Get the app

Privacy Policy

Effective Date: May 6, 2026

This Privacy Policy (“Policy”) explains how Cash Advance for CO Inc. (“we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you access or use the Lafet mobile application and our website at cashadvanceforco.com (collectively, the “App” or “Services”).

What we do: Lafet is a loan-matching / lead-generation platform. We are not a lender and we do not make credit decisions, set APRs, or guarantee any offer. We help connect users with independent third‑party lenders and other financial partners.

By installing, accessing, or using the App, you agree to this Policy. If you do not agree, do not use the App.

The App is intended for U.S. residents who are at least 18 years old (or the age of majority in their state).

Plain-language summary. We collect personal, financial, and device information to operate a loan-matching and lead-generation business. We sell personal information to lenders and marketing partners as described in Section 5 below. We use technical and organizational measures to protect data, but no method is perfect. Depending on your state, you may have rights to know, delete, correct, opt out of sale, and limit certain uses. This Policy explains each category, purpose, retention, and how to contact us.

Numbering. Section headings use a closing parenthesis after the number (for example, 3), 3a), 5.1)) so you can reference them in emails or opt-out requests.

We comply with applicable U.S. privacy and consumer-protection laws and guidance, including, as applicable:

  • Gramm–Leach–Bliley Act (GLBA)
  • California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA)
  • Fair Credit Reporting Act (FCRA)
  • Federal Trade Commission (FTC) rules and guidance for lead generation and data brokers
  • CAN-SPAM Act and Telephone Consumer Protection Act (TCPA)
  • Other applicable state privacy laws

Important: Certain rights described in this Policy may not apply to information governed by GLBA and/or FCRA, and GLBA/FCRA may limit or preempt some state privacy rights with respect to certain financial data.

Why multiple laws matter. GLBA focuses on nonpublic personal information in financial contexts. FCRA governs consumer reports and permissible purposes for sharing with consumer reporting agencies. State privacy laws (like CCPA/CPRA) add sale/opt-out and disclosure concepts that can overlap with, but not always replace, federal financial-privacy rules. Where laws conflict, the more specific or controlling rule applies to the data at issue.

We collect information in three ways: information you provide, information collected automatically, and information from third parties.

Minimization and purpose. We aim to collect only what is reasonably needed to operate the service, comply with law, prevent fraud, and fulfill requests you start. Partners may request additional fields directly from you in their own flows; their notices explain those collections.

Personal identifiers

  • Full legal name (first, middle, last)
  • Date of birth
  • Email address
  • Phone number (mobile and/or home)
  • Full residential address including street, city, state, and ZIP code

Government & identity documents

  • Social Security Number (SSN)
  • Driver’s license number and issuing state

Financial & employment information

  • Bank account number (full account number)
  • Bank routing number
  • Bank name and account type (checking / savings)
  • Employer name
  • Employer phone number
  • Employment status and job title
  • Monthly or annual gross income
  • Source of income (employment, self-employment, benefits, other)
  • Purpose of the loan or cash advance request

We request this information to help verify your identity, reduce fraud, and create a lead profile to match you with participating partners. Sensitive items (like SSN, bank account/routing, and driver’s license) may be required by lender partners for identity verification (KYC), state eligibility checks, fraud prevention, and to support funding and repayment setup where applicable.

Voluntary fields. If a field is optional, we will label it as optional where feasible. Skipping optional fields may limit matching quality but should not block lawful access to the App where technically possible.

  • Device identifiers, operating system, App version, and IP address
  • Usage patterns, session data, and clickstream
  • Approximate location derived from IP or device signals
  • Cookies, mobile SDKs, pixels, and similar technologies
  • Identity and fraud verification vendors
  • Credit bureaus and alternative data providers (where permitted and with required authorization)
  • Marketing or referral partners who send users to the App

Accuracy of third-party data. We do not guarantee that data from vendors or bureaus is complete or error-free. You may have rights to dispute inaccurate credit file information directly with the consumer reporting agency under FCRA.

