Greenlane.ai, LLC dba 8TK

Last Updated: October 12, 2026

This California Privacy Notice (“Notice”) supplements the 8TK Privacy Policy and applies to individuals who reside in California. It explains how Greenlane.ai, LLC dba 8TK (“8TK,” “we,” “us,” or “our”) collects, uses, discloses, and retains personal information subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”). Capitalized terms not defined here have the meanings given under the CCPA.

1. Scope and Financial-Information Exemptions

This Notice applies only to personal information that is subject to the CCPA. The CCPA does not apply to certain information, including personal information collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act (“GLBA”) and implementing regulations, or the California Financial Information Privacy Act, to the extent provided by law. Accordingly, CCPA rights described in this Notice may not apply to information we collect or process in connection with financial products or services where that information is subject to those laws.

Other statutory exclusions or exemptions may also apply, including for publicly available information, deidentified or aggregate information, and information governed by certain other sector-specific laws. We will apply exemptions only to the extent permitted by applicable law.

2. Categories of Personal Information We Collect and Use

Depending on how you interact with 8TK, we may collect the categories below. The examples are illustrative and are not intended to limit the broader descriptions in our Privacy Policy. We may use these categories for the business and commercial purposes described below.

3. Sources of Personal Information

• Directly from you, including when you create or maintain an account, provide information, communicate with us, request support, make a transaction, or use a product or feature.
• Automatically from your device and use of our app, websites, communications, and services, including through cookies, SDKs, logs, device permissions, and similar technologies.
• From banking partners, merchants, payment processors, card networks, financial-service partners, identity-verification providers, fraud-prevention and security providers, and other service providers or counterparties.
• From public records, government sources, commercially available sources, and other sources permitted by law.
• From information we derive or infer from the information described above.

4. Purposes for Collecting, Using, and Disclosing Personal Information

• Provide, operate, administer, personalize, support, and improve the 8TK app, accounts, payment features, fuel products, rewards, discounts, memberships, and other products and services.
• Process, authorize, settle, reconcile, monitor, and support transactions, transfers, deposits, payments, purchases, and related financial activity.
• Verify identity and satisfy KYC, AML, sanctions, fraud-prevention, security, authentication, and other legal or regulatory requirements.
• Detect, investigate, prevent, and respond to fraud, unauthorized activity, security incidents, abuse, errors, disputes, and other unlawful or prohibited activity.
• Communicate with you regarding accounts, transactions, security, support, legal notices, required disclosures, product updates, and other operational matters.
• With any consent required by law, market and promote our own products, services, discounts, rewards, loyalty benefits, member offers, and features.
• Conduct analytics, research, testing, debugging, auditing, quality assurance, product development, service improvement, and internal business operations.
• Enforce agreements and policies; establish, exercise, or defend legal claims; collect amounts owed; comply with law, legal process, regulatory requests, and contractual obligations.
• Protect the rights, property, safety, security, and integrity of 8TK, our users, our partners, and others.
• Evaluate or complete a merger, financing, acquisition, divestiture, reorganization, bankruptcy, sale of assets, or other corporate transaction.
• Carry out any other purpose disclosed to you at collection, with your consent, or as otherwise permitted by law.

5. Disclosure of Personal Information

We may disclose personal information to the categories of recipients below for business purposes or as otherwise permitted by law. A disclosure to a service provider, contractor, processor, bank, card network, or other recipient for these purposes does not necessarily constitute a sale or sharing under the CCPA, including where the disclosure is made pursuant to an applicable statutory exception or exemption.

• Banking and financial-service partners, including First Bank of the Lake.
• Processing and technology providers.
• Card networks and transaction participants, including Visa, Mastercard, merchants, acquirers, processors, and other entities involved in authorizing, processing, settling, or supporting transactions.
• Identity-verification, KYC/AML, sanctions, fraud-prevention, security, authentication, and risk providers, including Persona and Sardine
• Cloud hosting, software, communications, analytics, customer-support, professional-services, and other vendors that support our operations.
• Government agencies, regulators, courts, law enforcement, counterparties, and other persons when required or permitted by law or reasonably necessary to protect rights, safety, security, or property.
• Parties to a merger, financing, acquisition, reorganization, divestiture, bankruptcy, sale of assets, or similar corporate transaction, including advisers and prospective counterparties.
• Other persons at your direction, with your consent, or as disclosed to you at the time of collection.

6. Sale and Sharing of Personal Information

Based on our current practices, 8TK does not sell personal information for monetary or other valuable consideration and does not share personal information for cross-context behavioral advertising, as those terms are defined by the CCPA. We also do not disclose personal information to nonaffiliated third parties for their own direct-marketing purposes. We may use information to market our own products and services and may use service providers to assist us with those communications, subject to applicable law and contractual restrictions.

