Privacy Policy

Last Updated: September 1, 2026

This Privacy Policy (this “Policy” or this “Agreement”) constitutes an agreement between you and Advanced Financial Company, a California corporation (“AFC,” “we,” “us,” or “our”), and you, whether personally or on behalf of an entity (“you,” “your,” or “User”), concerning your access to and use of the AFC website located at “advancedfinco.com” and any other media form, media channel, mobile website, or mobile application related, linked, or otherwise connected thereto (collectively, the “Website”).

By accessing, browsing, creating an account on, or utilizing the payment processing and account servicing tools available via the Website, including but not limited to any digital interfaces, payment portals, interactive voice response systems, and financial servicing applications operated by AFC (collectively, the “Services”), you expressly acknowledge that you have read, understood, and agree to be bound by all of these Terms. If you do not agree with all of these Terms, you are expressly prohibited from using the Website and Services, and you must discontinue use immediately.

This policy is written in the English language. We do not guarantee the accuracy of any translated versions of this Policy. To the extent that any translated versions of this Policy conflict with the English language version, the English language version of this Policy shall control.

Advanced Financial Company, a California corporation (“AFC,” “we,” “us,” or “our”), operates strictly as an independent financial account servicing company, loan servicer, and specialized payment processing enterprise. The Services are engineered, hosted, administered, and intended exclusively for use by lawful residents of the United States of America and Canada who hold active financial accounts with AFC’s third-party Clients.

Consumers utilizing AFC’s platforms are explicitly notified that AFC operates as a financial institution under federal and state frameworks. Consequently, a substantial majority of the Personal Information (as defined herein) collected, ingested, processed, and archived by AFC is governed, regulated, and shielded by specific sectoral financial privacy statutes, including:

• The federal Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.) and its implementing regulations, including the Federal Trade Commission (FTC) Privacy Rule and Safeguards Rule (16 C.F.R. Part 314); and
• The California Financial Information Privacy Act (Cal. Fin. Code § 4050 et seq.) (“CalFIPA”).

Pursuant to the California Consumer Privacy Act of 2018, as amended and expanded by the California Privacy Rights Act of 2020 (Cal. Civ. Code § 1798.100 et seq.) (collectively, the “CCPA/CPRA”), personal information that is collected, processed, sold, or disclosed pursuant to the federal GLBA or CalFIPA is explicitly exempt from the consumer rights, deletion mandates, and disclosure provisions of the CCPA/CPRA (see Cal. Civ. Code § 1798.145(e)).

Parallel entity-level and data-level exemptions apply across other comprehensive state privacy regulations (including but not limited to those in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Florida, and other jurisdictions). AFC continues to monitor evolving state privacy language and will update this Policy as required.

Accordingly, this Privacy Policy is structured as a dual-track disclosure:

• Track 1: Non-public financial data collected to manage active account, associations, and collection files is handled via our GLBA/CalFIPA-compliant policies;
• Track 2: Standard consumer web-telemetry, anonymous site visitor logs, and basic marketing interaction data fall under the state comprehensive privacy framework disclosures detailed in Section 9.

1. EXHAUSTIVE SPECIFICATION OF CATEGORIES OF PERSONAL INFORMATION COLLECTED

AFC collects, processes, and maintains various categories of personal information. This data is collected to carry out its corporate duties as a financial account servicing agent, to execute electronic transactions, and to maintain the technical security of its digital platforms.

The following inventory details the explicit categories of data processed by AFC within the preceding twelve (12) months:

