Online Privacy Statement and Disclosures

Legal Rights & Agreement Rules · Context

Statement covers Amex websites and apps that link to it, not sites with their own statement

This online privacy statement applies to American Express websites and online apps (on smart phones, tablets and other devices) that link to it. It does not apply to American Express websites that have their own online privacy statements, and Resy.com is named as one of those. The statement describes how American Express and its Service Providers may collect, use, share and keep information obtained about you online.

Supporting quotations

This online privacy statement applies to American Express websites and online applications ("apps") that run on smart phones, tablets, and other devices that link to this statement.

This online privacy statement does not apply to those American Express websites that have their own online privacy statements, including Resy.com.

may collect, use, share and keep information that we get about you online

Qualifications & exceptions

• Defined terms such as Online Information, Service Providers, Personal Information and Other Information are explained in the Glossary at the end of the statement.

Not stated here

• Which other American Express websites have their own online privacy statements is not listed in this text beyond the Resy.com example.

Legal Rights & Agreement Rules · Context

Products from other providers, and some products, have their own privacy notices

American Express says that for certain of its products or services it may give you specific additional details about how it will use your Personal Information in that context. If an American Express product or service is not provided by American Express (for example, a card issued by one of its partner banks), the statement tells you to review the relevant privacy notice for that product or service, or contact the provider about its privacy practices. For a Business Card, a later passage points to a separate Business Card Privacy Notice for additional information.

Supporting quotations

When we provide certain American Express products or services to you, we may give you specific additional details about how we will use your Personal Information in that context.

If you have an American Express product or service that is not provided by American Express (such as a card issued by one of our partner banks), please review the relevant privacy notice that covers such product or service or contact your product or service provider for information about their privacy practices.

If you have a Business Card, please review the

Qualifications & exceptions

• The product-specific notices are linked from the statement but are not part of this text.

Not stated here

• What the product-specific details or the Business Card Privacy Notice say is not supplied here, so this statement alone does not show how those products handle information.

Legal Rights & Agreement Rules · Context

Recruitment and employment information is governed by separate notices

Information that American Express collects during recruitment or employment processes is governed by separate notices, which it says will be provided to you before or when your Personal Information is collected in those contexts. This online privacy statement is not the notice for that information.

Supporting quotations

Information that we collect during recruitment or employment processes at American Express is governed by separate notices, which will be provided to you before or when your Personal Information is collected in those contexts.

Not stated here

• The separate recruitment and employment notices are not supplied in this text.

Cross-references

• contrast (model-proposed): Separate Data Protection and Privacy Principles, effective December 19, 2024, set a global standard for personal data — The online statement says information collected during recruitment or employment is governed by separate notices. The Principles on the same page define "you" to include any customer or employee. The page does not say how the two statements fit together, so no exception or contradiction is claimed.

Data Access & Collection · Company practice

Not intended for children under 13; no knowing online solicitation or marketing to them

American Express says its products and services are not intended for children under 13 years of age, and that it does not knowingly solicit data online from, or market online to, children under 13.

Supporting quotations

Our products and services are not intended for children under 13 years of age. We do not knowingly solicit data online from, or market online to, children under 13 years of age.

Not stated here

• This passage does not say what American Express does if it learns it has received data from a child under 13.

Legal Rights & Agreement Rules · Procedure

Version dated March 26, 2026; updates are shown by changing the Effective Date

This version of the statement shows an Effective Date of March 26, 2026. American Express may update it, recommends that you check the current version from time to time, and says that if it updates the statement it will change the "Effective Date" at the top of the page.

Supporting quotations

Effective Date: March 26, 2026

Since we may update this online privacy statement, we recommend that you check the current version available from time to time. If we make updates to this statement, we will change the “Effective Date” at the top of this page.

Not stated here

• This passage does not say American Express will notify you directly of an update other than by changing the Effective Date.

Data Access & Collection · Company practice

Covers information from site and app use, electronic communications, ads and social media

The statement describes online information that American Express (and its Service Providers) may collect, use, share and keep. As examples, it says it gathers Online Information if you visit or use its website or apps; receive or reply to electronic communications from it; view or click on its ads or other online content; or interact with it through social media websites and other websites and applications.

Supporting quotations

may collect, use, share and keep information that we get about you online

Visit or use our website or apps;

Receive or reply to electronic communications from us;

View or click on our ads or other online content; and

Interact with us through social media websites and other websites and applications.

Qualifications & exceptions

• The list is introduced with "For example", so it is not stated to be a complete list of situations.

Not stated here

• Terms such as Service Providers and Online Information link to Glossary entries on the same page, which are carded separately; this card does not rely on any other linked document.

Use & Processing · Company practice

Some Online Information is Personal Information and may be combined with Other Information

The statement says some Online Information is Personal Information, and that it also explains how American Express may combine Online Information with Other Information and how it then uses the combined information. In the use section, American Express (or Service Providers acting on its behalf) says it may use the Online Information it collects on its own or combine it with Other Information for the purposes listed there.

Supporting quotations

Some Online Information is Personal Information.

In this statement, we also explain how we may combine Online Information with Other Information and how we then use the combined information.

we collect about you on its own or combine it with

Qualifications & exceptions

• The Glossary defines Other Information as including American Express internal information, such as card transaction data and customer call records.

Not stated here

• This passage does not say which kinds of Online Information count as Personal Information.
• The defined terms link to Glossary entries on the same page, which are carded separately; this card does not rely on any other linked document.

Data Access & Collection · Company practice

Information you give directly: name, account number, contact details, biometric data, date of birth

American Express says the types of information it collects depend on which product or service you use. Sometimes you give information directly to American Express or its Service Providers. For example, you might give your name, account number, email, mailing address, biometric data, phone number, or date of birth when you fill out an online form or survey (including when you book travel with American Express); register, log into or update the settings on your account using its online services; enter a competition or register for a marketing offer; or sign up for its products and services.

Supporting quotations

The types of information we collect depends on which product or service you use.

you might give us your name, account number, email, mailing address, biometric data, phone number, or date of birth when you:

fill out an online form or survey, including when you book travel with us;

register, log into or update the settings on your account using our online services;

enter a competition or register for a marketing offer; or

sign up for our products and services.

Qualifications & exceptions

• The items are introduced with "For example" and "might", so neither the data types nor the situations are stated to be a complete list.

Not stated here

• The statement does not say here what biometric data is collected, or in which of these situations.

