Open Finance Privacy Notice (U.S.)

Legal Rights & Agreement Rules · Context

Finicity, a Mastercard subsidiary, issues this notice and "we" means Finicity

This Open Finance Privacy Notice is provided by Finicity Corporation, a wholly owned subsidiary of Mastercard International Inc. In the notice, "Finicity," "we" and "us" refer to Finicity. The page states the notice was last updated November 24, 2025.

Supporting quotations

provided by Finicity Corporation, a wholly owned subsidiary of Mastercard International Inc.

Last updated: November 24, 2025

Data Access & Collection · Context

Notice covers information you provide through Finicity Open Finance services

The notice applies to information you provide to Finicity in connection with its Open Finance solutions, for example through Mastercard Data Connect and its other online services, websites, applications and related services that link to this notice (together, the "Services"). It explains the types of personal information collected and how Finicity collects, uses, maintains, protects and discloses it, and describes the rights and choices you may have.

Supporting quotations

This Privacy Notice applies to the information you provide to us in connection with our Open Finance solutions including, for example, through Mastercard Data Connect and our other online services, websites, applications, and related services that link to this Privacy Notice

It explains the types of personal information we collect, and how we collect, use, maintain, protect, and disclose this information.

Qualifications & exceptions

• Only Services that link to this Privacy Notice are covered; Mastercard Data Connect is given as an example.

Not stated here

• The scope sentence refers to "information you provide to us"; Section 1 also describes information collected from financial institutions, devices and third parties, and the scope sentence does not say separately how it treats that information.

Sharing & Disclosure · Restriction or exception

Notice does not explain what third parties you authorize do with your data

You may reach the Services through third parties and their applications that you have authorized to access your information so they can provide you a product or service. This notice does not explain what those third parties do with Personal Information Finicity provides to them on your behalf, or with other information they separately collect about you. Finicity encourages you to read their privacy notices and terms for their data practices.

Supporting quotations

You may access our Services through other third parties (and their related applications and services) that you have authorized to access your information in order for those third parties to provide a product or service to you.

This Privacy Notice does not explain what those third parties do with any Personal Information we provide to them on your behalf, or any other information they may separately collect about you.

Legal Rights & Agreement Rules · Permission or license

Accessing or using the Services counts as agreeing to the processing described

Finicity says it processes your Personal Information in accordance with applicable law and its applicable obligations, and that by accessing or using the Services you agree to the collection, use and processing of your Personal Information as set out in this notice.

Supporting quotations

We process your Personal Information in accordance with applicable law and our applicable obligations.

By accessing or using our Services, you agree to the collection, use, and processing of your Personal Information as set forth in this Privacy Notice.

Qualifications & exceptions

• Finicity states it processes Personal Information in accordance with applicable law and its applicable obligations.

Legal Rights & Agreement Rules · Restriction or exception

Job applicants are pointed to a separate Applicant Privacy Notice

If you are a job applicant, the notice tells you to refer to the Mastercard Applicant Privacy Notice for further information. The text of that linked notice is not part of this document.

Supporting quotations

If you are a job applicant, please refer to the Mastercard Applicant Privacy Notice for further information

Not stated here

• The Mastercard Applicant Privacy Notice is linked but its text was not supplied, so how applicants' information is handled is not shown here.

Data Access & Collection · Company practice

Connecting a financial account lets Finicity access and collect its data using your credentials or token

When you use the Services to connect a financial account from your bank, financial institution, payroll provider or other entity that provides the account, Finicity accesses and collects information from the financial accounts (such as checking, savings and credit card accounts) that are accessible through a set of credentials or an authenticated access token on your behalf.

Supporting quotations

When you use our Services to connect your financial account from your bank, financial institution, payroll provider, or other entity that provides your financial account, we will access and collect information from financial accounts (e.g., checking, savings, credit card, etc.) accessible through a set of credentials or an authenticated access token on your behalf.

Data Access & Collection · Company practice

Finicity also collects from your devices and from affiliates, service providers and third parties

Besides account data, Finicity collects information from the devices you use to access the Services and from affiliates, service providers or third parties. The notice says this includes collection to protect you and others against fraud; it does not say fraud protection is the only purpose.

Supporting quotations

We also collect information from the devices you use to access our Services, and from affiliates, service providers, or third parties, including to protect you and others against fraud.

Data Access & Collection · Context

Personal Information covers data about an identifiable person, and what is collected varies by Service

In the notice, Personal Information means any information relating to an identified or identifiable individual, or to a household or device that identifies a consumer or household where applicable law requires. The Personal Information Finicity collects, uses and discloses depends on the Services you use, the information available from your financial account and other factors. The categories it lists follow in a table.

Supporting quotations

In this Privacy Notice, “Personal Information” means any information relating to an identified or identifiable individual (or household or device that identifies a consumer or household, where required by applicable law). The Personal Information we collect, use, and disclose depends on the Services that you use, the information available from your financial account, and other factors. The categories of Personal Information we collect are:

Qualifications & exceptions

• Household or device information counts as Personal Information only "where required by applicable law".

