This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
9Total
2High severity
6Medium severity
1Low severity
Summary
This is Brex's Privacy Policy, describing how the company collects and uses personal and financial data from customers of its corporate card, business account, payment, and expense management products. The policy authorizes collection of financial account details, transaction data, device identifiers, browsing activity, geolocation data, and third-party sourced information, and permits sharing this data with advertising, analytics, financial, and service provider partners. California residents, EU users, and UK users are granted specific rights including the ability to opt out of data sale or sharing for targeted advertising, request deletion, and access their personal information.
Technical / Legal Breakdown
This document is Brex's Privacy Policy, governing how Brex collects, uses, shares, and retains personal information in connection with its financial services platform, including corporate cards, business accounts, treasury, payments, and travel products. The policy states that Brex collects identifiers, financial account data, transaction history, device and usage information, location data, and information from third-party sources including financial institutions and data providers; the terms authorize sharing this data with service providers, financial partners, analytics vendors, advertising partners, and government or regulatory bodies. The policy includes provisions authorizing use of personal data for marketing and targeted advertising purposes, with opt-out rights described for certain uses, and discloses sharing with third parties in ways that may constitute a 'sale' or 'sharing' of personal information under California law, engaging the CCPA and CPRA frameworks. The policy engages CCPA/CPRA for California residents, GDPR and UK GDPR for EU and UK users, and financial privacy frameworks including the Gramm-Leach-Bliley Act given Brex's financial services context; compliance exposure is heightened for business account holders whose employees' personal data may also be processed under the policy. Material considerations include the scope of data shared with advertising and analytics partners, the applicability of financial privacy notices alongside this general privacy policy, and the adequacy of consent mechanisms for cross-border data transfers.
Institutional Analysis
Institutional analysis available with Compliance
Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.
What changed
Brex removed two items from its Privacy Policy table of contents: 'Prohibited and Restricted Activities' and the Rewards section header. These sections are no longer listed in the document's navigation structure as of May 16, 2026. The operational impact depends on whether these sections were deleted from the policy itself or merely removed from the table of contents; the change summary does not clarify whether the underlying content remains in the policy body.
Why this matters
The revised table of contents no longer lists 'Prohibited and Restricted Activities' and 'Rewards' sections. The practical impact is unclear because the change summary does not confirm whether these sections were removed from the policy body itself or simply delisted from the navigation structure. If the sections remain in the policy but are not indexed, users may have difficulty locating that information. If the sections were deleted entirely, the terms governing those topics would no longer apply.
The policy authorizes Brex to share personal information with advertising and analytics vendors for targeted advertising and campaign measurement, and discloses that this sharing may qualify as a sale or sharing under CCPA/CPRA, triggering opt-out rights for California residents.
Added May 21, 2026StandardSeen across 284 platforms
The policy discloses collection of bank account numbers, payment card data, transaction history, and credit information in connection with Brex's financial services products, engaging financial privacy obligations under GLBA in addition to general privacy frameworks.
Added May 21, 2026StandardSeen across 284 platforms
The policy states that Brex collects identifiers, financial account and transaction data, device and usage information, location data, and information obtained from third-party sources including financial institutions and data providers.
Added May 21, 2026StandardSeen across 284 platforms
The policy discloses that California residents hold CCPA/CPRA rights to access, delete, correct, and opt out of sale or sharing of personal information, and states that Brex will not discriminate against users who exercise these rights.
Added May 21, 2026StandardSeen across 284 platforms
The policy grants EU and UK users data subject rights under GDPR and UK GDPR, including access, rectification, erasure, restriction, portability, objection, and consent withdrawal, with a designated contact for exercising these rights.
Added May 21, 2026StandardSeen across 284 platforms
The policy authorizes sharing personal information with service providers performing functions including payment processing, data analysis, email delivery, hosting, customer service, and marketing, subject to a contractual limitation that restricts these providers to use the data only for the stated service purposes.
Added May 21, 2026StandardSeen across 284 platforms
The policy discloses that personal data may be transferred to and processed in countries outside the user's country of residence, and states that Standard Contractual Clauses are used as the transfer mechanism for international data flows.
Added May 21, 2026StandardSeen across 284 platforms
The policy discloses use of cookies, web beacons, pixel tags, and other tracking technologies to collect browsing activity, device information, and interaction data, with browser settings and a cookie preference center identified as controls.
Added May 10, 2026StandardSeen across 284 platforms
The policy states that personal data is retained for as long as needed to fulfill collection purposes and meet legal and regulatory obligations, after which it will be deleted or anonymized.
Added May 8, 2026StandardSeen across 284 platforms
Monitoring
Brex has updated this document before.
Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.