loan agreement with Fortify for additional details.

Specific third-party privacy policies

Plaid. Your personal information may be disclosed to Plaid as a service provider, and will be handled in accordance with the Plaid End User Privacy Policy.
Stripe. Your personal information may be disclosed to Stripe as a service provider, and will be handled in accordance with the Stripe Privacy Policy.
Finix. Your personal information may be disclosed to Finix as a service provider, and will be handled in accordance with the Finix Privacy Policy, which may be updated from time to time in Finix's sole discretion and without notice.
Google. Your personal information may be disclosed to Google Maps/Google Earth as a service provider, and will be handled in accordance with the specific extended Terms of Use for Google Maps/Google Earth, as well as Google's general Terms of Use and Privacy Policy.
TransUnion. Your personal information may be disclosed to TransUnion as a service provider, and will be handled in accordance with the TransUnion Privacy Policy.
Sentry. Your personal information, and the contents of your communications or interactions with the Site, Software, and Services, may be disclosed to Sentry as a service provider, and will be handled in accordance with the Sentry Privacy Policy.
Intercom. Your personal information, and the contents of your communications or interactions with the Site, Software, and Services, may be disclosed to Intercom as a service provider, and will be handled in accordance with the Intercom Privacy Policy.
Rock and Welch. Your personal information may be disclosed to Rock and Welch, LCC (OFAC-API.com) as a service provider, and will be handled in accordance with the Rock and Welch Privacy Policy.
Incomplete List. This is not a complete list of the third party service providers that Fortify may disclose your information to.

We also disclose information in the following circumstances:

Business Transfers. If (i) we or our affiliates are or may be acquired by, merged with, financed by or invested in by another company, or (ii) if any of our assets are or may be transferred to another company, whether as part of a bankruptcy or insolvency proceeding or otherwise, we may transfer the information we have collected about you to the other company. As part of the business transfer process, we may share certain of your personal information with lenders, auditors, and advisors, including attorneys and consultants.
In Response to Legal Process. We disclose your information to comply with the law, a judicial proceeding, court order, law enforcement request, or other legal process, such as in response to a subpoena.
To Regulating Bodies. Fortify may be required to share your personal information with regulatory bodies, such as state or federal agencies, in the case when we are requested to comply with an audit or other directive from an appropriately authorized state or federal government agency.
To Protect Us and Others. We disclose your information when we believe it is appropriate to do so to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of our Terms of Service, customer agreement or this Policy, or as evidence in litigation in which we are involved.
Aggregate and De-Identified Information. We share aggregate, anonymized, or de-identified information about users with third parties for marketing, advertising, research or similar purposes.

Our Use of Cookies and Other Tracking Mechanisms

We and our service providers use cookies and other tracking mechanisms, such as session replay software, to track information about your use of our Site, Software or Services. We may combine this information with other personal information we collect from you (and our service providers may do so on our behalf). We use tools that may allow third parties (including our service providers) to monitor or access the contents of your communications or interactions with the Site, Software, and Services.

Cookies

Cookies are alphanumeric identifiers that we transfer to your device's hard drive through your web browser for record-keeping purposes. Some cookies allow us to make it easier for you to navigate our Site, Software, and Services, while others are used to enable a faster log-in process or to allow us to track your activities at our Site, Software and Services. There are two types of cookies: session and persistent cookies.

Session Cookies. Session cookies exist only during an online session. They disappear from your device when you close your browser or turn off your device. We use session cookies to allow our systems to uniquely identify you during a session or while you are logged into the Site and Services. This allows us to process your online transactions and requests and verify your identity, after you have logged in, as you move through our Site and Services.
Persistent Cookies. Persistent cookies remain on your device after you have closed your browser or turned off your device. We use persistent cookies to track aggregate and statistical information about user activity.

Disabling Cookies

Most web browsers automatically accept cookies, but if you prefer, you can edit your browser options to block them in the future. The Help portion of the toolbar on most browsers will tell you how to prevent your computer from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable cookies altogether. Visitors to our Site, Software, and Services who disable cookies will be able to browse certain areas of the Site and Software, but some features may not function.

