Provisions index

The policy discloses that Spotify shares pseudonymized user listening data with rightsholders, such as music labels and publishers, under contractual agreements, where data is identified by a code rather than directly identifying information....

Why it matters: This provision establishes a contractually obligated data sharing relationship with third-party rightsholders that users cannot opt out of, as it is framed as necessary for Spotify to fulfill agreements with content owners. Pseudonymization reduces but does not eliminate re-identification risk depending on the data fields shared....

View provision → Watch Spotify →

The policy discloses that Spotify transfers personal data internationally to Spotify group companies, subcontractors, and partners, and states that transfer compliance tools, encryption, pseudonymization, and processes to challenge government data requests are used as safeguards....

Why it matters: This provision acknowledges cross-border personal data transfers and describes the safeguard categories applied, but does not specify the legal transfer mechanisms used (such as standard contractual clauses), which is a relevant due diligence question for compliance teams assessing adequacy of transfer protections....

View provision → Watch Spotify →

The policy publishes global privacy request statistics for 2025, disclosing that Spotify received over 13 million privacy rights requests across four categories, complied with nearly all, and averaged response times ranging from 1 day for tailored advertising opt-outs to 23.4 days for correction requests....

Why it matters: This provision constitutes a transparency disclosure of operational privacy rights fulfillment at scale, and the metrics indicate that deletion and opt-out requests are being processed at high volume with near-complete compliance rates, which is operationally significant for assessing the functioning of Spotify's rights fulfillment infrastructure....

View provision → Watch Spotify →

The policy prohibits use of the Binance.US platform by individuals under 18 and states that BAM will delete personal information, close accounts, and restrict platform access upon notification that a user under 18 has provided personal information....

Why it matters: The policy establishes 18 as the minimum age for platform access and provides a mechanism for reporting underage users. Compliance teams should assess whether the platform's age verification procedures are adequate to prevent underage access given the sensitivity of financial and biometric data collected during onboarding....

View provision → Watch Binance.US →

The policy states that in the event Meta sells or transfers all or part of its business, user information may be transferred to the new owner as part of the transaction, subject to applicable law....

Why it matters: This provision establishes that user data may be transferred to a third-party acquirer in the event of a business sale, merger, or partial transfer, and that the new owner would receive user information under the terms of such a transaction. The constraint to what applicable law allows provides a legal guardrail but does not specify what user notice or consent would be provided....

View provision → Watch Meta →

Bank of America states that interest rates on variable-rate deposit accounts may be changed at the bank's discretion at any time, without a specified upper or lower limit and without advance notice to the account holder....

Why it matters: This provision asserts that the bank may adjust variable interest rates on deposit accounts without prior notice and without a stated floor or ceiling, which is a standard feature of variable-rate deposit products but may interact with Regulation DD change-in-terms disclosure requirements depending on how the rate change is characterized....

View provision → Watch Bank of America →

The document states that Robinhood retains personal information for up to 5 years after the end of the user relationship for regulatory compliance purposes, and may retain data for longer periods if required by law, in connection with ongoing or potential claims, or for other legitimate regulatory reasons....

Why it matters: This provision establishes a base retention period of up to 5 years post-relationship for personal information held by Robinhood's financial entities, reflecting regulatory recordkeeping obligations applicable to broker-dealers and money services businesses. The open-ended extension for legal claims or regulatory reasons means the maximum retention period is not fixed....

View provision → Watch Robinhood →

The document states that Robinhood may disclose user personal information to third parties in connection with mergers, acquisitions, financing transactions, changes in control, or bankruptcy proceedings....

Why it matters: This provision permits transfer of personal information to acquiring or successor entities without requiring individual user consent, which is standard in corporate transaction contexts but means user data may be processed by a different entity following a transaction....

View provision → Watch Robinhood →

Coinbase charges a 0.10% processing fee on net USDC conversion amounts exceeding $5 million in a 30-day rolling period, with net volume calculated by offsetting USDC-to-USD or USDC-to-PYUSD conversions against USD-to-USDC or PYUSD-to-USDC conversions....

Why it matters: This provision establishes a threshold-based fee structure for high-volume USDC converters that applies a netting methodology to determine taxable volume. The 30-day rolling calculation window and netting approach create operational tracking requirements for institutional or high-volume users managing large USDC positions....

