Employee and Applicant Privacy Policy

Effective: July 22, 2026

1. Overview and Purpose 

ZestFinance, Inc. (d/b/a “Zest AI,” including its parent, subsidiary and affiliated corporations and entities, and their successors and assigns; collectively, "Zest AI," “we,” “us,” “our”) is committed to protecting the privacy and security of the information we collect, and to being transparent about the way we collect and process your information. This Employee and Applicant Privacy Policy (“Policy”) explains the personal information we collect and the purpose(s) for which we may use it in connection with your employment at Zest AI.

2. Scope 

This Policy applies to applicants, existing and former employees, independent contractors, and interns.  Please read this Policy carefully, which was last updated on the effective date specified herein.  

A copy of this policy must be provided or made available to all applicants, employees, or subcontractors prior to interviewing with Zest AI and upon hire.

3. Policy Requirements 

3.1 Information We Collect 

In the course of the hiring process and, if hired, during your tenure at Zest AI, we may collect the following  categories of personal information directly from you (as applicable): 

• Identifiers 
• Customer Records 
• Protected Classification Characteristics
• Commercial Information 
• Biometric Information 
• Internet or Other Electronic Network  Activity  
• Geolocation Data 
• Sensory Data  
• Professional or Employment-Related  Information 
  
• Education Information
• Inferences drawn from any of the above 

Information or documents that fall under the foregoing categories may include, without limitation, name, alias, postal address, email, social security number, driver's license, passport, race, color, national origin, citizenship, religion, marital status, medical condition, physical/mental disability, gender, sexual orientation, veteran/military status, genetic information, non-publicly available education information, education and employment history, and résumé/CV. Additionally, note that when you apply to a position at Zest AI, you are given the opportunity to submit a “Voluntary Self-Identification of Disability” form (Form CC-305), which we make available to comply with equal opportunity laws.  To the extent that we collect and process sensitive personal information, we do so in accordance with applicable law.

We may also collect certain information automatically from you when you use our systems or company-issued IT devices, such as IP address, internet or other electronic network information, login credentials and activity information, certain metadata, and related technical information. In certain cases, we may also receive certain information described above from third parties, such as third-party recruitment agencies who you may have directed to share your information with us when you applied for a role at Zest AI.

3.2 Sensitive Personal Information 

Under the California Privacy Rights Act (CPRA), certain categories of personal information are classified as "Sensitive Personal Information" (SPI). In connection with your employment or application at Zest AI, we collect the following categories of SPI:

3.3 Use of Information  

We use the above-mentioned personal information in connection with various employment-related  business purposes, including, without limitation: 

• To perform services or provide goods reasonably expected in the context of employment ,  including, without limitation:  
  
  
  • Recruitment and interviewing;
  • Managing the employer/employee relationship (e.g., onboarding, day-to-day work-related activities, pay parity analysis, maintaining time records, direct deposit authorization, and reimbursements); 
  • Preparing legally required records (including I-9 and EEO-1 forms); and
  • Compliance and legal purposes (e.g., government agency requests, litigation-related purposes, or to exercise a right or fulfill an obligation conferred or imposed by law).
• To detect security incidents and protect against malicious, deceptive, fraudulent, or illegal actions
• To ensure the physical safety of employees and others
• To perform short-term, transient use that does not involve building a profile or altering your experience outside the current interaction
• To perform services on behalf of the business (e.g., general People Ops resourcing, background screening, accounting purposes, financial planning, protecting personal information and technology systems, or internal investigations)
• To verify or maintain the quality or safety of a product or service
• To comply with federal, state, or local laws and regulations, including equal employment opportunity laws

Access to personal information is restricted to only those individuals at Zest AI who require such access based on their role, according to a need-to-know basis.

3.4 Right to Limit Use of Information 

If you are a California resident, you have the right to direct Zest AI to limit the use and disclosure of your SPI to only the purposes listed herein.

To submit a request to limit use of your SPI, you may contact us by:

• Email: legal@zest.ai or peopleops@zest.ai
• Mail: Zest AI, Attn: Legal/Compliance — SPI Limit Request, 3900 W. Alameda Ave., Suite 1600, Burbank, CA 91505

We will respond to your request within 45 days. If we need additional time (up to 45 additional days), we will notify you of the extension and the reason for it in writing.

