CEFN Data Privacy Policy

Creative Economy Finance Network

Effective Date: January 2026

Last Updated: January 2026

Policy Owner: CEFN Founding Team

Contact: privacy@creativefinancenetwork.com | (720) 465-7522

1. Who We Are and What This Policy Covers

The Creative Economy Finance Network (CEFN) is building a member-governed platform to help creative businesses access capital and financial tools. We're not a bank or a lender. We're a network that connects creative entrepreneurs with resources and services designed for creative businesses.

This policy explains what data we collect, why we collect it, how we protect it, and what rights you have. We've written it in plain language because we believe you should actually be able to understand how your information is handled.

This policy covers three types of data:

• Member Data: Information you share when using our platform (Capital Navigator, member tools)
• Research/Demo Data: Responses from our research demos and surveys
• Institutional Partner Data: Anonymized lending data from partner financial institutions

2. What We Collect From You

2.1 Research Demo Data

When you participate in our research demos, we collect:

2.2 Full Platform Member Data

When you use the full CEFN platform, we collect information progressively. We only ask for sensitive details after establishing that they're relevant to your situation. Our tiered collection approach:

• Tier 1 (Routing): Location, entity type, credit score range, income basics, timeline
• Tier 2 (Depth): Seasonal income patterns, track record, cash position, team structure
• Tier 3 (Packaging): Only collected when preparing for a specific lender, including actual credit score, assets, personal guarantee comfort, background questions relevant to that lender's requirements

What we don't collect: We never ask for Social Security numbers, bank account credentials, or full credit reports. We collect self-reported information and do not pull credit checks.

CCPA Data Categories: For California residents, the information above maps to these statutory categories:

• Category A (Identifiers): Name, email, business name, location
• Category B (Personal Information): Business contact information
• Category D (Commercial Information): Business type, revenue, customer count
• Category K (Inferences): Pattern matches and readiness assessments derived from your responses

2.3 Institutional Partner Data (Separate Category)

When financial institutions partner with CEFN for research and benchmarking, they may share anonymized, aggregated lending data (loan volumes, terms, geographic distribution). This data never contains individual borrower information. See Section 9 for detailed governance of institutional data.

3. How We Use Your Data

3.1 To Serve You

• Pattern matching: Identifying which of our creative business patterns fit your situation
• Lender matching: Connecting you with appropriate capital sources through the Capital Navigator
• Education: Providing relevant learning content based on your situation
• Tool customization: Tailoring financial tools to your business type

AI and Automated Processing: We use AI tools to help analyze your story, identify patterns, and generate personalized reflections. These tools assist our process but do not make final decisions about your eligibility or access to capital. Your data is processed by our AI service providers under data protection agreements and is not used to train their general models.

3.2 The Navigator Package

When you're ready for a lender introduction, we create a Navigator Package: a summary of your situation translated into terms lenders understand. This package includes your Five Cs assessment (Character, Capacity, Capital, Collateral, Conditions), identified patterns, and readiness score.

3.3 For Research and Improvement

We use anonymized and aggregated data to:

• Improve our platform and tools
• Publish research on creative economy capital access (never identifying individuals)
• Advocate for better policies for creative businesses
• Train our pattern recognition systems

4. What We Never Do

We commit to the following:

• Never sell your data. Your information is not a product. We don't sell, rent, or trade your personal information to third parties.
• Never share without consent. We don't share your individual information with lenders or partners without your explicit permission.
• Never run credit checks. We collect self-reported credit information. We don't pull your credit report or affect your credit score.
• Never use data against you. We won't use your information to disadvantage you or share it with parties who might.
• Never target you with ads. We don't use your data for advertising or sell access to advertisers.

5. Who Sees Your Data

5.1 Service Providers We Use

We work with the following categories of service providers, each bound by data protection agreements:

• Cloud hosting: Our platform runs on secure cloud infrastructure (e.g., AWS) that stores your data with encryption
• Analytics: We use privacy-respecting analytics to understand how people use our platform and improve the experience
• Email communications: We use email services to send you updates and respond to inquiries
• AI/ML services: We use AI services to help analyze your story and match patterns (your data is not used to train external models)

We do not use advertising networks, retargeting pixels, or sell access to your data for marketing purposes.

