Stride Bank Privacy Notice

Legal Rights & Agreement Rules · Context

Document title identifies a Stride Bank privacy policy

The supplied document is titled “Stride Bank, N.A. Privacy Policy.” The title names Stride Bank, N.A. as the bank whose privacy terms follow and does not mention Affirm. Later text in the same document calls it a “notice” (“This notice describes how we collect, use and share information”), so the title’s “policy” and the body’s “notice” refer to this one document. The title line states no version or effective date.

Supporting quotations

Stride Bank, N.A. Privacy Policy

Qualifications & exceptions

• Title only; no version or effective date appears on this line.
• The body also calls the document a notice; the two labels refer to the same supplied text.

Not stated here

• The document does not explain why its title says “Privacy Policy” while later text calls it a notice.
• The title does not identify Affirm; the relationship between this Stride Bank document and Affirm is not stated here.

Legal Rights & Agreement Rules · Context

Notice is last updated January 2025 and points to another privacy notice

The document is presented as last updated January 2025. It says it describes how information is collected, used and shared, but it is not exhaustive: other privacy policies may apply in addition, and a person who inquires about, applies for, or has a financial product or service with the bank is directed to review a separate “Privacy Notice” that applies to U.S. customers and consumers as described in that notice. The supplied text does not state which document controls if the two differ, and the referenced Privacy Notice is not included.

Supporting quotations

Last Updated January 2025

This notice describes how we collect, use and share information.

Other privacy policies may apply in addition to the terms of this notice.

If you inquire about, apply for, or have a financial product or service with us, please review our Privacy Notice, which applies to U.S. customers and consumers as described in that notice.

Qualifications & exceptions

• The referenced Privacy Notice is a separate document that may apply in addition to this one.
• The notice does not state a priority or conflict rule between the two documents.
• The update line is “Last Updated January 2025”; no separate effective date is stated for the notice as a whole.

Not stated here

• The referenced “Privacy Notice” is not supplied, so its terms and any differences from this document are unknown.
• Whether “our” in “our Privacy Notice” refers to Stride Bank, N.A. or to another entity is not explicit.
• The notice does not state whether the January 2025 update replaced an earlier version or what changed.

Data Access & Collection · Company practice

Personal information is defined broadly and types depend on the product

Personal information is defined generally as information that identifies the consumer or device, plus other information the bank associates with it. The types collected and shared depend on the product or service the consumer has; the notice gives as examples Social Security number, account balances and transaction history, account transactions and risk tolerance. The list is introduced by “can include,” so it is illustrative rather than exhaustive. The definition does not exclude any category of information by name.

Supporting quotations

Personal information generally means information that identifies you or your device, and other information we associate with it.

This section generally describes how Stride Bank collects and uses your personal information

The types of personal information we collect and share depend on the product or service you have with us.

This information can include: ◼ Social Security number ◼ account balances and transaction history ◼ account transactions and risk tolerance

Qualifications & exceptions

• The data types depend on the product or service.
• The listed types are examples (“can include”), not a complete inventory.
• “Risk tolerance” is listed as a data type; the notice does not explain how it is derived or used.

Not stated here

• The notice does not map the listed data types to specific products or state that every customer’s data includes all of them.
• The notice does not define “risk tolerance” or say whether it is inferred.

Retention & Deletion · Company practice

Sharing continues after the customer relationship ends

The notice states that when a consumer is no longer a customer, the bank continues to share the consumer’s information as described in the notice. The reference to “as described in this notice” means the sharing reasons and limits elsewhere in the document continue to apply; the notice does not state a retention period or an end date for that sharing.

Supporting quotations

When you are no longer our customer, we continue to share your information as described in this notice.

Qualifications & exceptions

• Continues after the customer relationship ends, on the terms described in the notice.
• No retention period or end date is stated.

Not stated here

• The notice does not state how long information is kept or when sharing stops.
• The notice does not describe any deletion or customer-notification trigger.