Clear GIFs, pixel tags and other technologies

Clear GIFs are tiny graphics with a unique identifier, similar in function to cookies. In contrast to cookies, which are stored on your computer's hard drive, clear GIFs are embedded invisibly on web and app pages. We may use clear GIFs (a.k.a. web beacons, web bugs or pixel tags), in connection with our Site, Software and Services to, among other things, track the activities of Site visitors and Software users, help us manage content, and compile statistics about Site and Software usage. We and our service providers also use clear GIFs in HTML emails to our customers, to help us track email response rates, identify when our emails are viewed, and track whether our emails are forwarded.

Analytics

We may use automated devices and applications, such as Google Analytics to evaluate usage of our Site, and to the extent permitted, our Softwares. We also may use other analytic means to evaluate our Site and Softwares. We use these tools to help us improve our Site's and Softwares' performance and user experiences. These entities may use cookies and other tracking technologies, such as web beacons or local storage objects (LSOs), to perform their services. To learn more about Google's privacy practices, please review the Google Privacy Policy at https://www.google.com/policies/privacy/. You can also download the Google Analytics Opt-out Browser Add-on to prevent their data from being used by Google Analytics at https://tools.google.com/dlpage/gaoptout.

Screen Recording, Session Replay, and Keystroke Tracking

We may use screen recording software, session-replay software, or keystroke tracking software to monitor your usage of our Site, Software, and Services in order to facilitate product development and to improve our user experience. Third-parties that Fortify uses as a service provider, including but not limited to Sentry, may monitor or access the contents of your communication or interactions with the Site, Software, and Services, including these screen recordings, session replays, and keystroke logs.

AI-driven chatbots

We may use AI driven features in customer support interactions in order to provide you with a better user experience. To facilitate this, third parties may monitor or access the contents of your communication or interactions with the Site, Software, and Services.

Do-Not-Track

Currently, our systems do not recognize browser “do-not-track” requests. You may, however, disable certain tracking as discussed in this section (e.g., by disabling cookies); you also may opt-out of targeted advertising by following the instructions below in the Ad Network section.

Ad Networks

We may use network advertisers to serve advertisements on unaffiliated websites and other media (e.g., social networking platforms). This enables us and these network advertisers to target advertisements to you for products and services in which you might be interested. Ad network providers, advertisers, sponsors and/or traffic measurement services may use cookies, JavaScript, web beacons (including clear GIFs), Flash LSOs and other tracking technologies to measure the effectiveness of their ads and to personalize advertising content to you. These cookies and other technologies are governed by each entity's specific privacy policy, not this one. We may provide these parties with information, including personal information, about you.

Facebook. We may disclose certain information (such as your email address) to Facebook Custom Audiences (for more information on Facebook Custom Audience, go here, or to opt-out, go to the Facebook ad preferences page) — so that we can better target ads and content to you and others with similar interests on other websites or media (“Custom Audiences”). We may also work with other ad networks and marketing platforms that enable us and other participants to target ads to Custom Audiences submitted by us and others. You may also control how Facebook and other ad networks display certain ads to you, as explained further in their respective privacy policies or by using the opt-outs described below.

Users in the United States may opt out of many ad networks. For example, you may go to the Digital Advertising Alliance (“DAA”) Consumer Choice Page for information about opting out of interest-based advertising and their choices regarding having information used by DAA companies. You may also go to the Network Advertising Initiative (“NAI”) Consumer Opt-Out Page for information about opting out of interest-based advertising and their choices regarding having information used by NAI members. Software users may also download the AppChoices tool to manage interest-based advertising on their mobile device. Opting out from one or more companies listed on the DAA Consumer Choice Page, the NAI Consumer Opt-Out Page, or the AppChoices tool will opt you out from those companies' delivery of interest-based content or ads to you, but it does not mean you will no longer receive any advertising through our Software, Services, or on other websites or online media. You may continue to receive advertisements, for example, based on the particular website that you are viewing (i.e., contextually based ads). Also, if your browsers are configured to reject cookies when you opt out on the DAA or NAI websites, your opt out may not be effective. Additional information is available on the DAA's website at www.aboutads.info or the NAI's website at www.networkadvertising.org.

User Generated Content

We invite you to post content on our Services where allowed, including your comments, pictures, and any other information that you would like to be available on our Services. If you post content to our Services, any and all information that you post may be available to all visitors to our Site, and your username will also be available to all registered users on our Services. If you post your own content on our Services, your posting may become public and we cannot prevent such information from being used in a manner that may violate this Policy, the law, or your personal privacy.

