Privacy Policies

Banking services made available through OnePay are provided by Coastal Community Bank or Lead Bank, Members FDIC. Below are the Privacy Notices and Policies applicable to your OnePay accounts from OnePay and Coastal Community Bank or Lead Bank, as applicable.

OnePay GLBA Privacy Notice

Revised: May 2026

Synchrony Bank Privacy Policy for OnePay CashRewards World Mastercard and OnePay World Spend Card(s)

Revised: August 2025

Coastal Community Bank U.S. Consumer Privacy Notice

Revised:  June 2024

Lead Bank U.S. Consumer Privacy Notice

Revised: August 2024

OnePay Privacy Policy
Last Updated: May 15, 2026

This Privacy Policy applies to One Finance, Inc., OneProgress Services LLC, OneProgress Assets LLC, One Growth Portfolio LLC, Payment Progress LLC (collectively, “OnePay”, or “we”, “our”, and “us”) This Privacy Policy applies to all products, platforms, services, communications channels and other functionality offered by OnePay (collectively, the “Services”), including our websites (www.onepay.com and www.one.app) and mobile applications (the “OnePay Apps”) and describes how OnePay receives, uses, shares and otherwise processes Personal Information (as defined below) in connection with the Services.

1. GRAMM-LEACH-BLILEY ACT COVERED DATA

2. PERSONAL INFORMATION WE RECEIVE

3. HOW WE USE YOUR PERSONAL INFORMATION

4. THIRD PARTIES WHO MAY RECEIVE YOUR PERSONAL INFORMATION

5. U.S. STATE RESIDENTS’ PRIVACY RIGHTS AND CHOICES

6. RETENTION

7. CHILDREN'S PERSONAL INFORMATION

8. THIRD-PARTY PRIVACY PRACTICES

9. UPDATES TO THIS PRIVACY POLICY

10. CONTACT US

1. GRAMM-LEACH-BLILEY ACT COVERED DATA

If you apply for or have a financial product or service with us, we will use and share any Nonpublic Personal Information (“NPI”), as defined by the Gramm-Leach-Bliley Act (“GLBA”), that we collect from or about you in connection with your use of that product or service in accordance with our GLBA Privacy Notice, which offers you certain choices with respect to our collection, use, sharing, and processing of your NPI.


When you obtain or use financial products or services from OnePay that are issued by our bank partners, Coastal Community Bank or Lead Bank (each, a “Bank Partner”), those products or services are further subject to Synchrony Banks’s GLBA Privacy Notice, Coastal Community Bank’s GLBA Privacy Notice or Lead Bank’s GLBA Privacy Notice, as applicable. Each of our Bank Partner’s use of NPI that it receives is subject to its GLBA Privacy Notice.

2. PERSONAL INFORMATION WE RECEIVE 

“Personal Information” means any data that identifies, relates to, describes, is capable of being associated with, is linked to, or could reasonably be linked, directly or indirectly, with a person or household or any other data or information that constitutes “personal data,” “personal information,” or “personally identifiable information” under applicable privacy laws. When you use our Services we may receive Personal Information in a variety of ways, including directly from you and/or your devices, from third parties (including our affiliates, subsidiaries or other entities in our family of companies, including our affiliated retailer with distinct branding; partners, including our Bank Partners; your employer; credit bureaus; and other users), from publicly available sources, and through information that we collect automatically. We may receive the following categories of Personal Information:

• Identifiers: such as name, email, login credentials, address, phone number, password, date of birth, Social Security number, taxpayer identification number, military status, driver’s license or other government issued identification and numbers, and country of citizenship.

• Demographic Information: such as marital status, language preferences, citizenship status, race and gender.

• Geolocation Information: such as your city, state or zip code (including as inferred from your IP address), and may receive your precise geolocation, if you have location services enabled in the OnePay Apps (and with your consent, where required by applicable law). You can withdraw your consent for us to process your precise geolocation at any time by disabling location permission for the OnePay Apps within your device settings.

• Financial Information: such as bank account and routing numbers, debit and credit card details, direct deposit status, tax return information, credit score and credit history. We may also receive:

  • Linked Account Data: such as your account balance, transaction history, and information about the account owner.

