Governance document

CA-D-000363

Square Privacy Notice

Square

Last change detected August 18, 2026 Privacy policy

SHA-256: 2b6f9475e65b462a5b1… 16 versions captured 15 changes documented

Get the research letter

Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.

View original document at Square ↗

This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology

110 Total

41 High severity

64 Medium severity

5 Low severity

Key Facts

What may Square use artificial intelligence technologies to generate?

Square may use a user's Commercial Information and other personal information the user inputs or requests Square to analyse in connection with artificial intelligence technologies to generate personalized features for that user's business.

May Square use a user's Commercial Information with artificial intelligence technologies?

How long does Square store user information?

Square stores user information for as long as is necessary for the purposes identified in its Privacy Notice, including to provide Services, comply with legal obligations, enforce and prevent violations of its Terms of Service, and protect against fraudulent activity.

For what purposes does Square store user information?

What identity information does Square collect?

Square collects identity information including photo identification such as passports or driver's licenses in combination with a facial scan photograph and biometrics extracted from such images or other documents proving identity or place of residence.

Does Square collect photo identification in combination with a facial scan photograph?

With whom does Square share users' Identification Information?

Square shares users' Identification Information with identity verification vendors, including credit reporting agencies, wireless carriers, and others, to verify information Square collects.

Why does Square share users' Identification Information with identity verification vendors?

Square shares users' Identification Information with identity verification vendors, including credit reporting agencies, wireless carriers, and others, to verify information Square collects.

What does Square use to help ensure a high standard of protection when it transfers personal data to affiliates and/or service providers outside the EU?

When Square transfers personal data to affiliates and/or service providers outside the EU, it uses standard contractual clauses approved by the European Commission to help ensure a high standard of protection for that information.

Has Square sold or shared Usage Data over the last 12 months?

Square has sold or shared Usage Data over the last 12 months for the purpose of interest-based advertising (targeted advertising).

Stay ahead of the changes

Track Square and get the diff the day its terms change.

Monitor Square + up to 20 platforms — $4.99/mo →

Summary

Square's Privacy Notice explains what personal information Square collects about you—including biometrics, location, and business data—how Square uses and shares it, and how long Square keeps it. Square has shared your usage data for targeted advertising, but you can opt out using the 'Your Privacy Choices' link on Square's website or by enabling the Global Privacy Control in your browser. If you are a seller using Square, you are responsible for making sure your customers have given any necessary permission for Square to use their data.

Analysis

The Square Privacy Notice establishes how Square collects, uses, retains, and shares personal information across three collection channels: direct submission, passive collection during Service use, and acquisition from third-party sources. The notice covers sensitive data categories including biometrics extracted from facial scans and photo identification, precise geolocation, and commercial information, and discloses that Square has sold or shared Usage Data for interest-based advertising over the preceding 12 months. Square retains information for as long as necessary for the purposes identified in the notice, including after account closure for legal compliance, Terms enforcement, and fraud protection, without a fixed outer limit. Users may opt out of targeted advertising via the 'Your Privacy Choices' footer link or by enabling the Global Privacy Control, and sellers bear responsibility for obtaining any necessary customer permissions for Square's use of their customers' data.

What this means for you

Square collects sensitive information including biometric data extracted from facial scans and photo IDs, precise geolocation data, and commercial information, and may feed that information into AI technologies to generate personalized features. Square has already sold or shared your Usage Data for targeted advertising. You can stop targeted advertising by clicking the 'Your Privacy Choices' link in the footer of any page on Square's browser site, or by enabling the Global Privacy Control or a similar opt-out setting in your browser. Your information may be retained after you close your account for purposes including legal compliance, enforcement, and fraud protection, for an indeterminate period. Square takes reasonable security measures but does not guarantee a fully secure environment.

Institutional Analysis

Stay ahead of the changes

Institutional analysis available with Insight

Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.

Monitor Square + up to 20 platforms — $4.99/mo → Get the research letter, free

15 important changes detected

16 versions captured · Last updated: August 2026

August 18, 2026

low

What changed Square reorganized the list of linked documents and policies in its Privacy Notice in an update detected on August 18, 2026. The change reordered 13 document references without modifying their content or availability. This is a structural clarification with no operational impact on user rights, data practices, or privacy terms.

Why this matters This change reorganizes the order of linked documents and policies in Square's Privacy Notice. No privacy practices, data collection methods, rights, or protections were modified. The updated terms reference the same documents in a different sequence.

View full change record →

August 15, 2026

low

What changed Square's Privacy Notice was updated on August 15, 2026 to add a reference to the 'Square Multi-Account Suite Terms of Service' in its list of related governing documents. The previous version listed 'Square Savings Deposit Account Terms' immediately before 'Square Intellectual Property Policy'; the updated version inserts the new Multi-Account Suite document between them. This change does not alter Square's privacy practices themselves but expands the set of terms documents that may govern user obligations depending on which Square products a user employs.

Why this matters The updated Privacy Notice now formally references the 'Square Multi-Account Suite Terms of Service' as a governing document alongside other Square product-specific terms. This change does not materially alter data handling practices or consumer rights; it clarifies which product-specific terms may apply to users of Square's multi-account functionality. No action is required by consumers.

