-
Webull
· Webull Privacy Policy
The policy requires users to authorize Webull to transfer, store, process, and use their personal information in any country where Webull operates, with an acknowledgment that data protection standards and government access rules vary by country....
Why it matters: This provision establishes a consent-based cross-border data transfer mechanism applicable to all users globally. The provision's reliance on user consent as the transfer authorization basis may require evaluation under GDPR, which does not recognize consent alone as a sufficient mechanism for ongoing international data transfers absent the safeguards described in GDPR Article 46....
-
Webull
· Webull Privacy Policy
The policy authorizes Webull to make material changes to its privacy terms by posting updates on its website or app, without sending a direct notification to users, and treats continued use of the service as acceptance of the revised terms....
Why it matters: This provision establishes that users are bound by revised policy terms upon continued use, even without receiving direct notification. Compliance teams should evaluate whether this mechanism satisfies notice requirements under GDPR, UK GDPR, and CCPA where material changes to data processing practices may require active user notification or renewed consent....
-
Webull
· Webull Privacy Policy
The policy states that Webull does not respond to Do Not Track browser signals and authorizes third-party analytics providers to collect personal information about users' online activities over time and across different applications and websites....
Why it matters: This provision discloses that third parties may collect cross-site and cross-app behavioral data from Webull users, which may interact with CCPA and CPRA definitions of 'sharing' personal information for cross-context behavioral advertising purposes. Compliance teams should assess whether this third-party data collection constitutes a sale or sharing of personal information under applicable California law....
-
Webull
· Webull Privacy Policy
The policy states that Webull does not sell personal information to third parties but discloses that it permits third parties to collect information through its services for advertising and marketing delivery purposes on other platforms....
Why it matters: This provision asserts that Webull does not engage in the 'sale' of personal information under CCPA while simultaneously disclosing that third parties collect user data through Webull's services for advertising purposes. Compliance teams should evaluate whether this third-party collection arrangement meets the CPRA definition of 'sharing' personal information for cross-context behavioral advertising, which carries its own opt-out obligations distinct from the sale opt-out....
-
Webull
· Webull Privacy Policy
The policy establishes a 30-day restoration window following account deactivation, after which Webull begins account deletion from its systems, a process that may take up to one additional week. The policy also separately states that Webull retains personal information for as long as necessary to meet legal, regulatory, and legitimate interest obligations....
Why it matters: This provision establishes the procedural timeline for account deletion and data removal, which compliance teams should map against applicable data subject rights response timelines under GDPR (30 calendar days from request) and CCPA (45 calendar days from request). The separate data retention clause, which permits retention for legal, regulatory, and legitimate interest purposes without specifying categories or durations, creates a broad retention authorization that may require evaluation under applicable minimization and storage limitation principles....
-
Stay ahead of the changes
These provisions have changed before
Monitor includes same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
-
Webull
· Webull Privacy Policy
The policy authorizes Webull to share full payment card details, including card number, expiration date, CVV code, and billing address, with third-party payment services providers for payment processing, fraud investigation, and dispute resolution purposes....
Why it matters: This provision discloses the transmission of full payment card data, including CVV codes, to third-party payment processors. Compliance teams should note that the sharing of CVV codes with processors is subject to Payment Card Industry Data Security Standard (PCI DSS) restrictions, and the policy's disclosure of this practice warrants review to confirm that such sharing is limited to contexts permitted under PCI DSS and applicable card network rules....
-
Webull
· Webull Privacy Policy
The policy establishes that EEA and UK residents may exercise GDPR and UK data protection rights, including access, correction, deletion, restriction, objection, and portability, by contacting Webull, and may opt out of marketing emails via the unsubscribe mechanism....
Why it matters: This provision formally acknowledges GDPR and UK GDPR data subject rights for EEA and UK residents and directs them to contact Webull to exercise those rights. The provision also reserves Webull's right to retain information in its archives as necessary to comply with legal obligations, resolve disputes, and enforce agreements, which qualifies the scope of the deletion and erasure rights disclosed....
-
Webull
· Webull Privacy Policy
The policy discloses that users applying to open a trading account with a Webull affiliate may be required to provide detailed identity information, including government ID numbers, nationality, marital status, date of birth, and copies of identification documents and proof of address, for anti-money laundering compliance purposes....
Why it matters: This provision identifies a specific set of sensitive personal data categories collected under regulatory obligation for trading account applicants, including government-issued identification numbers and document copies. The collection of this data category triggers heightened data security, retention, and cross-border transfer obligations under applicable financial services, anti-money laundering, and data protection regulations....
-
Webull
· Webull Privacy Policy
The policy authorizes Webull to transfer user personal information to successor entities in the event of a bankruptcy, merger, acquisition, reorganization, or asset sale, and to share user information with corporate affiliates, including financial services affiliates, for service improvement purposes....
Why it matters: This provision establishes that user personal information may be transferred to new entities in corporate transactions without requiring separate user consent, subject to the policy continuing to apply. The authorization to share information with financial services affiliates for service improvement purposes is operationally significant for users who did not intend to share their data with affiliated broker-dealers or financial institutions....