Plaid Consumer Reporting Agency Privacy Policy
Effective Date: November 2023
Privacy and security are very important to us at Plaid Consumer Reporting Agency, Inc. dba Plaid Check (“Plaid CRA”). This Privacy Policy (“Policy”) is meant to help you understand how we at Plaid CRA collect, use, and share your data when you use Plaid CRA products or services – for example, when Plaid CRA is used to create and share a Plaid CRA consumer report based on your data with users of consumer reports such as lenders, landlords, or insurers (“Consumer Report Users”).
This Policy applies to Plaid CRA. You should read this Policy carefully, it contains important information about your privacy rights and choices.
Jump to section:
First, Some Background
Our goal with this Policy is to provide a simple and straightforward explanation of what data Plaid CRA collects from and about you and how we use and share that information, including when we create and share consumer reports on you. We value transparency and want to provide you with a clear and concise description of how we treat your data.
This Policy does not cover what Consumer Report Users do with your data or consumer report. You should review the privacy policies or terms of service for those Consumer Report Users for information about their practices. This Policy also does not cover data we collect through our websites or when you interact with Plaid CRA outside of using our product or services, such as emailing Plaid CRA directly. Please see our All Audience Privacy Statement and Cookie Policy for more information. This Policy also does not cover how Plaid Inc. collects, uses, and shares your data when you use Plaid Inc. products or services. You can find that information in Plaid Inc.’s End User Privacy Policy.
Plaid CRA’s services are not directed to individuals under 18 and we do not knowingly collect data relating to children.
Our Data Practices
Data We Collect and Categories of Sources
Depending on the products or services used, Plaid CRA may collect the following:
- Data you provide to us;
- Data from our affiliates to provide support to you or to provide you with a better user experience;
- Data you provide to us from your financial institutions when you connect your financial account;
- Data from the electronic device you use to connect or interact with Plaid CRA;
- Data from Consumer Report Users; and
- Data from other sources, including service providers or identity verification and fraud prevention services.
Data you provide to us. When you use Plaid CRA’s products or services, such as to create and share a consumer report, we may collect the following data from you:
- identifiers like name, email address, and phone number;
- login data when required by your financial institution, like your username and password, bank name, account and routing number, or a security token; and
- when needed, data to help verify your identity and connect your accounts, including your date of birth, security questions and answers, and one-time password (OTP).
When you provide this data, you also give Plaid CRA permission and authority to act on your behalf to access and transmit your data to and from the relevant bank or financial institution that holds your financial account (we’ll call them “financial institutions” in this Policy).
Data from our affiliates to provide support to you or to provide you with a better user experience. We may collect data from our affiliates to provide support to you or improve your experience. For example, if you elect for Plaid Inc. to remember financial accounts associated with your phone number, Plaid CRA may collect the following data from Plaid Inc. in order to help you connect to these accounts faster to Plaid CRA’s services:
- identifiers like name, email address, and phone number;
- login data when required by the provider of your account, like your username and password, bank name, account and routing number, or a security token;
- when needed, data to help verify your identity and connect your accounts, including your date of birth, security questions and answers, and one-time password (OTP); and
- data from your device (as explained in more detail below).
Data you provide to us from your financial institutions when you connect your financial account. Depending on the Plaid CRA products or services used, as well as what and how information is made available by your financial institutions, we may collect the following data from financial institutions when you connect your financial accounts with or through Plaid CRA:
- Account data, including financial institution name, account name, account type, account ownership, branch number, IBAN, BIC, account number, routing number, and sort code;
- Data about an account balance, including current and available balance;
- Data about credit accounts, including due dates, balances owed, payment amounts and dates, transaction history, credit limit, repayment status, and interest rate;
- Data about loan accounts, including due dates, repayment status, balances, payment amounts and dates, interest rate, guarantor, loan type, payment plan, and terms;
- Data about investment accounts, including transaction information, type of asset, identifying details about the asset, quantity, price, fees, and cost basis;
- Identifiers and data about the account owner(s), including name, email address, phone number, date of birth, and address information; and
- Data about account transactions, including amount, date, payee, type, quantity, price, location, involved securities, and a description of the transaction.
Depending on the Plaid CRA service used, and the manner in which the data is made available, the data collected from your financial accounts may include data from all accounts (e.g., checking, savings, credit card, and joint accounts) accessible through a single set of account credentials.