View full change record →

August 11, 2026 low

Square reordered the list of linked documents and policies in the Australian section of its Privacy Notice. The BEFORE version listed 'Square Payment Terms' before 'Government Licenses', while the AFTER …

View change record →

August 7, 2026 low

Square updated its Privacy Notice to add detailed disclosure about Trust Center data collection and use. The company now explicitly discloses that when visitors submit an NDA form to access …

View change record →

July 25, 2026 low

Square reorganized the footer section of its Privacy Notice by reordering the listed legal documents and policies. The BEFORE version listed policies in one sequence; the AFTER version reordered them …

View change record →

July 18, 2026 low

Square reordered a list of linked documents and service agreements in the footer section of their Privacy Notice, detected on July 18, 2026. The Afterpay Merchant Terms of Service and …

View change record →

July 17, 2026 low

Square's Privacy Notice underwent a detected change on July 17, 2026 that reorganized the order of linked documents and related terms within the policy. Specifically, the sequence of policy links …

View change record →

July 11, 2026 low

Square reorganized the footer section of their Square Privacy Notice on July 11, 2026 by reordering a list of linked documents and terms. The document previously listed 'Licenses' immediately after …

View change record →

June 9, 2026 low

Square reorganized the reference list of related legal documents in their Privacy Notice on June 9, 2026. The document previously listed 'Square Payment Terms' before 'Licenses', and also grouped several …

View change record →

June 2, 2026 low

Square reorganized the list of linked legal documents in their Australian privacy notice on June 2, 2026. The document previously listed terms in one order; the updated version reorders the …

View change record →

May 30, 2026 low

Square updated its Privacy Notice on May 30, 2026, substantially expanding the document with 217 new sentences and modifying 2 existing sentences. The updated notice now includes effective dates (Last …

View change record →

May 5, 2026 low

Square reorganized the list of links to its various legal documents and service terms in the footer of its Privacy Notice. The order and grouping of these links changed, but …

View change record →

April 19, 2026 low

Square removed a reference to the Square Payment Terms from its list of related policy documents in its privacy notice on April 19, 2026. This appears to be an organizational …

View change record →

March 29, 2026 low

Square removed two linked documents from its Privacy Notice reference list on March 29, 2026: Square Payment Terms and Square AI Terms of Service. These documents are no longer listed …

View change record →

March 19, 2026 low

Square reordered a list of linked policy documents in their Australian privacy notice footer. The 'Government Licenses' link moved from appearing after 'Square Payment Terms' to appearing before 'Square Additional …

View change record →

Featured, High severity

Commercial data used for AI-powered personalized features Compare →

Personal and commercial data may be processed by AI systems, meaning sensitive business information can be fed into automated technologies beyond standard data handling.

Added July 10, 2026 Standard Seen across 217 platforms
Data retained for duration of account and beyond Compare →

Retention is not limited to the duration of an active account; data may be kept after account closure for legal, enforcement, and fraud-related purposes, potentially for an extended and indeterminate period.

Added July 10, 2026 Standard Seen across 275 platforms
Identity information collection including biometrics Compare →

Square collects biometric data extracted from facial scans, which is among the most sensitive categories of personal information and is subject to heightened legal protections in many jurisdictions.

Added July 10, 2026 Standard Seen across 296 platforms
Identity verification shared with third-party vendors Compare →

Sensitive identity information, potentially including biometrics, is disclosed to third parties such as credit reporting agencies and wireless carriers, expanding the circle of entities that hold this data.

Added July 10, 2026 Standard Seen across 288 platforms
International data transfers using standard contractual clauses Compare →

The use of standard contractual clauses is the named legal mechanism Square relies on for cross-border data transfers, and the protection afforded is qualified as something Square works to help ensure, not an absolute guarantee.

Added July 10, 2026 Standard Seen across 288 platforms
Personal information sold or shared for targeted advertising Compare →

Square has already sold or shared Usage Data for targeted advertising, meaning this is a disclosed past practice rather than a merely potential future use.

Added July 10, 2026 Standard Seen across 288 platforms
Precise geolocation data collected from devices Compare →

Precise geolocation data is a sensitive category of information that can reveal detailed patterns of movement and location; its collection, even if conditional, carries significant privacy implications.

Added July 10, 2026 Standard Seen across 296 platforms
Right to opt out of targeted advertising Compare →

Square provides specific, named mechanisms for exercising the opt-out right, making the right actionable through both a site-based link and a browser-level signal.

Added July 10, 2026 Standard Seen across 290 platforms
Security measures taken but not guaranteed absolute Compare →

Square's security commitment is limited to reasonable measures; the explicit acknowledgment that the internet is not 100% secure signals that Square does not accept liability for security failures beyond what reasonable measures could prevent.

Added July 10, 2026 Standard Seen across 287 platforms
Seller responsibility to obtain customer permission Compare →

Square places the legal burden of obtaining customer consent or permission directly on the seller, not on Square itself, which means sellers bear compliance risk if customer permissions are inadequate.

Added July 10, 2026 Unique
Square collects information you provide directly Compare →

Square's data collection is not limited to what users actively submit; it also includes passive collection during Service use and acquisition from third-party sources, broadening the scope of information Square may hold.

Added July 10, 2026 Standard Seen across 296 platforms
Square reserves right to change privacy notice Compare →

The notice obligation is triggered only by material changes in how Square uses information; non-material changes may occur without prior notice, and the notice method (email) is contingent on the user having provided an email address.

Added July 10, 2026 Standard Seen across 289 platforms