5.2 Cookies and Tracking

We use only essential cookies required for the platform to function (session management, security). We do not use third-party advertising cookies or cross-site tracking pixels. If this changes, we will update this policy and provide notice.

6. Your Rights

You have the following rights regarding your data:

• Access: Request a copy of the data we have about you
• Correction: Ask us to correct inaccurate information
• Deletion: Request that we delete your data (subject to legal retention requirements)
• Portability: Receive your data in a portable format
• Withdraw consent: Revoke permission for specific uses at any time
• Opt out: Decline to provide certain information (some features may be limited)

To exercise these rights: Email privacy@creativefinancenetwork.com with your request. We'll respond within 30 days.

7. How We Protect Your Data

7.1 Technical Safeguards

• Encryption: Data encrypted at rest (AES-256) and in transit (TLS 1.2+)
• Access controls: Role-based access; team members only see data necessary for their role
• Authentication: Multi-factor authentication required for all team access
• Infrastructure: Hosted on secure, SOC 2-compliant cloud infrastructure

7.2 Operational Safeguards

• Limited team access: Only founding team members handle member data currently
• Access logging: All access to member data is logged and reviewed
• Incident response: Documented procedures for handling security incidents
• Vendor vetting: Third-party services are reviewed for security practices

8. Data Retention

When you request deletion, we remove your personal data within 30 days, except where we're legally required to retain it or it has been fully anonymized.

9. Institutional Partner Data Governance

This section governs data we receive from partner financial institutions (banks, credit unions, CDFIs) for research and benchmarking. This data is always anonymized and aggregated—we never receive individual borrower information from partners.

9.1 Core Principles

• Never share, never exploit: Partner data is never re-disclosed, sold, or used for competitive intelligence
• Anonymization standards: All data must have direct identifiers removed; aggregation thresholds apply
• Data minimization: We only collect what's necessary for stated research purposes
• Purpose limitation: Data used only for agreed-upon research, benchmarking, and advocacy

9.2 Partner Rights

Partner institutions have the right to:

• Audit our use of their data
• Review publications before release
• Withdraw consent with 30 days notice
• Request deletion of their contributed data

9.3 Publication Standards

When publishing research using institutional data:

• Cell counts under 5 are suppressed
• No analysis identifies a single institution without consent
• Partners may review findings before publication

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to know: What personal information we collect, use, and disclose
• Right to delete: Request deletion of your personal information
• Right to correct: Request correction of inaccurate information
• Right to opt out of sale/sharing: We do not sell or share personal information for cross-context behavioral advertising, so no opt-out is needed
• Non-discrimination: We won't treat you differently for exercising your rights

Global Privacy Control (GPC): We honor browser-based opt-out preference signals, including the Global Privacy Control. If your browser sends a GPC signal, we will treat it as a valid opt-out request.

Authorized Agents: You may designate an authorized agent to make requests on your behalf. We will require verification of both your identity and the agent's authority.

Data Collected in the Past 12 Months: We have collected the categories of personal information described in Section 2 of this policy. We have not sold personal information. We have disclosed personal information to the service provider categories described in Section 5.

To exercise California-specific rights, email privacy@creativefinancenetwork.com with "California Privacy Request" in the subject line, or call (720) 465-7522. We will verify your identity and respond within 45 days.

11. Children's Privacy

CEFN is designed for business owners and is not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at privacy@creativefinancenetwork.com.

12. Notice at Collection

When you begin our intake process or participate in research demos, you'll see a brief notice explaining what we're collecting. That notice, combined with this policy, satisfies California's "notice at collection" requirement. The key points:

• What we collect: Your story, business information, and self-reported financial details
• Why: To understand your situation and connect you with appropriate capital resources
• Your choice: Participation is voluntary; you can decline to answer questions or stop at any time

13. Changes to This Policy

We may update this policy as our practices evolve or as laws change. When we make material changes:

• We'll update the "Last Updated" date at the top
• For significant changes, we'll notify you by email or in-platform notice
• We'll give you the opportunity to review changes before they take effect

Continued use of CEFN after changes constitutes acceptance of the updated policy.

14. Questions and Contact

If you have questions about this policy or our data practices, you can reach us by:

We aim to respond to all inquiries within 30 days.

This policy was last reviewed by the CEFN founding team in January 2026 and will be reviewed annually or when material changes occur.