  • Partner Account Information: information related to your accounts with third-party partners, including Bank Partners, whose products and services are made available through the OnePay Apps, such as your account balances, account activities, transaction history, relationship history, and account status.

  • Transaction Information: such as transaction amount, products or services purchased, the date and time of the transaction, merchant or beneficiary details, or ATMs associated with the transaction (We may receive this information from our partners when you use a payment card that is linked to your OnePay Wallet, whether used through or outside of the OnePay Wallet).

• Third Party Purchase Information: such as purchase history (including SKU number), customer relationship status, and enrollment status relating to third party’s rewards and promotional programs.

• Employment Information: such as your employee identification number, employment status, employee benefits, start and end dates, location of your workplace, payroll information, income, pay period, pay rate, shift schedule, job title, username and password for employer benefits and payroll, time and attendance records, or other human resources information systems.

• Communications With Us: such as the content of your communications with us when you engage with our AI features, including the content of your queries or prompts, the generated responses and any feedback you provide regarding these outputs, when you provide survey responses or questionnaire answers (including through video or phone call, which may be recorded for product improvement purposes), provide referrals, submit inquiries on our Services, engage with customer support (e.g., through phone or automated chat, or participate in research.

• Social Media Information: such as your usernames or handles, and the contents of your posts, comments and direct messages you send to us on social media platforms. The Personal Information we receive is dependent upon your privacy settings with the social media network.

• Job Applicant Information: such as employment history, education history, skills, language abilities, work permit status and sponsorship requirements, physical limitations and special accommodations needed, and other information provided by you and/or third parties, such as job application platforms, your current employer, references, background check providers and recruiters, when you apply for a job with us.

• Device and App / Website Usage Information:  We receive information about the computers, phones, and other devices you use to interact with our Services, such as IP address (which may be used to infer general location), hardware model, operating system information, mobile network information, device performance information, device identifiers, cookie IDs, browser type, browser language, internet service provider, and your network connection. We also receive information regarding your use of our Services, like the electronic path you take to our Services, through our Services and when exiting our Services, as well as your activity information on our Services, including how long you spent on a page, access time, information about your use of and actions on our Services, and your interaction with our chat feature. This information is typically collected through tracking technologies, such as cookies (both session cookies and persistent cookies), session replay technology, web beacons, email beacons, embedded scripts, and location-identifying technologies. To learn more about cookies and your ability to opt out of certain advertising cookies, please visit the following websites: http://www.aboutads.info/choices or http://www.networkadvertising.org/choices. You may also use your browser settings to manage your cookie preferences. Please note that if you disable certain cookies, you may not be able to receive or take full advantage of the Services.

• Content: such as photos and files saved on your devices (with your consent) or uploaded to the Services.

• Contacts: information you provide through integrating your contacts with the Services, such as a list of contacts saved to your devices and contact details. You can update your phone’s settings to stop sharing phone contacts information at any time.

Biometric Information
As part of verifying your account, we may ask you to upload to one of our service providers, Persona Identities, Inc. (“Persona”) a live selfie and a photo of your driver’s license or other government issued identification. Persona processes these images, including by generating data about your facial geometry (which may be considered biometric information in some jurisdictions) for the purposes of verifying your identity and preventing fraud. This may involve comparing the biometric information generated from your selfie to the biometric information generated from your ID, as well as comparing the biometric information generated from your images to the biometric information generated from other images. Persona stores the biometric information and uses it to perform ongoing identity-verification and fraud-prevention screenings and permanently deletes the data when it is no longer needed to fulfill those purposes, or within three years of the initial creation of the data, whichever is sooner. Persona relies on service providers to process the biometric information and other information for these purposes. For more information on Persona’s policies, please visit Persona’s Privacy Policy (https://withpersona.com/legal/privacy-policy). Persona sends OnePay the results of these screenings, but not the biometric information used to perform them. OnePay does not have access to the biometric information generated by Persona to perform these services.

