Plaid Consumer Reporting Agency End User Privacy Policy
Effective Date: December 2025
Privacy and security are very important to us at Plaid Consumer Reporting Agency, Inc. dba Plaid Check (“Plaid CRA”). This Privacy Policy (“Policy”) is meant to help you understand how we at Plaid CRA collect, use, and share your data when you use Plaid CRA products or services – for example, when Plaid CRA is used to create and share a Plaid CRA consumer report based on your data with users of consumer reports such as lenders and landlords (“Consumer Report Users”).
This Policy applies to Plaid CRA and explains your privacy rights and the ways in which Plaid CRA lawfully uses, retains, and shares consumer data to provide, improve, and test our consumer reporting and scoring services in compliance with the Fair Credit Reporting Act (“FCRA”), Gramm-Leach-Bliley Act (“GLBA”), and other applicable laws.
This Policy does not cover data we collect through our websites or when you interact with Plaid CRA outside of using our product or services, such as emailing Plaid CRA directly. Please see our All Audience Privacy Statement and Cookie Policy for more information. This Policy also does not cover how Plaid Inc. collects, uses, and shares your data when you use Plaid Inc. products or services. You can find that information in Plaid Inc.’s End User Privacy Policy. In addition, this Policy does not cover what Consumer Report Users do with your data or consumer report. You should review the privacy policies or terms of service for those Consumer Report Users for information about their practices.
Jump to section:
Our Data Practices
Data We Collect and Categories of Sources
The data we collect, use, retain, or share depends on the Plaid CRA products and services that you, and/or the app you have connected to, use. Depending on the products or services used, Plaid CRA may collect the following:
- Data you provide to us;
- Data from financial institutions when you connect your financial account(s);
- Data from our affiliates to provide you with a better user experience and improve and evaluate Plaid CRA products and services;
- Data from the electronic device you use to connect your financial account(s) using Plaid CRA or to otherwise interact with Plaid CRA;
- Data from Consumer Report Users; and/or
- Data from other sources, including service providers or identity verification and fraud prevention services.
Plaid CRA’s services are not directed to individuals under 18 and we do not knowingly collect data relating to children.
Data you provide to us. When you interact with our Consumer Support Center or use Plaid CRA’s products or services, such as to create and share a consumer report, we may collect the following data from you:
- identifiers like name, email address, phone number, date of birth, and last four digits of Social Security number;
- login data when required by the provider of your account, like your username and password, account and routing number, or a security token;
- any additional information needed to help verify your identity, connect your accounts, or locate your records, including security questions and answers and one-time password (OTP);
- information from documents or statements that you provide to Plaid CRA, like bank statements or pay stubs; and/or
- information related to your use of our services, including which of our services you use, the dates and times of your use, and which financial institutions and apps you connect using Plaid CRA.
When you provide login data and additional information needed to connect your accounts, you also give Plaid CRA permission and authority to act on your behalf to access and transmit your data to and from your financial institution.
Data from our affiliates. We may receive data from our affiliates (these are companies related to us by common ownership or control) to: (i) provide support to you, improve your experience, or deliver products or services on your behalf; (ii) support compliance, audit, and model-validation functions required by law; and (iii) develop, test, and improve our products and services. For example, if you elect for Plaid Inc. to remember financial accounts associated with your phone number, Plaid CRA may collect the following data from Plaid Inc. in order to help you connect to your accounts faster when using Plaid CRA’s services:
- identifiers like name, email address, and phone number;
- login data when required by the provider of your account, like your username and password, bank name, account and routing number, or a security token;
- when needed, data to help verify your identity and connect your accounts, including your date of birth, security questions and answers, and OTP; and/or
- data from your device (as explained in more detail below).
