Public.com Privacy Policy

This document is Public.com's privacy policy, governing the collection, use, and sharing of personal information across its investment platform, which offers equities, crypto, options, bonds, IRAs, and related financial services, operating under general U.S. consumer privacy law and financial services regulatory frameworks. The policy states that Public collects identifiable information including name, Social Security number, government ID, financial account details, trading activity, device identifiers, location data, and communications content; the terms authorize use of this data for account management, marketing, analytics, and sharing with third-party service providers, affiliates, and financial industry partners. A notable provision permits sharing of personal information with third parties for marketing purposes, though the policy states users may opt out; the policy also reserves broad rights to use aggregated and de-identified data without restriction, and the scope of 'service providers' is not narrowly defined, which is common in this industry but worth reviewing given the sensitivity of financial data involved. The policy engages with the California Consumer Privacy Act (CCPA) and its amendment under CPRA, granting California residents specific rights including access, deletion, and opt-out of data sale or sharing; it also references Regulation S-P, which governs the privacy of customer financial information for SEC-registered broker-dealers, and the Gramm-Leach-Bliley Act (GLBA), which imposes notice and safeguarding obligations on financial institutions. Compliance teams should note that Public operates as or through registered broker-dealer and investment adviser entities subject to SEC and FINRA oversight, meaning data handling obligations under Regulation S-P may layer on top of general privacy policy assertions in ways that create distinct obligations beyond what the policy text alone conveys.