3. HOW WE USE YOUR PERSONAL INFORMATION

We use Personal Information for the following purposes depending on which Services you use:

• To Provide and Customize Our Services To You: We use your Personal Information to provide our Services to you and personalize your experience, including to assess your eligibility for and recommend new Services to you, to manage your Services, provide an integrated user experience across our Services, to process transactions or payments, to operate and administer our rewards programs and other promotions that may be made available to you (including to customize your rewards offers and to determine how your activities meet the requirements for available rewards offers), and to carry out our obligations arising from any transactions you enter into with us. We may link or combine your activities on our Services with information from you or other parties to provide you with a personalized experience. Precise geolocation, which we use for certain features such as allowing you to find nearby ATMs and providing you with local rewards and deals, is only used when enabled. You can withdraw your consent at any time by disabling location permission for the OnePay Apps within your mobile device settings (though note that you may still receive rewards or deals based on your general location).

• To Communicate With You: We use Personal Information to communicate with you about your account or use of our Services, including about product updates, security alerts, technical notices, changes to our policies and terms, to respond to you when you contact us, and to provide customer service and support.

• To Advertise and Market Services: We use Personal Information to advertise and market our Services, as well as the services of our affiliates and our partners, including our Bank Partners, including through third-party advertising companies to serve you personalized advertisements and offers, through SMS text with your consent, and through emails, messages, and push notifications. You may unsubscribe from such emails and text messages at any time: just follow the unsubscribe instructions contained in any such communications. The advertisements, including rewards and deals, you see in the OnePay Apps, may be presented based on your geolocation information. We will not share your telephone number with third parties for their own marketing purposes.

• To Improve our Services and Perform Administrative Activities: We use Personal Information to operate, maintain, and improve our Services, including to research and develop new products and services; enhance, improve, debug and analyze our products and Services; manage our business relationships; and perform accounting, auditing, marketing and other functions.

• Authentication, Integrity, Security, and Safety: We use Personal Information to verify your identity, to protect against fraud, to evaluate risk, including of overdraft and to impose credit and other limits, to detect, investigate, and prevent malicious conduct, fraudulent activity or unsafe experiences, to address security threats, protect public safety, and to secure the Services.

• Job Applications: We may use Personal Information to assess job applications, including to communicate with you about your employment application, to verify your information and carry out reference checks and/or background checks and to assist you with obtaining an immigration visa or work permit when requested by you.

• Legal Reasons: We may use Personal Information as needed, or when otherwise we deem it necessary or appropriate, to comply with applicable laws, such as financial crime laws; respond to, investigate, or participate in valid legal process and proceedings, including from law enforcement or government agencies; to enforce or investigate potential violations of our Terms of Service, Privacy Policy, and other policies; to detect, prevent, or investigate potential fraud, abuse, or safety and security concerns, including threats to the public; to protect our, your or others’ rights, privacy, safety or property; and to resolve disputes.

• With Your Consent: We may also use your Personal Information for other purposes, with your consent.
  
  

4. THIRD PARTIES WHO MAY RECEIVE YOUR PERSONAL INFORMATION

We may share any of the categories of Personal Information set out in Section 2 of this Privacy Policy, for any of the purposes set out in Section 3 of this Privacy Policy, with:

• Affiliates: We may share your Personal Information with our affiliates, subsidiaries, or other entities in our family of companies, including our affiliated retailer.

• Service Providers: We work with service providers to provide services to us, such as identity verification, risk detection and fraud prevention, customer service, email delivery, processing and authorizing payments, facilitate ownership of account transfers, and to support and improve our Services and technical infrastructure, and may share Personal Information with such service providers to enable them to provide such services.

• Other Users: We may share Personal Information, such as your name, contact information or relationship with us, with other OnePay users in connection with peer-to-peer transfers, customer referrals or managing shared products. We will never share your payment card information or account numbers with other OnePay users.

• Your Employer: We may share your Personal Information, such as your name, employee identification number, employee benefits, place of employment, and information related to your paycheck, with your employer to facilitate providing the Services. We do not share information about your purchases or spending, the transactions to or from your bank account, the balance of your account, or information regarding your individualized financial situation with your employer.

• Bank Partners: We may share your Personal Information with our Bank Partners.

