BluePen Compliance Privacy Policy

Version: 3.0 Effective date: November 1, 2026

---

1. Introduction and Scope

1.1 What this policy covers. This Privacy Policy explains how BluePen Compliance, a d/b/a of Riley Lennox Holdings LLC ("BluePen", "we", "us" or "our") collects, uses, shares and protects personal information. It applies to bluepencompliance.com, our applications, Reports and related services (the "Services").

1.2 Who it covers. This policy covers: (a) visitors to our website; (b) individuals who use the Services for a bank, credit union or other financial institution ("Bank Users"); (c) independent compliance consultants and their staff ("Consultants"); (d) business contacts at banks and consulting firms whom we may contact about the Services ("Business Contacts"); and (e) people who contact us.

1.3 Business context. The Services are designed for business and professional use. They are not intended for consumers acting for personal, family or household purposes.

1.4 Defined terms. Capitalized terms not defined here have the meanings given in our Terms of Service (the "Terms").

1.5 What it does not cover. This policy does not cover how Banks or Consultants handle personal information they receive from each other outside the Services. Each of them is responsible for its own practices.

2. Who We Are

2.1 BluePen Compliance is a d/b/a of Riley Lennox Holdings LLC, an Oklahoma limited liability company, 12101 N MacArthur Blvd, Suite A160, Oklahoma City, OK 73162.

2.2 Riley Lennox Holdings LLC decides how and why personal information collected through the Services is processed and is responsible for it.

3. Information We Collect

3.1 Information you give us

(a) Account information. Name, work email, password (stored in hashed form), job title, organization, phone number (if provided) and account preferences.

(b) Google sign-in. If you sign in with Google, we receive the information Google shares with your permission, typically your name, email address, profile picture and a Google account identifier. We do not receive your Google password.

(c) Consultant profile information. Specialties, services, experience, employment history, education, professional credentials and certifications, license details (issuing body, number and expiration), service regions, rates, availability, biography, photo, LinkedIn profile URL, references and work samples.

(d) Credential documents. Certificates, license copies and other supporting documents you upload for credential checks.

(e) Bank and institution information. Institution name, FDIC certificate or NCUA charter number, state, asset size, primary regulator, and your role at the institution.

(f) Marketplace activity. Requests, Proposals, bids, unlocks, interview invitations, messages, live chat, call bookings, ratings or reviews (if offered), and Credit use and return history.

(g) AI Feature inputs and files. The questions, prompts and context you enter into Ask BP or other AI Features, the answers you give in readiness scans, any policy files you upload, and the AI Output generated.

(h) Payment information. Billing name, billing address and plan details. Card details are collected and stored by our payment processor, Stripe, not by BluePen. We receive only limited details, such as card type, last four digits, expiration date and transaction records. Consultants who receive payouts for Paid Expert Calls provide their payout and tax information to Stripe.

(i) Communications. Support requests, feedback, survey answers and emails you send us.

3.2 Information from other sources

(a) Credential checks. To check Consultant credentials, we review public information, such as public license and certification registries and issuing-body directories, and your LinkedIn profile and other publicly available professional information. We do not obtain consumer reports or background checks.

(b) Public institution data. For the Directory and Reports, we use public data from sources such as the FDIC, the FFIEC, public CRA performance evaluations and public enforcement actions. This is mostly information about institutions, not individuals, but it may include the names of officers or contacts that appear in public records.

(c) Business contact information. We may collect the names, job titles, work email addresses and work phone numbers of Business Contacts from public sources, such as institution and firm websites, public regulatory records and professional networking profiles, so that we can contact them about the Services.

(d) Service providers. For example, payment status from Stripe and delivery data from our email provider.

3.3 Information collected automatically

(a) Usage and device data. IP address, browser and device type, operating system, pages and features used, search terms, referring URLs, dates and times, and crash and error logs.

(b) Cookies and similar technologies. See Section 8.

