GLBA / Reg P Notice
Effective August 25, 2026
Published by NAS Innovation LLC, a Massachusetts limited liability company, which operates Bao Budget.
This notice is given under Regulation P, 12 CFR Part 1016. The notice in section 2 reproduces the Appendix to Part 1016 model privacy form.
1. Scope and Relationship to Our Other Notices
1.1 This notice is our Regulation P privacy notice. It describes what we do with the nonpublic personal information of consumers and customers of our financial product or service.
1.2 It does not replace the Bao Budget Privacy Policy, which is broader: it covers website visitors, marketing analytics, product analytics, cookies and browser storage, and state privacy rights. Where a reader wants the complete picture, the Privacy Policy is the document to read.
1.2a Our bank-data aggregation provider is Quiltt. It is named, and its role described, in the Bao Budget Privacy Policy and in its subprocessor list.
1.2b Privacy questions and data-rights requests go to privacy@baobudget.com. That address is also published in the Privacy Policy and the U.S. State Privacy Notice.
2. The Model Privacy Form
FACTS — WHAT DOES NAS Innovation LLC DO WITH YOUR PERSONAL INFORMATION?
rev. August 2026
| Why? | Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do. |
| What? | The types of personal information we collect and share depend on the product or service you have with us. This information can include:<br>• Social Security number<br>• income<br>• account balances<br>• transaction history<br>• payment history<br>• assets |
| How? | All financial companies need to share customers' personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers' personal information; the reasons NAS Innovation LLC chooses to share; and whether you can limit this sharing. |
| Reasons we can share your personal information | Does NAS Innovation LLC share? | Can you limit this sharing? |
|---|---|---|
| For our everyday business purposes — such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus | Yes | No |
| For our marketing purposes — to offer our products and services to you | No | We don't share |
| For joint marketing with other financial companies | No | We don't share |
| For our affiliates' everyday business purposes — information about transactions and experiences | No | We don't share |
| For our affiliates' everyday business purposes — information about creditworthiness | No | We don't share |
| For our affiliates to market to you | No | We don't share |
| For nonaffiliates to market to you | No | We don't share |
Questions? Go to https://baobudget.com/support
Page 2
Who we are
| Who is providing this notice? | NAS Innovation LLC, a Massachusetts limited liability company, which operates Bao Budget. |
What we do
| How does NAS Innovation LLC protect my personal information? | To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings.<br><br>We encrypt data in transit and encrypt bank tokens and MFA secrets at the application layer. Enrolled second factors are required to export or delete your data. |
| How does NAS Innovation LLC collect my personal information? | We collect your personal information, for example, when you<br>• open an account<br>• provide account information<br>• give us your contact information<br>• give us your income information<br>• tell us about your investment or retirement portfolio<br><br>We also collect your personal information from other companies. |
| Why can't I limit all sharing? | Federal law gives you the right to limit only<br>• sharing for affiliates' everyday business purposes — information about your creditworthiness<br>• affiliates from using your information to market to you<br>• sharing for nonaffiliates to market to you<br><br>State laws and individual companies may give you additional rights to limit sharing. |
Definitions
| Affiliates | Companies related by common ownership or control. They can be financial and nonfinancial companies.<br>• NAS Innovation LLC has no affiliates |
| Nonaffiliates | Companies not related by common ownership or control. They can be financial and nonfinancial companies.<br>• NAS Innovation LLC does not share with nonaffiliates so they can market to you |
| Joint marketing | A formal agreement between nonaffiliated financial companies that together market financial products or services to you.<br>• NAS Innovation LLC doesn't jointly market |
3. Delivery and Timing
3.1 Initial notice. This notice is provided to each customer at the time the customer relationship is established, and made continuously available at https://baobudget.com/legal/glba-notice and from the app's settings menu. Questions about it, and any privacy or data-rights request, may be sent to privacy@baobudget.com.
3.2 Annual notice. Regulation P requires an annual notice unless the exception at 12 CFR 1016.5(e) (the FAST Act exception) is available.
3.3 Revised notice. If we change our sharing practices in a way this form describes, a revised notice will be delivered before the change takes effect where Regulation P requires it.
4. Changelog
| Version | Effective date (Rev.) | Change |
|---|---|---|
| 1.0 | August 25, 2026 | Initial publication. |