Stride Bank Online Privacy Policy

Legal Rights & Agreement Rules · Context

Stated policy version is January 2020

The document is headed "Online Privacy Policy" and states "Last Updated January 2020". It gives no earlier version or revision history. The CCPA section later in the document states an effective date of January 1, 2020.

Supporting quotations

Online Privacy Policy

Last Updated January 2020

Qualifications & exceptions

• The stated update month is January 2020; the document does not give a day.

Not stated here

• Whether this is the first version or a revision of an earlier policy is not stated.

Data Access & Collection · Context

Notice covers Stride Bank's own websites and apps

The notice applies to users and visitors of the Stride Bank, N.A. website and mobile application and to any online or mobile site or application owned or controlled by Stride Bank or its divisions, subsidiaries and affiliates. It describes how Stride Bank collects, uses and shares information from or about those users and visitors. The document does not name Affirm or another partner, so it does not by its terms state whether a partner-operated page is within this scope.

Supporting quotations

This notice applies to users and visitors to the Stride Bank, N.A. website and mobile application, and any online or mobile site or application (collectively “Site”) owned or controlled by Stride Bank or any of its divisions, subsidiaries and affiliates (collectively, “Stride Bank” or “we” or “us” or “our”).

This notice describes how we collect, use and share information from or about users and visitors of the Site.

Qualifications & exceptions

• Scope is limited to sites and apps owned or controlled by Stride Bank or its divisions, subsidiaries and affiliates.
• The notice describes collection, use and sharing for users and visitors of those Sites.

Not stated here

• Whether a co-branded or partner-operated page is owned or controlled by Stride Bank is not stated.
• The document does not name Affirm or any specific card program.

Legal Rights & Agreement Rules · Context

A separate Privacy Notice applies to financial products

The notice says other privacy policies may apply in addition. If you inquire about, apply for, or have a financial product or service with Stride Bank, it directs you to its Privacy Notice, which applies to U.S. customers and consumers as described in that notice. The text does not say which document controls if the two differ.

Supporting quotations

Other privacy policies may apply in addition to the terms of this notice. If you inquire about, apply for, or have a financial product or service with us, please review our Privacy Notice, which applies to U.S. customers and consumers as described in that notice.

Qualifications & exceptions

• The separate Privacy Notice applies to U.S. customers and consumers as described in that notice.
• Other privacy policies may apply in addition to this notice.

Not stated here

• The separate Privacy Notice is not part of this saved source; its terms are not supplied or analyzed here.
• Which notice controls in a conflict is not stated.

Data Access & Collection · Context

Personal information covers identifiers and associated data

The notice says the section describes generally how Stride Bank collects and uses personal information and how it may use it. It defines personal information as information that identifies you or your device, and other information the bank associates with it. The word "generally" and the separate product-dependent list mean the definition is broad rather than an exhaustive enumeration.

Supporting quotations

This section generally describes how Stride Bank collects and uses your personal information, and how Stride Bank may use your personal information. Personal information generally means information that identifies you or your device, and other information we associate with it.

Qualifications & exceptions

• The definition is introduced as general: information that identifies you or your device, and other information associated with it.

Not stated here

• The full set of information the bank collects is not enumerated.

Legal Rights & Agreement Rules · Context

Federal law gives a right to limit some sharing

The notice states that financial companies choose how they share personal information, that federal law gives consumers the right to limit some but not all sharing, and that federal law requires the bank to tell consumers how it collects, shares and protects personal information. It does not name the federal law or describe which sharing can be limited.

Supporting quotations

Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information.

Qualifications & exceptions

• The right described is to limit some but not all sharing.

Not stated here

• The federal law is not named.
• Which sharing is limitable is not stated in the document.

Data Access & Collection · Company practice

Data collected depends on the product and can include SSN and credit data

The types of personal information Stride Bank collects and shares depend on the product or service the person has. The notice gives examples: Social Security number and income; account balances and payment history; credit history and credit scores. The list is illustrative ("can include"), not a complete inventory.

