END USER PRIVACY POLICY
Full-Fill Financial, Inc.
Effective Date: May 6, 2026
Full-Fill Financial, Inc. ("Full-Fill," "we," "us," or "our") operates a technology-enabled student support platform (the "Platform") that allows universities, nonprofit organizations, employers, and other institutions ("Sponsoring Institutions") to administer nutrition support, emergency assistance, and related participant benefit programs.
This Privacy Policy describes how Full-Fill collects, uses, stores, and shares personal information about end users — the students, participants, and employees ("you" or "your") — who access the Platform through a Sponsoring Institution's program. Please read this policy carefully.
If you are a student at a U.S. educational institution, your personal data may also constitute Education Records protected under the Family Educational Rights and Privacy Act (FERPA). Please see Section 7 for more information.
1. WHO CONTROLS YOUR DATA
Your Sponsoring Institution is the data controller — meaning it determines the purposes and means of processing your personal data in connection with its benefit program. Full-Fill acts as a data processor, processing your personal data on behalf of and under the instructions of your Sponsoring Institution pursuant to a Data Processing Agreement (DPA).
Your Sponsoring Institution is responsible for providing you with any notices required by applicable privacy law, including FERPA, in connection with its use of the Platform. If you have questions about how your Sponsoring Institution uses your data, please contact your institution directly.
2. INFORMATION WE COLLECT
Information Your Sponsoring Institution Provides
Your Sponsoring Institution provides Full-Fill with the personal data necessary to create and manage your account and program enrollment. This typically includes:
First and last name
Institutional email address
Enrollment status or program eligibility confirmation
Benefit amount authorized for your account
Any additional data fields collected for a specific deployment will be identified by your Sponsoring Institution before or at the time of enrollment.
Information You Provide Directly
When you use the Platform, you may submit:
Receipt images and related documentation for program validation;
Profile updates (e.g., preferred contact information, notification preferences); and
Communications you send to Full-Fill support or your Sponsoring Institution through the Platform.
Information Collected Automatically
When you access the Platform, we may automatically collect:
Device information (device type, operating system version, app version);
Log data (IP address, access times, pages or screens viewed, actions taken within the Platform);
Push notification token (to enable in-app and push notifications); and
Usage data (features accessed, transaction activity, program progress).
We use this information to operate, maintain, and improve the Platform, to diagnose technical issues, and to fulfill our obligations to your Sponsoring Institution.
Financial and Payment Card Data
Payment card issuance, fund loading, and transaction processing are performed directly by SKUx, Full-Fill's financial partner, under SKUx's own terms and applicable law. Full-Fill does not store or process full payment card numbers, bank account numbers, or other sensitive financial account identifiers. Transaction records (merchant name, amount, date, and category) may be shared with Full-Fill by SKUx for program reporting and receipt validation purposes.
3. HOW WE USE YOUR INFORMATION
Full-Fill uses your personal data only as authorized by your Sponsoring Institution and as described in this Privacy Policy, including:
Creating and managing your Platform account;
Coordinating the disbursement of institution-authorized benefit funds to your payment card or account;
Processing receipt submissions and completing required program validation workflows;
Delivering educational content, program updates, and notifications via email, SMS, or push notification;
Generating program participation and outcome reports for your Sponsoring Institution;
Providing customer support;
Detecting and preventing fraud, abuse, and unauthorized use of the Platform; and
Complying with applicable legal obligations.
Full-Fill does not use your personal data to build advertising profiles, sell your information to third parties, or improve Full-Fill products or services beyond the services provided to your Sponsoring Institution.
Full-Fill may generate de-identified and aggregated data (e.g., program-level participation statistics) that does not identify you individually. Full-Fill may use such aggregated data for its own business purposes, including product development, benchmarking, and published research.
4. HOW WE SHARE YOUR INFORMATION
With Your Sponsoring Institution
Full-Fill shares your personal data with your Sponsoring Institution to enable program administration, reporting, and compliance. This is the primary purpose for which your data is processed. Your Sponsoring Institution determines what data it receives and how it is used in accordance with its own privacy policies and applicable law.
With Our Service Providers (Subprocessors)
Full-Fill engages the following third-party service providers (subprocessors) to operate the Platform. Each subprocessor is bound by contractual data protection obligations consistent with this Privacy Policy.
Provider
Location
Purpose
SKUx
United States
Payment card issuance, fund loading, and transaction processing
Fly.io
United States
Cloud infrastructure and application hosting
Twilio
United States
SMS and push notification delivery
Clerk
United States
User authentication and session management
Expo
United States
Mobile app delivery and over-the-air updates
Resend
United States
Transactional and automated email delivery
As Required by Law
Full-Fill may disclose your personal data if required to do so by applicable law, regulation, legal process, or governmental request, or to enforce these Terms, protect the rights of Full-Fill or others, or respond to an emergency involving risk to the safety of any person.