Legal Rights & Agreement Rules · Context

Federal law gives a partial right to limit sharing

The notice frames the sharing table within federal law: financial companies choose how they share personal information, but federal law gives consumers the right to limit some, not all, sharing and requires the bank to explain how it collects, shares and protects personal information. The notice does not name the federal statute or describe the limits beyond the three categories listed later.

Supporting quotations

Financial companies choose how they share your personal information.

Federal law gives consumers the right to limit some but not all sharing.

Federal law also requires us to tell you how we collect, share, and protect your personal information.

Qualifications & exceptions

• The right to limit is partial.
• The federal law is not named.

Not stated here

• The notice does not identify the statute or regulations that impose the notice and opt-out requirements.
• The notice does not state whether any sharing is required by law.

Sharing & Disclosure · Context

Sharing table lists reasons and whether sharing can be limited

The table is introduced as listing three things: the reasons financial companies can share customers’ personal information, the reasons Stride Bank, N.A. chooses to share, and whether the consumer can limit that sharing. Its columns are the reason, whether the bank shares, and whether the consumer can limit. In the supplied text the share-column heading is split: “Does Stride Bank, N.A.” appears before “Can you limit this sharing?” and “Share?” appears after the first data row. The row values remain readable as reason/share/limit, but the extraction does not preserve the original header layout.

Supporting quotations

In the section below, we list the reasons financial companies can share their customers’ personal information; the reasons Stride Bank, N.A. chooses to share; and whether you can limit this sharing.

Reasons we can share your personal information

Does Stride Bank, N.A.

Can you limit this sharing?

Share?

Qualifications & exceptions

• The table separates reasons financial companies generally may share from the reasons this bank says it chooses to share.
• The share-column heading is split across the text “Does Stride Bank, N.A.” and “Share?”.

Not stated here

• The supplied extraction does not preserve the original table layout, so the exact placement of “Share?” is inferred from the row values rather than from a retained table structure.
• The notice does not explain why some limit answers say “No” and others say “We don’t share.”

Sharing & Disclosure · Company practice

Bank shares for everyday business and its own marketing; no limit

Stride Bank says it shares personal information for its everyday business purposes and for its own marketing to offer its products and services. The everyday-business examples are processing transactions, maintaining accounts, responding to court orders and legal investigations, and reporting to credit bureaus. For both rows the notice answers “Yes” to sharing and “No” to whether the consumer can limit it. The examples are introduced by “such as” and are not a complete list of everyday business purposes.

Supporting quotations

For our everyday business purposes— such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus | Yes | No

For our marketing purposes— to offer our products and services to you | Yes | No

Qualifications & exceptions

• “Yes” means the bank shares; “No” means the consumer cannot limit that sharing.
• Everyday-business examples are illustrative.
• Applies to the bank’s own everyday business and marketing, not to joint marketing or affiliate/nonaffiliate marketing.

Not stated here

• The notice does not identify the recipients, service providers or marketing channels used.
• The notice does not state whether “sharing” here includes disclosures to affiliates or only to third parties.

Sharing & Disclosure · Company practice

No joint marketing of bank products

Joint marketing is defined as a formal agreement between nonaffiliated financial companies that together market financial products or services to the consumer. The bank says it does not jointly market bank products with other financial companies, and the table answers “No” to sharing for joint marketing. The no-joint-marketing statement is limited to bank products even though the definition covers financial products or services more broadly.

Supporting quotations

For joint marketing with other financial companies | No | No

A formal agreement between nonaffiliated financial companies that together market financial products or services to you.

We do not jointly market bank products with other financial companies.

Qualifications & exceptions

• The commitment names “bank products”; the definition covers financial products or services generally.
• The table’s limit answer for this row is “No.”

Not stated here

• The notice does not state whether the bank jointly markets any non-bank products.
• The notice does not name any joint-marketing partner.

Sharing & Disclosure · Company practice

No affiliate sharing for affiliate business or marketing

The notice says Stride Bank does not share with affiliates for the affiliates’ everyday business purposes, whether the information is transaction and experience data or creditworthiness data, and does not share for affiliates to market to the consumer. Affiliates are defined as companies related by common ownership or control, financial or nonfinancial. The bank adds that it has no affiliates with which it shares personal information. For these rows the limit column says “We don’t share,” so the limit question does not arise.

