Provisions index

The policy states that Postman is certified under the EU-U.S. DPF, UK DPF Extension, and Swiss-U.S. DPF, that unresolved DPF complaints are referred to JAMS for resolution at no cost to the complainant, and that in certain circumstances DPF complaints may ultimately proceed to binding arbitration under DPF Annex I....

Why it matters: This provision establishes the dispute resolution pathway for EU, UK, and Swiss individuals whose personal data is transferred to Postman in reliance on DPF certification, including a final binding arbitration mechanism under DPF Annex I. Postman's DPF certification is subject to FTC enforcement, and the DPF framework requires specific complaint handling timelines including a 45-day response window before JAMS escalation is available....

View provision → Watch Postman →

The policy states that personal data may be transferred to and processed in ten listed countries including the United States, Australia, Brazil, Canada, the EEA (Germany for EU instance), India, Nigeria, the Philippines, Ukraine, and the United Kingdom, by employees and independent contractors performing day-to-day responsibilities....

Why it matters: The policy explicitly lists ten countries where personal data may be accessed and processed, including jurisdictions such as Nigeria, Ukraine, and the Philippines that the policy acknowledges may not have equivalent data protection frameworks to users' home countries. Standard Contractual Clauses or DPF mechanisms are cited as the transfer safeguards for EEA, UK, and Swiss data....

View provision → Watch Postman →

Upon subscribing to or purchasing from a creator, Patreon shares the fan's full name, email address, profile information, shipping address, phone number, Discord account identifier, purchase details, and aggregated usage analytics directly with that creator....

Why it matters: This provision establishes a direct data transfer from Patreon to individual creators covering multiple personal data categories, subject to the Creator Privacy Promise and Data Processing Agreement but not to uniform third-party service controls, creating a data flow that compliance teams should evaluate against GDPR Article 28 and CCPA disclosure requirements....

View provision → Watch Patreon →

Creators may share fan personal data with third-party services they select to operate their memberships, with Patreon's app directory listing many but not all such services; the handling of fan data by those third parties is governed by their own privacy policies rather than Patreon's....

Why it matters: This provision establishes that fan personal data received by creators may flow to an open-ended set of third-party services not all of which are enumerated by Patreon, with data handling governed by those third parties' own policies rather than the terms of this privacy policy....

View provision → Watch Patreon →

The policy states that Patreon uses collected information to make inferences about users including demographic attributes such as age and binary gender, and to estimate potential earnings for creator accounts....

Why it matters: This provision discloses that Patreon engages in automated profiling to derive demographic characteristics and financial estimates about users, which may engage GDPR profiling provisions, CCPA inference data disclosure requirements, and FTC guidance on data-driven consumer profiling....

View provision → Watch Patreon →

Patreon reserves the right to modify the privacy policy at any time at its sole discretion, with material changes notified by email or phone to existing users and a 60-day effective date window for existing accounts, after which continued use constitutes acceptance....

Why it matters: This provision establishes that existing users have a 60-day window before updated policy terms take effect, but characterizes continued use of the platform as acceptance, and Patreon determines unilaterally whether a change is material enough to require notice....

View provision → Watch Patreon →

Patreon may share creator age verification data and, where collected, consent and age verification data for persons depicted in Adult/18+ content with payment partners upon their request, to demonstrate compliance with payment partner rules....

Why it matters: This provision establishes a conditional data sharing mechanism in which sensitive identity verification data about creators and persons depicted in Adult/18+ content may be disclosed to payment partners, with disclosure triggered by payment partner requests rather than solely by Patreon's own operational requirements....

View provision → Watch Patreon →

Patreon automatically collects IP address, approximate location, browser and device type, operating system, screen size, language settings, referring URL, mobile carrier, device and application IDs, search terms including unsubmitted queries, clicked links, pages visited, session length, dwell time, media view duration, and cookie information, including from users who have not created an account....

Why it matters: This provision establishes that behavioral and technical data collection occurs across all platform interaction surfaces including Patreon embeds on third-party websites and email interactions, and applies to non-account holders, which is relevant for privacy notice obligations and cookie consent frameworks....

View provision → Watch Patreon →

The policy requires users to authorize Webull to transfer, store, process, and use their personal information in any country where Webull operates, with an acknowledgment that data protection standards and government access rules vary by country....