Data Access & Collection · Company practice

Cookies and similar technologies collect information, including Personal Information, for listed purposes

American Express, its Service Providers and its Advertising Partners also collect information, including Personal Information, through Cookies and Similar Technologies. The purposes named are keeping the site secure, remembering website preferences, enhancing site functionality, analyzing site traffic, and advertising customization and measurement. As an example, if you click Remember Me when you log in to the website, a cookie will store your username. A later pointer sends readers to the "What are your choices?" section for choices about collection and use, including through these technologies.

Supporting quotations

also collect information including Personal Information through Cookies and Similar Technologies for purposes such as keeping our site secure, remembering website preferences, enhancing site functionality, analyzing site traffic, and advertising customization and measurement. For example, if you click Remember Me when you log in to our website, a cookie will store your username.

section below to learn more about your choices regarding the collection and use of your information, including through

Qualifications & exceptions

• The purposes are introduced with "for purposes such as", so the list is not stated to be complete.

Not stated here

• The definition of Cookies and Similar Technologies is in the Glossary and the linked terms are on the same page; this card does not rely on any other linked document.

Data Access & Collection · Company practice

Cookies and similar technologies may log device, IP address, browsing history, referrers and ad activity

American Express, its Service Providers and its Advertising Partners may use Cookies and Similar Technologies to collect information about: the device, operating system and browser you use (including when you browse the websites, use the apps or open electronic communications); your IP address and related information (such as domain information, your internet provider and general geographic location); your browsing history on the website or in the apps (such as what you search for, the pages you view, how long you stay and how often you come back); how you search for the website, which websites you arrive from, and which of its Business Partners' websites you visit; and which ads or online content from American Express and its Business Partners you view, access or click on.

Supporting quotations

may collect information using

the device, operating system, and browser you use, such as when browse our websites, access our apps, or open electronic communications from us;

the IP Address and related information (such as domain information, your internet provider and general geographic location);

browsing history on our website or in our apps (such as what you search for, the pages you view, how long you stay, and how often you come back);

how you search for our website, from which websites you arrive, and which of our Business Partners’ websites you visit;

which ads or online content from us and our Business Partners you view, access, or click on;

Not stated here

• The terms Business Partners, Service Providers and Advertising Partners link to Glossary entries on the same page, which are carded separately; the statement does not name which Business Partners' websites are meant.

Linking & Identification · Company practice

Activity may be tracked over time and across websites and apps, and devices may be linked to one person

Using Cookies and Similar Technologies, American Express, its Service Providers and its Advertising Partners may collect information about your browsing and app use activities over time, and across websites and apps; the statement says its Service Providers or Advertising Partners perform such activities on its behalf. They may also collect information about the likely associations among different browsers and devices, such as whether two devices are associated with the same individual.

Supporting quotations

your browsing and app use activities over time, and across websites and apps

perform such activities on our behalf

the likely associations among different browsers and devices, such as whether two devices are associated with the same individual;

Not stated here

• The statement does not say which websites and apps are covered by the "across websites and apps" tracking, or how the likelihood of a device association is determined.

Data Access & Collection · Company practice

Whether you open electronic communications and what you click on may be collected

Using Cookies and Similar Technologies, American Express, its Service Providers and its Advertising Partners may collect information about whether you open its electronic communications and which parts you click on.

Supporting quotations

whether you open our electronic communications and which parts you click on;

Data Access & Collection · Company practice

Information about your wireless account and device, including mobile device location, may be collected

Using Cookies and Similar Technologies, American Express, its Service Providers and its Advertising Partners may collect information about your wireless account and device, including the location of your mobile device. The example given is when you use mobile websites or apps to register to receive location-based content.

Supporting quotations

and information about your wireless account and device, including the location of your mobile device (for example, when you use mobile websites or apps to register to receive location-based content).

Qualifications & exceptions

• The location example is introduced with "for example", so it is not stated to be the only situation in which mobile device location is collected.

Not stated here

• The statement does not say how precise the location is, or whether it is collected only when you register for location-based content.

Data Access & Collection · Company practice

Information may also come from social platforms, online databases or directories, or be otherwise legitimately obtained

American Express, its Service Providers and its Advertising Partners may also collect information made available through third-party platforms and apps (such as online social media platforms), through online databases or directories, or that is otherwise legitimately obtained. The statement says this information may be governed by the privacy notice(s) provided by the third party at the time of collection.

Supporting quotations

may also collect information made available through third-party platforms and apps

Not stated here

• The third parties' privacy notices are not supplied here, and the statement does not say what other sources count as "otherwise legitimately obtained".

Use & Processing · Company practice

Online Information may be used to deliver and improve services, from recognizing devices to contacting you

American Express (or Service Providers assisting it or acting on its behalf) may use the Online Information it collects about you, on its own or combined with Other Information, to deliver and improve its products, services and systems. The listed examples are: recognizing you when you return to its websites or use its apps across multiple devices; completing transactions, including at retail stores and through digital channels (such as websites, apps and digital wallets); telling you about updates to your accounts, products and services; updating you about new features and benefits; answering questions and responding to requests made through its websites, third-party websites (including social media) and customer contact channels; using the location of your mobile device for location-based services that you may request; and determining how best to provide services and manage your accounts, such as the best way and time to contact you.

Supporting quotations

we collect about you on its own or combine it with

Deliver and improve our products, services, and systems, including to:

recognize you when you return to our websites or use our apps across multiple devices;

complete transactions, including at retail stores and through digital channels (such as websites, apps, digital wallets, etc.);

tell you about updates to your accounts, products, and services;

update you about new features and benefits;

answer questions and respond to your requests made through our websites, through third-party websites (including social media), and through our customer contact channels;

use the location of your mobile device for location-based services that you may request;

determine how to best provide services to you and manage your accounts, such as the best way and time to contact you;

Qualifications & exceptions

• The sentence says "may use", so these are permitted uses rather than commitments to do each one; "including to" introduces examples.
• Location-based services are described as services "that you may request".

Not stated here

• The terms Online Information, Other Information and Service Providers link to Glossary entries on the same page, which are carded separately.

Use & Processing · Company practice

Online Information may be used to advertise and market, including tailored ads across devices

American Express may use Online Information to advertise and market its products and services, and those of its Business Partners, including to present online content or ads tailored to your interests, including Targeted Advertising, across multiple devices. The statement adds that some Advertising Partners are third-party advertising networks and social media partners that allow American Express to serve you Targeted Advertising that is relevant to you when you are on a third-party website or app. It points to the "What are your choices?" section for how to opt out of having your Personal Information shared with Advertising Partners for Targeted Advertising, as well as opt-outs that may be provided directly by the Advertising Partners.

Supporting quotations

advertise and market our products and services

present content or ads online that are tailored to your interests, including Targeted Advertising, across multiple devices;

Some of our Advertising Partners are third-party advertising networks and social media partners that allow us to serve you with Targeted Advertising that is relevant to you when you are on a third-party website or app.