View provision → Watch Coinbase →

Coinbase charges a fee for instant unstaking or for converting a pending standard unstake to an instant unstake, with the specific fee amount disclosed at the time of the unstaking request rather than in advance in this document....

Why it matters: This provision establishes that users who wish to access staked assets immediately rather than waiting for the standard unbonding period will pay a fee disclosed only at the time of the request. The fee amount is not specified in the fee schedule itself, meaning users cannot assess the cost before initiating the unstaking process....

View provision → Watch Coinbase →

A 0.10% fee applies to net USDC conversion volume exceeding $5 million within any rolling 30-day period, calculated as gross USDC-to-USD or PYUSD conversions minus gross USD or PYUSD-to-USDC conversions....

Why it matters: This provision establishes a volume-threshold fee applicable to high-volume USDC converters, using a net rather than gross calculation methodology that may affect large institutional or market-making users differently depending on their conversion patterns. The 30-day rolling period calculation creates an ongoing monitoring obligation for users near the $5 million threshold....

View provision → Watch Coinbase →

Coinbase charges a network fee for any recovery attempt of unsupported cryptocurrency, plus a 5% recovery fee on the recovered value above $100 for eligible recoveries, with the disclosed estimated value potentially differing from the actual market value received....

Why it matters: This provision establishes two separate charges for asset recovery: a network fee and a 5% commission on value above $100. The disclosure that the estimated value may differ from actual market value means the effective cost of recovery in percentage terms may vary from what the user anticipates at the time of the recovery request....

View provision → Watch Coinbase →

Coinbase charges a 0.10% processing fee on USDC net conversion volume exceeding $5 million within any 30-day rolling period, with net volume calculated by offsetting USDC-to-fiat conversions against fiat-to-USDC conversions....

Why it matters: This provision applies primarily to institutional and high-volume users, establishing a fee threshold and a specific netting methodology that determines when the 0.10% fee applies. The 30-day rolling calculation period and the specific netting formula are operationally significant for users managing large USDC positions....

View provision → Watch Coinbase →

The policy states that account information is retained for the duration of account activity plus 15 days after account closure, and that content shared with team members or other users may persist on the platform after account deletion to preserve other users' access to that content....

Why it matters: This provision establishes that account deletion does not guarantee removal of all user content from Postman's platform, as content shared within teams or public workspaces may be retained to preserve other users' access. The 15-day post-closure retention window for account information is a defined operational timeline....

View provision → Watch Postman →

The policy prohibits Postman accounts for users under 13 in the United States and under 18 outside the United States, states that Postman does not knowingly collect information from children under 13, and states that accounts found to belong to underage users will be closed....

Why it matters: This provision establishes a higher minimum age threshold for non-U.S. users (18) compared to the U.S. threshold (13), which is consistent with certain international regulatory frameworks and aligns with the policy's broader geographic scope. The COPPA-compliant statement regarding children under 13 applies specifically to U.S. regulatory obligations....

View provision → Watch Postman →

The policy asserts legitimate business interests as the legal basis for a broad range of processing activities including service delivery, research and development, marketing, safety and security, legal protection, and merger and acquisition facilitation, with consent cited as an additional basis for certain marketing and testimonial activities....

Why it matters: The policy asserts legitimate interests as the legal basis for multiple processing purposes including marketing, R&D, and M&A activity. Under GDPR, legitimate interests processing requires a balancing test against the data subject's rights and interests; the policy asserts this basis for a range of activities without providing further detail on the balancing assessments conducted....

View provision → Watch Postman →

The policy states that Patreon does not monitor or respond to browser Do Not Track signals, citing the absence of an industry-standard interpretation of those signals....

Why it matters: This provision establishes that browser-level Do Not Track signals have no operational effect on Patreon's data collection or tracking practices, which is a standard industry disclosure but is relevant for users who rely on browser-level controls....

View provision → Watch Patreon →

Patreon states it will disclose user personal data to law enforcement and government agencies in response to valid legal process including subpoenas and warrants, and will attempt to notify affected users by email or phone when legally permitted to do so....

Why it matters: This provision establishes the conditions under which Patreon will disclose personal data to government and law enforcement authorities, including a conditional user notification commitment that is subject to legal permissibility and the availability of current contact information....

