Information is used for regulator, law-enforcement and litigation inquiries worldwide
Affirm uses information in connection with inquiries from regulators, law enforcement agencies or parties involved in litigation, in each case anywhere in the world, as necessary to comply with obligations or bring claims and exercise defenses, including to enforce loan agreements and Terms of Service.
Details
Who
regulators, law enforcement agencies and litigation parties
Where
anywhere in the world
Why
comply with obligations, bring claims and exercise defenses, including enforcing loan agreements and Terms of Service
Supporting quotations
In connection with inquiries from regulators, law enforcement agencies, or parties involved in litigation, in each case anywhere in the world, as necessary for Affirm to comply with obligations or bring claims and exercise defenses, including to enforce the terms of loan agreements and Terms of Service.
Qualifications & exceptions
Inquiries may come from anywhere in the world.
Use is as necessary to comply with obligations or bring and defend claims.
Legal Rights & Agreement Rules · Company practice
Affirm discloses information for legal requests and to protect customers, staff or property
Affirm discloses information to comply with applicable law and respond to requests from law enforcement agencies, other government authorities or third parties as permitted by law. It says this may be done without consent when it has a good-faith belief that it is necessary to protect customers, employees or property, in emergencies, to enforce its rights under its terms of service and policies, or to combat fraud or criminal activity.
Details
Who
law enforcement agencies, other government authorities and third parties
Condition
good-faith belief that disclosure is necessary to protect customers, employees or property, in emergencies, to enforce rights or to combat fraud
Supporting quotations
To comply with applicable law and respond to requests from law enforcement agencies or other government authorities or third parties, as permitted by law. This may be done without your consent when we have a good faith belief that it is necessary to protect our customers, employees, or property, in emergency situations, to enforce our rights under our terms of service and policies, or to combat fraud or criminal activity.
Qualifications & exceptions
Disclosure is described as permitted by law.
Consentless disclosure rests on Affirm's good-faith belief that it is necessary for the listed purposes.
Legal Rights & Agreement Rules · Procedure
Privacy questions go to privacy@affirm.com; merchant processing questions go to the merchant
Affirm asks that questions or concerns about the Privacy Notice be sent to privacy@affirm.com. For questions about how a merchant processes your information, it directs you to the merchant or the merchant's privacy notice.
Details
What it does
contact privacy@affirm.com with privacy questions
Condition
merchant processing questions go to the merchant or its privacy notice
Supporting quotations
If you have questions or concerns regarding this Privacy Notice, you should contact us at privacy@affirm.com.
If you have questions about how a merchant processes your information, you should contact the merchant or visit the merchant’s privacy notice.
Qualifications & exceptions
Merchant processing questions are directed to the merchant.
Legal Rights & Agreement Rules · Restriction or exception
State privacy rights apply to information outside GLBA's financial scope
Certain U.S. states give consumers rights over their personal information. Affirm says that for the financial services it offers it is governed by GLBA, which exempts NPI from most state privacy laws, so the rights it describes apply only when applicable and to information collected outside GLBA's scope, such as browsing the website while logged out or interacting outside a financial product or service. It points to its Cookie Notice for website data and how to opt out of cookies and web tracking.
Details
Where
certain U.S. states
Exception
NPI under GLBA is exempt from most state privacy laws
Condition
information collected outside GLBA's scope, such as logged-out website use
Supporting quotations
Certain U.S. states provide consumers with rights regarding their Personal Information. However, as explained above, Affirm, in connection with financial services we offer, is governed by GLBA, which exempts NPI collected from most state privacy laws. When applicable, we provide the rights outlined below for information collected outside the scope of GLBA, for example, information collected from you when you browse our website in a logged-out state.
You can find out more information about the website data we collect in our Cookie Notice, including how to opt out of certain cookies and web-tracking technologies.
This section describes the rights that may apply to personal information collected outside the scope of the GLBA, including when you use Affirm’s website in a logged-out state or interact with us outside of a financial product or service.
Qualifications & exceptions
Rights are described as applying outside GLBA's scope.
Examples given are logged-out website browsing and interactions outside a financial product or service.
Cookie and web-tracking choices are covered by the separately linked Cookie Notice.
Not stated here
The linked Cookie Notice is not supplied in this source; its terms are not analyzed.
California section is the CCPA Notice at Collection for data outside GLBA
Under California law the Notice serves as Affirm's "Notice at Collection" under the California Consumer Privacy Act as amended by the California Privacy Rights Act, and includes additional disclosures under California's Shine the Light law. The section applies only to personal information collected outside the scope of GLBA.
Details
Where
California
Condition
personal information collected outside the scope of GLBA
Supporting quotations
Under California law, you have certain rights regarding how your personal information is collected and used. This section serves as our "Notice at Collection" under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and includes additional disclosures under California’s Shine the Light law. This section applies only to personal information collected outside the scope of the GLBA.
Qualifications & exceptions
Applies only to personal information outside GLBA's scope.
Includes Shine the Light disclosures in addition to CCPA/CPRA ones.