See the “What are your choices?” section below to learn more about how you can opt out of having your Personal Information shared with AdvertisingPartners for Targeted Advertising purposes as well as opt-outs that may be provided directly by our Advertising Partners.

Qualifications & exceptions

• Targeted Advertising and Advertising Partners are defined terms in the Glossary (carded separately); opt-out choices are described in the choices section.

Not stated here

• The statement does not name every Advertising Partner here.

Inference & Profiling · Company practice

Online Information may be used to send offers, measure ads, infer interest in new products, personalize by location

Within its advertising and marketing uses, American Express may use Online Information to send or provide you with ads, promotions and offers; analyze whether its ads, promotions and offers are effective; help determine whether you may be interested in new products or services; and provide location-based content and advertising personalization.

Supporting quotations

send or provide you with ads, promotions, and offers;

analyze whether our ads, promotions, and offers are effective;

help us determine whether you may be interested in new products or services;

provide location-based content and advertising personalization;

Not stated here

• The statement does not say how interest in new products is determined, or what location data is used for location-based content and advertising personalization.

Use & Processing · Company practice

Online Information may be used for research, analytics, feedback features and product review

American Express may use Online Information to conduct research and analysis, including to better understand its customers across all of its communication channels (customer contact centers, websites and apps); allow you to give feedback by rating and reviewing its products and services and those of its Business Partners; produce data analytics, statistical research and reports; and assess, review and change its products, services and systems.

Supporting quotations

conduct research and analysis, including to:

better understand our customers across all of our communication channels, including our customer contact centers, our websites and apps;

allow you to give feedback by rating and reviewing our products and services and those of our Business Partners;

produce data analytics, statistical research, and reports;

assess, review and change our products, services, and systems;

Security & Safeguards · Company practice

Online Information may be used to detect fraud and secure information, systems and facilities

American Express may use Online Information to manage fraud and security risk, including to detect and prevent fraud, criminal activity, or violations of its terms and conditions, and to safeguard the security of your information, its systems and its facilities.

Supporting quotations

manage fraud and security risk, including to:

detect and prevent fraud, criminal activity, or violations to our terms and conditions.

safeguard the security of your information, our systems, and our facilities;

Charges & Financial Obligations · Company practice

Online Information may be used to assess credit risk, including applications and existing accounts

American Express may use Online Information to assess credit risks relating to its business, including to evaluate and process your applications for its products and services and manage your existing accounts.

Supporting quotations

assess credit risks relating to our business, including to:

evaluate and process your applications for our products and services and manage your existing accounts

Qualifications & exceptions

• "Including to" introduces examples of credit-risk assessment.

Not stated here

• The statement does not say which Online Information is used for credit-risk assessment.

Legal Rights & Agreement Rules · Permission or license

Other uses are allowed where required or permitted by law or with your consent

The list of uses ends with a general permission: American Express may use the information in other ways as required or permitted by law or with your consent.

Supporting quotations

use it in other ways as required or permitted by law or with your consent.

Not stated here

• The statement does not say what other uses this covers.

Use & Processing · Company practice

Personal Information may be processed by people and by automated methods, including AI

American Express may process Personal Information for the purposes described above using manual (human) and automated methods of processing, including artificial intelligence (AI), in accordance with applicable laws.

Supporting quotations

We may process Personal Information for the purposes described above using manual (human) and automated methods of processing, including artificial intelligence (AI), in accordance with applicable laws.

Not stated here

• The statement does not say which processing uses AI, what the AI does, or whether any decisions are made solely by automated means.

Sharing & Disclosure · Permission or license

Personal Information may be shared with credit bureaus to report or ask about finances and report or collect debts

American Express may share Personal Information, as required or permitted by law, with credit bureaus and similar institutions to report or ask about your financial circumstances, and to report or collect debts you owe.

Supporting quotations

as required or permitted by law, with:

credit bureaus and similar institutions to report or ask about your financial circumstances, and to report or collect debts you owe;

Qualifications & exceptions

• The sharing list is introduced with "may share ... as required or permitted by law", so each recipient below is subject to that qualifier.

Sharing & Disclosure · Permission or license

Personal Information may be shared with authorities for legal process, and with providers and agencies to prevent fraud

American Express may share Personal Information, as required or permitted by law, with regulatory authorities, courts and governmental agencies to comply with legal orders, legal or regulatory requirements and government requests pursuant to valid legal process. It may also share it with its Service Providers, regulatory authorities and governmental agencies to detect and prevent fraud or criminal activity and to protect the rights of American Express or others.

Supporting quotations

as required or permitted by law, with:

regulatory authorities, courts, and governmental agencies to comply with legal orders, legal or regulatory requirements, and government requests pursuant to valid legal process;

our Service Providers, regulatory authorities, and governmental agencies to detect and prevent fraud or criminal activity, and to protect the rights of American Express or others;

Qualifications & exceptions

• The sharing list is introduced with "may share ... as required or permitted by law", so each recipient below is subject to that qualifier.

Not stated here

• The statement does not say who decides what counts as protecting "the rights of American Express or others".

Sharing & Disclosure · Permission or license

Personal Information may be shared with the American Express Family of Companies

American Express may share Personal Information, as required or permitted by law, with the American Express Family of Companies. This list item states no purpose for this sharing.

Supporting quotations

as required or permitted by law, with:

the American Express Family of Companies;

Qualifications & exceptions

• The sharing list is introduced with "may share ... as required or permitted by law", so each recipient below is subject to that qualifier.

Not stated here

• This list item gives no purpose or limit for sharing with the Family of Companies. The Affiliate Sharing Notice listed later in the statement is a separate document that is not supplied here, so what it says is not known from this text.

Sharing & Disclosure · Permission or license

Personal Information may be shared with Service Providers who run services for American Express

American Express may share Personal Information, as required or permitted by law, with its Service Providers who perform services for it and help it operate its business. It says it requires Service Providers to safeguard Personal Information and only use your Personal Information for the purposes it specifies.

Supporting quotations

as required or permitted by law, with:

our Service Providers who perform services for us and help us operate our business (we require Service Providers to safeguard Personal Information and only use your Personal Information for the purposes we specify);

Qualifications & exceptions

• The sharing list is introduced with "may share ... as required or permitted by law", so each recipient below is subject to that qualifier.

Not stated here

• The purposes that American Express specifies to Service Providers, and the safeguards it requires of them, are not described in this passage.