If our practices change in a manner that creates a right to opt out of sale or sharing, we will update this Notice and provide the legally required opt-out mechanisms before engaging in the applicable activity.

7. Sensitive Personal Information

We may collect sensitive personal information as described above. We use and disclose sensitive personal information to provide goods or services you request; perform services on behalf of the business; verify and maintain the quality or safety of services; resist fraud and malicious, deceptive, or illegal actions; ensure physical and account security; process transactions; comply with law; and for other purposes permitted without a right to limit under the CCPA. Based on our current practices, we do not use or disclose sensitive personal information for purposes that require us to provide a right to limit its use or disclosure. If that changes, we will provide the required notice and method to exercise the right.

8. California Privacy Rights

Subject to applicable exemptions and verification requirements, California residents may have the right to:

• Know / Access: request the categories and specific pieces of personal information we have collected about you, the categories of sources, purposes, and categories of third parties to whom we disclose information.
• Delete: request deletion of personal information we collected from you, subject to legal and operational exceptions.
• Correct: request correction of inaccurate personal information we maintain about you.
• Opt Out of Sale or Sharing: direct a business not to sell or share personal information. Based on our current practices, we do not sell or share personal information as defined by the CCPA.
• Limit Use and Disclosure of Sensitive Personal Information: where a business uses sensitive personal information for purposes that trigger this right. Based on our current practices, we do not use sensitive personal information for those purposes.
• Non-Discrimination: exercise CCPA rights without unlawful discrimination or retaliation.

9. Exercising Your Rights

To submit a California privacy request, email privacy@8tkpay.com or write to Greenlane.ai, LLC dba 8TK, Attn: Privacy, 110 W. Escalones, Suite B, San Clemente, CA 92672. You may also contact us at 1-800-716-6997.

Please describe the right you wish to exercise and provide information reasonably necessary for us to identify your records and verify your request. We may ask for additional information where necessary to verify identity, protect your account, prevent fraud, or confirm an authorized agent’s authority. We will use information submitted in connection with a request only for verification, security, compliance, and responding to the request.

You may use an authorized agent to submit a request where permitted by law. We may require proof that the agent is authorized to act for you and may also require you to verify your identity or confirm the authorization directly with us.

We will respond within the time periods required by applicable law. If we deny a request in whole or in part, we will explain the basis for the denial to the extent required by law.

10. Retention

We retain personal information for as long as reasonably necessary and proportionate to achieve the purposes for which it was collected or processed, including to provide and administer services, maintain business and transaction records, satisfy legal, regulatory, accounting, audit, fraud-prevention, security, dispute-resolution, and contractual requirements, enforce agreements, and establish or defend legal claims. Retention periods vary based on the nature of the information, the product or relationship, legal requirements, risk considerations, and operational needs.

11. Financial Incentives, Rewards, and Loyalty Programs

8TK may offer discounts, rewards, loyalty benefits, membership tiers, promotional credits, referral benefits, or similar product features. These programs are designed as features of our products and services and are not intended to require the sale or sharing of personal information.

12. Children

Our services are not directed to children under 18, and we do not knowingly collect personal information from children under 18 through the 8TK app. Because we do not sell or share personal information as defined by the CCPA, we do not knowingly sell or share personal information of consumers under 16.

13. California ‘Shine the Light’

California Civil Code section 1798.83 may permit California residents to request information concerning certain disclosures of personal information to third parties for their own direct-marketing purposes. We do not disclose personal information to third parties for their own direct-marketing purposes.

14. Deidentified and Aggregated Information

Where we maintain information in deidentified form, we may use and disclose that information as permitted by law. Where required by the CCPA, we will maintain and use deidentified information without attempting to reidentify it except as permitted by law.

15. Changes to This Notice

We may update this Notice from time to time. When we do, we will post the revised Notice and update the ‘Last Updated’ date. Where required by law, we will provide additional notice before materially different collection, use, or disclosure practices take effect.

16. Contact Us

Greenlane.ai, LLC dba 8TK
Attn: Privacy
110 W. Escalones, Suite B
San Clemente, CA 92672
Email: privacy@8tkpay.com
Telephone: 1-800-716-6997

Relationship to Other Privacy Notices

This Notice supplements the 8TK Privacy Policy and should be read together with it. Banking services provided by First Bank of the Lake are also subject to the Bank’s applicable privacy notices. If a provision of this Notice conflicts with a mandatory requirement of applicable law, the mandatory requirement controls.