Data you provide to us from your financial institutions when you connect your financial account. Depending on the Plaid CRA products or services used, as well as what and how information is made available by your financial institutions, we may collect the following data from financial institutions:
- Account data, including financial institution name, account name, account type, account ownership, branch number, IBAN, BIC, account number, routing number, and sort code;
- Data about an account balance, including current and available balance;
- Data about credit accounts, including due dates, balances owed, payment amounts and dates, transaction history, credit limit, repayment status, and interest rate;
- Data about loan accounts, including due dates, repayment status, balances, payment amounts and dates, interest rate, guarantor, loan type, payment plan, and terms;
- Data about investment accounts, including transaction information, type of asset, identifying details about the asset, quantity, price, fees, and cost basis;
- Identifiers and data about the account owner(s), including name, email address, phone number, date of birth, and address information;
- Data about account transactions, including amount, date, payee, type, quantity, price, location, involved securities, and a description of the transaction; and/or
- Data from your payroll and tax documents, including data about your income and employer, in cases where you’ve connected your payroll accounts or provided us with your pay stub or tax form information.
Depending on the Plaid CRA product or service used, and the manner in which the data is made available, the data collected from your financial accounts may include data from all accounts (e.g., checking, savings, credit card, and joint accounts) accessible through a single set of account credentials.
Data we receive from your devices. When you use a device, like your smartphone, tablet, or computer, to interact with our services (including through a Consumer Report User’s application), we may collect the following data about that device:
- internet protocol (IP) address;
- timezone setting and location, device location;
- hardware model and operating system;
- features within our services you access;
- browser data;
- network data; and/or
- other technical data about the device (such as settings and preferences).
Data we receive about you from Consumer Report Users. Consumer Report Users may provide us with identifiers and commercial information about you, like your name, mailing address, email address, phone number, date of birth, last four digits of Social Security number, or information about your financial accounts and transactions.
Data we receive about you from other sources. We may receive data about you directly from third parties, for example, we may receive data from your wireless carrier to help identify your device or from identity verification and fraud prevention services.
Information we derive from the data we collect. We may derive additional information about you from the data we collect. For example, we may infer your geolocation, your annual income, your employer, or the type of account or subaccount you’ve chosen to connect (such as whether the account is for a mortgage, student loan, or credit card).
How We Use Your Data
We use your data for the following business and commercial purposes:
- Provide Services: To operate, provide, service, assess, process, and maintain our products and services, such as creating consumer reports about you and providing scores to Consumer Report Users.
- Develop Existing Services: To improve, enhance, modify, add to, and further develop our products and services.
- Help Prevent Fraud, Verify Your Identity, or Protect Privacy: To verify your identity and help protect you, Consumer Report Users, financial institutions, our partners, Plaid CRA, and others from fraud, malicious activity, and other privacy and security-related concerns.
- Develop New Services: To develop new products, risk and scoring models, and services for use in connection with credit underwriting, portfolio management, and other lawful purposes under the FCRA, including to develop, train, test, and deploy artificial intelligence (“AI”) systems.
- Develop Insights: To develop insights based on the data we’ve collected about you. This includes your transaction data, other financial data, data about which financial accounts you have connected to which apps, and data from other sources, to help us, your financial institutions, and the developers of your connected apps provide products and services and/or a better user experience to you, like providing you with a faster connection and onboarding experience or helping to detect and prevent potentially fraudulent activity.
- Provide Support: To provide support to you or to Consumer Report Users, including to help respond to your inquiries related to our services and prepare disclosures that you may request or to facilitate investigation of disputes that you initiate under the Fair Credit Reporting Act.
- Investigate Misuse and Misconduct: To investigate misuse of services, including violations of our terms of use (such as our Developer Policy), criminal activity, or other unauthorized access to our services.
- For Legal Purposes: To comply with and to further compliance with contractual and legal obligations under applicable law and for other legal purposes such as to establish and defend against claims.
- To Communicate with You: To communicate with you and send you things like technical notices, updates, security alerts, and other messages.
- For Testing, Research, and Model Validation: To retrospectively test, validate, and improve the accuracy and predictiveness of our consumer reporting and scoring products, consistent with FCRA obligations and other applicable laws.
- With Your Consent: For other notified purposes with your consent or at your direction.