Sharing & Disclosure · Permission or license

Personal Information may be disclosed to Advertising Partners, for example through cookies, for Targeted Advertising

American Express may share Personal Information, as required or permitted by law, with its Advertising Partners, such as through Cookies and Similar Technologies, for the purpose of serving you Targeted Advertising. The statement points to the "What are your choices?" section for how to opt out of certain disclosures of your Personal Information. That section explains how you can opt out of having Personal Information shared with Advertising Partners for Targeted Advertising purposes, as well as opt-outs that may be provided directly by the Advertising Partners.

Supporting quotations

as required or permitted by law, with:

our Advertising Partners, such as through Cookies and Similar Technologies, for purposes of serving you Targeted Advertising. See “What are your choices?” for information about how to opt out of certain disclosures of your Personal Information.

section below to learn more about how you can opt out of having your Personal Information shared with AdvertisingPartners for Targeted Advertising purposes as well as opt-outs that may be provided directly by our Advertising Partners.

Qualifications & exceptions

• The sharing list is introduced with "may share ... as required or permitted by law", so each recipient below is subject to that qualifier.
• The opt-out is described as covering "certain disclosures", not all sharing.

Not stated here

• Which disclosures are covered by the opt-out is explained only in the choices section, which is carded separately.

Cross-references

• qualified by (model-proposed): A footer link lets you opt out of certain Personal Information disclosures for Targeted Advertising — The sharing list allows disclosure of Personal Information to Advertising Partners for Targeted Advertising and points to the choices section; the footer link there lets you opt out of certain such disclosures.

Sharing & Disclosure · Permission or license

Personal Information may be shared with financial institutions or Co-brand Partners for joint offerings

American Express may share Personal Information, as required or permitted by law, with financial institutions or Co-brand Partners with whom it jointly offers or develops products and services, in connection with those joint offerings.

Supporting quotations

as required or permitted by law, with:

financial institutions or Co-brand Partners with whom we jointly offer or develop products and services, in connection with those joint offering; or

Qualifications & exceptions

• The sharing list is introduced with "may share ... as required or permitted by law", so each recipient below is subject to that qualifier.

Not stated here

• The financial institutions and Co-brand Partners are not named in this passage.

Sharing & Disclosure · Permission or license

Personal Information may be shared with necessary parties in a sale of part or all of the Family of Companies

American Express may share Personal Information, as required or permitted by law, with necessary parties in the context of a sale of all or part of the American Express Family of Companies or their assets.

Supporting quotations

as required or permitted by law, with:

necessary parties in the context of a sale of all or part of the American Express Family of Companies or their assets.

Qualifications & exceptions

• The sharing list is introduced with "may share ... as required or permitted by law", so each recipient below is subject to that qualifier.

Not stated here

• The statement does not say who the necessary parties are, or what limits apply to how they may use the information.

Sharing & Disclosure · Permission or license

Personal Information may be shared with other third parties for their own use with your consent

American Express may also share Personal Information with other third parties for their own use with your consent. For a Business Card, the statement points to a separate Business Card Privacy Notice for additional information.

Supporting quotations

We may also share Personal Information with other third parties for their own use with your consent.

If you have a Business Card, please review the

Not stated here

• The Business Card Privacy Notice is a separate linked document that is not supplied here, so its content is not known from this text. The passage does not say how consent is given.

Sharing & Disclosure · Company practice

Personal Information may be transferred worldwide to Service Providers and the Family of Companies

American Express may transfer Personal Information to Service Providers or companies within the American Express Family of Companies throughout the world, for example to process transactions and provide you with its products or services. It says that regardless of where it processes your information, it still protects it in the manner described in this online privacy statement and according to the applicable laws.

Supporting quotations

We may transfer Personal Information to Service Providers or companies within the American Express Family of Companies throughout the world, for example, to process transactions and provide you with our products or services. Regardless of where we process your information, we still protect it in the manner described in this online privacy statement and according to the applicable laws.

Qualifications & exceptions

• "For example" introduces the purposes, so processing transactions and providing products or services are examples.

Not stated here

• The statement does not name the countries involved or the legal mechanism used for transfers.

Sharing & Disclosure · Permission or license

Aggregated or De-identified Information may be shared, including with Business Partners for products and research

The statement describes De-identified Information as information that cannot be reasonably linked to or associated with you, and Aggregated Information as data relating to multiple people that has been combined and does not identify you individually. American Express says it may share Aggregated Information or De-identified Information in several ways, for example for the same reasons it might share Personal Information, with Business Partners to help develop and market products or services, or with Business Partners to conduct analysis and research about customers and website visitors.

Supporting quotations

How do we handle Aggregated and De-identified Information?

is information that cannot be reasonably linked to or associated with you.

relating to multiple people, which has been combined or aggregated and which does not identify you individually.

We may share Aggregated Information or De-identified Information in several ways, for example:

for the same reasons as we might share Personal Information

with Business Partners to help develop and market products or services; or

with Business Partners to conduct analysis and research about customers and website visitors;

Qualifications & exceptions

• "For example" introduces the ways of sharing, so the list is not stated to be complete.

Not stated here

• The Business Partners recipients are defined in the Glossary (carded separately); this passage does not say what safeguards apply to Aggregated or De-identified Information once shared.

Security & Safeguards · Company practice

Personal Information is protected with administrative, technical and physical security measures

American Express says it uses administrative, technical and physical security measures to protect your Personal Information, including computer safeguards and secured files and facilities.

Supporting quotations

We use administrative, technical, and physical security measures to protect your Personal Information. These measures include computer safeguards and secured files and facilities.

Not stated here

• The passage does not describe specific safeguards beyond "computer safeguards and secured files and facilities", and does not promise that information cannot be accessed without authorization.

Retention & Deletion · Company commitment

Personal Information is securely destroyed or permanently de-identified when no longer needed, with reasonable steps

American Express says it takes reasonable steps to securely destroy or permanently de-identify Personal Information when it no longer needs it.

Supporting quotations

We take reasonable steps to securely destroy or permanently de-identify Personal Information when we no longer need it.

Qualifications & exceptions

• The commitment is to "reasonable steps", not to a guaranteed outcome or a fixed deadline.

Not stated here

• The statement does not say how American Express decides when it "no longer need[s]" the information, or give a time period.

Retention & Deletion · Company commitment

Online Information is kept only as long as must be to deliver products and services, unless law requires longer

American Express says it will keep your Online Information only as long as it must to deliver its products and services, unless it is required by law or regulation, or for litigation and regulatory investigations, to keep it.

Supporting quotations

We will keep your Online Information only as long as we must to deliver our products and services, unless we are required by law or regulation or for litigation and regulatory investigations to keep it.

Qualifications & exceptions

• This sentence is about Online Information; the passage does not state a separate retention rule for Other Information.
• The exceptions are legal or regulatory requirements and litigation and regulatory investigations.

