Stash Privacy Policy

Stash collects a wide range of sensitive personal data — including biometric identifiers, Social Security numbers, bank credentials, and transaction records — and uses it to build automated profiles that drive marketing and advertising. Stash will never sell your Personal Information, and it must get your opt-in consent before sharing it with outside parties for marketing. However, Stash states that California privacy law does not cover most of the data it holds because of a federal financial-institution exemption, and your data is kept indefinitely after you stop being a customer unless the law says otherwise.

This document establishes how Stash collects, uses, retains, and shares personal information in connection with its financial services platform. Stash collects high-sensitivity data including biometric identifiers, government-issued identifiers, financial account credentials, and nonpublic personal information arising from financial transactions. Stash uses this information for automated profiling to deliver targeted marketing, and may share it with approved third-party advertising partners; it commits absolutely to never selling Personal Information and requires opt-in consent before sharing with non-affiliated third parties for marketing. Data is retained indefinitely after the customer relationship ends unless law requires or permits destruction, and Stash asserts that the CPRA does not apply to most of the personal information it collects due to a federal financial institution exemption.

As a Stash user, your most sensitive personal data — including biometric identifiers, government IDs, bank account credentials, and transaction history — is collected and used to build automated profiles that determine the promotional and marketing content you receive. Stash will share your information with third-party advertising partners it has approved, but it cannot share your Personal Information with non-affiliated third parties for marketing without first obtaining your opt-in consent. Stash states that the CPRA does not apply to most of its data collection, meaning California privacy rights such as deletion or opt-out of sale are not available for the majority of your information held by Stash. After your customer relationship ends, your data is kept indefinitely unless law requires otherwise. Stash will notify you by email or on its platform before any material policy changes take effect, giving you an opportunity to review changes before they become effective.