August 29, 2025
This privacy policy applies to:
This Policy applies when you interact with us through our Services. It also applies anywhere it is linked. It does not apply to third-party websites, mobile applications, or services that may link to the Services or be linked to from the Services. Please review the privacy policies on those websites and applications directly to understand their privacy practices.
Our products and services are used by enterprises to make onboarding, ongoing, and credit decisions about applicants and customers for financial products and services. In this Policy, “you” refers to individuals who administer or use our products and services or otherwise interact with us on behalf of our Clients (“Client Representatives”) and other individuals who are not affiliated with our Clients but who interact with our Services (“Visitors”). “Clients” refers to the enterprises that use or seek to use our products and services, and “Client Customers” refers to applicants and customers of our Clients.
This Policy is incorporated into, and considered a part of, the First Mile Group Terms of Service, currently located at www.alloy.com/tos. Any capitalized terms not defined herein have the meanings ascribed to them in the Terms of Service.
We may change this Policy from time to time. If we do, we will notify you by posting the updated version. Any changes to the Policy will become effective upon being posted to the Services, except when we notify Clients and/or Client Representatives about material changes by email (sent to the email address specified in your account) or by posting a notice to our website prior to the change becoming effective.
Information Client Representatives Give Us
Information We Collect Automatically
Information We Collect About Visitors and Client Representatives From Other Sources
Information We Collect About Client Customers From Other Sources
How We Use Visitor and Client Representative Information
How We Use Client Customer Information
Options and Rights Regarding Your Information
Privacy Disclosures for Specific Jurisdictions
European Economic Area, United Kingdom, and Switzerland
California Consumer Privacy Act
Contact Information, Submitting Requests, and Our Response Procedures
Making a Request to Exercise Your Rights
We collect information from you directly, from the devices you use to interact with us, and from third parties. We may combine information from the Services together and with other information we obtain from our business records. We may use and share information that we aggregate (compile to create statistics that cannot identify a particular individual) or de-identify (strip information of all unique identifiers such that it cannot reasonably be linked to a particular individual) at our discretion.
You may provide the following information to us directly:
You may provide the following information to us directly:
Clients may provide the following information about Client Customers to us directly when using the Services:
We and partners working on our behalf may use log files, cookies, or other digital tracking technologies to collect the following information from the device you use to interact with our Services. We may also create records when you make purchases or otherwise interact with the Services.
The following is a list of our partners who collect the information described above. Please follow the links to find out more information about the partner’s privacy practices.
| Partner | Information Type Collected |
| Bing Ads | Device, Analytical, Diagnostic, and Advertising information |
| Marketo Measure (formerly Bizible) | Device and Business record information |
| Cloudflare | Device and Analytical information |
| CookieYes | Device information |
| Craft CMS | Device information |
| Google Analytics | Device, Analytical, Diagnostic, and Advertising information |
| Google Tag Manager | Device, Analytical, Diagnostic, and Advertising information |
| Hotjar | Device, Analytical, and Diagnostic information |
| Device and Advertising information | |
| Marketo | Device, Analytical, and Advertising information |
| Positional | Device and Diagnostic information |
| Sumo | Device information |
| YouTube | Device, Analytical and Diagnostic information |
We may collect the following information about you from third-party sources:
We may collect the following information about Client Customers from third-party data services integrated into our platform (“partner companies”) that are accessed by Clients using our products and services:
We may use any of the information we collect for the following purposes:
Notwithstanding the above, we only use Client Representative data in accordance with our agreement with the Client.
We may share any of the information we collect with the following recipients.
We use a combination of physical, technical, and administrative safeguards to protect the information we collect through the Services, including secure socket layer technology (SSL) to encrypt sensitive information transmitted through the Services. While we use these precautions to safeguard your information, we cannot guarantee the security of the networks, systems, servers, devices, and databases we operate or that are operated on our behalf. Should you have any questions regarding our security procedures or wish to report any potential system failures or breaches, please contact us at [email protected].
