Mercury Privacy Policy

This document is Mercury's Privacy Policy governing the collection, use, sharing, and retention of personal information for users of Mercury's business banking platform, operating under applicable U.S. federal and state privacy law frameworks. The policy states that Mercury collects a broad range of personal and financial data including identity information, transaction data, device and usage data, and inferred characteristics, and the terms authorize sharing this information with affiliated entities, service providers, financial partners, and in some cases third parties for marketing and analytics purposes. Notably, the policy asserts the right to collect and use inferred data and behavioral signals for product improvement and marketing, and reserves broad discretion to share data with 'business partners' beyond core service delivery, though applicable law including CCPA and Gramm-Leach-Bliley Act provisions may constrain how some of these rights apply in practice. California residents are granted specific opt-out and deletion rights under CCPA, and the policy acknowledges GLBA applicability given Mercury's financial services context, which creates a layered regulatory compliance obligation spanning FTC enforcement, CFPB oversight, and state-level consumer protection regimes. Material compliance considerations include ensuring that consent mechanisms, data retention schedules, and third-party data sharing arrangements are consistent with GLBA financial privacy requirements and CCPA's expanded rights framework, particularly given Mercury's role as a banking-adjacent platform serving business customers.