We may also collect, use, retain, and share data that has been deidentified or aggregated in a manner that does not identify you personally for any purpose permitted under applicable law. This includes creating or using deidentified or aggregated data to develop new products or services, to facilitate research, and to help us or our customers assess the speed, accuracy, performance, and/or security of our services.
How We Share Your Data
As permitted by law, we may share your data as follows:
- With Consumer Report Users and as directed by that user;
- With your connected financial institutions;
- To enforce any contract with you;
- With our data processors and other service providers, partners, agents, or contractors in connection with the services they perform for us or Consumer Report Users;
- If we believe in good faith that disclosure is appropriate to comply with applicable law, regulation, or legal process (like a court order or subpoena) or as required to respond to a request by a regulator that has authority over us, a government authority or law enforcement authority;
- In connection with a change in ownership or control of all or a part of our business (like a merger, acquisition, reorganization, or bankruptcy);
- Between and among Plaid CRA and our current and future parents, affiliates, subsidiaries, and other companies under common control or ownership;
- As we believe reasonably appropriate to protect against and prevent actual or potential fraud, unauthorized transactions, claims, other liabilities, or otherwise protect the rights, privacy, safety, or property of you, Consumer Report Users, our partners, Plaid CRA, and others; or
- For any other notified purpose with your consent or at your direction.
Prescreening and Permissible Purposes under FCRA
Plaid CRA provides consumer report information to third parties for permissible purposes under the FCRA, this may include prescreening for firm offers of credit or insurance. Prescreening helps Consumer Report Users evaluate your creditworthiness and match you with certain offers for which you may qualify. You have the right to opt out of this data sharing for prescreened offers. To do so, you can visit our Consumer Service Center or contact us at 844-204-5860.
When you link your financial accounts through Plaid CRA, we typically use Google’s reCaptcha service to help detect fraud and abuse. Google reCAPTCHA is integrated into Plaid products and services in order to ensure that entries made in online forms, for example, are actually made by real persons and are not automated by software (or bots).
Google reCAPTCHA analyzes the behavior of users of our products and services using different characteristics. Google reCAPTCHA processes personal data such as your IP address, your length of stay on our website and further information about your use of Plaid products and services. This data will be transmitted and stored by Google on servers in the United States and other countries. Google has certified with the EU-US Data Privacy Framework; the certificate is available here. When reCaptcha is used, Google’s Privacy Policy and Terms of Use apply to reCaptcha and information Google collects through reCaptcha.
We may collect and share cookie data with third parties when you visit our website, or we may allow third parties to collect this cookie data from our sites. Please see our Cookie Policy and All Audience Privacy Statement for more details.
Our Retention and Deletion Practices
We retain your data only as long as necessary to fulfill legal, contractual, and operational purposes. The exceptions to this may be if: (a) you’ve established a connection with a Consumer Report User through Plaid CRA; (b) Plaid CRA needs your data to continue providing a Plaid CRA product or service you requested; (c) Plaid CRA is required by law to keep your data or retention is required by our compliance program to show compliance with law, including the Fair Credit Reporting Act; (d) Plaid CRA needs your data to help protect against or prevent fraud or protect privacy, provide support, or investigate misuse and misconduct; (e) Plaid has de-identified or aggregated your data such that it cannot be reasonably reidentified; or (f) we request – and you specifically agree – to allow us to retain your data longer.
Your data will only be accessed, shared, and retained as required by law or in accordance with this Policy.
Please refer to the “Your Data Protection Rights” section of this Policy for options that may be available to you, including how to request deletion of your data.
Protection of Data
Plaid CRA’s security policies and practices are designed to protect the confidentiality and integrity of your data. Plaid CRA implements controls designed to limit access to this data to its personnel who have a business reason to know it and prohibits its personnel from unlawfully accessing, using, and disclosing this data.
Some Final Details
Your Data Protection Rights
We welcome and appreciate the chance to address any concerns you may have and encourage you to contact us.
Under the FCRA, you have specific rights regarding your consumer report, including the right to access your file, dispute incomplete or inaccurate information, and request reinvestigation.