Supporting quotations

The types of personal information we collect, and share depend on the product or service you have with us. This information can include: ◼ Social Security number and income ◼ account balances and payment history ◼ credit history and credit scores

Qualifications & exceptions

• The list is introduced by "can include" and depends on the product or service.

Not stated here

• The notice does not map each data type to a product, purpose or recipient.

Sharing & Disclosure · Company practice

Sharing continues after the customer relationship ends

The notice states that when you are no longer its customer, Stride Bank continues to share your information as described in the notice. The notice does not state an end date. For Vermont residents, the separate Vermont section states that the bank will not share with non-affiliates except for its own marketing purposes, its everyday business purposes, or with consent.

Supporting quotations

When you are no longer our customer, we continue to share your information as described in this notice.

In accordance with Vermont law, we will not share with non-affiliates except for our own marketing purposes, our everyday business purposes, or with your consent.

Qualifications & exceptions

• Continued sharing is limited to the sharing described in this notice.
• The Vermont residents section states a non-affiliate sharing restriction with three exceptions.

Not stated here

• No end date or retention period for post-customer sharing is stated.
• The notice's sharing descriptions are incomplete because the promised sharing-reasons list is absent from the document.

Cross-references

• qualified by (model-proposed): Vermont residents: no non-affiliate sharing except three stated purposes — The Vermont section's non-affiliate sharing restriction and its three exceptions qualify the statement that sharing continues after the customer relationship ends, for Vermont residents.

Sharing & Disclosure · Context

Sharing-reasons list promised by the notice is absent

The notice says that, in the section below, it lists the reasons financial companies can share customers' personal information, the reasons Stride Bank chooses to share, and whether you can limit that sharing. The saved document contains no such list or table: the next heading after this paragraph is "Cookies and Beacons", and no sharing-reasons list appears anywhere in the document. The notice therefore does not state here its sharing reasons or the limit options it promises; this analysis does not reconstruct them from another policy.

Supporting quotations

In the section below, we list the reasons financial companies can share their customers’ personal information; the reasons Stride Bank chooses to share; and whether you can limit this sharing.

All financial companies need to share customers’ personal information to run their everyday business.

Qualifications & exceptions

• The paragraph states that all financial companies need to share customers' personal information to run their everyday business.

Not stated here

• The promised sharing reasons and limit options are not in the supplied document.
• Whether the missing content appears in another Stride Bank document is not established by this source.

Data Access & Collection · Company practice

Cookies are used only to provide services and effective Sites and Apps

The notice defines a cookie as an electronic file the Sites place on your computer to store information that makes visits and App use more efficient. It says cookies let the Site and App recognize prior visits and the security requirements and browser preferences of the device. It states a purpose limit: "We only use cookies to provide better services and more effective Sites and Apps."

Supporting quotations

A cookie is an electronic file our Sites place on your computer to store information that makes your visit to our Sites and your use of our Apps more efficient.

Cookies let our Site and App recognize if your computer or mobile device has visited our Sites or used our Apps before, and what security requirements and browser preferences your computer or mobile device requires.

We only use cookies to provide better services and more effective Sites and Apps.

Qualifications & exceptions

• The stated purpose limit is "to provide better services and more effective Sites and Apps".

Not stated here

• Cookie types, durations, and whether third-party cookies are used are not stated.

Data Access & Collection · Company practice

Beacons can track movements across websites; bank uses them for content and App efficiency

The notice defines "beacons" as small graphic files with a unique identifier used to track a visitor's online movements over time and across different websites. It says beacons are embedded on websites, not downloaded to the device. Stride Bank says it uses beacons to better manage content on the Site and to improve the use and efficiency of the App.

Supporting quotations

"Beacons" include small graphic files with a unique identifier that are used to track a visitor to our Site or user of our App online movements over time and across different websites.

Unlike cookies, beacons are embedded on websites, not downloaded on your computer or device.