To protect your privacy, we will verify your identity before processing your request. You may also designate an authorized agent to submit a limit request on your behalf; we may require written proof of authorization.

We will not discriminate against you for exercising your right to limit the use of your SPI. Exercising this right will not affect your employment, compensation, benefits, or any other terms or conditions of your employment.

3.5 Use of Artificial Intelligence in the Interview Process 

Zest AI currently uses artificial intelligence ("AI") technology in limited aspects of our interview process, currently specifically for:

• Scheduling candidate interviews; and
• Recording candidate interviews (you have the right to opt out of the recording).

Your personal information, including personally identifiable information ("PII") and SPI, may be processed by AI systems provided by third parties as part of these functions. Such third parties are subject to Zest AI’s Vendor Risk Management Program which includes a thorough review of the contracted AI-based services. Zest AI prohibits its vendor-provided AI systems from training on your PII. We implement appropriate safeguards to ensure that your personal information processed through AI systems maintain the same level of protection as outlined elsewhere in this Policy.  

Zest AI reserves the right to expand its use of AI in the interview process beyond the current limited applications described above. In the event that we implement additional AI uses in our interview process, such additional uses will be documented and disclosed in updates to this Policy. We will provide notice of any material changes to our AI usage practices in accordance with the "Changes to this Policy" section below.

3.6 Disclosure of Information 

We may share your personal information with the following parties for the above-mentioned business purposes:

• With our corporate affiliates – for conducting our day-to-day business as a company, including (but not limited to) recruitment and People Ops-related purposes;
• With Zest AI’s third-party service providers – such as software providers, payroll agencies, health insurance and other benefits providers, equity management companies, retirement plan providers and advisors, and other such providers;  
• For transaction-related business transfers – we may share personal information with third-party businesses or investors in connection with a substantial corporate transaction, such as a sale, merger, consolidation, initial public offering, or in the unlikely event of bankruptcy; 
• For legal purposes – we may disclose personal information to respond to subpoenas, court orders, legal process, law enforcement requests, legal claims or government inquiries, and to protect and defend the rights, interests, safety, and security of Zest AI and our affiliates, users, or the general public; and 
• With your consent – we may share personal information for any other purposes disclosed to you at the time we collect the information or pursuant to your consent. 

For current employees, depending on the platforms and software used for work purposes, such as Slack, Google Suite, Atlassian, etc., your personal information may also be collected by such third-party providers. Please check your information-sharing settings when using such platforms. 

We do not and will not sell (as defined under California law) your personal information, nor do we share it for purposes of cross-context behavioral advertising.

3.7 Retention of Information 

If you do not join our team, we will retain your personal information for as long as necessary to fulfill the purpose(s) for which it was collected, and thereafter as required by law. If you are hired at Zest AI, we will retain your personal information for the duration of your employment, and for a limited period thereafter as necessary and pursuant to our internal Data Retention Policy found in our Information Governance Policy. Zest AI conforms with the requisite security protocols in the retention of your personal information.

3.8 Security of Information 

We maintain reasonable security measures to safeguard personal information from loss, theft, interference, misuse, unauthorized access, disclosure, alteration, or destruction.

3.9 Rights  

Where provided by applicable law (and subject to applicable exceptions), you have the right to access, correct, or erase your personal information, as well as to object to or restrict the processing of your personal information (including sensitive personal information, as applicable).  If you become aware of changes or inaccuracies in your information, you should inform us of such changes so that the information may be updated or corrected. 

To submit a request to exercise one of the rights listed above, or to have an authorized agent submit a request on your behalf (where so provided by applicable law), please contact us at legal@zest.ai or peopleops@zest.ai.  Once we receive your request, we may verify it by requesting information sufficient to confirm your identity (and/or the identity of your authorized agent and their mandate to act on your behalf). We will not discriminate against you when you exercise your rights.

3.10 Changes to this Policy 

Zest AI may periodically update this Policy, which was last updated on the effective date specified above. We may make changes to it from time to time to better clarify our practices and comply with applicable laws. A copy of the current policy in force must be provided to applicants prior to interview and is made available to employees on our intranet site, transparenZ and on our website.

3.11 Questions 

We welcome any questions, concerns, or feedback about this Policy at legal@zest.ai.