  • To create and manage your account
  • To verify your identity (KYC) and check eligibility
  • To package your data into a lead and match you with partners
  • To sell your information to third-party lenders, financial institutions, and marketing partners (see Section 5 below)
  • To process and fulfill referrals and service requests you initiate
  • To send transactional messages and, where permitted, marketing communications
  • To improve the App, conduct analytics, and prevent fraud
  • To comply with legal obligations and enforce our Terms

Automated decision-making. We may use automated systems to score leads, detect fraud, or route requests. Lenders make separate eligibility decisions using their own models. You may contact us to ask about meaningful logic in plain language where required by applicable law, subject to verification and trade-secret protections.

Key notice: We operate a lead-generation / matching business. In connection with that model, Cash Advance for CO Inc. sells personal information as “sale” is defined by the CCPA/CPRA and similar state laws.

What “sale” means here. In many state laws, “sale” includes disclosures of personal information to third parties for monetary or other valuable consideration, even if the buyer is not a traditional data broker. It does not always mean we sold a single field in isolation; it can include transferring a structured lead package to a lender or buyer network. Opting out stops future sales from us as described in Section 5.3 below; it does not erase copies already received by buyers.

We may sell personal information to:

  • Third-party lenders and financial institutions
  • Marketing partners and lead buyers
  • Data aggregators and similar lead-distribution partners

Information sold may include the categories listed in Section 3a below, including: name, phone, email, address (with ZIP), SSN, driver’s license number, bank account and routing numbers, bank name and account type, employer name and employer phone, income and employment details, and loan purpose.

We may receive monetary compensation, referral fees, per‑lead fees, revenue share, or other valuable consideration in exchange for this data. Compensation may influence which partners receive your data first or how offers are ranked or displayed.

  • Licensed lenders and financial institutions (installment loans, cash advances, lines of credit)
  • Insurance companies and financial product providers
  • Debt relief and credit counseling companies
  • Marketing partners who send offers for financial and non‑financial products
  • Data brokers and aggregators who may resell the data further

Once your information is sold, the recipient’s own privacy policy governs their use. We do not control how buyers use the data after purchase.

Resale chains. Some buyers are aggregators who may combine your lead with other sources or resell to downstream partners. Their policies (and any consent you give inside their flow) determine those subsequent uses.

Depending on your state of residence, you may have the right to opt out of the sale of your personal information. To opt out, email us at support@cashadvanceforco.com with the subject line “Do Not Sell My Information”.

  • We aim to process opt‑out requests within 15 business days.
  • Opting out stops future sales; it does not recall data previously sold.
  • We may still share data as required by law or to complete a request you initiated.

Household and authorized agents. If you submit an opt-out for a household or through an authorized agent, we may require proof of authority and identity verification consistent with law before processing.

Retention periods vary by data type and legal requirements. Typical examples:

  • Full applicant profile (name, SSN, address, bank info, income): duration of relationship + 5–7 years after last activity (or longer if required by law or legal hold)
  • Lead and sale records (who received data, when, consideration): 5–7 years
  • Marketing / consent logs: 2–3 years after last interaction, or until opt‑out plus a short processing period
  • Device and usage logs (IP/session): 12–24 months
  • Opt‑out records (Do Not Sell requests): at least 5 years
  • Support communications: up to 3 years after resolution

Deletion vs. retention. When you ask us to delete data, we will balance your request against legal obligations (for example, evidence preservation, tax, or regulatory holds). Some backup systems may retain copies for a limited period until overwritten.

  • Encryption in transit (TLS) and, where applicable, encryption at rest
  • Role-based access controls and least-privilege practices
  • Monitoring, audits, and vendor security due diligence

No system is 100% secure. Please protect your account credentials and notify us of suspected unauthorized access via support@cashadvanceforco.com.

Your device matters. Use OS updates, avoid unknown sideloaded apps, and enable device encryption where available. Phishing can impersonate lenders or us—verify sender addresses and never share one-time codes with callers who initiated contact.