3.4 Information we ask you not to provide

Do not provide confidential supervisory information (CSI), nonpublic personal information about a financial institution's customers (Consumer NPI), Social Security numbers, customer account numbers or health information, including in uploaded files. If we find such information, we may delete it. See Section 13.

4. How We Use Information

We use personal information to:

4.1 create and manage accounts, including through Google sign-in;

4.2 verify Banks, check Consultant credentials, and display "Verified" or "Unverified" labels;

4.3 operate the marketplace: show Consultant profiles to Bank Users, match Requests to Consultants and send alerts, deliver Proposals and messages, and share contact details after an interview invitation;

4.4 provide the Directory, Reports, PDF exports, alerts, readiness scans and AI Features;

4.5 process payments, subscriptions, renewals, Credits, refunds and payouts;

4.6 send service messages, such as confirmations, security notices, renewal reminders and policy updates;

4.7 send marketing emails about the Services to Users and Business Contacts, who may opt out at any time (Section 11.4);

4.8 provide support and respond to requests;

4.9 monitor, secure, debug and improve the Services and develop new features;

4.10 prevent and investigate fraud, abuse, security incidents and violations of our Terms;

4.11 comply with law, respond to lawful requests, and establish, exercise or defend legal claims; and

4.12 carry out any other purpose we describe when we collect the information, or that you consent to.

We may create de-identified or aggregated information that does not identify you, any User or any Bank, and use it for any lawful purpose, such as benchmarks. We will not try to re-identify it.

5. How We Share Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising or targeted advertising. We share personal information only as follows:

5.1 With Bank Users. Consultant profile information, such as name, photo, specialties, experience, credentials, credential labels, rates and service regions, is visible to signed-in Bank Users. When a Consultant submits a Proposal, the Bank sees the Proposal and the credentials attached from the Consultant's profile. After a Bank sends an interview invitation, the Consultant's contact details are shared with that Bank.

5.2 With Consultants. Before an interview invitation, Consultants see only limited information about a Bank's Request, such as its asset-size band, region and primary regulator. After an interview invitation, the Bank's name and the inviting Bank User's contact details are shared with that Consultant.

5.3 Credential documents and uploaded files. Uploaded credential documents are visible only to you and BluePen's review team. Banks see the credential label, not the document itself, unless you choose to share it. Policy files uploaded to a readiness scan are private to your account, except that they are processed by our AI model providers as described in Section 7.

5.4 Service providers. We share information with providers that help us run the Services, under contracts that limit their use of it to providing services to us. These include providers of: (a) cloud hosting, databases and authentication (including Google sign-in); (b) content delivery and security; (c) payment processing (Stripe); (d) email delivery; (e) customer support; (f) AI models for Ask BP and other AI Features; and (g) web fonts, which receive your IP address when fonts load.

5.5 Legal and safety. We may disclose information when we believe in good faith that it is necessary to: (a) comply with law, a subpoena or a court order; (b) respond to requests from government or regulatory authorities; (c) enforce our Terms; or (d) protect the rights, property or safety of BluePen, our Users or others.

5.6 Business transfers. Information may be transferred as part of a merger, acquisition, financing, reorganization, bankruptcy or sale of assets. It will remain subject to the protections in this policy.

5.7 With your consent or at your direction. For example, when you share a Report with a third party or share a question with a Consultant (Section 7.4).

6. Public and Profile Information

6.1 Information you place in your Consultant profile may be seen by other Users as described in Section 5.1.

6.2 Information in the Directory comes from public government sources and reflects those records.

6.3 If you believe public information about you is shown incorrectly, contact us. We will review it, but we may be unable to change official source data.

7. Ask BP and Other AI Features

7.1 Storage. Your Ask BP conversations and readiness scan inputs are stored in your account so you can return to them. They are kept for the retention period in Section 9.2.

7.2 AI providers. To generate responses, your inputs, including uploaded policy files, are sent to third-party AI model providers acting as our service providers. We select providers whose terms limit their use of your inputs to providing services to us.