Links

Our Site, Software and Services may contain links to non-affiliated websites and online services, including links included in the posts of other users. Any access to and use of such linked websites is not governed by this Policy, but instead is governed by the privacy policies of those websites or online services. We are not responsible for the information practices of such websites or online services.

Security of My Personal Information

We have implemented reasonable precautions to protect the information we collect from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. Please be aware that despite our efforts, no data security measures can guarantee security.

You should take steps to protect against unauthorized access to your password, phone, device, and computer by, among other things, signing off after using a shared device, choosing a robust password that nobody else knows or can easily guess, and keeping your log-in and password private. We are not responsible for any lost, stolen, or compromised passwords or for any activity on your Fortify account via unauthorized password activity.

Access to My Personal Information

You may modify certain personal information that you have submitted by contacting Fortify at help@fortifyedu.com. Please note that copies of information that you have updated, modified or deleted may remain viewable in cached and archived pages of the Services for a period of time, and Fortify may retain all versions of your personal information on file in connection with our responsibility to service and collect on your loan, if you have one, as well as to meet regulatory requirements.

What Choices Do I Have Regarding Promotional Emails?

In accordance with applicable law, we may send periodic promotional communications to you. You may opt-out of such communications by following the opt-out instructions contained in the communication. We will process opt-out requests in accordance with applicable law. If you opt-out of receiving promotional communications, we may still send you communications about your account, required disclosures, or any services (such as those in connection with a loan agreement) that you have requested or received from us. Software users may enable or disable push notifications from Fortify by adjusting their Software or device settings.

Children Under 13

Our Services are not designed for children under 13. If we discover that a child under 13 has provided us with personal information, we will promptly delete such information from our systems.

Contact Us

If you have questions about the privacy aspects of our Site, Software, or Services, or would like to make a complaint, please contact us at help@fortifyedu.com.

Changes to this Policy

This Policy is current as of the Effective Date set forth above. We may change this Policy from time to time, so please be sure to check back periodically. We will post any changes to this Policy on our Site and Software. If we make any changes to this Policy that materially affect our practices with regard to the personal information we have previously collected from you, we will endeavor to provide you with notice in advance of such change by highlighting the change on our Site and Software.

Additional Privacy Notice For California Residents

In this section, we provide additional information to California residents about how we handle their personal information, as required under California privacy laws, including the California Consumer Privacy Act (“CCPA”). This section does not address or apply to our handling of publicly available information lawfully made available by state or federal government records or other personal information that is exempt under the CCPA, such as anonymous, deidentified, or aggregated information. To the extent that we process such deidentified personal information, we will make no attempt to reidentify such data.

This section was last updated on August 25th, 2024 (the “California Policy Addendum Last Updated Date”).

Information we collect from you

This section extends the Information We Collect About You section found above in this Privacy Policy. While our collection, use and disclosure of personal information varies based upon our relationship and interactions with you, in this section we describe, generally, how we have collected and disclosed personal information about California consumers in the prior 12 months from the California Policy Addendum Last Updated date. We may collect personal information from the following sources:

directly from you
advertising networks
data analytics providers
social networks
operating systems and platforms
government entities
business customers (e.g. referrals)

Why we process your information

Please see the How and Why We Use Your Information section found above in this Privacy Policy.

How we may disclose and sell your information

The sections below identify the categories of personal information (as defined by the CCPA) we collect about California consumers, as well as how we may disclose for a business or commercial purpose such information to third parties and service providers. For more information about the business and commercial purposes for which we may collect, use and disclose personal information, please refer to the How And Why We Use Your Information and the How We Share Your Information sections above.

Personal Identifiers. Includes direct identifiers, such as your name, email address, phone number, date of birth, social security number, and other contact information; your IP address and other online identifiers; license and certification identifiers; and other similar identifiers. We may disclose this information. We do not sell this information. We may disclose this information to the following categories of third parties: • partner schools • service providers, such as business operations tools, customer support tools, data analytics providers, sales and marketing tools, IT infrastructure services, payment processors, sub-servicers, risk and compliance software, and contractors • private buyers of your loan • government entities and law enforcement • affiliates and subsidiaries • advertising networks • data analytics providers • social networks