Why it matters: This provision establishes a consent-based cross-border data transfer mechanism applicable to all users globally. The provision's reliance on user consent as the transfer authorization basis may require evaluation under GDPR, which does not recognize consent alone as a sufficient mechanism for ongoing international data transfers absent the safeguards described in GDPR Article 46....

View provision → Watch Webull →

The policy authorizes Webull to make material changes to its privacy terms by posting updates on its website or app, without sending a direct notification to users, and treats continued use of the service as acceptance of the revised terms....

Why it matters: This provision establishes that users are bound by revised policy terms upon continued use, even without receiving direct notification. Compliance teams should evaluate whether this mechanism satisfies notice requirements under GDPR, UK GDPR, and CCPA where material changes to data processing practices may require active user notification or renewed consent....

View provision → Watch Webull →

The policy states that Webull does not respond to Do Not Track browser signals and authorizes third-party analytics providers to collect personal information about users' online activities over time and across different applications and websites....

Why it matters: This provision discloses that third parties may collect cross-site and cross-app behavioral data from Webull users, which may interact with CCPA and CPRA definitions of 'sharing' personal information for cross-context behavioral advertising purposes. Compliance teams should assess whether this third-party data collection constitutes a sale or sharing of personal information under applicable California law....

View provision → Watch Webull →

The policy states that Webull does not sell personal information to third parties but discloses that it permits third parties to collect information through its services for advertising and marketing delivery purposes on other platforms....

Why it matters: This provision asserts that Webull does not engage in the 'sale' of personal information under CCPA while simultaneously disclosing that third parties collect user data through Webull's services for advertising purposes. Compliance teams should evaluate whether this third-party collection arrangement meets the CPRA definition of 'sharing' personal information for cross-context behavioral advertising, which carries its own opt-out obligations distinct from the sale opt-out....

View provision → Watch Webull →

The policy authorizes Webull to share full payment card details, including card number, expiration date, CVV code, and billing address, with third-party payment services providers for payment processing, fraud investigation, and dispute resolution purposes....

Why it matters: This provision discloses the transmission of full payment card data, including CVV codes, to third-party payment processors. Compliance teams should note that the sharing of CVV codes with processors is subject to Payment Card Industry Data Security Standard (PCI DSS) restrictions, and the policy's disclosure of this practice warrants review to confirm that such sharing is limited to contexts permitted under PCI DSS and applicable card network rules....

View provision → Watch Webull →

The policy discloses that users applying to open a trading account with a Webull affiliate may be required to provide detailed identity information, including government ID numbers, nationality, marital status, date of birth, and copies of identification documents and proof of address, for anti-money laundering compliance purposes....

Why it matters: This provision identifies a specific set of sensitive personal data categories collected under regulatory obligation for trading account applicants, including government-issued identification numbers and document copies. The collection of this data category triggers heightened data security, retention, and cross-border transfer obligations under applicable financial services, anti-money laundering, and data protection regulations....

View provision → Watch Webull →

The policy authorizes Webull to transfer user personal information to successor entities in the event of a bankruptcy, merger, acquisition, reorganization, or asset sale, and to share user information with corporate affiliates, including financial services affiliates, for service improvement purposes....

Why it matters: This provision establishes that user personal information may be transferred to new entities in corporate transactions without requiring separate user consent, subject to the policy continuing to apply. The authorization to share information with financial services affiliates for service improvement purposes is operationally significant for users who did not intend to share their data with affiliated broker-dealers or financial institutions....

View provision → Watch Webull →

The agreement states that Webull treats all actions taken on an account following a correct-password login as the account holder's actions, with the user bearing full responsibility for consequences regardless of whether the user authorized those actions....

Why it matters: This provision establishes that Webull's attribution of account actions to users is based solely on login credentials, without distinguishing between authorized and unauthorized use following correct-password access, which may limit the practical scope of user recourse in cases of credential-based fraud or unauthorized access....

View provision → Watch Webull →

The agreement requires users to pay litigation costs and attorneys' fees incurred by Webull or its affiliates if the user's platform use exceeds permitted scope or constitutes a breach of the Terms....

Why it matters: This provision establishes a user-facing indemnification obligation for Webull's litigation costs and damages arising from Terms breaches, which is operationally significant because the scope of 'permitted use' is defined by Webull's Terms, which are subject to unilateral modification without advance notice....

View provision → Watch Webull →