Supporting quotations

For our affiliates’ everyday business purposes— information about your transactions and experiences | No | We don't share

For our affiliates’ everyday business purposes— information about your creditworthiness | No | We don’t share

For our affiliates to market to you | No | We don't share

Companies related by common ownership or control. They can be financial and nonfinancial companies.

Stride Bank, N.A. has no affiliates with which it shares your personal information.

Qualifications & exceptions

• Affiliates are defined by common ownership or control.
• The bank states it has no affiliates with which it shares personal information.
• These statements cover affiliate sharing, not sharing with nonaffiliates for other purposes.

Not stated here

• The notice does not name any affiliate or state whether the bank has affiliates with which it does not share.
• The notice does not explain how “common ownership or control” is applied.

Sharing & Disclosure · Company practice

No nonaffiliate marketing; other nonaffiliate sharing is not excluded

The notice says Stride Bank does not share personal information with nonaffiliates so that they can market to the consumer. Nonaffiliates are defined as companies not related by common ownership or control, financial or nonfinancial. The commitment is limited to marketing: the notice does not say the bank never shares with nonaffiliates for other purposes, and the everyday-business row separately lists reporting to credit bureaus as an example without characterizing the recipient.

Supporting quotations

For non-affiliates to market to you | No | We don't share

Companies not related by common ownership or control. They can be financial and nonfinancial companies.

Stride Bank, N.A. does not share with non-affiliates so they can market to you.

Qualifications & exceptions

• The statement is about nonaffiliate marketing, not all nonaffiliate sharing.
• Nonaffiliates may be financial or nonfinancial companies.

Not stated here

• The notice does not list nonaffiliates that receive information for everyday business purposes or state whether any such sharing occurs.
• The notice does not state whether nonaffiliates are service providers or independent recipients.

Legal Rights & Agreement Rules · User right or choice

Federal opt-out covers three categories; state sections qualify it

The notice says federal law gives consumers the right to limit only three categories: sharing with affiliates for their everyday business purposes about creditworthiness, affiliates’ use of information to market to the consumer, and sharing with nonaffiliates for them to market to the consumer. It adds that state laws and individual companies may give additional rights and points to the state-law sections below. The three categories named here correspond to table rows the bank marks “No | We don’t share” for affiliate creditworthiness, affiliate marketing and nonaffiliate marketing, so the notice presents the federal opt-out as covering categories in which it says it does not share. The state-law sections qualify the picture: the Vermont section limits nonaffiliate sharing to the bank’s own marketing, everyday business, or consent, and the California section describes CCPA rights but states those provisions do not apply to financial-institution data under federal law. The text prints “businesspurposes” as one word in the first category.

Supporting quotations

Federal law gives you the right to limit only ◼ sharing for affiliates’ everyday businesspurposes—information about your creditworthiness ◼ affiliates from using your information to market to you ◼ sharing for non-affiliates to market to you

State laws and individual companies may give you additional rights to limit sharing.

See below for more on your rights under state law.

For our affiliates’ everyday business purposes— information about your creditworthiness | No | We don’t share

For our affiliates to market to you | No | We don't share

For non-affiliates to market to you | No | We don't share

In accordance with Vermont law, we will not share with non-affiliates except for our own marketing purposes, our everyday business purposes, or with your consent.

These provisions of the CCPA do not apply to personal information collected, processed, shared, or disclosed by financial institutions pursuant to federal law.

Qualifications & exceptions

• The federal right is limited to the three listed categories.
• State laws may add rights; the notice points to the state-law sections below.
• The Vermont section narrows nonaffiliate sharing; the California section states a financial-institution limitation on CCPA rights.
• The quoted word “businesspurposes” is printed without a space; it appears to mean “business purposes.”

Not stated here

• The notice does not give a specific opt-out address, form or process for these categories; the only contact stated is for questions.
• The notice does not explain how a limit request would be handled if the bank shared in one of these categories.
• The notice does not explain how the Vermont exceptions and the federal opt-out interact for a Vermont consumer, or how the California limitation is applied.