Customer Records. Includes other personal information, such as your name, social security number, citizenship status, physical street addresses, phone numbers, credit history, OFAC screening reports, bank account information, government ID documents, or any other information that you may provide us when applying for financing with Fortify or when you register for an account or otherwise enter into an agreement with us related to our products and services. We may disclose this information. We do not sell this information. We may disclose this information to the following categories of third parties: • partner schools • service providers, such as business operations tools, customer support tools, data analytics providers, sales and marketing tools, IT infrastructure services, payment processors, sub-servicers, risk and compliance software, and contractors • private buyers of your loan • government entities and law enforcement • affiliates and subsidiaries • advertising networks • data analytics providers • social networks

Commercial Information. Includes records of any products or services purchased, obtained, or considered, or other use histories or tendencies. For example, this may include records of the Fortify Services that you applied for, used, or considered, or your financing history and the key terms of your loan. We may disclose this information. We do not sell this information. We may disclose this information to the following categories of third parties: • partner schools • service providers, such as business operations tools, customer support tools, data analytics providers, sales and marketing tools, IT infrastructure services, payment processors, sub-servicers, risk and compliance software, and contractors • private buyers of your loan • government entities and law enforcement • affiliates and subsidiaries • advertising networks • data analytics providers • social networks

Usage Data. Includes browsing history, clickstream data, search history, access logs and other usage data and information regarding an individual's interaction with our Site, Software, and Services, and our marketing emails and online ads. This includes session replay software or screen recording software, which may monitor your usage of the Site, Software, and Services. We may disclose this information. We do not sell this information. We may disclose this information to the following categories of third parties: • partner schools • service providers, such as business operations tools, customer support tools, data analytics providers, sales and marketing tools, IT infrastructure services, payment processors, sub-servicers, risk and compliance software, and contractors • private buyers of your loan • government entities and law enforcement • affiliates and subsidiaries • advertising networks • data analytics providers • social networks

Audio, Video, and Electronic Data. Includes audio, electronic, visual, thermal, olfactory, or similar information, photographs and images (e.g., that you provide us or post to your profile) and call recordings (e.g., of customer support calls that you make). We may disclose this information. We do not sell this information. We may disclose this information to the following categories of third parties: • partner schools • service providers, such as business operations tools, customer support tools, data analytics providers, sales and marketing tools, IT infrastructure services, payment processors, sub-servicers, risk and compliance software, and contractors • private buyers of your loan • government entities and law enforcement • affiliates and subsidiaries • advertising networks • data analytics providers • social networks

Professional Information. Includes your professional and employment-related information, such as your employment history, your resume/CV, professional licenses and certifications, and professional memberships. We may disclose this information. We do not sell this information. We may disclose this information to the following categories of third parties: • partner schools • service providers, such as business operations tools, customer support tools, data analytics providers, sales and marketing tools, IT infrastructure services, payment processors, sub-servicers, risk and compliance software, and contractors • private buyers of your loan • government entities and law enforcement • affiliates and subsidiaries • advertising networks • data analytics providers • social networks.

Education Information. Information about your educational history, such as the schools you've attended, the degrees or certificates you were awarded, and the associated dates. This includes information about education you may be considering, such as educational programs you apply for financing through Fortify for. We may disclose this information. We do not sell this information. We may disclose this information to the following categories of third parties: • partner schools • service providers, such as business operations tools, customer support tools, data analytics providers, sales and marketing tools, IT infrastructure services, payment processors, sub-servicers, risk and compliance software, and contractors • private buyers of your loan • government entities and law enforcement • affiliates and subsidiaries • advertising networks • data analytics providers • social networks.

How long we keep your data

We do not retain data for any longer than is necessary for the purposes described in this Policy. We generally retain data according to the guidelines outlined below.

Personal Identifiers. This includes information referenced in the “Personal Identifiers” sub-section of the “How we may disclose and sell your information” section above. We keep this data as long as is required for us to fulfill loan agreements or executed contracts with you, and as long as a federal or state regulatory body may require us to keep it on file for consumer records. We may retain this data to comply with legal obligations or security obligations. We will delete or anonymize this data within 10 years of your last active transaction with us.

Customer Records. This includes information referenced in the “Customer Records” sub-section of the “How we may disclose and sell your information” section above. We keep this data as long as is required for us to fulfill loan agreements or executed contracts with you, and as long as a federal or state regulatory body may require us to keep it on file for consumer records. We will delete or anonymize this data within 10 years of your last active transaction with us.

Commercial Information. This includes information referenced in the “Commercial Information” sub-section of the “How we may disclose and sell your information” section above. We will retain any data collected until you opt-out or request its deletion.

