Provisions index

The policy discloses that Spotify shares pseudonymized user listening data with rightsholders, such as music labels and publishers, under contractual agreements, where data is identified by a code rather than directly identifying information....

Why it matters: This provision establishes a contractually obligated data sharing relationship with third-party rightsholders that users cannot opt out of, as it is framed as necessary for Spotify to fulfill agreements with content owners. Pseudonymization reduces but does not eliminate re-identification risk depending on the data fields shared....

View provision → Watch Spotify →

The policy discloses that Spotify transfers personal data internationally to Spotify group companies, subcontractors, and partners, and states that transfer compliance tools, encryption, pseudonymization, and processes to challenge government data requests are used as safeguards....

Why it matters: This provision acknowledges cross-border personal data transfers and describes the safeguard categories applied, but does not specify the legal transfer mechanisms used (such as standard contractual clauses), which is a relevant due diligence question for compliance teams assessing adequacy of transfer protections....

View provision → Watch Spotify →

The policy publishes global privacy request statistics for 2025, disclosing that Spotify received over 13 million privacy rights requests across four categories, complied with nearly all, and averaged response times ranging from 1 day for tailored advertising opt-outs to 23.4 days for correction requests....

Why it matters: This provision constitutes a transparency disclosure of operational privacy rights fulfillment at scale, and the metrics indicate that deletion and opt-out requests are being processed at high volume with near-complete compliance rates, which is operationally significant for assessing the functioning of Spotify's rights fulfillment infrastructure....

View provision → Watch Spotify →

The policy prohibits use of the Binance.US platform by individuals under 18 and states that BAM will delete personal information, close accounts, and restrict platform access upon notification that a user under 18 has provided personal information....

Why it matters: The policy establishes 18 as the minimum age for platform access and provides a mechanism for reporting underage users. Compliance teams should assess whether the platform's age verification procedures are adequate to prevent underage access given the sensitivity of financial and biometric data collected during onboarding....

View provision → Watch Binance.US →

The policy states that in the event Meta sells or transfers all or part of its business, user information may be transferred to the new owner as part of the transaction, subject to applicable law....

Why it matters: This provision establishes that user data may be transferred to a third-party acquirer in the event of a business sale, merger, or partial transfer, and that the new owner would receive user information under the terms of such a transaction. The constraint to what applicable law allows provides a legal guardrail but does not specify what user notice or consent would be provided....

View provision → Watch Meta →

Bank of America states that interest rates on variable-rate deposit accounts may be changed at the bank's discretion at any time, without a specified upper or lower limit and without advance notice to the account holder....

Why it matters: This provision asserts that the bank may adjust variable interest rates on deposit accounts without prior notice and without a stated floor or ceiling, which is a standard feature of variable-rate deposit products but may interact with Regulation DD change-in-terms disclosure requirements depending on how the rate change is characterized....

View provision → Watch Bank of America →

The document states that Robinhood retains personal information for up to 5 years after the end of the user relationship for regulatory compliance purposes, and may retain data for longer periods if required by law, in connection with ongoing or potential claims, or for other legitimate regulatory reasons....

Why it matters: This provision establishes a base retention period of up to 5 years post-relationship for personal information held by Robinhood's financial entities, reflecting regulatory recordkeeping obligations applicable to broker-dealers and money services businesses. The open-ended extension for legal claims or regulatory reasons means the maximum retention period is not fixed....

View provision → Watch Robinhood →

The document states that Robinhood may disclose user personal information to third parties in connection with mergers, acquisitions, financing transactions, changes in control, or bankruptcy proceedings....

Why it matters: This provision permits transfer of personal information to acquiring or successor entities without requiring individual user consent, which is standard in corporate transaction contexts but means user data may be processed by a different entity following a transaction....

View provision → Watch Robinhood →

Coinbase charges a 0.10% processing fee on net USDC conversion amounts exceeding $5 million in a 30-day rolling period, with net volume calculated by offsetting USDC-to-USD or USDC-to-PYUSD conversions against USD-to-USDC or PYUSD-to-USDC conversions....

Why it matters: This provision establishes a threshold-based fee structure for high-volume USDC converters that applies a netting methodology to determine taxable volume. The 30-day rolling calculation window and netting approach create operational tracking requirements for institutional or high-volume users managing large USDC positions....

View provision → Watch Coinbase →

Coinbase charges a fee for instant unstaking or for converting a pending standard unstake to an instant unstake, with the specific fee amount disclosed at the time of the unstaking request rather than in advance in this document....

Why it matters: This provision establishes that users who wish to access staked assets immediately rather than waiting for the standard unbonding period will pay a fee disclosed only at the time of the request. The fee amount is not specified in the fee schedule itself, meaning users cannot assess the cost before initiating the unstaking process....

View provision → Watch Coinbase →

A 0.10% fee applies to net USDC conversion volume exceeding $5 million within any rolling 30-day period, calculated as gross USDC-to-USD or PYUSD conversions minus gross USD or PYUSD-to-USDC conversions....

