Privacy Policy

1. Overview

Ahead Lending, Inc. ("Ahead", "we", "us") provides small personal loans in all 50 U.S. states. This Privacy Policy describes what information we collect from you, why we collect it, what we do with it, and what rights you have. It applies to our website (aheadlendingloans.com), any Ahead-branded application, and all Ahead loan products.

We take privacy seriously because we have to and because we want to. We're regulated as a lender under federal and state law, including the Gramm-Leach-Bliley Act (GLBA), the Fair Credit Reporting Act (FCRA), and state financial privacy laws, and we're independently audited every year for our privacy and security controls.

2. What information we collect

To lend money to you responsibly, we need to know who you are, verify your identity, and evaluate whether you can repay the loan. We collect:

Identity information

• Full legal name, date of birth, Social Security number
• Current address, phone number, email address
• Government ID (driver's license or passport) during identity verification

Financial information

• Income and employment (self-reported and verified)
• Bank account information for funding your loan and receiving repayments
• Credit report and credit score from the three major bureaus
• Existing debt obligations

Usage information

• Login times, pages viewed, actions taken on our website and app
• Device type, browser, IP address (used for security)
• Communications with our support team (calls are recorded for quality assurance)

3. How we use your information

We use your information for these purposes and no others:

• To evaluate your loan application. Our underwriting model uses your income, credit, and banking history to determine whether we can lend to you and at what rate.
• To verify your identity. Federal Know-Your-Customer (KYC) rules require us to confirm you are who you say you are.
• To fund your loan and collect payments. Bank account information is used exclusively for money movement.
• To report to credit bureaus. If you have an active loan, we report your payment behavior monthly to Experian, TransUnion, and Equifax. This helps build your credit if you pay on time.
• To detect fraud. Device and usage information helps us spot fraudulent applications and prevent identity theft.
• To provide customer service. Our support team accesses your data only when you contact them, and only to answer your specific question.
• To send you required communications. Loan statements, disclosures, payment reminders, and changes to terms.
• To comply with the law. Various regulatory reports, tax reporting, responses to subpoenas.

4. Who we share your information with

We share only what's necessary, only with parties who need it to help us serve you, and only under contracts that bind them to protect your data:

• Service providers that help us operate: cloud hosting (AWS), identity verification (Persona), bank account verification (Plaid), payment processing (Stripe). Each has a signed data processing agreement.
• Credit bureaus Experian, TransUnion, and Equifax, for reporting and pulling your credit.
• Regulators and law enforcement when legally required (e.g., state financial regulators, CFPB, IRS, valid subpoenas).
• Your authorized parties (e.g., someone you give power of attorney).
• Acquirers or successors if we're ever acquired or merged. Any successor company would be bound by the same commitments in this policy.

5. What we don't do

6. Your privacy rights

You have the following rights regarding your data at Ahead, regardless of what state you live in:

• Right to know. See exactly what data we have on you, who has accessed it, and why.
• Right to correct. Fix anything that's wrong. Most edits can be made in your account settings.
• Right to download. Export a complete copy of your data as JSON or CSV. Delivered within 24 hours.
• Right to delete. After your loan is paid off, request deletion. We'll delete everything we're not legally required to keep (federal law requires us to retain tax records for 7 years).
• Right to opt out. Unsubscribe from marketing emails, credit-monitoring alerts, or analytics tracking, without losing access to your loan.
• Right to non-discrimination. Exercising any of these rights will never cost you access, better rates, or worse service.

To exercise any of these rights, email [email protected] or use the tools in your account settings. Most requests are fulfilled within 30 days.

7. How we secure your data

Our full technical security posture is documented on our Security page. In brief:

• All data encrypted with TLS 1.3 in transit and AES-256 at rest
• SOC 2 Type II audited annually
• PCI-DSS Level 1 certified for payment card handling
• Employee access is need-to-know, time-limited, and fully logged
• Bug bounty program with public disclosure of any fixed vulnerabilities
• $50M cyber liability insurance coverage

8. How long we keep your data

We keep your data only as long as we have a legitimate reason to:

• While you have an active loan: All data required for loan servicing.
• After your loan closes: 7 years of core loan records (required by federal tax law). Marketing data deleted immediately.
• After you request deletion: Everything not legally required is deleted within 30 days. Records required by law are marked for deletion when their retention period ends.

9. Cookies and tracking

Our website uses only strictly necessary cookies and first-party analytics we host ourselves. We do not use third-party analytics, advertising cookies, tracking pixels, or session replay tools.

Specifically we use:

• A session cookie to keep you logged in
• A CSRF cookie to prevent cross-site attacks
• A first-party analytics cookie to aggregate anonymous usage patterns (e.g., which pages people visit)

We honor Global Privacy Control (GPC) and "Do Not Track" signals from your browser.

10. Children's privacy

Ahead does not provide services to anyone under 18, and we do not knowingly collect information from anyone under 18. If you believe a minor has provided information to us, please email [email protected] and we will delete it.

11. International users

Ahead only serves customers residing in the United States. Our servers and staff are located in the United States. If you access our website from outside the U.S., your information will be transferred to and processed in the United States.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make any changes that materially affect your rights or how we use your data, we will notify you by email at least 30 days before the changes take effect. The "Last Updated" date at the top of this page shows when it was most recently revised.

Previous versions of this policy are archived and available on request from [email protected].

13. How to contact us

For any privacy-related question, request, or complaint:

You also have the right to contact your state's Attorney General or the Consumer Financial Protection Bureau (CFPB) if you believe we have violated your privacy rights.