Illinois Biometric Information Privacy Act (BIPA) Notice

This notice is provided to residents of Illinois under the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. ("BIPA"), and to all users who want to understand how biometrics work in Milli.

The Milli app lets you sign in using Face ID or Touch ID. These features are provided by Apple through the iOS LocalAuthentication framework. When you use them: - your face geometry or fingerprint is captured, stored, and matched only on your device, in Apple's Secure Enclave; - Milli receives only a "yes" or "no" result indicating whether authentication succeeded; and - Milli never receives, collects, captures, stores, or has access to your biometric identifiers or biometric information.

Android equivalents operate the same way through the Android BiometricPrompt API.

2. Written Policy and Retention Schedule

Because Milli does not collect or possess biometric identifiers or biometric information, Milli does not retain any such data. If Milli ever introduces a feature that would collect biometric identifiers or information (for example, selfie-based identity verification for the Milli Elite Card), Milli will, before any collection: 1. inform you in writing that biometric identifiers or information are collected or stored; 2. inform you in writing of the specific purpose and length of time for which they are collected, stored, and used; 3. obtain your written release; and 4. permanently destroy the data when the initial purpose has been satisfied, or within 3 years of your last interaction with Milli, whichever occurs first, unless a longer period is required by a valid warrant or subpoena.

3. No Sale or Profit

Milli will never sell, lease, trade, or otherwise profit from biometric identifiers or biometric information.

4. No Disclosure

Milli will not disclose, redisclose, or disseminate biometric identifiers or information, except as permitted by BIPA section 15(d), including with your consent or as required by law.

5. Protection

If Milli ever possesses biometric data, it will store, transmit, and protect that data using the reasonable standard of care within the financial services industry and in a manner at least as protective as the way Milli protects other confidential and sensitive information.

6. Your Control

Biometric sign-in is optional. You can turn it off at any time in the Milli app under Settings, or in your device settings, and use your passcode instead.

7. Contact

Questions about this notice can be sent to support@drivemilli.com.