Why it matters: This provision establishes a volume-threshold fee applicable to high-volume USDC converters, using a net rather than gross calculation methodology that may affect large institutional or market-making users differently depending on their conversion patterns. The 30-day rolling period calculation creates an ongoing monitoring obligation for users near the $5 million threshold....

View provision → Watch Coinbase →

Coinbase charges a network fee for any recovery attempt of unsupported cryptocurrency, plus a 5% recovery fee on the recovered value above $100 for eligible recoveries, with the disclosed estimated value potentially differing from the actual market value received....

Why it matters: This provision establishes two separate charges for asset recovery: a network fee and a 5% commission on value above $100. The disclosure that the estimated value may differ from actual market value means the effective cost of recovery in percentage terms may vary from what the user anticipates at the time of the recovery request....

View provision → Watch Coinbase →

Coinbase charges a 0.10% processing fee on USDC net conversion volume exceeding $5 million within any 30-day rolling period, with net volume calculated by offsetting USDC-to-fiat conversions against fiat-to-USDC conversions....

Why it matters: This provision applies primarily to institutional and high-volume users, establishing a fee threshold and a specific netting methodology that determines when the 0.10% fee applies. The 30-day rolling calculation period and the specific netting formula are operationally significant for users managing large USDC positions....

View provision → Watch Coinbase →

The policy states that account information is retained for the duration of account activity plus 15 days after account closure, and that content shared with team members or other users may persist on the platform after account deletion to preserve other users' access to that content....

Why it matters: This provision establishes that account deletion does not guarantee removal of all user content from Postman's platform, as content shared within teams or public workspaces may be retained to preserve other users' access. The 15-day post-closure retention window for account information is a defined operational timeline....

View provision → Watch Postman →

The policy prohibits Postman accounts for users under 13 in the United States and under 18 outside the United States, states that Postman does not knowingly collect information from children under 13, and states that accounts found to belong to underage users will be closed....

Why it matters: This provision establishes a higher minimum age threshold for non-U.S. users (18) compared to the U.S. threshold (13), which is consistent with certain international regulatory frameworks and aligns with the policy's broader geographic scope. The COPPA-compliant statement regarding children under 13 applies specifically to U.S. regulatory obligations....

View provision → Watch Postman →

The policy asserts legitimate business interests as the legal basis for a broad range of processing activities including service delivery, research and development, marketing, safety and security, legal protection, and merger and acquisition facilitation, with consent cited as an additional basis for certain marketing and testimonial activities....

Why it matters: The policy asserts legitimate interests as the legal basis for multiple processing purposes including marketing, R&D, and M&A activity. Under GDPR, legitimate interests processing requires a balancing test against the data subject's rights and interests; the policy asserts this basis for a range of activities without providing further detail on the balancing assessments conducted....

View provision → Watch Postman →

The policy states that Patreon does not monitor or respond to browser Do Not Track signals, citing the absence of an industry-standard interpretation of those signals....

Why it matters: This provision establishes that browser-level Do Not Track signals have no operational effect on Patreon's data collection or tracking practices, which is a standard industry disclosure but is relevant for users who rely on browser-level controls....

View provision → Watch Patreon →

Patreon states it will disclose user personal data to law enforcement and government agencies in response to valid legal process including subpoenas and warrants, and will attempt to notify affected users by email or phone when legally permitted to do so....

Why it matters: This provision establishes the conditions under which Patreon will disclose personal data to government and law enforcement authorities, including a conditional user notification commitment that is subject to legal permissibility and the availability of current contact information....

View provision → Watch Patreon →

The policy states that California residents have CCPA rights to access categories and specific pieces of personal information collected, the sources, purposes, and categories of third-party recipients, and that Patreon extends access, portability, and deletion rights to all users through the Privacy Center....

Why it matters: This provision establishes the CCPA rights available to California residents and extends access, portability, and deletion rights to all platform users regardless of California residency, with non-discrimination assurance for users who exercise those rights....

View provision → Watch Patreon →

The policy establishes a 30-day restoration window following account deactivation, after which Webull begins account deletion from its systems, a process that may take up to one additional week. The policy also separately states that Webull retains personal information for as long as necessary to meet legal, regulatory, and legitimate interest obligations....

Why it matters: This provision establishes the procedural timeline for account deletion and data removal, which compliance teams should map against applicable data subject rights response timelines under GDPR (30 calendar days from request) and CCPA (45 calendar days from request). The separate data retention clause, which permits retention for legal, regulatory, and legitimate interest purposes without specifying categories or durations, creates a broad retention authorization that may require evaluation under applicable minimization and storage limitation principles....

View provision → Watch Webull →

The policy establishes that EEA and UK residents may exercise GDPR and UK data protection rights, including access, correction, deletion, restriction, objection, and portability, by contacting Webull, and may opt out of marketing emails via the unsubscribe mechanism....

Why it matters: This provision formally acknowledges GDPR and UK GDPR data subject rights for EEA and UK residents and directs them to contact Webull to exercise those rights. The provision also reserves Webull's right to retain information in its archives as necessary to comply with legal obligations, resolve disputes, and enforce agreements, which qualifies the scope of the deletion and erasure rights disclosed....

View provision → Watch Webull →