Legal Rights & Agreement Rules · Context

Stride Bank provides the notice; questions go to an Affirm address

The notice identifies Stride Bank, N.A. as the entity providing it. Questions are directed to customercare@affirm.com, an Affirm customer-care address rather than a Stride Bank address. The notice describes that address only for questions; it does not label it as an opt-out, privacy-request or complaint channel.

Supporting quotations

If you have any questions, please contact us by email at customercare@affirm.com.

Who is providing this notice? | Stride Bank, N.A.

Qualifications & exceptions

• The contact is for questions.
• The email domain is Affirm, while the notice’s provider is Stride Bank, N.A.

Not stated here

• The notice does not state whether the Affirm customer-care mailbox handles privacy or opt-out requests.
• The notice does not give a Stride Bank privacy contact.

Security & Safeguards · Company commitment

Security measures described generically

Stride Bank says it uses security measures that comply with federal law to protect personal information from unauthorized access and use. It gives computer safeguards and secured files and buildings as examples. The notice does not specify standards, encryption, access controls, employee training or incident-notification commitments.

Supporting quotations

To protect your personal information from unauthorized access and use, we use security measures that comply with federal law.

These measures include computer safeguards and secured files and buildings.

Qualifications & exceptions

• The measures are described as examples (“include”).
• Compliance is asserted with federal law, not with a named standard.

Not stated here

• The notice does not state which federal security requirements apply or how compliance is verified.
• The notice does not describe breach notification or consumer remedies.

Data Access & Collection · Company practice

Collection happens through account activity and other companies

The notice says the bank collects personal information when a consumer opens an account or deposits money, pays bills or gives contact information, or uses a credit or debit card. It also collects personal information from other companies. The consumer-activity examples are introduced by “for example” and are not exhaustive.

Supporting quotations

We collect your personal information, for example, when you ◼ open an account or deposit money ◼ pay your bills or give us your contact information ◼ use your credit or debit card

We also collect your personal information from other companies.

Qualifications & exceptions

• The activity examples are illustrative.
• The other companies are not identified.

Not stated here

• The notice does not identify the other companies, the data they supply, or whether the consumer is notified.
• The notice does not state whether information is collected through cookies or website tracking in this document.

Sharing & Disclosure · Restriction or exception

Vermont residents: nonaffiliate sharing limited to three exceptions

For Vermont residents, the notice says the bank will not share with nonaffiliates except for the bank’s own marketing purposes, its everyday business purposes, or with the consumer’s consent. This state-specific statement addresses nonaffiliate sharing generally, while the national table addresses nonaffiliate marketing and does not state a general nonaffiliate-sharing rule.

Supporting quotations

Vermont Residents:

In accordance with Vermont law, we will not share with non-affiliates except for our own marketing purposes, our everyday business purposes, or with your consent.

Qualifications & exceptions

• Applies to Vermont residents.
• The exceptions are the bank’s own marketing, the bank’s everyday business purposes, and consent.
• The text uses “non-affiliates” here and “nonaffiliates” elsewhere for the same defined group.

Not stated here

• The notice does not describe how Vermont consent is obtained or recorded.
• The notice does not state whether the Vermont exceptions also apply to affiliates.

Legal Rights & Agreement Rules · Context

Nevada residents: contact information for the consumer-protection office

For Nevada residents, the notice provides contact information for the Bureau of Consumer Protection in the Nevada Attorney General’s Office, as required by Nevada law: street address, phone number and email. The section is a contact disclosure; it does not describe a Nevada privacy right, opt-out or substantive limitation on sharing.

Supporting quotations

Nevada Residents:

Nevada law requires that we provide you with the following contact information: Bureau of Consumer Protection, Office of the Nevada Attorney General, 555 E. Washington Ave., Suite 3900, Las Vegas, NV 89101; Phone number: 702-486-3132; email: agInfo@ag.nv.gov

Qualifications & exceptions

• This is a contact disclosure required by Nevada law.
• The notice does not state what requests the Nevada office accepts.