Data we receive from your devices. When you use a device, like your smartphone, tablet, or computer, to interact with our services (including through a Consumer Report User’s application), we may collect the following data about that device:
- internet protocol (IP) address;
- timezone setting and location, device location;
- hardware model and operating system; and
- which features within our services you access, browser data, and other technical data about the device.
Data we receive about you from Consumer Report Users. When needed for Plaid CRA to provide a service, Consumer Report Users may provide us with identifiers and commercial information about you, like your name, address, email address, phone number, or information about your financial accounts and account transactions.
Data we receive about you from other sources. When needed to provide a service or to help prevent fraud, abuse, or security threats, we may also receive data about you directly from third parties, including our service providers or identity verification and fraud prevention services.
Information we derive from the data we collect. We may derive additional information about you from the data we collect. For example, we may infer your geolocation, your annual income, your employer, or the type of account or subaccount you’ve chosen to connect (such as whether the account is for a mortgage, student loan, or credit card).
How We Use Your Data
We use your data for the following business and commercial purposes:
- Provide Services: To operate, provide, and maintain our services, such as creating consumer reports about you and providing scores to Consumer Report Users.
- Develop Existing Services: To improve, enhance, modify, add to, and further develop our services.
- Help Prevent Fraud or Protect Privacy: To help protect you, Consumer Report Users, financial institutions, our partners, Plaid CRA, and others from fraud, malicious activity, and other privacy and security-related concerns.
- Develop New Services: To develop new products and services.
- Develop Insights: To develop insights based on the data we’ve collected about you.
- Provide Support: To provide support to you or to Consumer Report Users, including to help respond to your inquiries related to our services and prepare disclosures that you may request or to facilitate reinvestigation of disputes that you initiate under the Fair Credit Reporting Act.
- Investigate Misuse and Misconduct: To investigate misuse of services, including violations of our terms of use (such as our Developer Policy), criminal activity, or other unauthorized access to our services.
- For Legal Purposes: To comply with contractual and legal obligations under applicable law and for other legal purposes such as to establish and defend against claims.
- With Your Consent: For other notified purposes with your consent or at your direction.
How We Share Your Data
We share your data for the following reasons:
- With Consumer Report Users and as directed by that user;
- To enforce any contract with you;
- With our data processors and other service providers, partners, or contractors in connection with the services they perform for us or Consumer Report Users;
- With financial institutions to help establish, maintain, or manage a connection you’ve chosen to make;
- If we believe in good faith that disclosure is appropriate to comply with applicable law, regulation, or legal process (like a court order or subpoena) or as required to respond to a request by a regulator that has authority over us, a government authority or law enforcement authority;
- In connection with a change in ownership or control of all or a part of our business (like a merger, acquisition, reorganization, or bankruptcy);
- With our current and future parents, affiliates, subsidiaries and other companies under common control or ownership;
- As we believe reasonably appropriate to prevent malicious or fraudulent activities, or otherwise protect the rights, privacy, safety, or property of you, Consumer Report Users, our partners, Plaid CRA, and others; or
- For any other notified purpose with your consent or at your direction.
We do not share your data with non-affiliated third parties except as permitted by law (as authorized by 12 C.F.R. s 1016.14 and 1016.15).
We may collect, use, and share data that has been aggregated or anonymized in a manner that does not identify you personally for any purpose permitted under applicable law. This includes creating or using aggregated or anonymized data to develop new services or to facilitate research, to the extent permitted under applicable law.
When you link your financial accounts through Plaid CRA, we typically use Google’s reCaptcha service to help detect fraud and abuse. When reCaptcha is used, Google’s Privacy Policy and Terms of Use apply to reCaptcha and information Google collects through reCaptcha.
We may collect and share cookie data with third parties when you visit our website, or we may allow third parties to collect this cookie data from our sites. Please see our Cookie Policy and All Audience Privacy Statement for more details.
Our Retention and Deletion Practices
We retain your data only as long as it is needed and we review your data periodically to ensure it is still needed. Plaid CRA may retain your data if: (a) Plaid CRA needs your data to continue providing a Plaid CRA service you requested; (b) Plaid CRA is required by law to keep your data or retention is required by our compliance program to show compliance with law; (c) Plaid CRA determines that it needs to keep your data to assist with Plaid CRA’s compliance with law or regulatory requirements, including the Fair Credit Reporting Act; (d) Plaid CRA needs your data to help prevent fraud or protect privacy, provide support, or investigate misuse and misconduct; or (e) we request – and you specifically agree – to allow us to retain your data longer.