View provision → Watch Patreon →

The policy states that California residents have CCPA rights to access categories and specific pieces of personal information collected, the sources, purposes, and categories of third-party recipients, and that Patreon extends access, portability, and deletion rights to all users through the Privacy Center....

Why it matters: This provision establishes the CCPA rights available to California residents and extends access, portability, and deletion rights to all platform users regardless of California residency, with non-discrimination assurance for users who exercise those rights....

View provision → Watch Patreon →

The policy establishes a 30-day restoration window following account deactivation, after which Webull begins account deletion from its systems, a process that may take up to one additional week. The policy also separately states that Webull retains personal information for as long as necessary to meet legal, regulatory, and legitimate interest obligations....

Why it matters: This provision establishes the procedural timeline for account deletion and data removal, which compliance teams should map against applicable data subject rights response timelines under GDPR (30 calendar days from request) and CCPA (45 calendar days from request). The separate data retention clause, which permits retention for legal, regulatory, and legitimate interest purposes without specifying categories or durations, creates a broad retention authorization that may require evaluation under applicable minimization and storage limitation principles....

View provision → Watch Webull →

The policy establishes that EEA and UK residents may exercise GDPR and UK data protection rights, including access, correction, deletion, restriction, objection, and portability, by contacting Webull, and may opt out of marketing emails via the unsubscribe mechanism....

Why it matters: This provision formally acknowledges GDPR and UK GDPR data subject rights for EEA and UK residents and directs them to contact Webull to exercise those rights. The provision also reserves Webull's right to retain information in its archives as necessary to comply with legal obligations, resolve disputes, and enforce agreements, which qualifies the scope of the deletion and erasure rights disclosed....

View provision → Watch Webull →

The guidelines prohibit sharing personal information on the platform where such sharing could lead to harms including identity theft, stalking, or fraud....

Why it matters: This provision establishes a harm-predicated standard for personal information sharing, covering doxing and related practices, and creates an enforcement basis for removal of content disclosing personal information in harmful contexts....

View provision → Watch TikTok →

The document states that Google's standard for deploying AI models and applications requires that likely overall benefits substantially outweigh foreseeable risks....

Why it matters: This provision establishes a publicly stated risk-benefit threshold for AI deployment decisions, which may serve as a reference point in regulatory assessments, civil litigation, or institutional due diligence regarding specific Google AI products....

View provision → Watch Google →

The document states that Google implements human oversight, due diligence, and feedback mechanisms in AI development and deployment, aligned with user goals and international law principles....

Why it matters: This provision creates a public institutional commitment to human oversight in AI systems, which directly engages requirements under the EU AI Act and other emerging AI governance frameworks that mandate human review mechanisms for high-risk AI applications....

View provision → Watch Google →

The document states that Google invests in safety and security research and benchmarks, develops technical risk mitigation solutions, and commits to sharing learnings with the broader AI ecosystem....

Why it matters: This provision establishes a publicly stated commitment to ecosystem-level AI safety disclosure, which may be evaluated by regulators and institutional partners when assessing Google's role in setting AI safety standards....

View provision → Watch Google →

The document states that Google's AI principles include promoting privacy and security and respecting intellectual property rights across AI development and deployment....

Why it matters: This provision creates a publicly stated commitment to privacy and intellectual property compliance in AI systems, which engages GDPR, CCPA, and copyright frameworks and may be referenced in regulatory or legal contexts concerning AI training data and output practices....

View provision → Watch Google →

The document states that Google's AI governance covers the full model lifecycle, including pre-launch risk assessment, post-launch monitoring, and continuous remediation, with safety measures that adapt over time....

Why it matters: This provision establishes a publicly stated multi-phase governance structure for AI systems, which may be evaluated by regulators under frameworks such as the EU AI Act that require documented risk management and post-market monitoring for high-risk AI systems....

View provision → Watch Google →

This provision states that account deactivation initiates a data deletion queue process, removes the account from public view, and allows account restoration for up to 30 days after deactivation....

Why it matters: This clause establishes that data deletion is not immediate upon deactivation but is queued following a 30-day reactivation window, which affects the timeline for data subject deletion rights requests under GDPR and CCPA....

View provision → Watch X →

This provision states that X may revise the Privacy Policy at any time, and commits to providing notice and a review opportunity before continued use when changes are determined by X to be material, with X retaining discretion over the materiality determination....