• Third-Party Partners: We partner with third-party companies, typically financial services companies, whose services or products may be accessed through our Services. If you choose to accept their services, we may share your Personal Information with such third-party financial services companies. This exchange of information is necessary to maintain business operations and to provide the ongoing services you’ve requested. Additionally, through our rewards partners, we may share your Personal Information with national payment card networks (Visa, Mastercard and American Express)

• Credit Bureaus: When you use certain Services, we share Personal Information with credit bureaus.

• Marketing, Advertising, and Analytics Partners: We may use third-party marketing, advertising, and business analytics partners, including Google Analytics, to deliver customized advertising on other websites or services you may use, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research. Click here to learn more about Google Analytics. We participate in interest-based advertising and use third-party advertising companies to serve you targeted advertisements based on your browsing history. Typically, though not always, the information used for interest-based advertising is collected through third-party tracking technologies, such as cookies, web beacons, embedded scripts, and location-identifying technologies, which recognize the device you are using and collect information, including device and usage information, as described in Section 2 of this Privacy Policy. We and our third-party partners use this information to make the advertisements you see online more relevant to your interests, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research. We may permit third-party online advertising networks, social media companies and other third-party services, to collect information about your use of our Services over time so that they may provide services to us, play or display ads on our Services, on other websites or services you may use, and on other devices you may use. We may also allow third parties, such as social media platforms, to collect information from our website visitors through a first-party pixel and such collection of information would be governed by the privacy policies of the company who provides the pixel. We may also share your Personal Information with our joint marketing partners.

• Change of Control: We may share Personal Information with actual or prospective acquirers, their representatives, and other relevant participants in the event of a corporate restructuring (e.g., merger, sale, joint venture, or other disposition) or change in control involving all or a portion of our business or assets, including in connection with bankruptcy or similar proceedings.

• Legal Reasons: We may share Personal Information as needed, or when otherwise we deem it necessary or appropriate, to comply with applicable laws, including financial crime laws; respond to, investigate, or participate in valid legal process and proceedings, including from law enforcement or government agencies; to enforce or investigate potential violations of our Terms of Service, Privacy Policy and other policies; to detect, prevent, or investigate potential fraud, abuse, or safety and security concerns, including threats to the public; to protect our, your or others’ rights, privacy, safety or property; and to resolve disputes.

• With Your Consent: We may also share your Personal Information with other third parties, with your consent.
  
  

5. U.S. STATE RESIDENTS’ PRIVACY RIGHTS AND CHOICES

If you are a resident of certain U.S. states, you may have certain rights in addition to those set forth in our GLBA Privacy Notice to manage your Personal Information (other than Personal Information that we collect and process subject to GLBA) under U.S. state laws, as set forth below:

• Transparency: Certain U.S. state laws require that we notify consumers at or before the collection of their Personal Information of the categories of Personal Information we have collected about consumers in the preceding 12 months, the categories of sources from which such Personal Information is collected, our purposes for collecting such Personal Information, whether such Personal Information is “sold” or “shared”, and the length of time we intend to retain each such category of Personal Information, or if that is not possible, the criteria we use to determine our retention periods, among other information. This Privacy Policy contains such information in Section 2, Section 3, Section 4, this Section 5 and Section 6. Please read it, as well as any other terms that are provided to you at or before the collection of your Personal Information, carefully.

• Access: Right to request access to the categories of your Personal Information that we have collected, processed, disclosed, or “sold”, as well as the specific pieces of your Personal Information that we have collected or processed, the categories of sources from which we have collected such Personal Information, the categories or a list of third parties to whom we have disclosed, “sold” or “shared” such Personal Information, and our purposes for collecting, “selling” or “sharing” such Personal Information.

• Data Portability: Right to obtain a copy of your Personal Information in a portable and, to the extent technically feasible, readily usable format.

• Correction: Right to correct inaccurate or incomplete Personal Information in certain circumstances. Please note, however, that information related to your creditworthiness is maintained by the credit bureaus. If you find that there is an error or you want to dispute the information found in your credit report, please contact the credit reporting bureaus: Experian, Transunion, and Equifax.

• Deletion: Right to delete Personal Information about you, subject to certain exceptions.