Data Access & Collection · Company practice

Account data collected includes account and owner identifiers, balances and transaction details

From your financial account, Finicity collects account identifying details (account name, type, number, owner, and identifying or routing information for the financial institution), account balance information, identifying information about the account owner(s) (name, email address, phone number, date of birth and address), and transaction or other commercial information (merchant, amount, date, payee, type, quantity, price, location, involved securities, and memo or description of the transaction).

Supporting quotations

Information from your financial account

Account identifying details (such as account name, type, number, owner, and identifying or routing information for the financial institution); account balance information;

identifying information about the account owner(s), (including name, email address, phone number, date of birth, and address information); and transaction or other commercial information (including merchant, amount, date, payee, type, quantity, price, location, involved securities, and memo or description of the transaction)

Qualifications & exceptions

• What is collected depends on the information available from your financial account and the Services you use.

Data Access & Collection · Company practice

Credit, payroll, loan and investment account details are collected, including tax and income data

From your financial account, Finicity collects revolving credit account information (balance owed, due dates, payment details, transaction history, credit limits, repayment status and interest rates); payroll account information (employer details, employment description, W2 and tax related information, income amount and dates paid, and amounts withheld for taxes, benefits and insurance); loan account information (due dates, repayment status, balances, payment details, interest rates, guarantor, loan types, and payment plans and terms); and investment account information (transaction information, type of asset, identifying details about the asset, quantity, price, fees, and cost basis).

Supporting quotations

Information from your financial account

revolving credit account information (including balance owed, due dates, payment details, transaction history, credit limits, repayment status, and interest rates); payroll account information (including employer details, employment description, W2 and tax related information, income amount and dates paid, and amounts withheld for taxes, benefits, and insurance); loan account information (including due dates, repayment status, balances, payment details, interest rates, guarantor, loan types, and payment plans and terms); investment account information (including transaction information, type of asset, identifying details about the asset, quantity, price, fees, and cost basis)

Qualifications & exceptions

• What is collected depends on the information available from your financial account and the Services you use.

Data Access & Collection · Company practice

Identifiers collected include contact details, date of birth and Social Security number

Finicity collects identifiers: personal and business contact information (name, email address, postal address, phone number, job title), date of birth, Social Security number, unique personal identifiers or numbers, online identifier, IP address, account name, authentication information, and similar identifiers.

Supporting quotations

Identifiers

Personal and business contact information (e.g., name, email address, postal address, phone number, job title), date of birth, social security number, unique personal identifiers or numbers, online identifier, internet protocol (IP) address, account name, authentication information, and similar identifiers

Data Access & Collection · Company practice

Login credentials, PINs and security answers are collected to authenticate you and connect accounts

Finicity collects authentication information: credentials, username, password, security questions and responses, Personal Identification Numbers (PINs), multi-factor authentication responses, security tokens, and other information required to authenticate you and to connect your financial account(s) through the Services.

Supporting quotations

Authentication information

Credentials, username, password, security questions and responses, Personal Identification Numbers (PINs), multi-factor authentication responses, security tokens, and/or other information required to authenticate you and to connect your financial account(s) through the Services

Data Access & Collection · Company practice

Registration and payment information collected includes name, contact details, date of birth and SSN

Under product and service information, Finicity collects registration and payment information, first name, last name, email, phone or mobile device number, date of birth and Social Security number.

Supporting quotations

Product and service information

Registration and payment information, first name, last name, email, phone/mobile device number, date of birth, social security number

Data Access & Collection · Company practice

Device and browser details, including via cookies and web beacons, are collected when you use the Services

Finicity collects device hardware model, operating system, browser type, referring URLs and other information collected by automated means such as cookies or web beacons when you interact with the Services.

Supporting quotations

Device, internet, and other electronic network activity information

Device hardware model, operating system, browser type, referring URLs, and other information collected via automated means such as cookies or web beacons when you interact with our Services

Data Access & Collection · Company practice

Time zone and geographic area are collected from your IP address and device information

Using your IP address and other device information, Finicity collects your time zone setting and geographic area.

Supporting quotations

Geolocation data

Using your IP address and other device information, we collect your time zone setting and geographic area

Inference & Profiling · Company practice

Inferences may include fraud signals, risk scores, income, employment and likelihood to make a payment

Finicity may draw inferences from Personal Information, including fraud signals (such as how many times a data element has been queried in a period or when it was last seen) used to identify behavioral patterns and insights for its fraud prevention and identity verification services, authentication risk scores, transaction risk factors, risk reason codes, income, employment, cash flow information, your likelihood to make a payment on a given day, and your regular payments (such as utilities, rent and subscription services).

Supporting quotations

Inferences drawn from personal information

Inferences may include fraud signals, such as the number of times a data element has been queried in a period of time or the last time a data element has been seen, to identify behavioral patterns and insights for our fraud prevention and identity verification services (e.g., patterns confirming that a provided address is genuine), authentication risk scores, transaction risk factors, risk reason codes, income, employment, cash flow information, your likelihood to make a payment on a given day, and your regular payments (e.g., utilities, rent subscription services)

Data Access & Collection · Company practice

Audio recordings, including customer-service call recordings, are collected

Finicity collects audio recordings, including call recordings made for customer service purposes.