Not stated here

• No specific retention period is stated. The passage does not say how this limit relates to the other uses of Online Information listed in the use section, such as advertising, research and fraud management.

Cross-references

• contrast (model-proposed): Principles: process data promptly and accurately and keep it no longer than necessary, unless law requires — The online statement keeps Online Information only as long as it must to deliver products and services, with legal and litigation exceptions. The Principles say personal data is not kept longer than necessary, except as required by applicable law. The wording differs and neither gives a period; the page does not say which governs online data.

Sharing & Disclosure · Context

Glossary: Business Partners are third parties under contract; Co-brand Partners offer cards with both brand logos

The Glossary defines Business Partners as any third parties with whom American Express conducts business and has a contractual relationship, such as a business that accepts American Express branded cards. It defines Co-brand Partners as businesses American Express partners with to offer cards featuring both brand logos.

Supporting quotations

any third parties with whom we conduct business and have a contractual relationship, such as a business that accepts American Express branded cards.

businesses we partner with to offer cards featuring both brand logos.

Data Access & Collection · Context

Glossary: Cookies and Similar Technologies include cookies, pixels, web beacons, SDKs, tags and Device ID technology

The Glossary says American Express and its Service Providers and Advertising Partners may use cookies, pixels, web beacons, Software Development Kits (SDKs), gifs, tags, Device ID technology and other similar technologies (together, "Cookies and Similar Technologies") on its websites and apps. It describes cookies as small data files a website transfers to your computer's hard drive, and SDKs as snippets of code embedded in websites or apps, both of which collect information about your activity.

Supporting quotations

we and our Service Providers and Advertising Partners may use cookies, pixels, web beacons, Software Development Kits (“SDKs”), gifs, tags, Device ID technology and other similar technologies (collectively, “Cookies and Similar Technologies”) on our websites and apps. Cookies, for example, are small data files that a website transfers to your computer's hard drive, while SDKs are snippets of code embedded in websites or apps, both of which collect information about your activity.

Qualifications & exceptions

• "Other similar technologies" is open-ended, so the list is not stated to be complete.

Use & Processing · Context

Glossary: De-identified Information is often derived from Personal Information, including from card transactions

The Glossary defines De-identified Information as data or information which cannot be reasonably linked to or associated with you. It says American Express often derives De-identified Information from Personal Information, and that it includes information that may be collected from various sources, such as card transactions.

Supporting quotations

data or information which cannot be reasonably linked to or associated with you.

We often derive De-identified Information from Personal Information. It includes information that we may collect from various sources, such as card transactions.

is information that cannot be reasonably linked to or associated with you.

Not stated here

• The statement does not describe how the de-identification is done.

Data Access & Collection · Context

Glossary: an IP Address is a number assigned to a device when connecting to the Internet

The Glossary defines an IP Address as a number assigned to a device when connecting to the Internet.

Supporting quotations

a number assigned to a device when connecting to the Internet.

Data Access & Collection · Context

Glossary: Online Information covers data from American Express and third-party websites and apps about its business

The Glossary defines Online Information as data or information collected on the American Express websites and apps, as well as on websites and apps of third parties, relating to topics about its business.

Supporting quotations

data or information collected on the American Express websites and apps as well as on websites and apps of third parties relating to topics about our business.

Not stated here

• The definition does not say which third-party websites and apps are meant, or what "topics about our business" covers.

Data Access & Collection · Context

Glossary: Other Information includes internal records such as card transactions, external data and offline information

The Glossary defines Other Information as American Express internal information (for example, card transaction data and customer call records), external data that financial companies use to process applications and complete transactions, and other online and offline information it collects from or about you.

Supporting quotations

American Express internal information (for example, Card transaction data and customer call records), external data that financial companies use to process applications and complete transactions, and other online and offline information we collect from or about you.

Qualifications & exceptions

• This is the information that Online Information may be combined with, as described in the use section.

Not stated here

• The definition does not say what the "other online and offline information" consists of.

Data Access & Collection · Context

Glossary: Personal Information is information that can identify a person, such as name, address, phone and email

The Glossary defines Personal Information as information that can identify a person, such as name, address, telephone number, and email address.

Supporting quotations

information that can identify a person, such as name, address, telephone number, and email address.

Qualifications & exceptions

• "Such as" introduces examples.

Not stated here

• The definition does not say whether the other items the statement says it collects online (for example IP address, device and browsing information, biometric data or mobile device location) count as Personal Information.

Sharing & Disclosure · Context

Glossary: Service Providers are vendors and companies that perform business operations for American Express

The Glossary defines Service Providers as any vendor, third party and/or company that performs business operations on American Express's behalf, such as printing, mailing, and other communications services (email, direct mail, etc.), marketing, data processing, servicing, collections, or ad management.

Supporting quotations

any vendor, third party and/or company that performs business operations on our behalf, such as printing, mailing, and other communications services (email, direct mail, etc.), marketing, data processing, servicing, collections, or ad management.

Qualifications & exceptions

• "Such as" introduces examples of the business operations.

Inference & Profiling · Context

Glossary: Targeted Advertising is ads outside the Family of Companies based on inferred interests

The Glossary defines Targeted Advertising as ads that American Express, its Service Providers or its Advertising Partners display on websites or in apps outside the American Express Family of Companies, based on preferences or interests inferred from data collected from a computer or device regarding viewing behaviors or app use over time and across different websites or apps. It adds that Targeted Advertising may occur across browsers or mobile devices that have been associated together.

Supporting quotations

Ads that we, our Service Providers, or our Advertising Partners display on websites or in apps outside the American Express Family of Companies based on the preferences or interests inferred from data collected from a computer or device regarding viewing behaviors or app use over time and across different websites or apps.

Targeted Advertising may occur across browsers or mobile devices that have been associated together.

any affiliate and subsidiary of, and any company owned or controlled by, the American Express Company.

Legal Rights & Agreement Rules · Context

The statement lists separate privacy notices for particular products; their text is not part of this document

Under a line saying that its Privacy Notices inform you what personal information is collected, reasons for sharing and how you can limit sharing, the statement lists notices to click for the product that applies: Consumer Products; American Express Business Card Privacy Notice; American Express Affiliate Sharing Notice; American Express Prepaid Cards; American Express Travelers Cheques; American Express Savings; MyCredit Guide; Travel & Lifestyle Services; CreditSecure; American Express Travel Insurance; and California Privacy Notice.

Supporting quotations

Our Privacy Notices inform you of what personal information we collect, reasons we share information and how you can limit the sharing of your information. Click on the applicable product below to view associated privacy notice.