If you wish to exercise these rights or initiate a dispute, you can submit a request using our Consumer Service Center. You can also contact us as described in the “Contacting Plaid CRA” section below to exercise these rights. You may be required to provide additional information necessary to confirm your identity before we can respond to your request.
If we receive your request from an authorized agent, we may ask for evidence that the agent has valid written authority, like a power of attorney, to submit requests on your behalf.
We will consider requests and provide our response within a reasonable period of time (and within any time period required by applicable law). Please note, however, that certain data may be exempt from such requests, for example if we need to keep the data to comply with our own legal obligations or to establish, exercise, or defend legal claims.
For information about data rights associated with Plaid Inc.’s products or services, please visit Plaid Inc.’s End User Privacy Policy.
Changes To This Policy
We may update or change this Policy from time to time. If we make any updates or changes, we will post the new policy on Plaid CRA’s website at https://plaid.com/plaid-check-consumer-report/privacy-policy and update the effective date at the top of this Policy. We will also notify Consumer Report Users of any material changes in accordance with our developer agreements. If we have an email address for you, we will also send you an email notifying you of the update.
Contacting Plaid CRA
If you have any questions or complaints about this Policy, or about our privacy practices generally, you can contact us at 844-204-5860, at PlaidCRA@plaid.com, or by mail at:
Plaid CRA
Attn: Legal
P.O. Box 7775 #35278
San Francisco, California 94120-7775
U.S.A.
Consumer Privacy Notice
Last Updated: December 2025
| WHAT DOES PLAID CONSUMER REPORTING AGENCY, INC. DO WITH YOUR PERSONAL INFORMATION? | |
| Why? | Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do. |
| What? | The types of personal information we collect and share depend on the product or service used. This information can include:
|
| How? | All financial companies need to share consumers’ personal information to provide their products and services. In the section below, we list the reasons financial companies can share their consumers’ personal information; the reasons Plaid CRA chooses to share; and whether you can limit this sharing. |
| Reasons we can share your personal information | Does Plaid CRA share? | Can you limit this sharing? |
| For our everyday business purposes – such as to connect and share data from your financial accounts to power the apps you use, as well as to protect against fraud or misuse, respond to court orders and legal investigations, or report to credit bureaus. | Yes | No |
| For our marketing purposes | No | We don’t share |
| For joint marketing with other financial companies | No | We don’t share |
| For our affiliates' everyday business purposes - information about transactions and experiences | Yes | Yes, and we only share with your consent or at your direction |
| For our affiliates' everyday business purposes - information about creditworthiness | No | We do not share |
| For nonaffiliates to market to you | Yes | Yes |
| To Limit our Sharing | Visit us online: https://plaid.com/check/consumer-service-center/ Please note: If you are a new customer, we can begin sharing your information 30 days from the date we sent this notice. When you are no longer our customer, we continue to share your information as described in this notice. However, you can contact us at any time to limit our sharing. |
| Question | Contact us Privacy@plaid.com |
| Who we are | |
| Who is providing this notice? | Plaid Consumer Reporting Agency, Inc. |
| What we do | |
| How does Plaid CRA protect my personal information? | To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings. |
| How does Plaid CRA collect my personal information? | As explained in more detail in the Data We Collect and Categories of Sources section of the Privacy Policy, we collect personal information you provide to us and collect your personal information from other companies when you use our products or services. |
| Why can’t I limit all sharing? | Federal law gives you the right to limit only:
|
| Definitions | |
| Affiliates | Companies related by common ownership or control. They can be financial and nonfinancial companies.
|
| Nonaffiliates | Companies not related by common ownership or control. They can be financial and nonfinancial companies. |
| Joint marketing | A formal agreement between nonaffiliated financial companies that together market financial products or services to you.
|
| Other Important Information | |
| California: If you are a resident of California, we will not share personal information we collect about you except to the extent permitted under California law. Vermont: If you are a resident of Vermont, we will not share personal information we collect about you with non-affiliates unless the law allows or you provide authorization. |