Effective Date: August 28, 2026

1. Purpose and Scope

Prizm Companies, Inc. uses Plaid to connect financial accounts owned or controlled by Prizm to an internal business tool. The connection supports cash monitoring, transaction reconciliation, bookkeeping, and financial forecasting.

This integration is not offered as a consumer financial product. It is limited to authorized Prizm representatives connecting Prizm business accounts.

2. Information the Integration May Receive

Depending on the products enabled and the permissions selected during Plaid Link, the integration may receive:

• Financial institution and account name

• Account type and masked account identifier

• Current and available balances

• Transaction dates, amounts, descriptions, status, and merchant or counterparty information

• Connection status, Item identifiers, and consent-related metadata

Prizm does not request or store online-banking usernames or passwords. Those credentials are entered through Plaid or the applicable financial institution and are not provided to Prizm.

3. How the Information Is Used

Prizm uses the information only for internal business purposes:

• Monitoring Prizm's cash position

• Identifying posted and pending transactions

• Reconciling financial activity with accounting and project records

• Supporting cash forecasts and internal financial reporting

• Diagnosing and securing the integration

Prizm does not sell the information or use it for advertising.

4. Consent and Account Connection

An authorized Prizm representative chooses whether to connect an account and completes the Plaid Link flow. Plaid and the financial institution may present additional notices, permissions, and authentication steps. No account is connected without an affirmative action by an authorized representative.

5. Service Providers and Disclosure

Plaid processes information to provide the connection. The connected financial institution processes the request under its own terms and privacy practices.

Prizm may use approved hosting, Microsoft 365, security, accounting, or professional-service providers to operate and protect the integration. Those providers receive only the access reasonably necessary for the service.

Prizm may disclose information when required by law, to protect rights or security, to investigate fraud or a security event, or with valid authorization.

6. Security

Prizm uses administrative, technical, and physical safeguards proportionate to the sensitivity of financial information. These include access restrictions, multi-factor authentication where supported, encrypted transmission, encrypted storage, credential controls, logging, and incident-response procedures.

No security method eliminates all risk. Suspected unauthorized access involving the Plaid account or connected financial data is investigated and handled under Prizm's incident-response procedures.

7. Retention and Deletion

Prizm keeps financial information only for the approved business purpose and applicable legal, accounting, audit, security, or dispute requirements.

• Raw Plaid responses are processed transiently and retained no longer than 30 days unless needed for an active technical investigation.

• Balance snapshots used only for monitoring are retained on a rolling 90-day basis.

• Transactions used as accounting support may be retained for seven years after the applicable tax or fiscal year, subject to legal or CPA direction.

• Plaid connection and consent records may be retained for the life of the connection plus five years.

• Security logs are generally retained for at least 12 months.

• Backups expire through the normal backup cycle, generally within 90 days.

When a Plaid connection is no longer needed, Prizm removes or revokes the connection and deletes associated credentials and data that are not subject to a documented legal or business retention requirement.

8. Choices and Requests

An authorized representative may disconnect the account through the available application control, the financial institution, Plaid's consumer tools where applicable, or by contacting Prizm.

Requests to access, correct, or delete information may be sent to [email protected]. Prizm will evaluate the request under applicable law and any legal, tax, accounting, contractual, audit, or security retention requirement.

9. Scope Changes

Prizm will update this notice before using the integration for financial accounts belonging to customers, employees, or other third parties, or before using Plaid data for a materially different purpose.

10. Contact

Prizm Companies, Inc.

d/b/a Prizm Coatings & Restoration

Email: [email protected]

Security contact: [email protected]

11. Changes to This Notice

Prizm may update this notice to reflect changes in the integration, law, or security practices. The published notice will state its effective date.