Supporting quotations

Audio information

Audio recordings (including call recordings for customer service purposes)

Data Access & Collection · Company practice

Business and employment information, including payroll provider details, is collected

Finicity collects professional or employment-related information: business-to-business ("B2B") information (such as job title, department and name of organization), professional employment information and payroll provider information.

Supporting quotations

Professional or Employment-Related Information

Business-to-business (“B2B”) information (such as job title, department, and name of organization); professional employment information; and payroll provider information

Data Access & Collection · Company practice

Commercial information retained includes bank statements, purchase history, tax documents and credit scores

Finicity collects commercial information, described as information it creates or retains that is fundamental to its business, for example bank statements, bank transactions, records of personal property, products or services purchased or obtained, purchase history, consumer habits or tendencies, banking account numbers, bank routing numbers, W-2s and other tax-related documentation, and credit scores.

Supporting quotations

Commercial Information

Information we create or retain that is fundamental to our business, e.g., bank statements, bank transactions, records of personal property; products or services purchased or obtained; purchase history; consumer habits or tendencies; banking account numbers; bank routing numbers; W-2s and other tax-related documentation, and credit scores

Qualifications & exceptions

• Described as information Finicity creates or retains that is fundamental to its business.

Use & Processing · Company practice

Finicity says it does not use sensitive data for purposes that would trigger a right to limit

The notice says some of the data it collects may be considered "Sensitive Personal Information" under applicable state privacy laws. Finicity states that it does not use or disclose sensitive personal information for purposes that would require it to offer consumers the right to limit the collection and processing of that data under those laws.

Supporting quotations

Sensitive Personal Information

Some of the data above may be considered “Sensitive Personal Information” under applicable state privacy laws. We do not use or disclose sensitive personal information for purposes which would require us to offer consumers the right to limit our collection and processing of this data under those laws.

Qualifications & exceptions

• Measured against "applicable state privacy laws", which the notice does not name.

Not stated here

• The notice does not say which of the listed data counts as Sensitive Personal Information, or which uses would require a right to limit.

Data Access & Collection · Company practice

Finicity collects from your bank or financial institution and directly from you or your devices

Finicity says it collects Personal Information from various categories of sources, including your bank or financial institution and directly from you or your devices. The list continues with further sources.

Supporting quotations

We collect this Personal Information from various categories of sources, including:

Your bank or financial institution.

Directly from you or your devices.

Data Access & Collection · Company practice

Other sources include Mastercard affiliates, authorized third parties, service providers, platforms and data providers

Beyond your bank and you or your devices, Finicity says it collects Personal Information from Mastercard group affiliates (including to monitor and prevent fraud), third parties you have authorized to access your information to provide you a product or service, service providers including analytics providers, OS/platform providers, publicly accessible sources, and third-party data providers, who may collect the information from publicly available sources, directly from individuals, or other sources.

Supporting quotations

Our affiliates within the Mastercard group, including to monitor and prevent fraud.

Third parties that you have authorized to access your information in order to provide a product or service to you.

Service providers, including analytics providers.

OS/platform providers.

Publicly accessible sources.

Third party data providers, who may collect the information from publicly available sources, directly from individuals, or other sources.

Not stated here

• The Mastercard Fraud & Security Notice that the affiliate item points to is linked but its text was not supplied.

Use & Processing · Permission or license

Finicity may collect, use and disclose Personal Information for the listed purposes, consistent with the notice

Finicity says it uses Personal Information in a manner consistent with this notice, and that it may collect, use and disclose Personal Information for the purposes listed in Section 2. The list covers service delivery and improvement, identity verification, fraud protection, payments, communications, insights for third parties you authorize, de-identified data, internal operations, legal compliance and other disclosed purposes.

Supporting quotations

We use your Personal Information in a manner consistent with this Privacy Notice.

Specifically, we may collect, use, and disclose your Personal Information for the following purposes:

Use & Processing · Company practice

Finicity may use artificial intelligence and machine learning for some processing

For some processing activities, Finicity says it may use techniques such as artificial intelligence and machine learning to process and analyze data.

Supporting quotations

For some processing activities, we may use techniques such as artificial intelligence and machine learning to process and analyze data.

Not stated here

• The notice does not say which processing activities use artificial intelligence or machine learning.

Use & Processing · Company practice

Personal Information is used to provide, improve and personalize the Services and to understand usage

Finicity lists as purposes: providing, maintaining, improving and enhancing the Services; helping improve and personalize the content and functionality of the Services; and helping it understand your usage of the Services in order to improve them.

Supporting quotations

To provide, maintain, improve, and enhance our Services;

To help us improve and personalize the content and functionality of our Services;

To help us understand your usage of the Services to improve the Services;

Use & Processing · Company practice

Personal Information is used to verify your identity, which is required for access

Finicity lists verifying your identity as a purpose. It says identity verification is required to give you access to the Services, including for account creation and for fielding disputes and data requests.

Supporting quotations

To verify your identity, which is required to give you access to our Services, including for account creation and for fielding disputes and data requests;

Use & Processing · Company practice

Personal Information is used to recognize you when you return to manage account connections and permissions

Finicity lists remembering you when you return to the Services as a purpose, so that you can manage your eligible financial account connections and permissions.