Your data will only be accessed, shared, and retained as required by law or in accordance with this Policy.
Protection of Data
Plaid CRA’s security policies and practices are designed to protect the confidentiality and integrity of your data, as well as any other data we collect about you. Plaid CRA implements controls designed to limit access to this data to its personnel who have a business reason to know it and prohibits its personnel from unlawfully disclosing this data.
Some Final Details
Your Data Protection Rights
We welcome and appreciate the chance to address any concerns you may have and encourage you to contact us.
To request a disclosure of consumer report information or to initiate a dispute with us, you can submit a request using our online form. You can also contact us as described in the “Contacting Plaid CRA” section below to exercise these rights. You may be required to provide additional information necessary to confirm your identity before we can respond to your request.
If we receive your request from an authorized agent, we may ask for evidence that the agent has valid written authority, like a power of attorney, to submit requests on your behalf.
We will consider requests and provide our response within a reasonable period of time (and within any time period required by applicable law). Please note, however, that certain data may be exempt from such requests, for example if we need to keep the data to comply with our own legal obligations or to establish, exercise, or defend legal claims.
For information about data rights associated with Plaid Inc.’s products or services, please visit Plaid Inc.’s End User Privacy Policy.
Changes To This Policy
We may update or change this Policy from time to time. If we make any updates or changes, we will post the new policy on Plaid CRA’s website at https://plaid.com/plaid-check-consumer-report/privacy-policy and update the effective date at the top of this Policy.
Contacting Plaid CRA
If you have any questions or complaints about this Policy, or about our privacy practices generally, you can contact us at PlaidCRA@plaid.com or by mail at:
Plaid CRA
Attn: Legal
P.O. Box 7775 #35278
San Francisco, California 94120-7775
U.S.A.
Plaid CRA Consumer Privacy Notice
Last Updated: November 2023
| WHAT DOES PLAID CONSUMER REPORTING AGENCY, INC. DO WITH YOUR PERSONAL INFORMATION? | |
| Why? | Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do. |
| What? | The types of personal information we collect and share depend on the product used. This information can include:
|
| How? | All financial companies need to share consumers’ personal information to provide their products and services. In the section below, we list the reasons financial companies can share their consumers’ personal information; the reasons Plaid CRA chooses to share; and whether you can limit this sharing. |
| Reasons we can share your personal information | Does Plaid CRA share? | Can you limit this sharing? |
| For our everyday business purposes – such as to connect and share data from your financial accounts to power the apps you use, as well as to protect against fraud or misuse, respond to court orders and legal investigations, or report to credit bureaus. | Yes | No |
| For our marketing purposes | No | We don’t share |
| For joint marketing with other financial companies | No | We don’t share |
| For our affiliates' everyday business purposes - information about transactions and experiences | No | We don’t share |
| For our affiliates' everyday business purposes - information about creditworthiness | No | We don’t share |
| For nonaffiliates to market to you | No | We don’t share |
| Questions | Contact us at PlaidCRA@plaid.com. |
| Who we are | |
| Who is providing this notice? | Plaid CRA |
| What we do | |
| How does Plaid CRA protect my personal information? | To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings. |
| How does Plaid CRA collect my personal information? | As explained in more detail in the Data We Collect or Derive section of the Privacy Policy, we collect personal information you provide to us and collect your personal information from other companies when you use our products or services. |
| Why can’t I limit all sharing? | Federal law gives you the right to limit only:
|
| Definitions | |
| Affiliates | Companies related by common ownership or control. They can be financial and nonfinancial companies.
|
| Nonaffiliates | Companies not related by common ownership or control. They can be financial and nonfinancial companies.
|
| Joint marketing | A formal agreement between nonaffiliated financial companies that together market financial products or services to you.
|
| Other Important Information |
| California: If you are a resident of California, we will not share personal information we collect about you except to the extent permitted under California law. Vermont: If you are a resident of Vermont, we will not share personal information we collect about you with non-affiliates unless the law allows or you provide authorization. |