Legal Rights & Agreement Rules · Restriction or exception
CCPA disclosures apply only to information not subject to GLBA or another exemption
The Notice says California residents may have the right to receive certain disclosures about the collection, use and sharing of personal information, and that these disclosures apply only to information not subject to GLBA or another applicable exemption.
Details
Where
California
Exception
information subject to GLBA or another applicable exemption
Supporting quotations
California Consumer Privacy Act: California residents may have the right to receive certain disclosures regarding the collection, use, and sharing of Personal Information. These disclosures apply only to information not subject to GLBA or another applicable exemption.
Qualifications & exceptions
Applies only to information outside GLBA or another applicable exemption.
Legal Rights & Agreement Rules · Restriction or exception
Section 8.2 rights cover information outside GLBA, such as logged-out browsing
Affirm repeats that it is a GLBA financial institution and that much of the personal information it collects is NPI, so many state privacy laws do not apply to that information. The rights in this section therefore apply to personal information collected outside GLBA's scope, including when you use Affirm's website in a logged-out state or interact with it outside a financial product or service.
Details
Exception
personal information that is NPI under GLBA
Condition
personal information collected outside GLBA's scope, including logged-out website use
Supporting quotations
As mentioned above, Affirm is a financial institution subject to GLBA, and much of the personal information we collect and process is considered NPI under that law. As a result, many state privacy laws do not apply to that information.
This section describes the rights that may apply to personal information collected outside the scope of the GLBA, including when you use Affirm’s website in a logged-out state or interact with us outside of a financial product or service.
Qualifications & exceptions
NPI governed by GLBA remains outside these state rights.
Examples of covered data are logged-out website use and interactions outside a financial product or service.
Legal Rights & Agreement Rules · Company commitment
The GLBA notice gives Vermont residents stricter limits on affiliate and nonaffiliate sharing
For Vermont residents, the GLBA notice says Affirm will not disclose information about your creditworthiness to its affiliates, and will not disclose your personal information, financial information, credit report or health information to nonaffiliated third parties for them to market to you, other than as permitted by Vermont law.
Details
Where
Vermont
Exception
as permitted by Vermont law
What it covers
creditworthiness information, personal information, financial information, credit report and health information
Supporting quotations
For Vermont Residents. We will not disclose information about your creditworthiness to our affiliates and will not disclose your personal information, financial information, credit report, or health information to nonaffiliated third parties to market to you, other than as permitted by Vermont law.
Qualifications & exceptions
Applies to Vermont residents.
The restriction is subject to what Vermont law permits.
Legal Rights & Agreement Rules · Context
Bank-partner products are governed by the partner bank's own privacy notice
The Notice says Affirm may partner with banks ("Bank Partners") to offer products and services, and that if you are approved for a product offered through Affirm by one of its Bank Partners, or through other partnerships with Bank Partners, your non-public personal information is subject to those banks' privacy notices. The Notice links notices for Cross River Bank, Celtic Bank, Lead Bank, Evolve Bank and Trust, and Stride Bank.
Details
Who
Affirm's Bank Partners
What it covers
non-public personal information for products offered by Bank Partners
Supporting quotations
We may partner with banks ("Bank Partners") to offer certain products and services. If you are approved for a product offered through Affirm by one of our Bank Partners, or through other partnerships with Bank Partners, your non-public personal information will be subject to the following privacy notices:
Applies to products offered through Affirm by a Bank Partner or through other Bank Partner partnerships.
Non-public personal information is subject to the bank's notice.
Not stated here
The bank partners' privacy notices linked here (Cross River, Celtic, Lead, Evolve and Stride) are not supplied in this source; their terms and any differences between them are not analyzed.
Legal Rights & Agreement Rules · Restriction or exception
GLBA financial information is governed by federal law and Section 9, not state privacy law
Affirm says certain information collected and processed for its Services is "nonpublic personal information" (NPI) under the U.S. Gramm-Leach Bliley Act, and that Affirm is a "financial institution" under GLBA. On that basis the Notice states the collection and use of that NPI is governed exclusively by federal law rather than applicable state privacy laws, and that Section 9 of this Privacy Policy, titled "Affirm's Privacy Notice for Consumer Financial Information," applies to it. The Notice repeats the limit in its state-rights part: GLBA exempts NPI from most state privacy laws, and the state rights it describes cover information collected outside GLBA's scope, such as browsing the website while logged out.
Details
Who
Affirm, Inc. and its affiliates
What it does
treats NPI as governed exclusively by federal law rather than applicable state privacy laws
What it covers
nonpublic personal information (NPI) under the U.S. Gramm-Leach Bliley Act
Condition
information collected and processed in connection with Affirm Services
Where
United States
When
Section 9 revision 08/2025
Exception
state privacy rights apply only to information collected outside GLBA's scope, such as logged-out website browsing
Supporting quotations
Please note that certain information we collect and process in connection with your use of Affirm Services is considered "nonpublic personal information" (NPI) under the U.S. Gramm-Leach Bliley Act ("GLBA"). Affirm is considered a "financial institution" under GLBA, and as such, the collection and use of NPI is governed exclusively by federal law, not applicable state privacy laws. Section 9 of this Privacy Policy, titled "Affirm’s Privacy Notice for Consumer Financial Information," applies to this information.
