Affirm Privacy Policy

This document is Affirm's consumer privacy policy governing the collection, use, and sharing of personal information in connection with its buy-now-pay-later lending products and related financial services, operating under applicable U.S. consumer financial privacy law including the Gramm-Leach-Bliley Act (GLBA) and state privacy statutes such as the California Consumer Privacy Act (CCPA). The policy states that Affirm collects a broad range of data categories including identifiers, financial account information, transaction history, credit-related information, device and usage data, geolocation, and inferences drawn from these data points to build consumer profiles; the terms authorize sharing this information with affiliated companies, merchant partners, service providers, and third-party marketing partners, with opt-out rights available only for certain non-essential sharing categories. A notable operational feature is Affirm's stated collection of data from third-party sources including credit bureaus, data brokers, and merchant partners, combined with device-level tracking and behavioral inference, which creates a layered data profile that extends beyond transactional lending data; the policy also reserves the right to use consumer data for marketing and targeted advertising, though CCPA and related state laws may constrain some of these uses for California residents and similar frameworks may apply in other jurisdictions. The policy engages GLBA financial privacy requirements, CCPA and its amendments under CPRA, the Fair Credit Reporting Act (FCRA) with respect to credit-related data use, and FTC Act unfair or deceptive practices standards; CFPB oversight is directly relevant given Affirm's status as a nonbank financial services provider subject to supervisory authority. Material compliance considerations include the breadth of third-party data sharing for marketing purposes, the adequacy of opt-out mechanisms relative to CCPA requirements, and whether data retention and deletion practices align with GLBA and CCPA obligations.