Revolut Privacy Policy

This privacy policy establishes Revolut's data collection, use, and disclosure practices for US customers across its banking, brokerage, and investment services. The policy authorizes collection of identity data, financial transaction records, location information, device identifiers, and biometric data, with provisions for sharing this information with affiliates, service providers, credit reference agencies, fraud prevention agencies, and government or law enforcement bodies as permitted by applicable law. The policy describes specific rights for California residents, including the ability to request access to, correction of, or deletion of personal data by contacting dpo@revolut.com or through the app.

This document is Revolut's Customer Privacy Policy (effective December 18, 2025), governing the collection, use, and sharing of personal data by Revolut Technologies Inc., Revolut Securities Inc., and Revolut Wealth Inc. for US-based customers accessing financial, brokerage, and investment advisory services. The policy states Revolut will 'never sell your personal data' and permits sharing with a broad range of third parties including affiliates, service providers, fraud prevention agencies, credit reference agencies, financial institutions, and government or law enforcement bodies under specified circumstances. The policy authorizes collection of an extensive range of data types including identity, financial, transactional, biometric, location, device, behavioral, and social media data, and permits use of automated decision-making including credit scoring and fraud detection, which is operationally significant given the financial services context. The policy engages the Gramm-Leach-Bliley Act (GLBA) and its implementing Regulation P for financial privacy obligations, the California Consumer Privacy Act (CCPA) for California residents, and federal financial services regulations applicable to the broker-dealer and investment advisory entities; the involvement of Revolut Securities Inc. and Revolut Wealth Inc. also engages SEC oversight frameworks. The scope of biometric and behavioral data collection, combined with automated decision-making in credit and fraud contexts, may warrant evaluation under state biometric privacy laws and FTC consumer protection standards, with the breadth of third-party sharing categories requiring careful data mapping to confirm alignment with applicable notice and consent requirements.

Revolut's data collection and sharing practices establish that personal information—including transaction history, location, device activity, and biometric data—may be disclosed to third parties for operational, compliance, and law enforcement purposes. The policy authorizes automated decision-making processes, including credit scoring and fraud detection, which may determine access to products or services. Customers have the ability to submit requests for data access, correction, or deletion through designated channels, and California residents have additional statutory rights under applicable state law.