Open Finance Privacy Notice (U.S.)

Mastercard · agreement dated November 24, 2025 · Official agreement

Read the agreement

13 of 69 cards in Use & Processing

Use & Processing · Company practice

Finicity says it does not use sensitive data for purposes that would trigger a right to limit

The notice says some of the data it collects may be considered "Sensitive Personal Information" under applicable state privacy laws. Finicity states that it does not use or disclose sensitive personal information for purposes that would require it to offer consumers the right to limit the collection and processing of that data under those laws.

Details
Who
Finicity ("we")
Exception
Does not use or disclose sensitive personal information for purposes requiring the right to limit

Supporting quotations

Sensitive Personal Information
Some of the data above may be considered “Sensitive Personal Information” under applicable state privacy laws. We do not use or disclose sensitive personal information for purposes which would require us to offer consumers the right to limit our collection and processing of this data under those laws.

Qualifications & exceptions

  • Measured against "applicable state privacy laws", which the notice does not name.

Not stated here

  • The notice does not say which of the listed data counts as Sensitive Personal Information, or which uses would require a right to limit.
Also annotated in the same passage (1)

Use & Processing · Permission or license

Finicity may collect, use and disclose Personal Information for the listed purposes, consistent with the notice

Finicity says it uses Personal Information in a manner consistent with this notice, and that it may collect, use and disclose Personal Information for the purposes listed in Section 2. The list covers service delivery and improvement, identity verification, fraud protection, payments, communications, insights for third parties you authorize, de-identified data, internal operations, legal compliance and other disclosed purposes.

Details
Who
Finicity ("we")
What it does
May collect, use and disclose Personal Information

Supporting quotations

We use your Personal Information in a manner consistent with this Privacy Notice.
Specifically, we may collect, use, and disclose your Personal Information for the following purposes:
Also annotated in the same passage (1)

Use & Processing · Company practice

Finicity may use artificial intelligence and machine learning for some processing

For some processing activities, Finicity says it may use techniques such as artificial intelligence and machine learning to process and analyze data.

Details
What it does
May use artificial intelligence and machine learning to process and analyze data

Supporting quotations

For some processing activities, we may use techniques such as artificial intelligence and machine learning to process and analyze data.

Not stated here

  • The notice does not say which processing activities use artificial intelligence or machine learning.
Also annotated in the same passage (1)

Use & Processing · Company practice

Personal Information is used to provide, improve and personalize the Services and to understand usage

Finicity lists as purposes: providing, maintaining, improving and enhancing the Services; helping improve and personalize the content and functionality of the Services; and helping it understand your usage of the Services in order to improve them.

Details
Why
Provide, maintain, improve, enhance and personalize the Services; understand usage

Supporting quotations

To provide, maintain, improve, and enhance our Services;
To help us improve and personalize the content and functionality of our Services;
To help us understand your usage of the Services to improve the Services;

Use & Processing · Company practice

Personal Information is used to verify your identity, which is required for access

Finicity lists verifying your identity as a purpose. It says identity verification is required to give you access to the Services, including for account creation and for fielding disputes and data requests.

Details
Why
Verify identity, required for access, account creation, disputes and data requests

Supporting quotations

To verify your identity, which is required to give you access to our Services, including for account creation and for fielding disputes and data requests;

Use & Processing · Company practice

Personal Information is used to recognize you when you return to manage account connections and permissions

Finicity lists remembering you when you return to the Services as a purpose, so that you can manage your eligible financial account connections and permissions.

Details
Why
Remember you when you return to manage eligible financial account connections and permissions

Supporting quotations

To remember you when you return to our Services to manage your eligible financial account connections and permissions;

Use & Processing · Company practice

Personal Information is used for customer service replies and technical or administrative messages

Finicity lists communicating with you about customer service matters, questions and comments you send, and communicating technical and administrative messages about the Services, including notices of technology updates.