7.3 No training by BluePen. BluePen does not use your AI Feature inputs, uploaded files or AI Output to train AI models. Authorized BluePen personnel may access them only as needed to provide support, investigate abuse or security issues, or comply with law.

7.4 Sharing with Consultants. When you use "Book a Call" or "Talk to a live expert", only the question you choose to share is passed to the Consultant, as editable preparation notes. Your full conversation is not shared automatically.

7.5 Sensitive data. Do not enter CSI, Consumer NPI or other sensitive data into any AI Feature.

8. Cookies and Similar Technologies

8.1 What we use. We use cookies, local storage and similar technologies: (a) Strictly necessary: for sign-in, security and bot protection, site delivery and remembering preferences. These are required for the Services to work. (b) Payments: Stripe may set cookies for fraud prevention during checkout. (c) Analytics and advertising: We may use analytics tools to understand how the Services are used and to improve them. We do not sell personal information or share it for cross-context behavioral advertising. If we add advertising technologies, we will update this policy first and provide any required opt-outs.

8.2 Your choices. You can block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop the Services from working.

8.3 Global Privacy Control. We honor Global Privacy Control (GPC) signals. When we detect a GPC signal, we treat it as a request to opt out of the sale or sharing of personal information and of targeted advertising for that browser and, if you are signed in, for your account. Because we do not sell or share personal information or engage in targeted advertising, a GPC signal does not change how the Services work for you.

8.4 Do Not Track. There is no common industry standard for "Do Not Track" browser signals, and we do not respond to them. We honor GPC as described in Section 8.3.

9. Data Retention

9.1 General rule. We keep personal information for as long as your account is active and as needed for the purposes in this policy, and then delete or de-identify it.

9.2 Typical periods. (a) Account and profile data, credential documents, AI Feature conversations and uploaded files: for the life of the account. When you request deletion of your account, deletion is completed 30 days after your request, except as described in Section 9.3. (b) Transaction, billing and tax records: 7 years after the transaction, for accounting and tax purposes. (c) Marketplace and acceptance records (Requests, Proposals, unlocks, interview invitations, Paid Expert Call records and Terms acceptance logs): 5 years after account closure, to resolve disputes and enforce our Terms. (d) Business Contact information: until the contact asks us to stop contacting them or to delete it, after which we keep only what we need to honor the request. (e) Logs and security data: generally up to 12 months. (f) Backups: deleted information may remain in encrypted backups until they are overwritten in the normal course, generally within 90 days.

9.3 Exceptions. We may keep information longer where the law requires it, for an active dispute or investigation, or to prevent fraud.

10. Data Security

10.1 Safeguards. We use reasonable administrative, technical and physical safeguards suited to the nature of the information. These include encryption in transit, access controls, hashed passwords, limiting staff access to those who need it, and private storage for credential documents and uploaded files.

10.2 No guarantee. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10.3 Your part. Protect your login details and tell us right away at Support@bluepencompliance.com if you suspect unauthorized access.

10.4 Breach notice. If a security incident affects your personal information, we will notify you and regulators as required by applicable law.

11. Your Choices and Rights

11.1 Account settings. You can update your profile and account information, pause your Consultant profile and change notification settings in your account.

11.2 Data export. You can download a copy of your data with Export My Data in Account Controls on your Profile page, or ask us for a copy.

11.3 Deletion. You can delete your account in Account Controls on your Profile page or ask us to delete your personal information. Deletion is completed 30 days after your request, subject to the exceptions in Section 9.3.

11.4 Marketing messages. You can unsubscribe from marketing emails at any time using the link in any marketing email or by emailing us. We honor unsubscribe requests within 10 business days. You will still receive service and transactional messages while you have an account. We send marketing text messages only to people who have given prior express written consent; reply STOP to opt out.