Not stated here

• The notice does not describe any additional Nevada privacy rights or the bank’s Nevada obligations beyond the contact disclosure.

Legal Rights & Agreement Rules · User right or choice

California residents: CCPA rights subject to a financial-institution limitation

For California residents, the notice describes three CCPA rights effective January 1, 2020: to ask a covered business which categories and pieces of personal information it collects and how the information is used; to request deletion; and to opt out of the sale of personal information, “if applicable.” The notice then states that these CCPA provisions do not apply to personal information collected, processed, shared or disclosed by financial institutions pursuant to federal law. The limitation is stated broadly, and the notice does not analyze whether particular Stride Bank data falls within it.

Supporting quotations

California Residents:

Effective January 1, 2020, the California Consumer Privacy Act (CCPA) permits consumers who are California residents to (a) ask a covered business which categories and pieces of personal information it collects and how the information is used; (b) request deletion of the information; and (c) opt out of the sale of such information, if applicable.

These provisions of the CCPA do not apply to personal information collected, processed, shared, or disclosed by financial institutions pursuant to federal law.

Qualifications & exceptions

• Applies to California residents.
• The rights are those the notice describes under the CCPA effective January 1, 2020.
• The sale opt-out is qualified by “if applicable.”
• The notice states a financial-institution limitation; this card reports that statement, not a legal conclusion about its scope.

Not stated here

• The notice does not identify which data is held by a financial institution “pursuant to federal law,” so the practical reach of the CCPA rights for a given product is not stated.
• The notice does not define “covered business” or “sale.”

Legal Rights & Agreement Rules · Procedure

California request rules, response timing and fees

The procedure is framed around a “verifiable consumer request.” Only the consumer or a person registered with the California Secretary of State who is authorized to act on the consumer’s behalf may make a request; a consumer may also request on behalf of a minor child. A consumer may make a request to know or delete twice in a 12-month period. The bank says it endeavors to respond within 45 days, may extend up to 90 days with written reasons, and disclosures cover only the preceding 12-month period. The response will explain reasons the bank cannot comply, if applicable. For right-to-know requests, the bank says it will select a readily usable format that should allow transmission without hindrance. No fee is charged unless the request is excessive, repetitive or manifestly unfounded; if a fee applies, the bank says it will explain why and give a cost estimate before completing the request. The notice also says consumers will not receive discriminatory treatment for exercising CCPA rights.

Supporting quotations

Only you or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information.

You may also make a verifiable consumer request on behalf of your minor child.

You may make a verifiable consumer request to know or delete personal information twice within a 12-month period.

We endeavor to respond to a verifiable consumer request within 45 days of its receipt.

If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.

Any disclosures we provide will only cover the preceding 12-month period.

The response we provide will also explain the reasons we cannot comply with a request, if applicable.

For right to know requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded.

If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

consumers will not receive discriminatory treatment for the exercise of the privacy rights conferred by the CCPA

Qualifications & exceptions

• The response times are stated as endeavors; an extension up to 90 days is allowed with written reasons.
• Disclosures cover only the preceding 12 months.
• The fee exception applies to excessive, repetitive or manifestly unfounded requests.
• These commitments are subject to the financial-institution limitation stated in the same section.

Not stated here

• The notice does not describe how to submit a request, what verification evidence is required, or how the 12-month limit is calculated.
• The notice does not state what “readily useable” format will be selected.

Legal Rights & Agreement Rules · Procedure

California CCPA contact is for compliance questions

The notice gives privacy@affirm.com as the contact for questions about its compliance with the CCPA. It does not say this address is the channel for submitting a verifiable consumer request; the request procedure is described separately without a submission address.

Supporting quotations

To contact us with questions about our compliance with the CCPA, please contact us by email at privacy@affirm.com.

Qualifications & exceptions

• The address is an Affirm privacy address, not a Stride Bank address.
• The stated purpose is questions about CCPA compliance.

Not stated here

• The notice does not state where or how a verifiable consumer request is submitted.
• The notice does not state whether the address accepts requests or only questions.