Certain U.S. states provide consumers with rights regarding their Personal Information. However, as explained above, Affirm, in connection with financial services we offer, is governed by GLBA, which exempts NPI collected from most state privacy laws. When applicable, we provide the rights outlined below for information collected outside the scope of GLBA, for example, information collected from you when you browse our website in a logged-out state.
As mentioned above, Affirm is a financial institution subject to GLBA, and much of the personal information we collect and process is considered NPI under that law. As a result, many state privacy laws do not apply to that information.
9. Affirm’s Privacy Notice for Consumer Financial Information
[Rev. 08/2025]
Qualifications & exceptions
Applies to information that counts as NPI under GLBA in connection with Affirm Services.
Section 9 of this Notice, revised 08/2025, is the separate notice for that information.
The state consumer privacy rights described later apply outside GLBA's scope, for example logged-out website use.
Not stated here
The Notice does not determine which individual data items are NPI beyond this general GLBA statement.
Section 9 is Affirm, Inc.'s separate GLBA privacy notice, revised 08/2025
Section 9 of the Notice is titled "Affirm's Privacy Notice for Consumer Financial Information" and is marked Revision 08/2025. Its opening line describes it as facts about how Affirm, Inc. uses your personal information.
Details
When
Revision 08/2025
Who
Affirm, Inc.
Supporting quotations
9. Affirm’s Privacy Notice for Consumer Financial Information
[Rev. 08/2025]
Facts about how Affirm, Inc. uses your personal information
Qualifications & exceptions
Section 9 revision is dated 08/2025.
The notice provider is Affirm, Inc.
Not stated here
The Notice does not explain how the 08/2025 GLBA notice and the 14 Oct 2026 main Notice are synchronized.
Legal Rights & Agreement Rules · Restriction or exception
Federal law limits only three kinds of sharing; state law may add rights
The GLBA notice explains that federal law gives the customer the right to limit only three things: sharing for affiliates' everyday business purposes involving information about creditworthiness, affiliates using the information to market to the customer, and sharing for nonaffiliates to market to the customer. It adds that state laws and individual companies may give additional rights to limit sharing.
Details
Exception
affiliates' creditworthiness sharing, affiliates' marketing use and nonaffiliate marketing sharing
Where
United States federal law, with possible additional state rights
Supporting quotations
Why can't I limit all sharing? Federal law gives you the right to limit only
sharing for affiliates' everyday business purposes--information about your creditworthiness
affiliates from using your information to market to you
sharing for nonaffiliates to market to you
State laws and individual companies may give you additional rights to limit sharing. See below for more on your rights under state law.
Qualifications & exceptions
The federal limit right covers only the three listed sharing types.
State laws and individual companies may add rights.
Legal Rights & Agreement Rules · Context
The GLBA notice defines affiliates, nonaffiliates and joint marketing
The GLBA notice defines affiliates as companies related by common ownership or control, which can be financial and nonfinancial, and lists Affirm Loan Services, LLC, Affirm Financial Solutions, LLC and Affirm Payments, LLC as affiliates with an Affirm name. It defines nonaffiliates as companies not related by common ownership or control, which can be financial and nonfinancial, and says nonaffiliates it can share with include merchant partners, third-party platforms and marketing service providers. Joint marketing means a formal agreement between nonaffiliated financial companies that together market financial products or services to you, with bank and merchant partners given as its joint marketing partners.
Details
What it covers
affiliates, nonaffiliates and joint marketing
Supporting quotations
Definitions
Affiliates Companies related by common ownership or control. They can be financial and nonfinancial companies.
Our affiliates include companies with an Affirm name, such as Affirm Loan Services, LLC, Affirm Financial Solutions, LLC and Affirm Payments, LLC.
Nonaffiliates Companies not related by common ownership or control. They can be financial and nonfinancial companies.
Nonaffiliates we can share with include our merchant partners, third-party platforms, and marketing service providers.
Joint marketing A formal agreement between nonaffiliated financial companies that together market financial products or services to you.
Our joint marketing partners include bank and merchant partners.
Qualifications & exceptions
Affiliates and nonaffiliates can each be financial or nonfinancial companies.
Joint marketing requires a formal agreement between nonaffiliated financial companies.
Legal Rights & Agreement Rules · Company commitment
The GLBA notice limits California sharing to what California law permits
Under "Other important information" and its "Special Notice For State Residents," the GLBA notice says that for California residents it will not share personal information with affiliates or nonaffiliates except as permitted by California law, such as to process a transaction or with the customer's consent.
Details
Where
California
Exception
sharing permitted by California law, such as to process a transaction or with consent
Supporting quotations
Other important information
Special Notice For State Residents
For California Residents. We will not share personal information with affiliates or nonaffiliates except as permitted by California law, such as to process your transaction or with your consent.
Qualifications & exceptions
Applies to California residents.
Exceptions are conduct permitted by California law, such as processing a transaction or consent.
Not stated here
The Vermont-specific statement that follows in the source belongs to the next section packet and is not analyzed here.