Supporting quotations

To remember you when you return to our Services to manage your eligible financial account connections and permissions;

Inference & Profiling · Company practice

Finicity derives information such as income, payment likelihood and regular payments from your data

Finicity lists providing you with certain information that it derives from your Personal Information, such as your income based on your pay checks. It also lists generating insights such as your income or employment, your likelihood to make a payment on a given day, or your regular payments, in support of services you request from a third party you have authorized to access your information.

Supporting quotations

To provide you with certain information that we derive from your Personal Information, such as your income based on your pay checks;

To generate insights, such as your income or employment, your likelihood to make a payment on a given day, or your regular payments, in support of services you request from a third party who you have authorized to access your information;

Qualifications & exceptions

• The insights are generated in support of services you request from a third party you have authorized to access your information.

Security & Safeguards · Company practice

Personal Information is used to protect you and others against fraud

Finicity lists protecting you and others against fraud as a purpose for using Personal Information.

Supporting quotations

To protect you and others against fraud;

Charges & Financial Obligations · Company practice

If you subscribe to a paid Service, Personal Information is used to process the initial and later payments

Finicity lists processing payments as a purpose when you subscribe to a Service that requires payment: the initial payment and all subsequent payments.

Supporting quotations

If you subscribe to a Service requiring payment, to process the initial payment and all subsequent payments;

Use & Processing · Company practice

Personal Information is used for customer service replies and technical or administrative messages

Finicity lists communicating with you about customer service matters, questions and comments you send, and communicating technical and administrative messages about the Services, including notices of technology updates.

Supporting quotations

To communicate with you regarding customer service matters, questions and other various comments you may send to us;

To communicate various technical and administrative messages regarding the Services, including notices of technology updates;

Use & Processing · Permission or license

Finicity may create de-identified or aggregated data and use or disclose it for any lawful purpose

Where permissible by law, Finicity lists generating de-identified and/or aggregated data as a purpose. It says it may use or disclose that data for any lawful purpose, including the purposes described in the notice.

Supporting quotations

Where permissible by law, to generate de-identified and/or aggregated data that we may use or disclose for any lawful purpose, including purposes described in this Privacy Notice;

Qualifications & exceptions

• Only where permissible by law.

Use & Processing · Company practice

Personal Information is used for auditing, debugging and internal research and development

Finicity lists auditing related to your interaction with the Services, debugging to identify and repair errors that impair existing intended functionality, and undertaking internal research for technological development and demonstration.

Supporting quotations

Auditing related to your interaction with the Services;

Debugging to identify and repair errors that impair existing intended functionality;

Undertaking internal research for technological development and demonstration;

Legal Rights & Agreement Rules · Company practice

Personal Information is used for legal and regulatory compliance and to enforce Finicity's Terms and Policies

Finicity lists maintaining legal and regulatory compliance and enforcing compliance with its Terms and Conditions and Policies as purposes for using Personal Information.

Supporting quotations

To maintain legal and regulatory compliance;

To enforce compliance with our Terms and Conditions and Policies

Not stated here

• The Terms and Conditions and Policies named here are not part of this notice and were not supplied.

Use & Processing · Permission or license

Other purposes are allowed if disclosed when information is collected or if you consent

Finicity lists, as a final purpose, any other purpose disclosed to you at the time it collects or receives the Personal Information, or otherwise with your consent.

Supporting quotations

For any other purpose disclosed to you at the time we collect or receive the Personal Information, or otherwise with your consent.

Sharing & Disclosure · Company practice

When you authorize a third party, Finicity discloses your Personal Information to it, under a confidentiality contract

When you authorize third parties (and their related applications and services) to access your information so they can provide you a product or service, Finicity discloses your Personal Information, including from the categories identified in Section 1, to those third parties. It says it provides Personal Information to a third party only after that party has signed a confidentiality contract with Finicity, and only for business purposes. The notice does not explain what those third parties then do with the information Finicity provides on your behalf.

Supporting quotations

When you authorize third parties, and their related applications and services that you have authorized, to access your information in order to provide a product or service to you, we disclose your Personal Information, including from the categories identified above in Section 1, to those third parties. We only provide your Personal Information to a third party after such third party has a signed a confidentiality contract with us, and we provide your Personal Information to such third parties only for business purposes.

This Privacy Notice does not explain what those third parties do with any Personal Information we provide to them on your behalf

Qualifications & exceptions

• Only after the third party has signed a confidentiality contract with Finicity.
• Only for business purposes.

Not stated here

• The notice does not define "business purposes" or say what the confidentiality contract requires of the third party.

Sharing & Disclosure · Company practice

Finicity may disclose Personal Information with your consent and at your discretion

Finicity says it may also disclose your Personal Information with your consent and at your discretion.

Supporting quotations

We may also disclose your Personal Information as follows:

With your consent and at your discretion;

Sharing & Disclosure · Company practice

Finicity may disclose Personal Information to service providers working on its behalf

Finicity says it may disclose your Personal Information to third-party service providers it employs to provide services on its behalf, including security, fraud prevention or identity verification, development, or other business processes.