Statutory Category	Explicit Elements and Data Points Collected
Category A: Identifiers	Full legal name, structural aliases, physical mailing address, billing address, unique personal identifiers, online identification credentials, Internet Protocol (IP) addresses, personal email addresses, secure account user IDs, and social security numbers, driver’s license details, government ID cards, or U.S./Canadian passport information (where required for identity verification and loan document validation).
Category B: Personal Records (Cal. Civ. Code § 1798.80(e))	Hand-written or electronic signatures, home telephone numbers, corporate or mobile phone numbers, credit card account numbers, debit card numbers, clearinghouse routing details, checking/savings account numbers, bank statements, card expiration metrics, and underlying cardholder names.
Category C: Protected Characteristics	Age, date of birth, biological sex, marital status, or familial composition (strictly to the extent embedded within preexisting legacy loan agreements, bankruptcy declarations, or probate documentation received from Clients).
Category D: Commercial Information	Records of real property ownership, timeshare interval allocations, fractional ownership points balances, account histories, amortization schedules, escrow histories, interest calculations, delinquency logs, tax balances, property assessment fee tracking, payment histories, and records of services purchased via the portal.
Category E (Biometric Information)	Not Collected — AFC does not collect biometric identifiers, biometric information, or audio/visual/thermal data. See Section 13.
Category F: Internet or Electronic Network Activity	Browser application architectures, device hardware specifications, operating system versions, media access control (MAC) addresses, clickstream logs, navigation paths within our payment systems, session durations, referring URLs, tracking pixel metadata, and security log exceptions.
Category G: Geolocation Data	Coarse, non-precise geographical metadata derived solely from user IP address locations or cellular tower triangulation connections during portal authentication.
Category H: Sensory or Audio/Visual/Thermal/Olfactory/Similar Information	Not Collected — AFC does not collect biometric identifiers, biometric information, or audio/visual/thermal data. See Section 13.
Category I: Professional or Employment Data	Current employer, corporate contact points, baseline income tracking, and employment tenure metrics (solely processed during financial underwriting reviews, hardship modification applications, or internal employment applications).
Category K: Inferences	Analytical profiles generated by our automated platforms regarding account risk vectors, delinquency likelihood scoring, or transaction preference processing behaviors.
Category L: Sensitive Personal Information (SPI)	Social Security numbers, driver’s license or state identification profiles, passport numbers, financial bank account routing details combined with mandatory security access keys, PINs, or credentials necessary to execute automated account transfers.

2. GRANULAR PIPELINES OF DATA INGESTION AND SOURCES

AFC acquires the categories of Personal Information and Sensitive Personal Information detailed in Section 3 through a multi-channel ingestion pipeline:

Direct Consumer Submission

We collect data directly from you when you complete forms on our payment portal, create an online profile, initiate electronic check transfers, speak directly with our telephone account agents (which interactions may be monitored and voice-recorded for quality assurance, statutory compliance, and training protocols), send electronic mail messages, transmit facsimiles, or submit written hardship or refund requests.

Ingestion from Contracting Clients (Associations and Creditors)

To allow AFC to perform its financial servicing functions, our Clients (the third-party associations, timeshare developers, and creditors) transfer primary consumer master files to AFC. These files include the consumer’s name, property ownership details, original loan balances, history of assessments, and historical contact metrics.

Automated Behavioral and Technical Telemetry

When you access the Website or utilize our web-based payment gateways, our servers automatically log technical metadata. This ingestion is executed via digital instrumentation tracking, including essential cookies, third-party analytical cookies, clear GIFs, web beacons, and server log monitors.

Independent Third-Party Compliance Vectors

AFC may supplement internal files with data acquired from lawful third-party databases, skip-tracing networks, consumer credit reporting bureaus (to validate financial status and credit standing), public property records, and legal/probate repositories.

3. EXHAUSTIVE BUSINESS AND COMMERCIAL PURPOSES FOR PROCESSING AND USE

AFC utilizes, processes, and references Personal Information and Sensitive Personal Information for strict business and commercial functions, including:

Financial Account Servicing and Operational Ingestion

Processing single, recurring, or structured credit card, debit card, or electronic check (ACH) transactions; managing property assessment billing ledgers; preparing annual association budgets and coupon books; updating ledger balances; auditing interest allocations; and managing internal accounting systems.

Multi-State Debt Collection and Recovery Management

Executing lawful recovery operations regarding delinquent, defaulted, or outstanding financial accounts on behalf of our Clients. This includes generating statutory notices, deploying telephone outreach, managing settlement parameters, and monitoring bankruptcy or probate filings in strict accordance with the Fair Debt Collection Practices Act (FDCPA) and applicable state debt collection regulations.