Usage Data. This includes information referenced in the “Usage Data” sub-section of the “How we may disclose and sell your information” section above. We keep this data as long as is required for us to fulfill loan agreements or executed contracts with you, and as long as a federal or state regulatory body may require us to keep it on file for consumer records. We will delete or anonymize this data within 10 years of your last active transaction with us.

Audio, Video, and Electronic Data. This includes information referenced in the “Audio, Video, and Electronic Data” sub-section of the “How we may disclose and sell your information” section above. We keep this data as long as is required for us to fulfill loan agreements or executed contracts with you, and as long as a federal or state regulatory body may require us to keep it on file for consumer records. We will delete or anonymize this data within 10 years of your last active transaction with us.

Professional Information. This includes information referenced in the “Professional Information” sub-section of the “How we may disclose and sell your information” section above. We keep this data as long as is required for us to fulfill loan agreements or executed contracts with you, and as long as a federal or state regulatory body may require us to keep it on file for consumer records. We will delete or anonymize this data within 10 years of your last active transaction with us.

Educational Information. This includes information referenced in the “Educational Information” sub-section of the “How we may disclose and sell your information” section above. We keep this data as long as is required for us to fulfill loan agreements or executed contracts with you, and as long as a federal or state regulatory body may require us to keep it on file for consumer records. We will delete or anonymize this data within 10 years of your last active transaction with us.

Privacy Requests/Opt-Out Requests. We retain records related to privacy requests for as long as necessary to comply with our legal obligations. We will further retain a record of opt-out requests to prevent sending you communications.

Information sharing and selling

We do not “sell” your data, meaning that we do not receive monetary or valuable consideration in exchange for providing your data to third parties. We do not knowingly sell or share the personal information of consumers 16 years of age or less for cross-context behavioral advertising.

Rights of California Residents under the CCPA

Right to Opt-Out of Sales. You have the right to opt-out of the sale of your personal information to any third parties. Fortify does not “sell” your data, as referenced in the section above on Information Sharing and Selling.

Right to Access. You have the right to access the personal information we have collected about you, including the categories of personal information, the categories of sources of personal information, the categories of personal information that we have disclosed for a business purpose or sold, the categories of third parties to whom we have sold or disclosed for a business purpose your personal information, the business or commercial purposes for collecting, disclosing, and selling personal information, and a copy of the specific pieces of personal information we have about you. If you exercise this right more than twice in a 12-month period, we may require you to pay a small fee for further requests within the 12-month period.

Right to Correct. You have the right to correct any inaccuracies you may find in your personal information, taking into account the nature of the personal information provided and our purposes for processing it. We may require documentation of the validity of updated personal information, such as a physical address or citizenship status, before processing the change. We will notify appropriate third parties (such as contractors and service providers) that you have requested the correction of your personal information.

Right to Delete. You have the right to request deletion of your personal information that you have provided to us. Subject to certain exceptions, including but not limited to limitations imposed by an ongoing loan agreement you have executed with us, or a regulatory requirement to preserve customer records, we will delete your personal information from our records and notify appropriate third parties (such as contractors and service providers) that you have requested the deletion of your personal information.

Right to Limit the Use of Sensitive Personal Information. You have the right under the CCPA to limit the use of your sensitive personal information to infer characteristics about you. Fortify does not currently use your sensitive personal information to infer characteristics about you.

Right to Non-Discrimination. If you exercise your rights under the CCPA, we will not discriminate against you - for example, by altering your pricing, key loan terms, or offering you a different quality of service. If you are a job applicant, a contractor, or a current or former employee of Fortify, we will not retaliate against you in any way for exercising your rights under the CCPA.

Submitting a CCPA Request

California residents may submit a privacy request by emailing Fortify at help@fortifyedu.com.

Identity Verification. Requests to opt-out of sales or requests to limit the use of sensitive personal information do not require verification. To exercise other rights you have under the CCPA, however, Fortify will need to verify that you are the consumer who is the subject of the CCPA request, for example, by asking you to confirm certain information about yourself that we already have on file, or verifying that you have access to the email address that we have on file for you. If we cannot verify your identity, Fortify cannot fulfill your request under the CCPA. Fortify may also need to verify your identity as a California resident.

