Open Finance Privacy Notice (U.S.)

Data Access & Collection · Context

Notice covers information you provide through Finicity Open Finance services

The notice applies to information you provide to Finicity in connection with its Open Finance solutions, for example through Mastercard Data Connect and its other online services, websites, applications and related services that link to this notice (together, the "Services"). It explains the types of personal information collected and how Finicity collects, uses, maintains, protects and discloses it, and describes the rights and choices you may have.

Supporting quotations

This Privacy Notice applies to the information you provide to us in connection with our Open Finance solutions including, for example, through Mastercard Data Connect and our other online services, websites, applications, and related services that link to this Privacy Notice

It explains the types of personal information we collect, and how we collect, use, maintain, protect, and disclose this information.

Qualifications & exceptions

• Only Services that link to this Privacy Notice are covered; Mastercard Data Connect is given as an example.

Not stated here

• The scope sentence refers to "information you provide to us"; Section 1 also describes information collected from financial institutions, devices and third parties, and the scope sentence does not say separately how it treats that information.

Data Access & Collection · Company practice

Connecting a financial account lets Finicity access and collect its data using your credentials or token

When you use the Services to connect a financial account from your bank, financial institution, payroll provider or other entity that provides the account, Finicity accesses and collects information from the financial accounts (such as checking, savings and credit card accounts) that are accessible through a set of credentials or an authenticated access token on your behalf.

Supporting quotations

When you use our Services to connect your financial account from your bank, financial institution, payroll provider, or other entity that provides your financial account, we will access and collect information from financial accounts (e.g., checking, savings, credit card, etc.) accessible through a set of credentials or an authenticated access token on your behalf.

Data Access & Collection · Company practice

Finicity also collects from your devices and from affiliates, service providers and third parties

Besides account data, Finicity collects information from the devices you use to access the Services and from affiliates, service providers or third parties. The notice says this includes collection to protect you and others against fraud; it does not say fraud protection is the only purpose.

Supporting quotations

We also collect information from the devices you use to access our Services, and from affiliates, service providers, or third parties, including to protect you and others against fraud.

Data Access & Collection · Context

Personal Information covers data about an identifiable person, and what is collected varies by Service

In the notice, Personal Information means any information relating to an identified or identifiable individual, or to a household or device that identifies a consumer or household where applicable law requires. The Personal Information Finicity collects, uses and discloses depends on the Services you use, the information available from your financial account and other factors. The categories it lists follow in a table.

Supporting quotations

In this Privacy Notice, “Personal Information” means any information relating to an identified or identifiable individual (or household or device that identifies a consumer or household, where required by applicable law). The Personal Information we collect, use, and disclose depends on the Services that you use, the information available from your financial account, and other factors. The categories of Personal Information we collect are:

Qualifications & exceptions

• Household or device information counts as Personal Information only "where required by applicable law".

Data Access & Collection · Company practice

Account data collected includes account and owner identifiers, balances and transaction details

From your financial account, Finicity collects account identifying details (account name, type, number, owner, and identifying or routing information for the financial institution), account balance information, identifying information about the account owner(s) (name, email address, phone number, date of birth and address), and transaction or other commercial information (merchant, amount, date, payee, type, quantity, price, location, involved securities, and memo or description of the transaction).

Supporting quotations

Information from your financial account

Account identifying details (such as account name, type, number, owner, and identifying or routing information for the financial institution); account balance information;

identifying information about the account owner(s), (including name, email address, phone number, date of birth, and address information); and transaction or other commercial information (including merchant, amount, date, payee, type, quantity, price, location, involved securities, and memo or description of the transaction)

Qualifications & exceptions

• What is collected depends on the information available from your financial account and the Services you use.

Data Access & Collection · Company practice

Credit, payroll, loan and investment account details are collected, including tax and income data

From your financial account, Finicity collects revolving credit account information (balance owed, due dates, payment details, transaction history, credit limits, repayment status and interest rates); payroll account information (employer details, employment description, W2 and tax related information, income amount and dates paid, and amounts withheld for taxes, benefits and insurance); loan account information (due dates, repayment status, balances, payment details, interest rates, guarantor, loan types, and payment plans and terms); and investment account information (transaction information, type of asset, identifying details about the asset, quantity, price, fees, and cost basis).

Supporting quotations

Information from your financial account

revolving credit account information (including balance owed, due dates, payment details, transaction history, credit limits, repayment status, and interest rates); payroll account information (including employer details, employment description, W2 and tax related information, income amount and dates paid, and amounts withheld for taxes, benefits, and insurance); loan account information (including due dates, repayment status, balances, payment details, interest rates, guarantor, loan types, and payment plans and terms); investment account information (including transaction information, type of asset, identifying details about the asset, quantity, price, fees, and cost basis)

Qualifications & exceptions

• What is collected depends on the information available from your financial account and the Services you use.

Data Access & Collection · Company practice

Identifiers collected include contact details, date of birth and Social Security number

Finicity collects identifiers: personal and business contact information (name, email address, postal address, phone number, job title), date of birth, Social Security number, unique personal identifiers or numbers, online identifier, IP address, account name, authentication information, and similar identifiers.

Supporting quotations

Identifiers

Personal and business contact information (e.g., name, email address, postal address, phone number, job title), date of birth, social security number, unique personal identifiers or numbers, online identifier, internet protocol (IP) address, account name, authentication information, and similar identifiers

Data Access & Collection · Company practice

Login credentials, PINs and security answers are collected to authenticate you and connect accounts

Finicity collects authentication information: credentials, username, password, security questions and responses, Personal Identification Numbers (PINs), multi-factor authentication responses, security tokens, and other information required to authenticate you and to connect your financial account(s) through the Services.