Identity Fraud Interdiction and Cybersecurity Engineering

Validating and authenticating user identities during account access attempts; monitoring systems for unauthorized account modifications; blockading malicious automated scraping scripts; preventing brute-force intrusion arrays; and mitigating security incidents or financial fraud.

Statutory, Regulatory, and Judicial Compliance Engineering

Complying with federal, state, and provincial statutory demands, including the Bank Secrecy Act (BSA), anti-money laundering (AML) protocols, Internal Revenue Service (IRS) 1099 financial reporting mandates, responding to formal civil subpoenas, satisfying regulatory field audits, and exercising or defending AFC’s legal rights in judicial proceedings.

Maintenance and Optimization of Digital Systems

Debugging platform codebases; isolating and repairing structural code exceptions that impair platform usability; measuring data latency across secure payment pipelines; and verifying the integrity of system backups.

4. RIGOROUS DATA RETENTION MANDATES AND AUDIT METRICS

Retention Optimization Standard

AFC does not retain Personal Information or Sensitive Personal Information for longer than is commercially necessary to fulfill the explicit business and commercial purposes detailed in Section 5.

Structural Retention Criteria

The baseline duration for our retention schedules is dictated by a multi-layered legal matrix:

• Contractual Mandates: The active operational life cycle of the servicing agreement executed between AFC and the specific Client Association or creditor governing your account file.
• Statutory Limitations: Explicit record preservation mandates imposed by federal and state regulatory oversight bodies (including the FTC, CFPB, and California Department of Financial Protection and Innovation). This requires financial transaction logs and tax-related metadata to be securely archived for a duration ranging from seven (7) to ten (10) calendar years following the formal date of account closure or full loan amortization.
• Litigation Preservation Hold Frameworks: Any personal info subject to an active or reasonably anticipated legal dispute, regulatory investigation, or preservation order is immediately siloed and exempted from automated destruction cycles until the final resolution of the matter.

5. PROHIBITION ON THE SALE AND SHARING OF PERSONAL INFORMATION; DOWNSTREAM VENDOR SUB-PROCESSING CONTROL

Absolute Prohibition on Monetization

AFC has never sold, traded, rented, leased, or commercially exploited consumer Personal Information or Sensitive Personal Information to any third party for monetary or valuable consideration.

Furthermore, AFC does not “share” (as that term is defined under California Civil Code Section 1798.140(ad)) Personal Information with third-party enterprises for cross-context behavioral advertising or targeted cross-platform marketing initiatives.

Downstream Disclosures and Contractual Controls

AFC discloses Personal Information strictly to authorized downstream categories of recipients to fulfill its servicing obligations:

• Contracting Client Associations/Creditors: We transfer account ledger status updates, payment verifications, settlement logs, and communication data directly back to the specific Association or creditor to whom your underlying financial obligation is legally owed.
• Contracted Service Providers and Sub-Processors: We disclose data to vetted, under-contract service providers who maintain technical infrastructure on our behalf. These include core merchant payment gateways, automated check-clearing networks, statement printing and mailing houses, digital SMS/text messaging aggregators, encrypted cloud architecture hosts, independent auditing corporations, and designated outside legal counsel.

CPRA-Compliant Vendor Mandates

All service providers operating under the direction of AFC are bound by strict, comprehensive data-protection addenda. These agreements contractually prohibit the vendor from retaining, utilizing, or disclosing your Personal Information for any purpose other than the specific business purpose designated in the master contract. They are explicitly prohibited from selling or sharing your data across external commercial domains.

6. COOKIES, TELEMETRY, INTERNET LOGS, AND GLOBAL PRIVACY CONTROL (GPC) INTEGRATION

Technical Utilization of Tracking Technologies

AFC’s web interfaces employ technical tracking tools to optimize performance and protect user sessions. These tools include:

• Strictly Necessary Cookies: Essential digital components required to permit secure user login, manage session variables during check routing, and prevent cross-site request forgery attacks.
• Analytical/Performance Metrics: We utilize specialized utilities to capture aggregated, non-identifying traffic patterns, browser versions, and user drop-off trends.