Your Account: If you have an account with us, please sign in to your account to update your account information.
Email Unsubscribe: If you do not wish to receive marketing information from us or wish to opt out of future email promotions from us, please contact us. Please note that all promotional email messages you receive from us will include an option to opt out of future email communications.
Cookie Choices: You may disable cookies and related technologies in your browser or mobile device using their settings menu. If you are in the EEA, UK, or Switzerland can also set and adjust your cookie preferences using our cookie settings menu. Please note that declining certain types of cookies may affect performance and functionality of the Services. If you delete your cookie, you may also delete your consent preferences.
Ad Choices: Visitors and Client Representatives have options to limit the information that we and our partners collect for online advertising purposes.
If you exercise these options, please be aware that you may still see advertising, but it will not be personalized. Nor will exercising these options prevent other companies from displaying personalized ads to you.
If you delete your cookies, you may also delete your consent preferences.
Do Not Track: Your browser or device may include “Do Not Track” functionality. Our information collection and disclosure practices and the choices that we provide to you will continue to operate as described in this privacy policy regardless of whether a Do Not Track signal is received.
Jurisdiction-specific rights: Visitors and Client Representatives may have certain rights with respect to your personal information depending on your location or residency. Please see “privacy disclosures for specific jurisdictions” below. Please contact us to exercise your rights.
We may store information about you for as long as we have a legitimate business need for it.
We may collect, process, and store your information in the United States and other countries. The laws in the United States regarding information may be different from the laws of your country. Any such transfers will comply with safeguards as required by relevant law.
Clients may offer financial products and services to individuals who are under the age of majority in their jurisdiction (“minors”) and may therefore submit information about minors to us in connection with their use of our products and services. However, the Services are intended for users who are 18 years old and older. We do not knowingly collect information from children. If we discover that we have inadvertently collected information from anyone younger than the age of 13, we will delete that information. Please contact us with any concerns.
We process “personal data,” as that term is defined in the European Union’s General Data Protection Regulation (“GDPR”). In some cases, we are the controller of personal data about Visitors and Client Representatives. We act as the processor of personal data about Client Customers, and in some cases about Client Representatives, on behalf of our Clients.
Alloy’s EU representative is: The DPO Centre Europe Limited Alexandra House, 3 Ballsbridge Park, Dublin, D04C 7H2, Ireland, who can be contacted at [email protected]
Alloy’s DPO is: The DPO Centre Limited of 50 Liverpool Street, London EC2M 7PY, UK, who can be contacted at [email protected].
To learn more about how Client Customer data is processed, please review the privacy policy of the relevant Client. Client Representatives and Client Customers who would like to access, correct, or delete personal data that we process on behalf of Clients, should submit their requests directly to the Client.
Legal basis for processing under the GDPR: When we are a controller, we only use your personal data to (1) fulfill our contractual obligations to Clients; (2) where it is necessary for our legitimate business and commercial interests (or those of a third party) and your interests and fundamental rights do not override those interests; or (3) to comply with a legal obligation. To the extent we process your personal data for any other purposes, we (or a partner) will obtain your consent.
If we need to collect personal data for a legal purpose or under the terms of a contract we have and you fail to provide that data when requested, we might not be able to perform the contract we have or are trying to enter into (for example, to provide the requested products or services). If that happens, we will let you know.
Your rights under the GDPR for data we process as a controller: If you are located in the European Economic Area (“EEA”), U.K., or Switzerland, you have the right to lodge a complaint about our data collection and processing actions with the supervisory authority concerned. Contact details for data protection authorities are available here: http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.
Visitors and Client Representatives located in the EEA, U.K., or Switzerland have the following rights.
Please contact us to exercise these rights.