Authorized Agents. The authorized agent of a California resident may also submit a rights request by emailing us at help@fortifyedu.com. Any requests submitted by an authorized agent will still require identity verification of the consumer who is the subject of the request, if appropriate. We may also require the consumer who is the subject of the request to prove that they authorized an agent to submit a privacy request on their behalf, either by directly verifying their identity with us, or by directly confirming with us that they provided permission to the authorized agent to submit the request. If the authorized agent has power of attorney, pursuant to California Probate Code (section 4121-4130), they may also directly submit proof of statutory power of attorney, in which case Fortify will not require separate consumer verification.

Additional Information

If you have trouble accessing and interpreting this notice, or require more information about our privacy practices, you may contact us as set forth in the Contact Us section above.

Additional Privacy Notice For Oregon Residents

In this section, we provide additional information to Oregon residents about how we handle their personal information, as required under Oregon privacy laws, including the Oregon Consumer Privacy Act (“OCPA”). This section does not address or apply to our handling of publicly available information lawfully made available by state or federal government records or other personal information that is exempt under the OCPA, such as anonymous, deidentified, or publicly available information.

This section was last updated on August 25th, 2024 (the “Oregon Policy Addendum Last Updated Date”).

Profiling

The OCPA gives consumers the right to opt out of any automated profiling that produces legal effects, such as approval for a loan. Fortify uses automated profiling to make legal decisions with your personal information, such as approval for financing applications at qualifying educational institutions. We may use the personal information that we collect, defined above in the “Information We Collect About You” section of this Privacy Policy, in the manner described in the “How and Why We Use Your Information” section. To opt-out, please refer to the section below that describes your rights under the OCPA and how to create a privacy request.

Data Selling

We do not “sell” your data, meaning that we do not receive monetary or valuable consideration in exchange for providing your data to third parties. We do not knowingly process your personal information for targeted advertising.

Rights of Oregon Residents Under the OCPA

Right to Access. You have the right to know about the personal data we have obtained about you, and to confirm whether or not we are processing it. You have the right to retrieve a portable and easily understandable copy of your personal data, that allows you to transmit it to another party. If you exercise this right more than twice in a 12-month period, we may require you to pay a small fee for further requests within the 12-month period.

Right to Opt-Out. Fortify does not sell your personal data or process it for targeted advertising. As we do use automated profiling to make legal decisions with your personal information, such as evaluating your application for financing at a qualifying educational institution, you have the right to opt-out of such use.

Right to Non-Discrimination. If you exercise your rights under the OCPA, we will not discriminate against you - for example, by altering your pricing, key loan terms, or offering you a different quality of service. If you are a job applicant, a contractor, or a current or former employee of Fortify, we will not retaliate against you in any way for exercising your rights under the OCPA.

Submitting a OCPA Request

Oregon residents may submit a privacy request by emailing Fortify at help@fortifyedu.com.

Authentication. After we receive your request, we will verify the information you provide by matching information that we have on file for you. If we are unable to authenticate you, we may ask you for additional information. If you are unable to provide additional information, or we are unable to reasonably authenticate the request on our own, we cannot fulfill your request under the OCPA.

Authorized Agents. You may authorize an agent to submit a Request to Opt-Out on your behalf. Fortify will comply with such requests if we are able to authenticate your identity and able to verify the agent's authority to act on your behalf.

Appeals. If we decline to fulfill any of your privacy requests, you may request an appeal of that decision within 90 days of the date of our original decision. To create an appeal, please email Fortify at arbitration@fortifyedu.com, with a subject line of “Appeal an OCPA Decision”. If you believe that Fortify has violated your rights and you are unable to reach a resolution with us, you may file a complaint directly to the Consumer Protection office of the Oregon Department of Justice.

Additional Privacy Notice For Florida Residents

In this section, we provide additional information to Florida residents about how we handle their personal information, as required under Florida privacy laws, including the Florida Digital Bill of Rights (“FDBR”).

This section was last updated on August 25th, 2024 (the “Florida Policy Addendum Last Updated Date”).

Data Selling

The FDBR prevents businesses from selling your sensitive personal data without providing you notice and getting your consent first. We do not “sell” your sensitive personal data, meaning that we do not receive monetary or valuable consideration in exchange for providing your sensitive personal data to third parties.

Additional Privacy Notice For Colorado Residents

In this section, we provide additional information to Colorado residents about how we handle their personal information, as required under Colorado privacy laws, including the Colorado Privacy Act (“CPA”). This section does not address or apply to our handling of publicly available information lawfully made available by state or federal government records or other personal information that is exempt under the CPA, such as anonymous, deidentified, or publicly available information.