Supporting quotations

We may also disclose your Personal Information as follows:

To third-party service providers that we employ to provide services on our behalf, including security, fraud prevention or identity verification, development, or other business processes;

Sharing & Disclosure · Company practice

Partners such as financial institutions and payment processors may receive your data or derived de-identified data

Finicity says it may disclose Personal Information to partners with whom it collaborates to provide services, such as financial institutions or payment processors that facilitate payment transactions. Those partners may use the Personal Information, or de-identified, anonymized and/or aggregated data derived from it, to provide their services, including to third parties you have authorized to access your information. Elsewhere the notice says Finicity may generate de-identified and/or aggregated data, where permissible by law, and use or disclose it for any lawful purpose.

Supporting quotations

We may also disclose your Personal Information as follows:

To partners (such as financial institutions or payment processors that facilitate payment transactions) with whom we collaborate to provide services, so that they may use the Personal Information or de-identified, anonymized and/or aggregated data derived from that Personal Information to provide their services, including to third parties that you have authorized to access your information in order to provide a product or service to you;

Where permissible by law, to generate de-identified and/or aggregated data that we may use or disclose for any lawful purpose, including purposes described in this Privacy Notice

Qualifications & exceptions

• Partners may use the information "to provide their services".

Sharing & Disclosure · Company practice

Finicity may disclose Personal Information to Mastercard group affiliates

Finicity says it may disclose your Personal Information to its affiliates within the Mastercard group and points to the Mastercard Global Privacy Notice for more information. The text of that linked notice is not part of this document.

Supporting quotations

We may also disclose your Personal Information as follows:

To our affiliates within the Mastercard group; for more information, please see the Mastercard Global Privacy Notice;

Not stated here

• The Mastercard Global Privacy Notice is linked but its text was not supplied, so the affiliates' own handling of the information is not shown here.

Legal Rights & Agreement Rules · Company practice

Finicity may disclose Personal Information as reasonably necessary to comply with law or legal process

Finicity says it may disclose your Personal Information as reasonably necessary to comply with applicable law, an investigation or other legal process, such as a court order or a subpoena.

Supporting quotations

We may also disclose your Personal Information as follows:

As reasonably necessary to comply with applicable law, an investigation, or other legal process, such as a court order or a subpoena;

Sharing & Disclosure · Company practice

Finicity may disclose Personal Information to protect people, enforce terms, prevent loss or investigate fraud

Finicity says it may disclose your Personal Information when it believes disclosure is necessary to protect individuals' vital interests, to enforce its applicable Terms of Use, to prevent Mastercard from harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity.

Supporting quotations

We may also disclose your Personal Information as follows:

When we believe disclosure is necessary to protect individuals’ vital interests, to enforce our applicable Terms of Use, prevent Mastercard against harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity

Qualifications & exceptions

• Depends on Finicity's own belief that disclosure is necessary.

Sharing & Disclosure · Company practice

Finicity may disclose Personal Information in connection with a merger, acquisition or asset sale

Finicity says it may disclose your Personal Information to service providers, advisors, potential transactional partners or other third parties in connection with the consideration, negotiation or completion of a corporate transaction in which it is acquired by or merged with another company, or sells, liquidates or transfers all or a portion of its assets.

Supporting quotations

We may also disclose your Personal Information as follows:

To service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets.

Security & Safeguards · Company practice

Google reCAPTCHA runs in the background and may collect IP address, browser details and keystroke behavior

To protect the Services from security-related abuse, Finicity has implemented Google reCAPTCHA, which operates in the background to check that each connection request comes from a real person. The tool may collect personal data such as your IP address, browser information, and user behavior like mouse movements and keystrokes to determine whether you are a bot. The information collected by reCAPTCHA is governed by Google's Privacy Policy and Terms of Service.

Supporting quotations

To protect our Services from security-related abuse without disrupting your experience, we have implemented Google reCAPTCHA, which operates in the background to ensure that every connection request comes from a real person.

This tool may collect personal data such as your IP address, browser information, and user behavior like mouse movements and keystrokes to determine if you are a bot.

The information collected by reCAPTCHA is governed by Google’s

Qualifications & exceptions

• Information collected by reCAPTCHA is governed by Google's Privacy Policy and Terms of Service.

Not stated here

• Google's Privacy Policy and Terms of Service are linked but their text was not supplied.

Security & Safeguards · Context

The notice quotes Google saying reCAPTCHA data is not used for other purposes such as personalized advertising

The notice quotes Google as saying that it processes information submitted through the service only as necessary to provide and maintain the service and to keep its security, threat detection, protection and response capabilities effective, and that the information will not be used for any other purpose, such as personalized advertising by Google. This is Google's statement as quoted by Finicity, not a separate commitment by Finicity.

Supporting quotations

Google processes information submitted via use of the [s]ervice only as necessary to provide and maintain the [s]ervice, and ensure that the [s]ervice’s security, threat detection, protection, and response capabilities remain effective against evolving threats. Such information will not be used for any other purpose, such as personalized advertising by Google.

Not stated here

• The Google service terms the quote comes from are linked but were not supplied, so the quote could not be checked against them.

Security & Safeguards · Company commitment

Finicity maintains safeguards designed to protect Personal Information

Finicity says it has implemented and maintains administrative, technical and physical security controls designed to safeguard your Personal Information, including physical, electronic and procedural safeguards consistent with industry-standard practices.