Supporting quotations

Authentication information

Credentials, username, password, security questions and responses, Personal Identification Numbers (PINs), multi-factor authentication responses, security tokens, and/or other information required to authenticate you and to connect your financial account(s) through the Services

Data Access & Collection · Company practice

Registration and payment information collected includes name, contact details, date of birth and SSN

Under product and service information, Finicity collects registration and payment information, first name, last name, email, phone or mobile device number, date of birth and Social Security number.

Supporting quotations

Product and service information

Registration and payment information, first name, last name, email, phone/mobile device number, date of birth, social security number

Data Access & Collection · Company practice

Device and browser details, including via cookies and web beacons, are collected when you use the Services

Finicity collects device hardware model, operating system, browser type, referring URLs and other information collected by automated means such as cookies or web beacons when you interact with the Services.

Supporting quotations

Device, internet, and other electronic network activity information

Device hardware model, operating system, browser type, referring URLs, and other information collected via automated means such as cookies or web beacons when you interact with our Services

Data Access & Collection · Company practice

Time zone and geographic area are collected from your IP address and device information

Using your IP address and other device information, Finicity collects your time zone setting and geographic area.

Supporting quotations

Geolocation data

Using your IP address and other device information, we collect your time zone setting and geographic area

Data Access & Collection · Company practice

Audio recordings, including customer-service call recordings, are collected

Finicity collects audio recordings, including call recordings made for customer service purposes.

Supporting quotations

Audio information

Audio recordings (including call recordings for customer service purposes)

Data Access & Collection · Company practice

Business and employment information, including payroll provider details, is collected

Finicity collects professional or employment-related information: business-to-business ("B2B") information (such as job title, department and name of organization), professional employment information and payroll provider information.

Supporting quotations

Professional or Employment-Related Information

Business-to-business (“B2B”) information (such as job title, department, and name of organization); professional employment information; and payroll provider information

Data Access & Collection · Company practice

Commercial information retained includes bank statements, purchase history, tax documents and credit scores

Finicity collects commercial information, described as information it creates or retains that is fundamental to its business, for example bank statements, bank transactions, records of personal property, products or services purchased or obtained, purchase history, consumer habits or tendencies, banking account numbers, bank routing numbers, W-2s and other tax-related documentation, and credit scores.

Supporting quotations

Commercial Information

Information we create or retain that is fundamental to our business, e.g., bank statements, bank transactions, records of personal property; products or services purchased or obtained; purchase history; consumer habits or tendencies; banking account numbers; bank routing numbers; W-2s and other tax-related documentation, and credit scores

Qualifications & exceptions

• Described as information Finicity creates or retains that is fundamental to its business.

Data Access & Collection · Company practice

Finicity collects from your bank or financial institution and directly from you or your devices

Finicity says it collects Personal Information from various categories of sources, including your bank or financial institution and directly from you or your devices. The list continues with further sources.

Supporting quotations

We collect this Personal Information from various categories of sources, including:

Your bank or financial institution.

Directly from you or your devices.

Data Access & Collection · Company practice

Other sources include Mastercard affiliates, authorized third parties, service providers, platforms and data providers

Beyond your bank and you or your devices, Finicity says it collects Personal Information from Mastercard group affiliates (including to monitor and prevent fraud), third parties you have authorized to access your information to provide you a product or service, service providers including analytics providers, OS/platform providers, publicly accessible sources, and third-party data providers, who may collect the information from publicly available sources, directly from individuals, or other sources.

Supporting quotations

Our affiliates within the Mastercard group, including to monitor and prevent fraud.

Third parties that you have authorized to access your information in order to provide a product or service to you.

Service providers, including analytics providers.

OS/platform providers.

Publicly accessible sources.

Third party data providers, who may collect the information from publicly available sources, directly from individuals, or other sources.

Not stated here

• The Mastercard Fraud & Security Notice that the affiliate item points to is linked but its text was not supplied.

Data Access & Collection · User right or choice

You may decline to share some Personal Information, but some features may then be unavailable

You may decline to share certain Personal Information with Finicity, in which case it may not be able to provide you some of the features and functionalities of the Services. Where applicable law requires, Finicity says it will indicate whether and why you must provide Personal Information and the consequences of failing to do so.

Supporting quotations

You may decline to share certain Personal Information with us, in which case we may not be able to provide to you some of the features and functionalities of our Services. Where required by applicable law, we will indicate whether and why you must provide us with your Personal Information, as well as the consequences of failing to do so.

Qualifications & exceptions

• Finicity indicates whether and why you must provide information, and the consequences, only "where required by applicable law".

Data Access & Collection · Company practice

Finicity does not respond to browser Do Not Track signals at this time

Finicity says there is not yet a consensus on how companies should respond to web browser-based do-not-track mechanisms, and that it does not respond to browser-based DNT signals at this time.

Supporting quotations

Finicity does not respond to web browser-based DNT signals at this time.

Data Access & Collection · Company commitment

Finicity says it does not knowingly collect Minors' data and will promptly delete it if it learns of it

Finicity says it does not knowingly collect, use or disclose Personal Information about Minors who use the Services. If you believe a Minor has provided Personal Information, you can alert Finicity at the email address in the notice, and if Finicity learns it has collected Personal Information from a Minor, it says it will promptly take steps to delete it.

Supporting quotations

nor do we knowingly collect, use, or disclose Personal Information about Minors who use our Services

If we learn that we have collected Personal Information from a Minor, we will promptly take steps to delete such information.