This section was last updated on August 25th, 2024 (the “Colorado Policy Addendum Last Updated Date”).

Profiling

The CPA gives consumers the right to opt out of any automated profiling that produces legal effects, such as approval for a loan. Fortify uses automated profiling to make legal decisions with your personal information, such as approval for financing applications at qualifying educational institutions. We may use the personal information that we collect, defined above in the “Information We Collect About You” section of this Privacy Policy, in the manner described in the “How and Why We Use Your Information” section. To opt-out, please refer to the section below that describes your rights under the CPA and how to create a privacy request.

Data Selling

Rights of Colorado Residents Under the CPA

Right to Non-Discrimination. If you exercise your rights under the CPA, we will not discriminate against you - for example, by altering your pricing, key loan terms, or offering you a different quality of service. If you are a job applicant, a contractor, or a current or former employee of Fortify, we will not retaliate against you in any way for exercising your rights under the CPA.

Submitting a CPA Request

Colorado residents may submit a privacy request by emailing Fortify at help@fortifyedu.com.

Appeals. If we decline to fulfill any of your privacy requests, you may request an appeal of that decision within 90 days of the date of our original decision. To create an appeal, please email Fortify at arbitration@fortifyedu.com, with a subject line of “Appeal a CPA Decision”. If you believe that Fortify has violated your rights and you are unable to reach a resolution with us, you may file a complaint directly to the office of the Colorado Attorney General.

Additional Privacy Notice For Connecticut Residents

In this section, we provide additional information to Connecticut residents about how we handle their personal information, as required under Connecticut privacy laws, including the Connecticut Data Privacy Act (“CTDPA”). This section does not address or apply to our handling of publicly available information lawfully made available by state or federal government records or other personal information that is exempt under the CTDPA, such as anonymous, deidentified, or publicly available information.

This section was last updated on August 25th, 2024 (the “Connecticut Policy Addendum Last Updated Date”).

Profiling

The CTDPA gives consumers the right to opt out of any automated profiling that produces legal effects, such as approval for a loan. Fortify uses automated profiling to make legal decisions with your personal information, such as approval for financing applications at qualifying educational institutions. We may use the personal information that we collect, defined above in the “Information We Collect About You” section of this Privacy Policy, in the manner described in the “How and Why We Use Your Information” section. To opt-out, please refer to the section below that describes your rights under the CTDPA and how to create a privacy request.

Data Selling

Rights of Connecticut Residents Under the CTDPA

Right to Non-Discrimination. If you exercise your rights under the CTDPA, we will not discriminate against you - for example, by altering your pricing, key loan terms, or offering you a different quality of service. If you are a job applicant, a contractor, or a current or former employee of Fortify, we will not retaliate against you in any way for exercising your rights under the CTDPA.

Submitting a CTDPA Request

Connecticut residents may submit a privacy request by emailing Fortify at help@fortifyedu.com.

Appeals. If we decline to fulfill any of your privacy requests, you may request an appeal of that decision within 90 days of the date of our original decision. To create an appeal, please email Fortify at arbitration@fortifyedu.com, with a subject line of “Appeal a CTDPA Decision”. If you believe that Fortify has violated your rights and you are unable to reach a resolution with us, you may file a complaint directly to the office of the Connecticut Attorney General.

Additional Privacy Notice For Texas Residents

In this section, we provide additional information to Texas residents about how we handle their personal information, as required under Texas privacy laws, including the Texas Data Privacy and Security Act (“TDPSA”). This section does not address or apply to our handling of publicly available information lawfully made available by state or federal government records or other personal information that is exempt under the TDPSA, such as anonymous, deidentified, or publicly available information.

This section was last updated on August 25th, 2024 (the “Texas Policy Addendum Last Updated Date”).

Profiling

The TDPSA gives consumers the right to opt out of any automated profiling that produces legal effects, such as approval for a loan. Fortify uses automated profiling to make legal decisions with your personal information, such as approval for financing applications at qualifying educational institutions. We may use the personal information that we collect, defined above in the “Information We Collect About You” section of this Privacy Policy, in the manner described in the “How and Why We Use Your Information” section. To opt-out, please refer to the section below that describes your rights under the TDPSA and how to create a privacy request.