• Opt Out of Processing (“Sales”, “Sharing” and Targeted Advertising): We do not sell your Personal Information in the conventional sense (i.e., for money). However, as is common practice among companies that operate online, we may use advertising and analytics services that are intended to analyze your interactions with our Services, based on information obtained from cookies or other trackers, including for delivering advertising to you (such as interest-based, targeted, or cross-context behavioral advertising). With respect to your interactions on our Services, we may disclose certain of this information, including device and usage information, to third parties, and such disclosure may be considered a “sale” and/or “sharing” of Personal Information under various state laws. You can opt out of the processing of your Personal Information for purposes of targeted advertising and the “sale” and “sharing” of your Personal Information by implementing the Global Privacy Control (“GPC”) in your browser. For instructions on how to download and use GPC, please visit https://globalprivacycontrol.org. You can also opt out of the processing of your Personal Information for purposes of targeted advertising and the “sale” and “sharing” of your Personal Information by clicking “Your Privacy Choices” on www.onepay.com. Your opt-out decision is specific to a particular device and browser. If you use a different browser or device, you will need to opt out on each. Additionally, if you clear your cookies, you will need to opt out again. Please note that even if you opt out of the “sale” and “sharing” of your Personal Information, we may still use essential cookies to track your use of our Services, including for purposes of operating the Services and for legal and security reasons, such as detecting and preventing fraud. We do not have actual knowledge that we “sell” or “share” the Personal Information of consumers under 16 years of age.

• Opt Out of “Profiling”: Right to opt out of “profiling” in furtherance of “decisions that produce legal effects or effects of similar significance” (as such terms or similar terms are defined by applicable U.S. state laws). We do not profile in furtherance of such decisions and therefore do not provide this right.

• Limit the Use and Disclosure of Sensitive Personal Information:  We may process certain information that is considered sensitive under certain U.S. state laws, such as Social Security and driver’s license numbers, race and citizenship status, biometric information and precise geolocation, as described in more detail in Section 2 above. We do so only with your consent where required by applicable U.S. state laws. We only process such sensitive Personal Information in order to provide the Services, or as otherwise permitted by applicable U.S. state laws, such that we are not required to provide the right to limit the use or disclosure of sensitive Personal Information.

• Non-Discrimination: The right to not be discriminated against for exercising any of the foregoing rights. However, please note that if the exercise of these rights limits our ability to process Personal Information (such as in the case of a deletion request), we may no longer be able to provide you our products and Services or engage with you in the same manner.

• Shine the Light: California residents who have an established business relationship with us have the right to know how their information is disclosed to third parties for their direct marketing purposes under California’s “Shine the Light” law (Civ. Code §1798.83). We do not share Personal Information with third parties for such purposes.

To exercise your right to access, correct or delete your Personal Information, please submit a request by contacting us at support@onepay.com, 1-855-830-6200 or writing to us at: One Finance, Inc., P.O. Box 513717, Los Angeles, CA 90051. We will acknowledge your request within 10 business days of receipt, and within 45 calendar days of receipt we will either provide a substantive response or notify you of an extension period of up to an additional 45 calendar days and a reason for that extension. You can also correct and delete certain information directly in the OnePay Apps.

Before processing your request, we will need to verify your identity and confirm your residency. To do so, we will generally either require the successful authentication of your account, or the matching of sufficient information you provide us to the information we maintain about you in our systems. This process may require us to request additional Personal Information from you, including, but not limited to, your email address and phone number.

In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to verify your identity or locate your information in our systems or where no U.S. state laws apply to our processing of your Personal Information because it is collected and processed subject to GLBA. If we are unable to comply with all or a portion of your request, we will explain the reasons for declining to comply with the request in our substantive response.

You may designate an authorized agent to submit your verified consumer request by providing written permission and verifying your identity, or through proof of power of attorney. The authorized agent must provide a letter signed by you confirming the agent has permission to submit a request on your behalf or must provide sufficient evidence to show that the authorized agent has been lawfully vested with power of attorney. For security purposes, where an authorized agent does not have power of attorney, we may need to verify your identity and confirm directly with you that you have provided the authorized agent permission to submit the request. We may deny a request in the event we are not able to verify the authorized agent’s authority to act on your behalf. Please note that for privacy and security reasons, we will direct future communications to the consumer on whose behalf the request was made.