Stride Bank uses beacons to better manage content on our Site and to improve the use and efficiency of our App.

Qualifications & exceptions

• The cross-website tracking description is part of the notice's definition of beacons.
• The bank's own stated uses are content management and App use and efficiency.

Not stated here

• The notice does not identify the beacons or third parties involved, or say whether beacon data is linked to personal information.

Data Access & Collection · Company practice

Location is collected only after manual entry; the App does not collect it automatically

On the Site, visitors are not asked whether they want to share their location; they must manually enter a location before Stride Bank will collect it, and the notice says the decision is entirely up to the visitor. The bank uses the information for location-specific services such as finding ATMs and branches. The notice separately says the App does not automatically collect location information from the device.

Supporting quotations

When you visit our Site, you will not be asked if you would like to share your location.

You would have to manually enter your location before we will collect it, and the decision to share your location is entirely up to you.

We use this information to offer location-specific services, like helping you find our ATMs and our branches.

Our App does not automatically collect location information from your device

Qualifications & exceptions

• The manual-entry condition is stated for the Site; the App statement is separate and addresses only automatic collection.

Not stated here

• Whether the App collects location information at all, and how long location data is kept, is not stated.

Data Access & Collection · Company practice

Site and App do not respond to Do Not Track signals

The notice states that the Site and App do not process or respond to "do not track" signals or other similar web browser signals.

Supporting quotations

Our Site and App do not process or respond to "do not track" signals or other similar web browser signals.

Qualifications & exceptions

• The statement covers the Site and App.

Not stated here

• The notice does not describe any alternative tracking control.

Data Access & Collection · Company practice

Bank collects the pages visited before and after its Site

When you visit the Site, Stride Bank says it collects information about the webpage you visited before visiting the Sites and the webpage you visit after leaving the Site.

Supporting quotations

When you visit our Site, we collect information about the webpage you visited before visiting our Sites and the webpage you visit after leaving our Site.

Qualifications & exceptions

• The statement is about visits to the Site.

Not stated here

• How the referral information is used or how long it is kept is not stated.

Data Access & Collection · Company practice

Google Analytics collects usage statistics; opt-out is through Google

Stride Bank uses Google Analytics to collect statistical and usage information about the Site to continually improve its design and functionality. The notice says a visitor who does not want Google Analytics to collect information about their website use can opt out by visiting https://tools.google.com/dlpage/gaoptout and following the instructions.

Supporting quotations

Stride Bank uses Google Analytics to collect statistical and usage information related to the Site in order to continually improve the design and functionality.

If you do not want Google Analytics to collect information about your website use, you can opt out by visiting https://tools.google.com/dlpage/gaoptout and following the instructions.

Qualifications & exceptions

• The opt-out route given is Google's page, not a Stride Bank opt-out.

Not stated here

• Whether Google Analytics data is linked to personal information, and how long it is retained, is not stated.

Legal Rights & Agreement Rules · Context

Other websites reached from the Sites have their own policies

The Sites may contain links to other websites or refer visitors to them. Those sites may be operated by affiliated companies or by unaffiliated third parties. Once a visitor leaves the Sites and accesses another website, that website's privacy and security policies apply.

Supporting quotations

For your convenience, our Sites may contain links to other websites, or may refer you to other websites.

Those other sites may be operated by other companies affiliated with us or by third party companies not affiliated with us.

Once you leave our Sites and access another website, you should be aware that you are subject to the privacy and security policies of that website.

Qualifications & exceptions

• The statement covers sites reached by a link or referral from the Sites.

Not stated here

• The notice does not identify the linked sites or their policies.

Security & Safeguards · Company practice

Online submissions are encrypted; email is not secure

Stride Bank says it uses encryption to secure all information submitted to it on-line. It also says emails sent to the bank are NOT secure and tells users not to include personal information in them.

Supporting quotations

We use encryption to secure all information you submit to us on-line.

However, emails you send to us are NOT secure; therefore, you should not include any personal information in your emails.