Supporting quotations

We have implemented and maintain administrative, technical, and physical security controls that are designed to safeguard your Personal Information, including physical, electronic, and procedural safeguards consistent with industry-standard practices.

Security & Safeguards · User right or choice

You are asked to protect your own information and report suspected insecurity immediately

Finicity says protecting your Personal Information is also your responsibility. It urges you to take every precaution on the internet and when communicating with it and other parties, for example changing passwords often, using a combination of letters and numbers, and using a secure browser. If you have reason to believe your interaction with Finicity or its partners is no longer secure, you are asked to tell Finicity immediately through the contact details in the notice.

Supporting quotations

Please recognize that protecting your Personal Information is also your responsibility. We urge you to take every precaution to protect your Personal Information when you are on the internet and when you communicate with us and with other parties through the internet. Change your passwords often, use a combination of letters and numbers, and make sure you use a secure browser.

If you have reason to believe that your interaction with us or our partners is no longer secure, please let us know immediately by contacting us as indicated in the Contact Us section below.

Legal Rights & Agreement Rules · Permission or license

By using the Services you agree Finicity may contact you electronically about security, privacy and administration

Finicity says that by using the Services you agree that it may communicate with you electronically regarding security, privacy and administrative issues relating to your use of the Services.

Supporting quotations

By using our Services, you agree that we may communicate with you electronically regarding security, privacy, and administrative issues relating to your use of our Services.

Security & Safeguards · Company practice

If Finicity learns of a breach involving your information, it may attempt to notify you by email or mobile number

Finicity says that if it learns of a security breach involving your Personal Information, it may attempt to notify you electronically using any email or mobile device number it has on file for you. It invites security questions by email to the address given in the notice.

Supporting quotations

If we learn of a security breach involving your Personal Information, we may attempt to notify you electronically via any email or mobile device number we may have on file for you.

If you have any questions about the security of your Personal Information, please email us at

Not stated here

• This section does not state a deadline for notification or any channel other than email or a mobile device number on file.

Retention & Deletion · Company practice

Finicity takes measures to delete or de-identify information it no longer needs, unless the law requires keeping it

Finicity says it takes measures to delete your Personal Information, or keep it in a form that does not permit identifying you, when the information is no longer necessary for the purposes for which it processes it, unless the law requires it to keep the information for a longer period. The notice states no fixed retention period.

Supporting quotations

We take measures to delete your Personal Information or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it, unless we are required by law to keep this information for a longer period.

Retention & Deletion · Context

Retention periods depend on factors such as product type, relationship length, re-enrolment and legal minimums

When Finicity determines how long to keep Personal Information, it says it takes into account the type of products and services requested by or provided to you, the nature and length of its relationship with you, possible re-enrolment with its products or services, the impact on the services it provides to you if it deletes some information, mandatory retention periods provided by law, and the statute of limitations.

Supporting quotations

When determining the retention period, we take into account various criteria, such as the type of products and services requested by or provided to you, the nature and length of our relationship with you, possible re-enrolment with our products or services, the impact on the services we provide to you if we delete some information from or about you, mandatory retention periods provided by law and the statute of limitations.

Not stated here

• The notice does not give specific retention periods for any category of information.

Data Access & Collection · User right or choice

You may decline to share some Personal Information, but some features may then be unavailable

You may decline to share certain Personal Information with Finicity, in which case it may not be able to provide you some of the features and functionalities of the Services. Where applicable law requires, Finicity says it will indicate whether and why you must provide Personal Information and the consequences of failing to do so.

Supporting quotations

You may decline to share certain Personal Information with us, in which case we may not be able to provide to you some of the features and functionalities of our Services. Where required by applicable law, we will indicate whether and why you must provide us with your Personal Information, as well as the consequences of failing to do so.

Qualifications & exceptions

• Finicity indicates whether and why you must provide information, and the consequences, only "where required by applicable law".

Account & Service Control · User right or choice

Depending on your country or state, you may have rights to access, correct, delete and opt out

Depending on your country or state, you may have the right to access, correct or delete Personal Information Finicity holds about you; to know more about the categories of Personal Information it collects, uses and discloses, its sources and the categories or a specific list of third parties it discloses to; to confirm whether it has processed your Personal Information; to opt out of, object to or restrict some uses (including targeted advertising, sale of personal information and profiling in furtherance of decisions that produce legal effects); and to withdraw any consent you gave.

Supporting quotations

Depending on your country or state, you may have the right to access, correct, or delete any Personal Information we hold about you; know more about the categories of Personal Information we collect, use, and disclose, as well as our sources of Personal Information and categories or a specific list of third parties with whom we disclose it; confirm whether we have processed your Personal Information; opt out of, object to, or restrict some uses of your Personal Information (including targeted advertising, sale of personal information, and profiling in furtherance of decisions that produce legal effects); and withdraw any consent provided.

Not stated here

• The notice does not say which countries or states give which of these rights.