The California Consumer Privacy Act (“CCPA”) provides California residents with rights to receive certain disclosures regarding our collection, use, and disclosure of information by businesses under the CCPA, as well as rights to know/access, correct, delete, and limit disclosure of personal information granted under the CCPA. You have the right to be free from discrimination based on your exercise of your CCPA rights. If we collect personal information as a business subject to the CCPA, that information, our practices, and your rights are described below.
Notice at Collection Regarding the Categories of Personal Information Collected
You have the right to receive notice of certain information about our data collection, use, and disclosure as a business under the CCPA. The following table summarizes the categories of personal information we collect in that capacity about Visitors and Client Representatives; the categories of sources of that information; whether we disclose, sell, or share that information to service providers or third parties, respectively; and the criteria we use to determine the retention period for such information. The categories we use to describe personal information are those enumerated in the CCPA. We collect this personal information for the purposes described above in “How We Use Your Information.”
| Category | Examples of Information | Source | We disclose to: | We sell to/share with: |
Identifiers
|
| Visitors; Client Representatives; event partners; our social media pages | Service Providers | Not sold/shared
|
| Financial Information |
| Visitors; Client Representatives | Service Providers | Not sold/shared |
Commercial Information
|
| Visitors; Client Representatives | Service Providers | Not sold/shared |
| Geolocation Information |
| Visitors; our analytics and advertising partners | Service Providers | Advertising partners |
| Internet or Electronic Network Activity Information |
| Visitors; Client Representatives; our analytics and advertising partners | Service Providers | Advertising partners |
| Audio, Electronic, Visual, Thermal, Olfactory, or Similar Information |
| Visitors; Client Representatives | Service Providers | Not sold/shared |
| Professional or Employment-Related Information |
| Visitors; Client Representatives | Service Providers | Not sold/shared |
| Inferences Drawn About You |
| Visitors; Client Representatives; our analytics and advertising partners | Service Providers | Advertising partners |
| Content of Communications |
| Visitors; Client Representatives | Service Providers | Not sold/shared |
Communications Metadata
|
| Visitors; Client Representatives; Service Providers | Service Providers | Not sold/shared |
| Contacts |
| You | Service Providers | Not sold/shared |
We determine the retention period for each of the categories of personal information listed above based on (1) the length of time we need to retain the information to achieve the business or commercial purpose for which it was obtained, (2) any legal or regulatory requirements applicable to such information, (3) internal operational needs, and (4) any need for the information based on any actual or anticipated investigation or litigation.
Entities to whom we disclose information for business purposes are service providers, which are companies that we engage to conduct activities on our behalf. We restrict service providers from using personal information for any purpose that is not related to our engagement or authorized by law.
Entities to whom we “sell” or with whom we “share” information are third parties. Under the CCPA, a business “sells” personal information when it discloses personal information to a company for monetary or other benefit. A company may be considered a third party either because we disclose personal information to the company for something other than an enumerated business purpose under California law, or because its contract does not restrict it from using personal information for purposes unrelated to the service it provides to us. A business “shares” personal information when it discloses personal information to a company for purposes of cross-context behavioral advertising.
Your rights under the CCPA
Please contact us if you have questions or wish to take any action with respect to information to which this privacy policy applies.
Email: [email protected]
Telephone: 844-382-5569
Mail: First Mile Group, Inc. (dba Alloy), 41 East 11th Street, Second Floor, New York, NY 10003
Submitting requests: You may request to exercise your rights by submitting this Form or making a request using the contact information above.
If you are a resident of California, you may, under certain circumstances, authorize another individual or a business, called an authorized agent, to make requests on your behalf.
We may have a reason under the law why we do not have to comply with your request, or why we may comply with it in a more limited way than you anticipated. If we do, we will explain that to you in our response.
Verification: We must verify your identity before responding to your request. We verify your identity by asking you to provide personal identifiers that we can match against information we may have collected from you previously. We may need to follow up with you to request more information to verify identity.
We will not use personal information we collect in connection with verifying or responding to your request for any purpose other than responding to your request.