Consumer Products

American Express Business Card Privacy Notice

American Express Affiliate Sharing Notice

American Express Prepaid Cards

American Express Travelers Cheques

American Express Savings

MyCredit Guide

Travel & Lifestyle Services

CreditSecure

American Express Travel Insurance

California Privacy Notice

Not stated here

• These notices are linked documents whose text is not supplied here, so this card cannot say what they cover or how they differ from this statement. The statement does not say which notice applies to which situation beyond "the applicable product".

Legal Rights & Agreement Rules · Context

Separate Data Protection and Privacy Principles, effective December 19, 2024, set a global standard for personal data

After the list of product notices, the page includes Data Protection and Privacy Principles marked "Effective: December 19, 2024". They set out how American Express Company and its wholly owned direct and indirect subsidiaries will collect, use, store, share, transmit, delete or otherwise process personal data, and say the same standard will be used by American Express globally. In the Principles, personal data means any information that relates to an identified or identifiable individual, and "you" means any individual customer or employee of American Express and any other individual whose personal data is processed.

Supporting quotations

Effective: December 19, 2024

The following Data Protection and Privacy Principles (“Principles”) set out the way that American Express Company and its wholly owned direct and indirect subsidiaries (“American Express”) will collect, use, store, share, transmit, delete or otherwise process (collectively “process”) your personal data. Personal data means any information that relates to an identified or identifiable individual. The standard of personal data protection set out in these Principles will be used by American Express globally,

Personal data means any information that relates to an identified or identifiable individual.

In these Principles, “you” and “your” means any individual customer or employee of American Express and any other individual whose personal data we process

Not stated here

• The page does not say how the Principles relate to the online privacy statement above them (for example, which controls if they differ). The Principles carry their own date, separate from the statement's Effective Date of March 26, 2026.

Cross-references

• contrast (model-proposed): Recruitment and employment information is governed by separate notices — The online statement says information collected during recruitment or employment is governed by separate notices. The Principles on the same page define "you" to include any customer or employee. The page does not say how the two statements fit together, so no exception or contradiction is claimed.

Data Access & Collection · Company commitment

Principles: collect only personal data that is needed, by lawful and fair means

The Principles say American Express will only collect personal data that is needed and by lawful and fair means.

Supporting quotations

We will only collect personal data that is needed and by lawful and fair means.

Use & Processing · Company commitment

Principles: tell you how data is processed where not apparent, and process only for stated, permitted or lawful purposes

The Principles say that where it is not apparent from the products or services you require or the nature of your relationship with American Express, it will tell you how your personal data will be processed and which companies in the American Express Group are responsible. It will process your personal data fairly and only for purposes it has told you, purposes permitted by you or purposes permitted by applicable law. You may object to certain types of processing as expressly permitted by applicable law.

Supporting quotations

Personal data means any information that relates to an identified or identifiable individual.

Where it is not apparent from the products or services you require or the nature of your relationship with us, we will tell you how your personal data will be processed and which companies in the American Express Group are responsible for that processing. We will process your personal data fairly and only for those purposes we have told you, for purposes permitted by you or as permitted by applicable law. In addition, you may object to certain types of processing as expressly permitted by applicable law.

Qualifications & exceptions

• The duty to tell you applies only "where it is not apparent" from the products or services you require or the nature of your relationship.
• The right to object is limited to types of processing where applicable law expressly permits it.

Not stated here

• The Principles do not say how or when American Express tells you, or which types of processing you may object to; that depends on applicable law.

Use & Processing · User right or choice

Principles: option to have personal data included in or removed from marketing lists, as required by applicable law

The Principles say American Express gives customers the option of having their personal data included in or removed from lists used for marketing, as required by applicable law. This covers product and service offers from American Express and those made in conjunction with its business partners. Each of its businesses will continue to send customers information about the products or services they receive from that business.

Supporting quotations

We give customers the option of having their personal data included or removed from lists used for marketing as required by applicable law. This includes product and service offers from American Express and those made in conjunction with our business partners. Of course each of our businesses will continue to send customers information about the products or services they receive from that business.

Qualifications & exceptions

• The option is stated "as required by applicable law".

Not stated here

• The Principles do not say how to exercise this option; the online statement's choices section is carded separately and the page does not say how the two connect.

Retention & Deletion · Company commitment

Principles: process data promptly and accurately and keep it no longer than necessary, unless law requires

The Principles say American Express uses appropriate technology and well-defined employee practices to process personal data promptly and accurately, and will not keep personal data longer than is necessary, except as otherwise required by applicable law.

Supporting quotations

We use appropriate technology and well-defined employee practices to process your personal data promptly and accurately. We will not keep your personal data longer than is necessary, except as otherwise required by applicable law.

Not stated here

• No retention period is given, and the Principles do not say who decides what is "necessary".

Cross-references

• contrast (model-proposed): Online Information is kept only as long as must be to deliver products and services, unless law requires longer — The online statement keeps Online Information only as long as it must to deliver products and services, with legal and litigation exceptions. The Principles say personal data is not kept longer than necessary, except as required by applicable law. The wording differs and neither gives a period; the page does not say which governs online data.

Security & Safeguards · Company commitment

Principles: confidentiality, need-to-know access, reasonable safeguards, and security requirements for processors

The Principles say American Express will keep your personal data confidential and limit access to those who specifically need it to conduct their business activities, except as otherwise permitted by applicable law. It refers to industry standards and uses reasonable administrative, technical and physical security measures to protect personal data from unauthorised access, destruction, use, modification or disclosure. It requires industry standard data security measures from those third parties who are authorized to process personal data on its behalf.

Supporting quotations

We will keep your personal data confidential and limit access to your personal data to those who specifically need it to conduct their business activities, except as otherwise permitted by applicable law. We refer to industry standards and use reasonable administrative, technical and physical security measures to protect your personal data from unauthorised access, destruction, use, modification or disclosure. We require industry standard data security measures from those third parties who are authorized by us to process your personal data on our behalf.

Qualifications & exceptions

• The confidentiality and access limit is subject to "except as otherwise permitted by applicable law".
• The security measures are described as "reasonable", and as referring to industry standards.

Not stated here

• The Principles do not name the industry standards or the security measures required of third parties.

Sharing & Disclosure · Company commitment

Principles: share with third parties only where needed, authorized, for fraud reduction, or as law permits

The Principles say American Express only shares your personal data with third parties where it is necessary to provide you with products or services or as part of the nature of its relationship with you, where it has previously informed you or been authorized by you, in connection with efforts to reduce fraud or criminal activity, or as permitted by law.

Supporting quotations

We only share your personal data with third parties where it is necessary to provide you with products or services or as part of the nature of our relationship with you, where we have previously informed or been authorized by you, in connection with our efforts to reduce fraud or criminal activity, or as permitted by law.

