This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
“We may use anonymized or aggregate customer data for any business purpose, including to better understand Customer needs and behaviors, improve our products and services, conduct business intelligence and marketing, and detect security threats.”
“To develop one or more automated models, algorithms, or similarly designed technologies that conduct profiling based on your Personal Information, characteristics, and preferences, in order to send you promotional messages, marketing, advertising...”
“Biometric information: distinguishing physical or behavioral biological human characteristics used to identify a person, including, but not limited to, fingerprints, hand or facial geometry or patterns, voice characteristics, typing cadence...”
“The CPRA does not apply to non-public personal information collected by financial institutions governed by certain federal regulations. As a result, the CPRA does not apply to most of the personal information that Stash collects from you as a customer.”
“Your name, alias, date of birth, citizenship and passport number, visa information, home address, telephone number, email address, Social Security number, bank account number, bank routing number, bank account login credentials...”
“We will also collect your nonpublic personal information, which means (i) any information you provide to us to obtain a financial product or service from us, (ii) any information about you resulting from any transaction...”
Stash collects a wide range of sensitive personal data — including biometric identifiers, Social Security numbers, bank credentials, and transaction records — and uses it to build automated profiles that drive marketing and advertising. Stash will never sell your Personal Information, and it must get your opt-in consent before sharing it with outside parties for marketing. However, Stash states that California privacy law does not cover most of the data it holds because of a federal financial-institution exemption, and your data is kept indefinitely after you stop being a customer unless the law says otherwise.
This document establishes how Stash collects, uses, retains, and shares personal information in connection with its financial services platform. Stash collects high-sensitivity data including biometric identifiers, government-issued identifiers, financial account credentials, and nonpublic personal information arising from financial transactions. Stash uses this information for automated profiling to deliver targeted marketing, and may share it with approved third-party advertising partners; it commits absolutely to never selling Personal Information and requires opt-in consent before sharing with non-affiliated third parties for marketing. Data is retained indefinitely after the customer relationship ends unless law requires or permits destruction, and Stash asserts that the CPRA does not apply to most of the personal information it collects due to a federal financial institution exemption.
As a Stash user, your most sensitive personal data — including biometric identifiers, government IDs, bank account credentials, and transaction history — is collected and used to build automated profiles that determine the promotional and marketing content you receive. Stash will share your information with third-party advertising partners it has approved, but it cannot share your Personal Information with non-affiliated third parties for marketing without first obtaining your opt-in consent. Stash states that the CPRA does not apply to most of its data collection, meaning California privacy rights such as deletion or opt-out of sale are not available for the majority of your information held by Stash. After your customer relationship ends, your data is kept indefinitely unless law requires otherwise. Stash will notify you by email or on its platform before any material policy changes take effect, giving you an opportunity to review changes before they become effective.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
“We may use anonymized or aggregate customer data for any business purpose, including to better understand Customer needs and behaviors, improve our products and services, conduct business intelligence and marketing, and detect security threats.”
“To develop one or more automated models, algorithms, or similarly designed technologies that conduct profiling based on your Personal Information, characteristics, and preferences, in order to send you promotional messages, marketing, advertising...”
“Biometric information: distinguishing physical or behavioral biological human characteristics used to identify a person, including, but not limited to, fingerprints, hand or facial geometry or patterns, voice characteristics, typing cadence...”
“Your name, alias, date of birth, citizenship and passport number, visa information, home address, telephone number, email address, Social Security number, bank account number, bank routing number, bank account login credentials...”
“We will also collect your nonpublic personal information, which means (i) any information you provide to us to obtain a financial product or service from us, (ii) any information about you resulting from any transaction...”
“The CPRA does not apply to non-public personal information collected by financial institutions governed by certain federal regulations. As a result, the CPRA does not apply to most of the personal information that Stash collects from you as a customer.”
“If your customer relationship with Stash ends, we will not destroy your Information unless required or permitted by law. We will continue to treat your Personal Information in accordance with this Privacy Policy and applicable laws.”
“If we make any material changes, we will notify you by email (sent to the email address specified in your account), by means of a notice on the Stash Platform prior to the change becoming effective, or as otherwise required …”
“Stash will not share your Personal Information with non-affiliated third parties that may use your Personal Information to market to you without first obtaining your opt-in consent.”
“Under no circumstances will we ever sell your Personal Information to third parties.”
“We may share information about you with third parties that Stash has selected and approved for external ad distribution and ad optimization (including tailoring, behavioral or contextual targeting or retargeting, analyzing, managing, reporting, and optimizing of ads).”
“By using our Services, you grant us and Plaid the right, power, and authority to act on your behalf to access and transmit your personal and financial information from the relevant financial institution.”
Every distinct legal provision identified in this document. Featured provisions appear above with analysis.
Cross-platform context
See how other platforms handle Anonymized Data Used for Any Business Purpose and similar clauses.
Compare across platforms →