Depending on your state, you may have rights to:

  • Know / access what we collect and to whom we sold it (where technically feasible)
  • Delete information (subject to legal exceptions; sold data cannot be “undeleted” from third parties)
  • Correct inaccurate information
  • Receive a portable copy where required
  • Opt out of sale (see Section 5.3 below)
  • Non-discrimination for exercising rights

To submit a request, email support@cashadvanceforco.com with the subject “Privacy Request” and include your name, state, and the request type. We may need to verify your identity before responding.

Verification. We may ask for confirming details (for example, email match, partial account identifiers, or government ID where permitted) to reduce fraud. If we cannot verify you, we may deny the request as allowed by law and explain how to appeal or resubmit.

  • Email: use the unsubscribe link in marketing emails (transactional messages may continue)
  • SMS: reply STOP to opt out (transactional/verification messages may continue)
  • Push notifications: manage via your device settings

Note: opting out of marketing does not automatically opt you out of sale; submit a “Do Not Sell” request (see Section 5.3 below) to stop future sales.

If you are a California resident, additional rights may apply, including the right to opt out of sale/sharing and to limit use of sensitive personal information under CPRA.

Submit requests to support@cashadvanceforco.com with the subject “California Privacy Request”. We respond within required timeframes (generally up to 45 days).

Sensitive personal information. Where CPRA limits use of certain sensitive categories, we will honor applicable limit requests after verification. Some processing remains necessary to provide services you request or to meet legal obligations.

Residents of certain states (for example, Virginia, Colorado, Connecticut, Texas, and others) may have similar rights. Submit requests via email using the process in Section 8 below.

Appeals. Some states grant a right to appeal our denial of a request. If your request is denied, our response will describe any appeal steps available to you under applicable law.

We do not respond to Do Not Track signals. Where required, we may honor Global Privacy Control (GPC) signals as an opt‑out of certain sharing for targeted advertising purposes.

Browser controls. You can also block or delete cookies through browser settings; mobile OS settings may limit ad tracking or reset advertising identifiers. These controls may not affect “sale” of personal information for lead matching—use the Do Not Sell process in Section 5.3 below for that.

Some information we handle (like SSN, bank account/routing, income, and employment data) may be “nonpublic personal information” under GLBA and may be subject to separate GLBA notices. If we use consumer reports or share data with consumer reporting agencies, FCRA requirements apply. We do not initiate hard credit inquiries without express authorization.

GLBA privacy notices. Partners who extend credit or offer financial products may provide their own GLBA privacy notices when required. Keep those notices with your loan records.

We use cookies, mobile SDKs, pixels, and similar tools for authentication, fraud detection, analytics, and session management. Disabling some technologies may limit functionality.

Third-party analytics. Analytics vendors may receive device and usage events subject to their policies and our agreements. Where required, we configure tools to reduce unnecessary collection and to honor opt-out signals for covered sharing.

The App is for users 18+ and is not directed to minors. We do not knowingly collect personal information from anyone under 18.

If you believe a minor used the App. Contact us immediately with details so we can investigate and delete information that should not have been collected, subject to legal retention exceptions.

The App is U.S.-directed and data is processed in the United States. By using the App, you consent to U.S. processing.

Cross-border transfers. If you access the App while temporarily outside the U.S., your information may still be stored and processed in the United States under U.S. law, which may differ from the laws of your current location.

We may update this Policy from time to time. We will update the Effective Date and provide notice of material changes as required by law.

Archive. We may retain prior versions internally for compliance. If you need a copy of a prior version, ask support@cashadvanceforco.com and we will provide the latest available snapshot where feasible.

Website: https://cashadvanceforco.com
Email: support@cashadvanceforco.com

Mailing address. Cash Advance for CO Inc., 2269 Uinta St, Denver, CO 80238-3085, USA. For privacy requests, prefer email with the subject lines described in Sections 5.3 and 8 above so we can route your message quickly.