Qualifications & exceptions

• The final ground, "as permitted by law", is broad.

Not stated here

• The Principles do not say whether "third parties" includes other companies in the American Express Group, and do not list recipients; the online statement's sharing list is carded separately and the page does not say how the two connect.

Use & Processing · User right or choice

Principles: on request, explain processing, allow inquiries, give access as your country's law requires

The Principles say that if you ask, American Express will inform you about how your personal data is processed and the rights and remedies you have under the Principles. You may inquire about the nature of the personal data stored or processed about you. You will be provided access as is required by law in your country, regardless of where the data is processed and stored. If any data is inaccurate or incomplete, you may request that it be amended.

Supporting quotations

If you ask, we will inform you about how your personal data is processed and the rights and remedies you have under these Principles. You may inquire as to the nature of the personal data stored or processed about you by American Express. You will be provided access as is required by law in your country, regardless of the location of the data processing and storage. If any data is inaccurate or incomplete, you may request that the data be amended.

Qualifications & exceptions

• Access is "as is required by law in your country", so it depends on local law.
• You "may request" an amendment; the passage does not promise that every request will be granted.

Not stated here

• The Principles do not say how to make these requests or how long a response takes.

Use & Processing · Company commitment

Principles: tell you if data may leave your country where not apparent, and transfer only in line with applicable law

The Principles say that where it is not apparent from the international products or services you require or the nature of your relationship with American Express, it will inform you if your personal data may be transferred outside your country, and will ensure such transfer is only performed in accordance with applicable law. Regardless of where personal data is transferred, it is protected by the Principles.

Supporting quotations

Where it is not apparent from the international products or services you require or the nature of your relationship with us, we will inform you if your personal data may be transferred outside of your country and ensure that such transfer is only performed in accordance with applicable law. Regardless of where your personal data is transferred, your personal data is protected by these Principles.

Qualifications & exceptions

• The duty to inform applies only "where it is not apparent" from the international products or services or the relationship.

Not stated here

• The Principles do not name the countries or the legal mechanisms used for transfers.

Legal Rights & Agreement Rules · Company commitment

Principles: group companies and employees may only process data under them, with training, reviews and discipline

The Principles say each company in the American Express Group and their employees may only process your personal data in accordance with the Principles. American Express says it conducts training and reviews of its compliance, that employees who violate the Principles may be subject to disciplinary action up to and including dismissal, and that employees are expected to report violations to their managers, compliance officer, the legal department, the Privacy Office or the Amex Ethics Hotline.

Supporting quotations

Each company in the American Express Group and their employees may only process your personal data in accordance with these Principles.

We conduct training and reviews of our compliance with these Principles.

Employees who violate these Principles may be subject to disciplinary action, up to and including dismissal.

Employees are expected to report violation of these Principles, and may do so to their managers, to their business unit's compliance officer, to the legal department, to the Privacy Office or to the

Not stated here

• The results of training and compliance reviews are not described.

Legal Rights & Agreement Rules · User right or choice

Principles: you may enforce them against a responsible group company after an unresolved complaint

The Principles say you may enforce them in your country against any company in the American Express Group that is responsible for your personal data, as a third party contractual beneficiary. This applies if you have a complaint that American Express breached the Principles, you have attempted in good faith to resolve it through its customer service process, and it was not resolved within a reasonable amount of time. If you complain to your local data protection authority and the authority finds a breach, American Express says it will abide by the findings, but reserves the right to challenge or appeal them. The Principles say they do not affect any rights you have under applicable law, the requirements of any applicable regulatory data protection authority, or any other type of agreement you may have with American Express.

Supporting quotations

You may enforce these Principles in your country against any company in the American Express Group that is responsible for your personal data, as a third party contractual beneficiary to these Principles.

If you have a complaint that we have breached these Principles and have attempted in good faith to resolve the complaint through our customer service process, but the complaint was not resolved by us within a reasonable amount of time, then you may enforce these Principles against us.

If you complain to your local data protection authority and the data protection authority finds that we have breached these Principles, we will abide by the findings of the data protection authority, but we reserve the right to challenge or appeal such findings.

These Principles do not affect any rights you have under applicable law, the requirements of any applicable regulatory data protection authority, or any other type of agreement that you may have with us.

Qualifications & exceptions

• Enforcement is conditioned on an unresolved complaint after a good-faith attempt through the customer service process and a reasonable amount of time.

Not stated here

• "A reasonable amount of time" is not defined, and the passage does not say how enforcement works in practice or whether it is available in every country.

Legal Rights & Agreement Rules · Company commitment

Principles: binding on all Group companies, which may keep additional rules consistent with them

The Principles say they emphasize American Express's commitment to protect your personal data and are binding on all companies in the American Express Group. Each Group company that holds personal data may maintain its own additional rules and practices for particular products or services, consistent with the Principles. Questions or comments can be sent to American Express.

Supporting quotations

They are binding on all companies in the American Express Group

each company in the American Express Group that holds personal data may maintain its own additional rules and practices for particular products or services, consistent with these Principles.

If you have questions or comments about these Principles, please contact us at American Express.

Not stated here

• The passage does not give a contact address or method for questions or comments, and does not say what the additional rules and practices are.

Sharing & Disclosure · User right or choice

A footer link lets you opt out of certain Personal Information disclosures for Targeted Advertising

American Express says you have choices about how it uses and discloses your information, such as how it markets to you or how it uses Cookies and Similar Technologies. To opt out of certain disclosures of your Personal Information for Targeted Advertising purposes, the statement says to click the "Do Not Sell or Share My Personal Information" link at the footer of this site. This relates to the sharing of Personal Information with Advertising Partners for Targeted Advertising described in the sharing section.

Supporting quotations

You have choices about how American Express uses and discloses your information, such as how we market to you or how we use Cookies and Similar Technologies.

To opt out of certain disclosures of your Personal Information for Targeted Advertising purposes, please click the “Do Not Sell or Share My Personal Information” link at the footer of this site.

our Advertising Partners, such as through Cookies and Similar Technologies, for purposes of serving you Targeted Advertising. See “What are your choices?” for information about how to opt out of certain disclosures of your Personal Information.

Qualifications & exceptions

• The opt-out is described as covering "certain disclosures" for Targeted Advertising purposes, and the link is in the footer "of this site".

Not stated here

• The statement does not say which disclosures count as "certain disclosures", or whether the footer link also covers other websites, apps or devices.

Cross-references

• qualifies (model-proposed): Personal Information may be disclosed to Advertising Partners, for example through cookies, for Targeted Advertising — The sharing list allows disclosure of Personal Information to Advertising Partners for Targeted Advertising and points to the choices section; the footer link there lets you opt out of certain such disclosures.

