Square Privacy Notice

This is Square's privacy policy explaining how the company collects and uses your personal data when you use Square's payment terminals, online checkout, Cash App ecosystem, and other financial tools — including your name, payment card details, government ID, transaction history, and device location. The most important thing to know is that Square may collect your financial transaction data even if you are a buyer at a merchant's store — not just a Square account holder — meaning you may be in Square's database without ever signing up. You can request access to, correction of, or deletion of your personal data by submitting a request through Square's privacy rights portal at https://squareup.com/us/en/privacy/request.

This document is Square's Privacy Policy governing the collection, use, and sharing of personal data across Square's suite of payment processing, point-of-sale, financial services, and commerce products, operating under a consent and legitimate interests legal basis framework consistent with CCPA, GDPR, and U.S. state privacy laws. The policy obligates Square to disclose categories of data collected (including financial transaction data, government-issued ID, biometric identifiers for identity verification, device and location data, and inferred consumer profiles) and grants users rights to access, delete, correct, and opt out of certain data sales or sharing. Notably, Square collects transaction-level data from both sellers (merchants) and buyers (consumers who transact with Square-powered businesses), meaning consumer data is collected even from individuals who have never directly contracted with Square — a materially broader collection scope than many industry peers. The policy engages CCPA/CPRA (Cal. Civ. Code §1798.100 et seq.), GDPR (Arts. 6, 9, 13, 17), GLBA (15 U.S.C. §6801), FinCEN BSA/AML requirements, and state money transmission regulations, with the CFPB, FTC, and California Privacy Protection Agency as primary enforcement authorities. Compliance teams should note that Square's dual-sided data collection model (merchant and buyer data) and its use of transaction data for product development and cross-product profiling require careful data mapping and potentially dual consent frameworks under CPRA and GDPR.