Account & Service Control · User right or choice

Exercising privacy rights should not lead to denial or different prices, except where tied to data value

You also have the right not to receive discriminatory treatment for exercising your privacy rights, subject to certain limitations. Finicity says it will not deny, charge different prices for, or provide a different level of quality of goods or services because you exercise your rights, except where a different price or level of quality is reasonably related to the value of the data it receives from you.

Supporting quotations

You also have the right not to receive discriminatory treatment for the exercise of your privacy rights, subject to certain limitations. We will not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise your rights, except where the different price or level of quality of good or service is reasonably related to the value of the data that we receive from you.

Qualifications & exceptions

• The right is "subject to certain limitations" that the notice does not list.

Account & Service Control · Procedure

Submit privacy rights requests through the Data Privacy Consumer Rights Portal or by phone

To exercise rights under the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) or any other applicable privacy law granting such rights, you can submit a request through Finicity's Data Privacy Consumer Rights Portal or call the phone number given in the notice.

Supporting quotations

Submit Requests. To exercise your rights under the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) or any other applicable privacy law granting such rights, please submit your request via our Data Privacy Consumer Rights Portal or call (833) 246-9307.

Account & Service Control · Procedure

Access, deletion and correction requests require identity verification, including a signed affidavit

Requests for access, deletion or correction are subject to Finicity's ability to reasonably verify your identity in light of the information requested and applicable law. For requests through the portal, a two-step verification adds a layer of security. To help verify your identity and find relevant information, Finicity will request any usernames you previously shared with Finicity systems (if applicable), the corresponding bank names and the last 4 digits of corresponding account numbers. It will also request a signed affidavit (a suggested template is provided, signable physically or electronically) affirming your state of residence and that you are the consumer whose personal information is the subject of the request.

Supporting quotations

Verification. Requests for access, deletion, or correction of Personal Information are subject to our ability to reasonably verify your identity in light of the information requested pursuant to applicable law requirements, limitations, and regulations. We are committed to securing your personal information. When consumers exercise their rights through our Data Privacy Consumer Rights Portal, a two-step verification will enable their account to be guarded by an extra layer of security. To aid us in verifying your identity and identifying any relevant personal information on our systems, we will request any usernames that you previously shared with Finicity systems (if applicable), corresponding bank names, and last 4 digits of corresponding account numbers. We will also request a signed affidavit (we provide a suggested template which can be signed physically or electronically) affirming your state of residence, and that you are the consumer whose personal information is the subject of your request.

Qualifications & exceptions

• Subject to Finicity's ability to reasonably verify your identity in light of the information requested and applicable law.
• The request for previously shared usernames applies "if applicable".

Account & Service Control · User right or choice

If a rights request is denied, you can appeal by phone or through the portal

If your request is denied, you have the right to appeal the decision by calling Finicity or submitting a request through the Data Privacy Consumer Rights Portal as described in the "Submit Requests" subsection.

Supporting quotations

How to Appeal. If your request is denied, you have the right to appeal the decision by calling us at (833) 246-9307 or submitting a request through our Data Privacy Consumer Rights Portal as described above in the “Submit Requests” subsection.

Account & Service Control · Procedure

An authorized agent can make requests for you with the resident's signed written authorization

If you act as an authorized agent making a request to know, delete, correct or opt out on behalf of a consumer, you may submit it through the Data Privacy Consumer Rights Portal or by phone. Finicity says it will require you to attach a written authorization signed by the resident whose Personal Information is the subject of the request.

Supporting quotations

Authorizing an Agent. If you are acting as an authorized agent to make a request to know, delete, correct, or opt out on behalf of a consumer, you may submit a request via our Data Privacy Consumer Rights Portal or call (833) 246-9307. Please note that we will require you to attach a written authorization signed by the resident whose Personal Information will be subject to the request.

Qualifications & exceptions

• Covers requests to know, delete, correct or opt out.

Sharing & Disclosure · Company commitment

Finicity says it does not sell or "share" Personal Information for targeted advertising

Finicity states that it does not sell or "share" (disclose for targeted advertising purposes) your Personal Information.

Supporting quotations

Finicity does not sell or “share” (disclose for targeted advertising purposes) your Personal Information.

Not stated here

• The statement is about Personal Information; the notice does not say whether the same applies to the de-identified, anonymized or aggregated data it may use or disclose for any lawful purpose.

Use & Processing · Company commitment

Finicity repeats that it does not use sensitive data for purposes that would trigger a right to limit

In the rights section, Finicity states again that it does not use or disclose sensitive personal information for purposes that would require it to offer consumers the right to limit the collection and processing of that data under applicable law. Section 1 says some of the collected data may be considered "Sensitive Personal Information" under applicable state privacy laws.

Supporting quotations

Finicity does not use or disclose sensitive personal information for purposes which would require us to offer consumers the right to limit our collection and processing of this data under applicable law.

Some of the data above may be considered “Sensitive Personal Information” under applicable state privacy laws. We do not use or disclose sensitive personal information for purposes which would require us to offer consumers the right to limit our collection and processing of this data under those laws.

Qualifications & exceptions

• Measured against "applicable law", which the notice does not name.

Not stated here

• The notice does not say which of the listed data counts as sensitive or which uses would require a right to limit.