Qualifications & exceptions

• The encryption statement covers information submitted on-line.
• The email statement is an express exception: emails are not secure.

Not stated here

• The notice does not describe the encryption standard or what "on-line" submissions include.

Security & Safeguards · Company commitment

Bank will never ask for a password or SSN by email

The notice states that Stride Bank will never ask for your password, Social Security number or other personal information in an email.

Supporting quotations

Stride Bank will never ask for your password, Social Security number or other personal information in an email.

Qualifications & exceptions

• The commitment is limited to requests made in an email.

Not stated here

• The notice does not say what to do if you receive such an email.

Legal Rights & Agreement Rules · Restriction or exception

Sites and Apps are not intended for children under 13

The notice says the Sites and Apps are not intended for children under 13 and asks those under 13 not to access or use them. It says that by using the Sites or Apps, a user affirms being over the age of 13. It refers to the Children's Online Privacy Protection Act (COPPA) and directs readers to the FTC website. The notice uses both "under the age of 13" and "over the age of 13"; a person exactly 13 falls between those formulations, and the notice does not resolve that.

Supporting quotations

Our Sites and our Apps are not intended for children under the age of 13.

Please do not access or use our Sites or our Apps if you are under 13 years of age.

By using our Sites or using our Apps, you affirm that you are over the age of 13.

For more information about the Children's Online Privacy Protection Act (COPPA), visit the FTC website: www.ftc.gov.

Qualifications & exceptions

• The stated age threshold is 13.
• The affirmation is stated as a consequence of using the Sites or Apps.

Not stated here

• What the bank does if a child under 13 uses the Sites or Apps, including how it handles that child's data, is not stated.

Legal Rights & Agreement Rules · Company practice

Bank may amend the notice without prior notice; posting makes changes effective

Stride Bank may add to, delete from, or otherwise amend and update this Online Privacy Notice from time to time without prior notice as applicable by law. Changes are effective immediately upon posting of the updated notice. The date of last update appears at the beginning of the notice. Use of the Sites and mobile applications after an update indicates acceptance of the most current version. This section calls the document "this Online Privacy Notice" and "this Privacy Notice", while the title is "Online Privacy Policy"; the notice does not explain the difference, and it separately refers to a different "Privacy Notice" for financial products.

Supporting quotations

We may add to, delete from, or otherwise amend and update this Online Privacy Notice from time to time without prior notice as applicable by law. Changes will be effective immediately upon posting of the updated Privacy Notice.

The date of last update is provided at the beginning of this Privacy Notice. Use of our Sites and mobile applications after an update indicates acceptance of the most current version.

Qualifications & exceptions

• "Without prior notice" is qualified by "as applicable by law".
• Changes are effective immediately upon posting.
• Continued use after an update is stated to indicate acceptance of the most current version.

Not stated here

• The notice does not describe any other way users are told of changes.
• Whether prior notice is required by applicable law is not stated.
• The difference between "Online Privacy Policy", "Online Privacy Notice" and "Privacy Notice" is not explained.

Legal Rights & Agreement Rules · Procedure

Privacy questions go to a phone number or the bank website

The notice says that if you have any questions, you can call 1-800-229-7497 or go to www.stridebank.com.

Supporting quotations

If you have any questions, please call us at 1-800-229-7497 or go to www.stridebank.com.

Qualifications & exceptions

• The section gives a phone number and the bank's website.

Not stated here

• No email address is given in this Questions section; other sections give additional contact routes for specific requests.

Sharing & Disclosure · Restriction or exception

Vermont residents: no non-affiliate sharing except three stated purposes

In accordance with Vermont law, Stride Bank says it will not share with non-affiliates except for its own marketing purposes, its everyday business purposes, or with your consent. The restriction is specific to Vermont residents and is stated with those three exceptions.

Supporting quotations

In accordance with Vermont law, we will not share with non-affiliates except for our own marketing purposes, our everyday business purposes, or with your consent.