Global Privacy Control (GPC) and Opt-Out Signal Tracking

AFC’s digital architecture supports automated detection of Global Privacy Control (GPC) signals transmitted by compatible browers.

When a valid GPC signal is detected, our consent management platform automatically enforces the user’s opt-out preference by disabling non-essential cookies and preventing analytics and other tracking technologies from executing during that session.

Our systems do not process standard, non-standardized browser “Do Not Track” (DNT) headers due to the absence of unified industry technical standards.

7. EXHAUSTIVE CONSUMER RIGHTS MATRIX (CPRA AND MULTI-STATE DISCLOSURES)

To the extent that a consumer’s data is not exempt from comprehensive state laws under the GLBA/CalFIPA framework outlined in Section 2, residents of California and other compliant states may assert the following privacy rights:

Right to Confirm Processing and Access Data

The right to confirm whether AFC is actively processing your Personal Information and to request an explicit disclosure detailing:

• The categories of Personal Information collected;
• The specific categories of sources from which the data was harvested;
• The business or commercial purpose underlying the data collection;
• The explicit categories of third parties to whom AFC disclosed the data; and
• A secure, portable copy of the specific pieces of Personal Information maintained by AFC in a standard, machine-readable format.

Right to Correct Inaccurate Personal Information

The right to demand that AFC alter, modify, or correct inaccurate, outdated, or incomplete personal records maintained within our active account servicing databases.

Right to Request Deletion of Personal Information

The right to request that AFC permanently purge, erase, or de-identify Personal Information collected directly from the consumer.

Statutory Exceptions and Limitations to Deletion

Consumers are explicitly notified that AFC is not legally required to comply with deletion requests if the underlying data is mandatory for AFC or its Clients to maintain compliance with applicable laws, or to execute core financial actions, including:

• Completing the transaction for which the Personal Information was collected, or fulfilling the explicit terms of a written contract or loan agreement executed between the consumer and the Client Association;
• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, or prosecuting those responsible for such actions;
• Complying with state and federal debt collection record-preservation mandates, tax reporting laws, or the California Financial Information Privacy Act; or
• Defending active or prospective corporate legal claims or cross-demands.

Right to Limit the Use of Sensitive Personal Information

Under state privacy rules, consumers have the right to limit an enterprise’s utilization of Sensitive Personal Information if that data is deployed for secondary commercial marketing or profiling purposes.

Right to Opt Out of Sale or Sharing of Personal Information

AFC does not sell Personal Information, nor does it share Personal Information for cross-context behavioral advertising. Accordingly, no opt-out link is required or provided.

AFC Structural Disclaimers: AFC only collects and utilizes Sensitive Personal Information (such as Social Security numbers and bank routing numbers) to perform core account servicing functions, confirm user identity, or satisfy federal financial regulations. Because AFC does not use Sensitive Personal Information for any purpose outside the strict exemptions defined in CPRA Regulation § 7027(m), AFC is not legally required to provide a “Limit the Use of My Sensitive Personal Information” link on its platforms.

Absolute Protection Against Discriminatory Practices

AFC will never discriminate against, penalize, or retaliate against any consumer who exercises their lawful statutory privacy privileges. We will not deny you services, charge altered fee structures, or apply modified portal interfaces based upon your assertion of privacy rights.

8. VERIFIABLE CONSUMER REQUEST (VCR) SUBMISSION AND IDENTITY EXHAUSTION PROTOCOLS

To execute any of the consumer privacy privileges detailed in Section 9, you or an agent authorized by law to act on your behalf must submit a Verifiable Consumer Request (VCR) through one of the following legal intake channels:

• Dedicated Online Privacy Web-Portal: https://privacyportal-cdn.onetrust.com/
• Toll-Free Telephone Intake Hotline: 1-800-234-6222
• Physical Mail Legal Intake:

Advanced Financial Company
Attn: Legal Compliance Department
5900 Pasteur Court, Suite 210
Carlsbad, CA 92008

Multi-Layer Identity Verification Protocol

Because AFC handles sensitive non-public financial metadata, we enforce a strict identity validation protocol to prevent data breaches or social engineering attacks.