Data Access & Collection · Company practice

Finicity does not respond to browser Do Not Track signals at this time

Finicity says there is not yet a consensus on how companies should respond to web browser-based do-not-track mechanisms, and that it does not respond to browser-based DNT signals at this time.

Supporting quotations

Finicity does not respond to web browser-based DNT signals at this time.

Account & Service Control · Restriction or exception

You must be at least 18 and at least the age of majority where you live

You must be at least 18 years old to use the Services. Finicity does not knowingly direct the Services to people under 18 ("Minors"). If you use the Services, you represent that you are at least the age of majority under the laws of the jurisdiction where you live.

Supporting quotations

You must be at least 18 years old to use our Services. We do not knowingly direct our Services to individuals under 18 years old

If you use our Services, you represent that you are at least the age of majority under the laws of the jurisdiction of your place of residence.

Data Access & Collection · Company commitment

Finicity says it does not knowingly collect Minors' data and will promptly delete it if it learns of it

Finicity says it does not knowingly collect, use or disclose Personal Information about Minors who use the Services. If you believe a Minor has provided Personal Information, you can alert Finicity at the email address in the notice, and if Finicity learns it has collected Personal Information from a Minor, it says it will promptly take steps to delete it.

Supporting quotations

nor do we knowingly collect, use, or disclose Personal Information about Minors who use our Services

If we learn that we have collected Personal Information from a Minor, we will promptly take steps to delete such information.

Sharing & Disclosure · Company practice

Finicity says it has no actual knowledge of selling or sharing data of consumers under 16

Finicity states that it does not have actual knowledge that it sells or "shares" (discloses for targeted advertising purposes) Personal Information of consumers under 16 years of age.

Supporting quotations

Finicity does not have actual knowledge that we sell or “share” (disclose for targeted advertising purposes) Personal Information of consumers under 16 years of age.

Use & Processing · Context

The Services are hosted in the US; using them from elsewhere transfers your data to the United States

Finicity says the Services are hosted in the United States and directed to people inside the United States. If you use the Services from other regions of the world whose data collection and use laws may differ from United States law, you are transferring your Personal Information from those regions to the United States for storage and processing.

Supporting quotations

Our Services are hosted in the United States and are directed to people inside the United States. If you choose to use the Services from other regions of the world with laws governing data collection and use that may differ from United States law, then please note that you are transferring your Personal Information outside of those regions to the United States for storage and processing.

Use & Processing · Company practice

Finicity may transfer data from the US to other countries and says it complies with applicable legal requirements

Finicity says it may transfer your Personal Information from the United States to other countries or regions in connection with storage and processing of data, fulfilling your requests and operating the Services. It states that it complies with applicable legal requirements when transferring Personal Information to countries other than the country where you are located.

Supporting quotations

Also, we may transfer your Personal Information from the United States to other countries or regions in connection with storage and processing of data, fulfilling your requests, and operating the Services. We comply with applicable legal requirements when transferring Personal Information to countries other than the country where you are located.

Not stated here

• The notice does not name the countries or regions data may be transferred to, or the legal mechanisms it relies on.

Legal Rights & Agreement Rules · Permission or license

Finicity may revise this notice at any time in its sole discretion; changes take effect when posted

Finicity says it may revise the notice at any time and in its sole discretion to reflect how it collects, uses and processes Personal Information. Changes are effective when posted on the page, you are advised to review the notice periodically, and your continued use of the Services after a modification counts as your acknowledgment of the modified notice.

Supporting quotations

We may revise this Privacy Notice to reflect how we collect, use, and process Personal Information at any time and in our sole discretion.

You are advised to review this Privacy Notice periodically for any changes. Your continued use of our Services after such modifications will constitute your acknowledgment of the modified Privacy Notice. Changes to this Privacy Notice are effective when they are posted on this page.

Qualifications & exceptions

• Continued use of the Services after a modification counts as acknowledgment.

Legal Rights & Agreement Rules · Company commitment

For material changes to how existing data is treated, Finicity says it will attempt to notify you

If Finicity makes material changes to how it treats Personal Information it has already collected about you, it says it will attempt to notify you by any email or mobile device number it has for you, by a notice on its website, or by other means.

Supporting quotations

If we make any material changes to how we treat Personal Information we have already collected about you, we will attempt to notify you by any email or mobile device number we may have for you, by a notice on our website, or by other means.

Qualifications & exceptions

• Notice may go by email, mobile device number, website notice or other means, and is stated as an attempt.

Not stated here

• The notice does not state how far ahead of the change notice would be given.

Account & Service Control · Procedure

Privacy questions go to Finicity's Data Privacy Officer by email or to its mailing address

Questions about the notice, Finicity's information practices or other aspects of privacy in connection with the Services should be directed to its Data Privacy Officer, who can be reached at the email address in the notice. The Finicity mailing address given is Mastercard, attn: Open Finance Compliance, 1895 E Rodeo Walk Dr, Suite B200, Holladay, UT 84117.

Supporting quotations

Questions regarding this Privacy Notice, our information practices, or other aspects of privacy in connection with the use of our Services should be directed to our Data Privacy Officer, who can be reached by email at

Finicity Mailing Address: Mastercard attn: Open Finance Compliance 1895 E Rodeo Walk Dr Suite B200 Holladay, UT 84117