Why it matters: This clause reserves to X the determination of what constitutes a material change warranting user notification, which means changes assessed by X as non-material will not trigger a notice and review opportunity before taking effect....

View provision → Watch X →

The policy states that Robinhood may retain personal information for up to five years after the end of the user's relationship with the company for regulatory compliance purposes, and may retain data for longer periods if required by law, in connection with a claim, or for other legal or regulatory reasons....

Why it matters: This provision establishes a baseline five-year post-relationship retention period for personal data with open-ended extensions for legal, regulatory, or claim-related purposes. The retention period affects the practical scope of data deletion rights, including CCPA deletion requests, which the document elsewhere states may be limited by GLBA obligations....

View provision → Watch Robinhood →

The policy states that Teladoc recognizes GPC browser signals and automatically applies a preference to reject non-essential cookies and prevent associated personal information sharing when the signal is detected....

Why it matters: This provision establishes an automated opt-out mechanism for non-essential cookies triggered by GPC browser settings, without requiring users to interact with the cookie preference center. Compliance teams should verify that GPC signal detection and enforcement operate as described across all Teladoc public website domains....

View provision → Watch Teladoc →

The policy states that personal information is retained only as long as necessary for stated purposes or as required by law, after which it is securely deleted, anonymized, or put beyond use. Residual copies in backup or archival systems may persist for a limited period....

Why it matters: This provision establishes the general retention framework for public website personal data. The policy does not specify fixed retention periods for individual data categories, which may limit consumers' ability to predict how long specific data is held. The carve-out for backup and archival systems is a standard industry disclosure....

View provision → Watch Teladoc →

The policy states that Teladoc may use automated tools, including AI technologies, to support website operations, analytics, quality improvement, administrative activities, and system management....

Why it matters: This provision discloses AI and automated tool use in connection with public website operations but does not specify which decisions or outputs are influenced by automated processing, the types of AI systems used, or whether automated decision-making affects individual users. The scope and operational detail of this disclosure is limited....

View provision → Watch Teladoc →

The platforms are restricted to users aged 13 and over; Teladoc Health states it does not seek to collect personal information from children under 13 without parental or guardian consent, and use of the platform constitutes an affirmation of being over age 13....

Why it matters: This provision engages COPPA, which imposes specific notice, consent, and data handling requirements for online services that collect personal information from children under 13. The terms rely on a user affirmation mechanism rather than active age verification, which is the approach commonly observed in consumer platform agreements and may require evaluation under COPPA's actual knowledge standard....

View provision → Watch Teladoc →

Users may not assign their rights or obligations under these terms without Teladoc Health's written consent, while Teladoc Health may assign, transfer, or delegate its rights and obligations without user consent....

Why it matters: This provision authorizes Teladoc Health to transfer the contractual relationship, including obligations related to personal health data, to any assignee without user consent. This is relevant in the context of corporate transactions such as mergers or acquisitions, where user data and service obligations could transfer to a new entity....

View provision → Watch Teladoc →

The agreement restricts Credit Karma's services to U.S. users and explicitly prohibits access from jurisdictions where doing so would be contrary to local law or would subject Credit Karma to local registration requirements. Credit Karma reserves the right to limit service availability to any person, geographic area, or jurisdiction at any time at its discretion....

Why it matters: This provision establishes a U.S.-only operational scope, limiting regulatory exposure under international data protection frameworks such as GDPR. The reservation of discretion to limit service availability to any person or geographic area at any time and without stated criteria is an operationally significant enforcement mechanism....

View provision → Watch Credit Karma →

Conversions between USDC and USD or PYUSD above a net $5 million threshold within a rolling 30-day period are subject to a 0.10% processing fee on the amount exceeding the threshold, with net conversion calculated by offsetting conversions in both directions....

Why it matters: This provision primarily affects high-volume users, institutional clients, or business accounts converting large amounts between USDC and fiat. The net calculation methodology means that users who convert in both directions within the period may offset volumes and reduce or avoid the fee....

View provision → Watch Coinbase →

The policy states that Coinbase services are not directed at users under 18 and that if a user is suspected of being under 18, their account will be required to close and their data will be deleted as soon as possible....

Why it matters: This provision establishes a minimum age of 18 for Coinbase services and a remediation process for suspected underage users, including account closure and data deletion; the detection mechanism for underage users is described as suspicion-based rather than systematic age verification at onboarding....

View provision → Watch Coinbase →