Data Selling

Rights of Texas Residents Under the TDPSA

Right to Non-Discrimination. If you exercise your rights under the TDPSA, we will not discriminate against you - for example, by altering your pricing, key loan terms, or offering you a different quality of service. If you are a job applicant, a contractor, or a current or former employee of Fortify, we will not retaliate against you in any way for exercising your rights under the TDPSA.

Submitting a TDPSA Request

Texas residents may submit a privacy request by emailing Fortify at help@fortifyedu.com.

Appeals. If we decline to fulfill any of your privacy requests, you may request an appeal of that decision within 90 days of the date of our original decision. To create an appeal, please email Fortify at arbitration@fortifyedu.com, with a subject line of “Appeal a TDPSA Decision”. If you believe that Fortify has violated your rights and you are unable to reach a resolution with us, you may file a complaint directly to the office of the Texas Attorney General.

Additional Privacy Notice For Utah Residents

In this section, we provide additional information to Utah residents about how we handle their personal information, as required under Utah privacy laws, including the Utah Consumer Privacy Act (“UTCPA”). This section does not address or apply to our handling of publicly available information lawfully made available by state or federal government records or other personal information that is exempt under the UTCPA, such as anonymous, deidentified, or publicly available information.

This section was last updated on August 25th, 2024 (the “Utah Policy Addendum Last Updated Date”).

Profiling

The UTCPA gives consumers the right to opt out of any automated profiling that produces legal effects, such as approval for a loan. Fortify uses automated profiling to make legal decisions with your personal information, such as approval for financing applications at qualifying educational institutions. We may use the personal information that we collect, defined above in the “Information We Collect About You” section of this Privacy Policy, in the manner described in the “How and Why We Use Your Information” section. To opt-out, please refer to the section below that describes your rights under the UTCPA and how to create a privacy request.

Data Selling

Rights of Utah Residents Under the UTCPA

Right to Non-Discrimination. If you exercise your rights under the UTCPA, we will not discriminate against you - for example, by altering your pricing, key loan terms, or offering you a different quality of service. If you are a job applicant, a contractor, or a current or former employee of Fortify, we will not retaliate against you in any way for exercising your rights under the UTCPA.

Submitting a UTCPA Request

Utah residents may submit a privacy request by emailing Fortify at help@fortifyedu.com.

Appeals. If we decline to fulfill any of your privacy requests, you may request an appeal of that decision within 90 days of the date of our original decision. To create an appeal, please email Fortify at arbitration@fortifyedu.com, with a subject line of “Appeal a UTCPA Decision”. If you believe that Fortify has violated your rights and you are unable to reach a resolution with us, you may file a complaint directly with the Utah Division of Consumer Protection.

Additional Privacy Notice For Virginia Residents

In this section, we provide additional information to Virginia residents about how we handle their personal information, as required under Virginia privacy laws, including the Virginia Consumer Data Protection Act (“VCDPA”). This section does not address or apply to our handling of publicly available information lawfully made available by state or federal government records or other personal information that is exempt under the VCDPA, such as anonymous, deidentified, or publicly available information.

This section was last updated on August 25th, 2024 (the “Virginia Policy Addendum Last Updated Date”).

Profiling

The VCDPA gives consumers the right to opt out of any automated profiling that produces legal effects, such as approval for a loan. Fortify uses automated profiling to make legal decisions with your personal information, such as approval for financing applications at qualifying educational institutions. We may use the personal information that we collect, defined above in the “Information We Collect About You” section of this Privacy Policy, in the manner described in the “How and Why We Use Your Information” section. To opt-out, please refer to the section below that describes your rights under the VCDPA and how to create a privacy request.

Data Selling

Rights of Virginia Residents Under the VCDPA

Right to Non-Discrimination. If you exercise your rights under the VCDPA, we will not discriminate against you - for example, by altering your pricing, key loan terms, or offering you a different quality of service. If you are a job applicant, a contractor, or a current or former employee of Fortify, we will not retaliate against you in any way for exercising your rights under the VCDPA.

Submitting a VCDPA Request

Virginia residents may submit a privacy request by emailing Fortify at help@fortifyedu.com.

Appeals. If we decline to fulfill any of your privacy requests, you may request an appeal of that decision within 90 days of the date of our original decision. To create an appeal, please email Fortify at arbitration@fortifyedu.com, with a subject line of “Appeal a VCDPA Decision”. If you believe that Fortify has violated your rights and you are unable to reach a resolution with us, you may file a complaint directly with the office of the Virginia Attorney General.

Fortify Privacy Policy

Version 2.1.0