Qualifications & exceptions

• The restriction applies to Vermont residents.
• The three stated exceptions are the bank's own marketing purposes, its everyday business purposes, and your consent.

Not stated here

• "Everyday business purposes" is not defined in this notice.

Cross-references

• qualifies (model-proposed): Sharing continues after the customer relationship ends — The Vermont section's non-affiliate sharing restriction and its three exceptions qualify the statement that sharing continues after the customer relationship ends, for Vermont residents.

Legal Rights & Agreement Rules · Procedure

Nevada residents: notice gives the Nevada Attorney General contact

The notice says Nevada law requires it to provide contact information for the Bureau of Consumer Protection, Office of the Nevada Attorney General: 555 E. Washington Ave., Suite 3900, Las Vegas, NV 89101; phone 702-486-3132; email agInfo@ag.nv.gov. The Nevada section states no separate Nevada opt-out procedure.

Supporting quotations

Nevada law requires that we provide you with the following contact information: Bureau of Consumer Protection, Office of the Nevada Attorney General, 555 E. Washington Ave., Suite 3900, Las Vegas, NV 89101; Phone number: 702-486- 3132; email: agInfo@ag.nv.gov

Qualifications & exceptions

• The section provides contact information only.

Not stated here

• The notice does not describe a Nevada-specific request or opt-out process.

Legal Rights & Agreement Rules · User right or choice

California residents: CCPA rights to know, delete and opt out of sale

Effective January 1, 2020, the notice says the California Consumer Privacy Act (CCPA) permits California residents to ask a covered business which categories and pieces of personal information it collects and how the information is used; to request deletion of the information; and to opt out of the sale of such information, if applicable. The same paragraph states that these provisions of the CCPA do not apply to personal information collected, processed, shared, or disclosed by financial institutions pursuant to federal law.

Supporting quotations

Effective January 1, 2020, the California Consumer Privacy Act (CCPA) permits consumers who are California residents to (a) ask a covered business which categories and pieces of personal information it collects and how the information is used; (b) request deletion of the information; and (c) opt out of the sale of such information, if applicable.

These provisions of the CCPA do not apply to personal information collected, processed, shared, or disclosed by financial institutions pursuant to federal law.

Qualifications & exceptions

• The rights are described as effective January 1, 2020.
• The sale opt-out is qualified by "if applicable".
• The same paragraph states that the CCPA provisions do not apply to personal information handled by financial institutions pursuant to federal law.

Not stated here

• The notice does not identify which of its data or activities fall within the federal-law carve-out.

Cross-references

• has exception (model-proposed): CCPA provisions are stated not to apply to financial-institution data under federal law — The same CCPA paragraph states that the described provisions do not apply to personal information handled by financial institutions pursuant to federal law, so the carve-out limits the rights card.

Legal Rights & Agreement Rules · Restriction or exception

CCPA provisions are stated not to apply to financial-institution data under federal law

The notice states that the CCPA provisions it describes do not apply to personal information collected, processed, shared, or disclosed by financial institutions pursuant to federal law. The notice does not identify which of its processing it treats as pursuant to federal law, so the practical reach of the described CCPA rights is not stated.

Supporting quotations

These provisions of the CCPA do not apply to personal information collected, processed, shared, or disclosed by financial institutions pursuant to federal law.

Qualifications & exceptions

• The carve-out is stated for financial institutions acting pursuant to federal law.

Not stated here

• Which processing the bank treats as pursuant to federal law is not stated.
• How a California resident can tell whether the carve-out applies to their information is not stated.

Cross-references

• exception to (model-proposed): California residents: CCPA rights to know, delete and opt out of sale — The same CCPA paragraph states that the described provisions do not apply to personal information handled by financial institutions pursuant to federal law, so the carve-out limits the rights card.

Legal Rights & Agreement Rules · Procedure

CCPA requests: who may ask and how often

Only the California resident or a person registered with the California Secretary of State whom the resident authorizes may make a verifiable consumer request about the resident's personal information. A resident may also make a request on behalf of a minor child. A resident may make a request to know or delete personal information twice within a 12-month period.