Upon receipt of a consumer rights request, AFC’s compliance team will match the provided name, email address, physical address, and associated account number against our secure database.

To validate requests concerning high-risk categories of information or full data deletion, AFC reserves the right to require a signed declaration under penalty of perjury, or verification via a live phone authentication session with our compliance officers. If we are unable to conclusively verify your identity, your request will be denied to protect the account owner.

Authorized Agent Representation Rules

If you utilize an Authorized Agent registered with the California Secretary of State (or a parallel state authority) to execute a rights request on your behalf, AFC mandates that you provide the agent with signed, written permission to do so. The agent must upload this authorization during the intake process.

Additionally, the underlying consumer must directly verify their own identity with AFC, unless the agent provides a certified Power of Attorney executed pursuant to California Probate Code Sections 4121 to 4130.

Regulatory Response Windows

AFC will acknowledge receipt of a consumer rights request within ten (10) business days. A comprehensive substantive response, or a formal notice of execution, will be delivered within forty-five (45) calendar days from initial receipt.

If structural account complexity requires an extension of time, AFC may claim an additional 45-day extension window by delivering a formal written justification to the consumer within the initial response period.

9. TEXT MESSAGING (SMS) PRIVACY PROTECTIONS AND OPT-OUT MANIFESTO

SMS Communications Operational Context

Please review AFC’s Terms and Conditions for the complete scope of SMS consent, including communication from authorized third parties acting on AFC’s behalf. As detailed in AFC’s master Terms and Conditions, if you provide your wireless cellular phone number to AFC, you grant us prior express written consent to transmit automated text alerts regarding transactional balance changes, payment deadline reminders, and collection notifications.

Explicit SMS Information Sharing Restrictions

AFC maintains a strict information-sharing firewall regarding mobile device data. No mobile phone numbers, short-code consent records, or consumer opt-in text message data collected by AFC will ever be sold, rented, shared, or transferred to any third-party corporation, joint marketer, partner entity, or affiliate for marketing, promotional, or secondary commercial profiling purposes.

All text message distribution structures are operated strictly within AFC’s secure cloud vendor instances. These vendors are under contractual mandates that prohibit the utilization of user numbers for any purpose other than transmitting AFC-approved account communications.

Termination of SMS Interactivity (STOP/STOP ALL)

You can terminate SMS message distribution at any time. Replying STOP to any text received from AFC will opt your cellular device out of marketing and non-critical account notifications.

Replying STOP ALL will opt your cellular device out of all text communications, including payment confirmations and urgent delinquency notices. Opt-out requests are processed via automated scripts and become operationally effective within one (1) business day.

10. FIREWALLS CONCERNING HEALTH DATA, BIOMETRICS, AND SPECIFIC INTRUSIONS

Absolute Exclusion of Biometric Processing

Unlike standard hospitality enterprises, timeshare developers, or fitness resorts, AFC does not collect, ingest, generate, or process biometric templates, iris scans, voiceprint models, fingerprint identifiers, or facial recognition matrices.

To the extent that any legacy documentation transferred to AFC by a Client or GPR affiliate contains digital photography or imagery captured at a resort location, AFC stores such data strictly as static archival attachments within its servicing files. AFC does not perform any mathematical conversion or biometric analysis on such imagery.

Exclusion of Sensitive Medical and Health Data

AFC does not collect medical histories, health symptoms, diagnostic reports, or vaccination records. Any incidental disclosure of health status or medical conditions provided by a consumer during telephonic communication or within a written hardship relief request is utilized strictly to evaluate loan modifications or repayment suspensions. This information is classified as strictly confidential and is protected from disclosure.

11. STRICT PROHIBITION CONCERNING DATA OF MINORS

The Website and Services are designed and intended exclusively for adult consumers who possess the capacity to enter into legally binding contracts. AFC does not knowingly market to, target, or collect Personal Information from individuals under the age of eighteen.