If we deny your request, some states afford you the right to appeal our decision. You may do so by contacting us at support@onepay.com, 1-855-830-6200 or writing to us at: One Finance, Inc., P.O. Box 513717, Los Angeles, CA 90051. Within 45 days of receipt, we will notify you in writing of our decision and the reasons therefor.

Notice of Financial Incentive

From time to time, we may ask you to participate in surveys, questionnaires, and research activities, and offer you rewards, such as gift cards or cash, in exchange for your participation. You may opt in by agreeing to participate. Additionally, we may offer you the opportunity to participate in rewards programs where you can earn points or other benefits by linking your payment cards. You may choose not to participate in these programs and may cease participation at any time by unlinking your card within the OnePay mobile application for the rewards programs and by ending the call or choosing not to fill out the webform for the research activities. Please note that you will not receive rewards unless you complete the survey, questionnaire, or research activity for which it was offered or, in the case of rewards programs, complete a qualifying purchase meeting the specific requirements of an active offer. In connection with such programs and activities, we may collect your name, general location, payment card information, and transactions data as shared by national payment card networks, as well as information about your experience with OnePay, your recommendations, your views on new features and functionality, and any other information that you choose to provide to us. We have made a good faith determination that the value of participants’ Personal Information processed in connection with such programs, activities, and research equivalent to the value of the rewards we offer in connection therewith.

6. RETENTION

We may retain Personal Information for as long as necessary for the purposes described in this Privacy Policy, or as otherwise permitted or required by law. In determining our retention periods, we use the following criteria: our relationship with you, the choices you have made with respect to your Personal Information, the permissibility of retention (including for backup and archival purposes), our legal and regulatory rights and obligations (including with respect to the prevention of fraud and abuse).

We do not delete your Personal Information upon deactivation of your account. Although your deactivated status is reflected promptly in our user databases, we may retain your Personal Information for a variety of purposes, including legal compliance, backups and archiving, prevention of fraud and abuse, and analytics. Upon deactivation of your account, you will no longer receive emails from us and links to third-party financial accounts and services will automatically terminate. If you have a money transfer transaction pending at the time you deactivate your account, your link to this service from us will terminate but your pending transfer will continue to completion and your bank account will remain open.

7. CHILDREN’S PERSONAL INFORMATION

Our Services are not directed to, and we do not intend to, or knowingly, collect or solicit Personal Information from children under the age of 16. If you believe that a child under the age of 16 may have provided us with Personal Information without parental consent, please contact us.

8. THIRD-PARTY PRIVACY PRACTICES

This Privacy Policy covers our privacy practices only. This Privacy Policy does not apply to the practices of third parties, including third parties with whom we partner, third parties whose products or services may be accessed through the Services, and third-party websites and applications linked to within the Services. Third-party products, services, websites, and applications are governed by each such third party’s privacy policy, which we encourage you to read carefully. We are not responsible for the privacy policies or practices of third parties, and we are not responsible for the failure of third parties to honor their privacy obligations. By including a third-party product or service or a link to a third-party website or application in our Services, we do not endorse or recommend any products or services offered by such third party or information contained therein. If you decide to use a third-party product or service or visit a third-party website or application via a link contained on the Services, you do so at your own risk.

9. UPDATES TO THIS PRIVACY POLICY

When we make changes to this Privacy Policy, we will change the date at the beginning of this document. If we make material changes to this Privacy Policy, we will notify individuals by either email to their registered email address, by prominently posting within the OnePay Apps, or through other appropriate communication channels. All changes shall be effective from the date of publication unless otherwise provided.

10. CONTACT US

If you have any questions or requests in connection with this Privacy Policy or other privacy-related matters, or if you need assistance exercising any of the choices described in this Privacy Policy, contact us at support@onepay.com, call us at: 1-855-830-6200 or write to us at: One Finance, Inc., P.O. Box 513717, Los Angeles, CA 90051.