Supporting quotations

Only you or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information.

You may also make a verifiable consumer request on behalf of your minor child.

You may make a verifiable consumer request to know or delete personal information twice within a 12-month period.

Qualifications & exceptions

• An authorized agent must be registered with the California Secretary of State.
• The twice-per-12-month limit is stated for requests to know or delete.

Not stated here

• The notice does not describe how authorization of an agent is documented.

Legal Rights & Agreement Rules · Company commitment

CCPA responses: 45 days, up to 90 with written notice

Stride Bank says it endeavors to respond to a verifiable consumer request within 45 days of receipt. If it requires more time, up to 90 days, it will inform the requester of the reason and extension period in writing. Any disclosures will cover only the preceding 12-month period. The response will explain the reasons the bank cannot comply, if applicable.

Supporting quotations

We endeavor to respond to a verifiable consumer request within 45 days of its receipt.

If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.

Any disclosures we provide will only cover the preceding 12-month period.

The response we provide will also explain the reasons we cannot comply with a request, if applicable.

Qualifications & exceptions

• The 45-day period is stated as an endeavor, not a guarantee.
• The 90-day extension requires written notice of the reason and extension period.
• Disclosures cover only the preceding 12-month period.

Not stated here

• The notice does not state what happens if the bank does not respond within the stated period.

Legal Rights & Agreement Rules · Company commitment

Right-to-know disclosures are provided in a portable format

For right-to-know requests, Stride Bank says it will select a format to provide personal information that is readily useable and should allow the requester to transmit the information from one entity to another without hindrance.

Supporting quotations

For right to know requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

Qualifications & exceptions

• The format statement applies to right-to-know requests.
• The bank selects the format.

Not stated here

• The notice does not identify the format.

Legal Rights & Agreement Rules · Company commitment

CCPA requests are free unless excessive, repetitive or unfounded

Stride Bank does not charge a fee to process or respond to a verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If it determines that a request warrants a fee, it will tell the requester why and provide a cost estimate before completing the request.

Supporting quotations

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded.

If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Qualifications & exceptions

• The no-fee rule has three stated exceptions: excessive, repetitive, or manifestly unfounded requests.
• A cost estimate is provided before the request is completed.

Not stated here

• The notice does not state the amount of any fee.

Legal Rights & Agreement Rules · Company commitment

No discriminatory treatment for exercising CCPA rights

The notice states that consumers will not receive discriminatory treatment for exercising the privacy rights conferred by the CCPA.

Supporting quotations

Please note, consumers will not receive discriminatory treatment for the exercise of the privacy rights conferred by the CCPA.

Qualifications & exceptions

• The statement is tied to rights conferred by the CCPA.

Not stated here

• The notice does not give examples of what would count as discriminatory treatment.

Legal Rights & Agreement Rules · Procedure

CCPA requests can be made by phone, mail, web form or email

For questions about CCPA compliance, the notice gives phone 1-800-229-7497 and a mailing address: Stride Bank N.A., PO Box 3448, Enid, OK 73702-3448. California residents may also submit a CCPA request online at https://stridebank.com/sft1172/ccpa-web-form.pdf or print and email it to privacyrequests@stridebank.com. The linked web form itself is not part of this saved document.

Supporting quotations

To contact us with questions about our compliance with the CCPA, call 1-800-229- 7497; or write to: Stride Bank N.A., PO Box 3448, Enid, OK 73702-3448.

California Residents may also submit their CCPA request online at https://stridebank.com/sft1172/ccpa-web-form.pdf or print and email their CCPA request to privacyrequests@stridebank.com.

Qualifications & exceptions

• The online route is a linked PDF form; the form's contents are not in this document.

Not stated here

• The form's contents and any additional requirements are not supplied here.
• The notice does not say how requests sent by different routes are processed.