Use & Processing · Company commitment

Participates in the Digital Advertising Alliance program and adheres to its Online Behavioral Advertising principles

American Express says it participates in the Digital Advertising Alliance (DAA) self-regulatory program and adheres to the DAA principles for Online Behavioral Advertising. It links to the DAA to learn more about the DAA and your choices related to Targeted Advertising.

Supporting quotations

We also participate in the Digital Advertising Alliance (DAA) self-regulatory program and adhere to the DAA principles for Online Behavioral Advertising.

Not stated here

• The DAA principles are described in a linked outside resource that is not supplied here, so this card cannot say what they require.

Use & Processing · User right or choice

Targeted Advertising controls: third-party sites, mobile ad tracking, location settings, partner opt-outs

To exercise choices about Targeted Advertising from American Express on third-party websites, the statement links to an opt-out page. For Targeted Advertising from American Express in third-party apps, it says you can turn off mobile device ad tracking or reset the advertising identifier in your device settings on each of the devices you use. If you do not want Targeted Advertising using precise location data, you can turn off location-based services in your device settings. Many Advertising Partners provide their own advertising-related opt-outs, and American Express encourages you to read the privacy statements of the relevant Advertising Partners.

Supporting quotations

If you want to exercise choices related to Targeted Advertising from American Express on third-party websites, click here. For Targeted Advertising from American Express in third-party apps, you can turn off mobile device ad tracking or reset the advertising identifier in your device settings on each of the devices that you use.

If you do not want to receive Targeted Advertising using precise location data, you can turn off location-based services in your device settings.

Many Advertising Partners provide their own advertising-related opt-outs to consumers. We encourage you to learn more about Targeted Advertising and the choices you have by referring to the respective privacy statements of relevant Advertising Partners.

Qualifications & exceptions

• The device-based steps must be taken on each device you use.

Not stated here

• The third-party opt-out page and the Advertising Partners' privacy statements are not supplied here, so what they offer is not known from this text.

Use & Processing · User right or choice

You can choose postal, email and/or phone marketing; opting out may affect offers, but servicing messages continue

You can choose how you would like to receive direct marketing communications, whether American Express sends them by postal mail, email and/or telephone. If you choose not to receive marketing communications, American Express says it will honor your choice, but certain offers attached to the product or services you have chosen may be affected. It will still communicate with you in connection with servicing your account, fulfilling your requests, or administering any promotion or any program in which you have elected to participate.

Supporting quotations

Direct Marketing Choices

You can choose how you would like to receive direct marketing communications - whether we send them to you through postal mail, email and/or telephone. If you choose to not receive marketing communications from us, we will honor your choice. Please be aware that if you choose not to receive such communications, certain offers attached to the product or services you have chosen may be affected. We will still communicate with you in connection with servicing your account, fulfilling your requests, or administering any promotion or any program in which you have elected to participate.

Not stated here

• The passage does not say which offers may be affected by opting out.

Use & Processing · Procedure

Ways to exercise choices: account preferences, 1-855-AXP-PRIV, unsubscribe links and the National Do Not Call List

If you are a Card Member, a Merchant, or use another product or service, the statement lists these ways to exercise your choices: log in to americanexpress.com/communications to update product-specific privacy preferences, or call 1-855-AXP-PRIV and follow the prompts. You can also exercise certain choices by clicking the Unsubscribe link at the bottom of marketing emails (or going to americanexpress.com/preferences), or by registering for the National Do Not Call List. It also tells you to consult the Privacy Notice associated with your specific product to understand the choices that may be available to you.

Supporting quotations

If you are a Card Member, a Merchant, or use another product or service, you may exercise your choices in the following ways:

Log in to americanexpress.com/communications to update the product specific privacy preferences;

Call 1-855-AXP-PRIV and follow the prompts.

You can also exercise certain choices by:

Clicking on the Unsubscribe link on the bottom of marketing e-mails and following the instructions or going to americanexpress.com/preferences;

Registering for the National Do Not Call List

Please consult the Privacy Notice associated with your specific product to understand the choices that may be available to you.

Qualifications & exceptions

• The second group of ways is described as exercising "certain" choices.

Not stated here

• The product-specific Privacy Notices are not supplied here, so the choices they offer are not known from this text.

Account & Service Control · Procedure

You can update Personal Information by logging in to your account or by calling

You can update your Personal Information by logging in to your account at americanexpress.com. Card Members can also call the number on the back of their Card, and Non-Card Members can call the customer service number associated with their product.

Supporting quotations

How can you update your Personal Information?

You can update your Personal Information by logging in to your account at americanexpress.com. Card Members can also call the number on the back of their Card. Non-Card Members can call the customer service number associated with their product.

Not stated here

• In the saved text, the link on "americanexpress.com" in this sentence points to a Business Card Privacy Notice PDF rather than a login page, so the intended login destination is not clear from this text.
• The linked page behind "americanexpress.com" is a separate document whose text is not supplied here, so this card cannot say what it contains.

Sharing & Disclosure · Context

Glossary: Advertising Partners place ads and track ad performance, including social media and online partners

The Glossary defines Advertising Partners as partners American Express works with to place ads on its and third parties' websites and apps and track how ads perform, including social media and online partners such as Facebook and Google.

Supporting quotations

partners we work with to place ads on our and third parties’ websites and apps and track how ads perform, including social media and online partners, such as Facebook and Google.

Use & Processing · Context

Glossary: Aggregated Information can be compiled from various sources, including card transactions

The Glossary defines Aggregated Information as data or information relating to multiple people that has been combined or aggregated and does not identify you individually. It says Aggregated Information includes information that American Express creates or compiles from various sources, including card transactions.

Supporting quotations

data or information relating to multiple people which has been combined or aggregated and which does not identify you individually. Aggregated Information includes information that we create or compile from various sources, including card transactions.

Legal Rights & Agreement Rules · Context

Glossary: "American Express" is the American Express Company; its Family includes affiliates and controlled companies

The Glossary defines "American Express" (we, our, us) as the American Express Company as identified at the beginning of the online privacy statement. It defines the American Express Family of Companies as any affiliate and subsidiary of, and any company owned or controlled by, the American Express Company.

Supporting quotations

American Express (we, our, us)

the American Express Company as identified at the beginning of this online privacy statement.

any affiliate and subsidiary of, and any company owned or controlled by, the American Express Company.

Not stated here

• The beginning of the statement as saved here refers to "American Express" without naming the American Express Company as a legal entity, so the entity the Glossary points to is not separately identified in this text.