Details
Why
Customer service communications; technical and administrative messages including notices of technology updates

Supporting quotations

To communicate with you regarding customer service matters, questions and other various comments you may send to us;
To communicate various technical and administrative messages regarding the Services, including notices of technology updates;

Use & Processing · Permission or license

Finicity may create de-identified or aggregated data and use or disclose it for any lawful purpose

Where permissible by law, Finicity lists generating de-identified and/or aggregated data as a purpose. It says it may use or disclose that data for any lawful purpose, including the purposes described in the notice.

Details
Condition
Where permissible by law
Why
Any lawful purpose, including purposes described in the notice

Supporting quotations

Where permissible by law, to generate de-identified and/or aggregated data that we may use or disclose for any lawful purpose, including purposes described in this Privacy Notice;

Qualifications & exceptions

  • Only where permissible by law.
Also annotated in the same passage (1)

Use & Processing · Company practice

Personal Information is used for auditing, debugging and internal research and development

Finicity lists auditing related to your interaction with the Services, debugging to identify and repair errors that impair existing intended functionality, and undertaking internal research for technological development and demonstration.

Details
Why
Auditing, debugging and internal research for technological development and demonstration

Supporting quotations

Auditing related to your interaction with the Services;
Debugging to identify and repair errors that impair existing intended functionality;
Undertaking internal research for technological development and demonstration;

Use & Processing · Permission or license

Other purposes are allowed if disclosed when information is collected or if you consent

Finicity lists, as a final purpose, any other purpose disclosed to you at the time it collects or receives the Personal Information, or otherwise with your consent.

Details
Condition
Purpose disclosed to you at the time of collection or receipt, or your consent

Supporting quotations

For any other purpose disclosed to you at the time we collect or receive the Personal Information, or otherwise with your consent.

Use & Processing · Company commitment

Finicity repeats that it does not use sensitive data for purposes that would trigger a right to limit

In the rights section, Finicity states again that it does not use or disclose sensitive personal information for purposes that would require it to offer consumers the right to limit the collection and processing of that data under applicable law. Section 1 says some of the collected data may be considered "Sensitive Personal Information" under applicable state privacy laws.

Details
Who
Finicity

Supporting quotations

Finicity does not use or disclose sensitive personal information for purposes which would require us to offer consumers the right to limit our collection and processing of this data under applicable law.
Some of the data above may be considered “Sensitive Personal Information” under applicable state privacy laws. We do not use or disclose sensitive personal information for purposes which would require us to offer consumers the right to limit our collection and processing of this data under those laws.

Qualifications & exceptions

  • Measured against "applicable law", which the notice does not name.

Not stated here

  • The notice does not say which of the listed data counts as sensitive or which uses would require a right to limit.
Also annotated in the same passage (1)

Use & Processing · Context

The Services are hosted in the US; using them from elsewhere transfers your data to the United States

Finicity says the Services are hosted in the United States and directed to people inside the United States. If you use the Services from other regions of the world whose data collection and use laws may differ from United States law, you are transferring your Personal Information from those regions to the United States for storage and processing.

Details
Where
Services hosted in and directed to people in the United States
Condition
You choose to use the Services from other regions

Supporting quotations

Our Services are hosted in the United States and are directed to people inside the United States. If you choose to use the Services from other regions of the world with laws governing data collection and use that may differ from United States law, then please note that you are transferring your Personal Information outside of those regions to the United States for storage and processing.
Also annotated in the same passage (1)

Use & Processing · Company practice

Finicity may transfer data from the US to other countries and says it complies with applicable legal requirements

Finicity says it may transfer your Personal Information from the United States to other countries or regions in connection with storage and processing of data, fulfilling your requests and operating the Services. It states that it complies with applicable legal requirements when transferring Personal Information to countries other than the country where you are located.

Details
Why
Storage and processing of data, fulfilling your requests, operating the Services

Supporting quotations

Also, we may transfer your Personal Information from the United States to other countries or regions in connection with storage and processing of data, fulfilling your requests, and operating the Services. We comply with applicable legal requirements when transferring Personal Information to countries other than the country where you are located.

Not stated here

  • The notice does not name the countries or regions data may be transferred to, or the legal mechanisms it relies on.
Also annotated in the same passage (1)