If a parent or legal guardian becomes aware that a minor child has submitted data or created an unauthorized portal profile on our website, they must contact our compliance team immediately at customercare@advancedfinco.com. If we discover that an account contains data from an individual under eighteen, we will remove that information from our active servers immediately as permitted by law.

12. CALIFORNIA “SHINE THE LIGHT” LAW (CAL. CIV. CODE § 1798.83)

California Civil Code Section 1798.83 permits California residents utilizing our platforms to request a disclosure detailing whether AFC has disclosed their Personal Information to third parties for those third parties’ direct marketing functions.

AFC explicitly confirms that it does not disclose consumer Personal Information to third parties for independent marketing purposes. Consequently, no such disclosure logs are maintained by the corporation.

13. ADOPTION AND COMPLIANCE WITH THE FTC SAFEGUARDS RULE

Physical, Administrative, and Technical Safeguards

Pursuant to Section 501(b) of the Gramm-Leach-Bliley Act and the Federal Trade Commission’s Safeguards Rule (16 C.F.R. Part 314), AFC designs, maintains, and audits a comprehensive, written Information Security Program (WISP). This architecture is engineered to protect customer data from unauthorized access, modification, or exposure.

Structural Control Vector Inventory

Our security architecture includes the following controls:

• Comprehensive Multi-Factor Authentication (MFA): Mandatory MFA controls applied across all corporate endpoints, administrative portals, and developer access channels.
• Continuous Encryption Protocols: All Personal Information and Sensitive Personal Information is encrypted using advanced algorithms (e.g., AES-256) both while at rest within our storage networks and while in transit across public telecommunication nodes.
• Role-Based Access Controls (RBAC): Restricting data visibility to verified corporate personnel who require access to specific consumer profiles to execute their core job responsibilities.
• Continuous Vulnerability Assessments: Executing automated daily vulnerability scans, monthly security patches, and annual third-party penetration testing against our payment application networks.

14. AMENDMENTS, MODIFICATIONS, AND MATERIAL NOTIFICATION MANIFESTO

AFC retains the absolute right to alter, modify, amend, expand, or restate this Privacy Policy at any time and for any reason. When an alteration is deployed, the “Last Updated” date at the top of this document will be amended.

Any changes become effective immediately upon their publication to our web interfaces. Your continued utilization of our payment systems or websites following a posted modification constitutes acknowledgment of the updated terms.

15. THIRD PARTY SERVICES AND SITES

AFC provides distinct corporate administrative services, debt collection management, accounting, billing, and electronic payment routing services to independent third-party creditors, real estate developers, timeshare homeowners’ associations, fractional vacation clubs, and property management organizations. Some of these entities operate under or are contractually affiliated with the brand name or corporate umbrella of the Grand Pacific Group, Inc. or Grand Pacific Resorts, Inc. (collectively, “GPR”). AFC is structurally, legally, and operationally independent of GPR and the individual vacation ownership properties or homeowners’ associations at issue.

This Privacy Policy applies solely and exclusively to the data systems, databases, websites, applications, and customer touchpoints owned, operated, and controlled directly by AFC. It does not govern, monitor, or apply to the independent data collection practices, marketing activities, hospitality software systems, or reservation desks operated by GPR or any associated resort management companies. When a consumer interacts with a resort property, books an interval stay, requests concierge accommodations, or stays at an asset managed by GPR, all such data interactions are governed by the respective resort’s or GPR’s independent privacy declaration.

16. CORPORATE COMPLIANCE CONTACT AND ESCALATION TOUCHPOINTS

For questions regarding this Privacy Policy, our data verification workflows, or to register a formal corporate grievance, you must contact AFC via the following touchpoints:

By Mail:

ADVANCED FINANCIAL COMPANY
Attn: Legal and Regulatory Compliance Department
5900 Pasteur Court, Suite 210
Carlsbad, CA 92008

By Email:

customercare@advancedfinco.com

By Phone (Domestic Toll-Free):

1-800-234-6222

By Phone (International Intake):

1-760-431-8500