11.5 How to make a request. Email Support@bluepencompliance.com with the subject line "Privacy Request". (a) We will verify your identity, usually by confirming control of your account email address. (b) An authorized agent may make a request for you with proof of authorization. (c) We will not discriminate against you for exercising your rights.

12. U.S. State Privacy Rights

12.1 Which laws. Several U.S. states give residents rights over their personal information, including California (CCPA, as amended by the CPRA), Colorado, Connecticut, Virginia, Utah, Texas, Oregon and Montana, and Oklahoma from January 1, 2027. These laws apply to BluePen only where BluePen meets their thresholds and the information is within their scope; some exclude information collected in a business-to-business or employment context. We will honor the requests in this Section for all U.S. Users and Business Contacts, where applicable and to the extent reasonably possible.

12.2 Your rights. Depending on your state, you may have the right to: (a) know or access the categories and specific pieces of personal information we collect, its sources, the purposes for which we use it, and the categories of third parties to which we disclose it; (b) correct inaccurate information; (c) delete personal information; (d) receive a portable copy; (e) opt out of the sale or sharing of personal information, targeted advertising, and profiling that produces legal or similarly significant effects (we do not do any of these); (f) limit the use of sensitive personal information (we use it only to provide the Services and do not use it to infer characteristics about you); and (g) not be discriminated against for exercising these rights.

12.3 Categories collected in the past 12 months.

12.4 Appeals. If we deny your request, you may appeal by replying to our decision or by emailing Support@bluepencompliance.com with the subject line "Privacy Appeal". We will respond within the time required by law. If you are not satisfied, you may contact your state attorney general.

12.5 Response times. We will respond within 45 days. Where the law allows, we may extend this once by up to 45 more days and will tell you if we do.

13. GLBA Statement

13.1 Who GLBA protects. The Gramm-Leach-Bliley Act (GLBA) protects nonpublic personal information that financial institutions collect about their consumers and customers.

13.2 BluePen does not receive Consumer NPI. The Services are not designed to collect, receive or process Consumer NPI, and BluePen is not a service provider that receives Consumer NPI from Banks. The personal information we process relates to business users of the Services (Bank Users and Consultants), Business Contacts and public institution data.

13.3 Do not upload it. Banks and Consultants must not upload Consumer NPI to the Services. If we discover it, we may delete it.

13.4 Engagements. Any Consumer NPI that a Bank shares with a Consultant during an Engagement must be handled under their own agreement and the Bank's GLBA obligations, outside the Services.

14. Children's Privacy

14.1 The Services are intended for adults acting in a professional capacity and are not directed to children.

14.2 We do not knowingly collect personal information from anyone under 18, including children under 13.

14.3 If you believe a child has given us personal information, contact us and we will delete it.

15. International Users

15.1 The Services are operated in, and intended for use in, the United States.

15.2 Personal information is processed in the United States and in other countries where our service providers operate. Data protection laws in those countries may differ from those in your country.

15.3 If you access the Services from outside the United States, you do so on your own initiative, and your information will be transferred to and processed in the United States.

16. Third-Party Links and Services

16.1 The Services may link to third-party sites and services, such as Google, LinkedIn, the FDIC and other government sites, Stripe and video-call tools.

16.2 Their privacy practices are governed by their own policies, and we are not responsible for them.

16.3 Google sign-in. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

17. Changes to This Policy

17.1 We may update this Privacy Policy from time to time. We will post the updated version with its version number and effective date.

17.2 For material changes, we will notify you by email or in the Services before they take effect.

17.3 If a change would allow us to use previously collected personal information in a materially different way, we will ask for your consent where the law requires it.

18. Contact Us

For questions, requests or complaints about this Privacy Policy or our data practices, contact:

BluePen Compliance, a d/b/a of Riley Lennox Holdings LLC Attn: Privacy 12101 N MacArthur Blvd, Suite A160 Oklahoma City, OK 73162 Email: Support@bluepencompliance.com