In Connection with a Business Transaction
If Full-Fill is acquired, merged, or undergoes another corporate transaction, your personal data may be transferred to the acquiring entity, subject to the same obligations under this Privacy Policy.
5. DATA RETENTION
Full-Fill retains your personal data for the duration of your Sponsoring Institution's active agreement with Full-Fill and for a limited period thereafter as required by applicable law, to resolve disputes, or to satisfy audit and compliance obligations.
Following the expiration or termination of your Sponsoring Institution's agreement with Full-Fill, Full-Fill will delete or irreversibly anonymize your personal data in accordance with its data retention schedule, unless a longer retention period is required by law. Requests for deletion may also be submitted by your Sponsoring Institution on your behalf.
6. SECURITY
Full-Fill implements and maintains commercially reasonable technical and organizational security measures designed to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:
Encryption of personal data in transit using TLS and at rest using AES-256 or equivalent;
Role-based access controls limiting access to personal data to personnel with a legitimate operational need;
Multi-factor authentication for administrative access to systems that store or process personal data;
Regular security assessments and vulnerability management processes; and
Incident response procedures, including detection, escalation, and notification protocols.
No security measure is perfect. In the event of a security incident affecting your personal data, Full-Fill will notify your Sponsoring Institution as required by the DPA and applicable law. Your Sponsoring Institution is responsible for notifying you in accordance with applicable breach notification requirements.
7. FERPA NOTICE
If you are a student enrolled at a U.S. educational institution, your personal data collected through the Platform may constitute Education Records as defined under FERPA. Under FERPA, your Sponsoring Institution (as the covered educational agency or institution) is responsible for your rights with respect to Education Records.
Full-Fill acts as a "school official" with "legitimate educational interests" as those terms are used under FERPA, solely for the purpose of providing the services described in its agreement with your Sponsoring Institution. Full-Fill does not use Education Records for any other purpose and does not re-disclose Education Records except as authorized under its agreement with your Sponsoring Institution or as required by applicable law.
To exercise your rights under FERPA — including rights to access, amendment, or restriction of your Education Records — please contact your Sponsoring Institution directly. Full-Fill will cooperate with your Sponsoring Institution to fulfill any such requests to the extent they relate to data held by Full-Fill.
8. YOUR RIGHTS AND CHOICES
Depending on your location and applicable law, you may have certain rights with respect to your personal data, including:
Access — the right to request a copy of the personal data Full-Fill holds about you;
Correction — the right to request correction of inaccurate or incomplete personal data;
Deletion — the right to request deletion of your personal data, subject to applicable legal and contractual obligations; and
Restriction or Objection — the right to request that Full-Fill limit or cease processing your personal data in certain circumstances.
Because Full-Fill processes your personal data on behalf of your Sponsoring Institution, requests to exercise these rights should generally be directed to your Sponsoring Institution. You may also contact Full-Fill at privacy@full-fill.com, and Full-Fill will work with your Sponsoring Institution to respond to your request as appropriate.
Notification Preferences
You may manage your preferences for SMS and push notification alerts within the Platform settings. You may also unsubscribe from non-essential email communications by following the unsubscribe link in any email we send. Note that certain transactional notifications (such as account creation confirmations, funding alerts, and security notices) are necessary for operation of the Platform and cannot be disabled while your account is active.
9. CHILDREN'S PRIVACY
The Platform is not directed to children under the age of 13. Full-Fill does not knowingly collect personal data from children under 13 without verifiable parental consent. If Full-Fill becomes aware that it has collected personal data from a child under 13 without appropriate consent, it will take steps to delete that data. If you believe a child under 13 has provided personal data through the Platform without consent, please contact us at privacy@full-fill.com.
10. INTERNATIONAL DATA TRANSFERS
Full-Fill processes personal data in the United States. If you are located outside the United States, please be aware that your personal data will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.
Full-Fill does not currently transfer personal data outside of the United States to third parties. If Full-Fill engages a subprocessor that processes data outside the United States, Full-Fill will ensure that appropriate safeguards are in place and will notify your Sponsoring Institution in advance.
11. CHANGES TO THIS PRIVACY POLICY
Full-Fill may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the Platform or by sending a notification to your registered email address. The revised policy will be effective as of the date indicated at the top of the document. Your continued use of the Platform after the effective date of any revision constitutes your acknowledgment of the updated policy.
12. CONTACT US
If you have questions, concerns, or requests regarding this Privacy Policy or Full-Fill's data practices, please contact us at:
Full-Fill Financial, Inc.
Privacy Inquiries