Terms of Use

The agreement between you and Finicity, a Mastercard company, that applies to your use of our services.

Open Finance Privacy Notice (U.S.)

Explains what information we collect and why, how we use it and how you can access and manage it.

Terms of Use

Mastercard Data Connect is provided by Finicity Corporation, a Mastercard company.

These Terms of Use (“Terms”) are a legal agreement between you (“you” or “your”) and Finicity Corporation (“we,” “us,” or “our”). These Terms apply to your use and access to our websites and Permissioned Data Services (defined below). For simplicity, in these Terms we refer to our websites, online interfaces, and Permissioned Data Services as our “Services”.

ARBITRATION NOTICE: THESE TERMS INCLUDE AN AGREEMENT TO ARBITRATE DISPUTES THAT WILL HAVE A SUBSTANTIAL EFFECT ON YOUR AND OUR RIGHTS, INCLUDING THE ABILITY TO BRING A CLASS ACTION OR HAVE A MATTER DECIDED BY A JURY OR JUDGE. PLEASE REVIEW THE ARBITRATION AGREEMENT, AS WELL AS THE OTHER TERMS OF THESE TERMS, CAREFULLY BEFORE AGREEING. YOU HAVE THE RIGHT TO REJECT THE ARBITRATION AGREEMENT WITHIN 60 DAYS AS PROVIDED BELOW.

By clicking “Next” (or similar checkbox or button) or accessing or using our Services, you confirm you agree to these Terms. If you do not agree with these Terms or any other of our policies, then do not click “Next” or access or use the Services. Please read these Terms carefully.

We may change, suspend, or limit access to our Services at any time without telling you first. We may change these Terms at any time, including by adding to these Terms. Revised Terms will be posted to our website. By continuing to access or use the Services, you agree to the revised Terms.

In order to use our Services, you may be required to use certain third-party applications or other services. These Terms do not apply to the services provided to you by Recipients or other third parties. Your use of such third-party applications or other services is subject to separate terms of use or conditions. Please read those separate terms carefully.

Our Permissioned Data Services

Our “Permissioned Data Services” are services that allow you to connect to your accounts at banks, financial institutions, and other third-party providers (“Providers”), or upload data from your accounts with your Providers, and direct us to provide information from these accounts (your “Financial Data”) to third parties designated and authorized by you to receive your Financial Data (“Recipients”).

In order to use our Permissioned Data Services, you may need to either (i) provide your credentials for accessing your accounts at Providers, such as access numbers, passwords, security questions and answers, account numbers, and other login information, (collectively, “Credentials”), or (ii) upload to us (including through a third party) your financial documents, employment documents, account statements, or other documents or information (“Uploaded Data”).

We are not responsible or liable for products and services provided to you by third parties, including products and services offered by your Providers or Recipients.

Your Providers

You acknowledge and agree that we have no control over your Providers and that some Providers may prevent, delay, or restrict us from accessing your account information. Depending on your Provider, your Financial Data may not reflect your most recent account information and transaction information. If you see a discrepancy, you should wait to proceed with the transaction and check the last refresh date for the relevant account. If the refresh date is not current, you should wait until the information has been refreshed and is accurate. If the refresh date is current but the information appears incorrect, you should contact your Provider. We do not guarantee that you will be able to use the Permissioned Data Services with any particular Provider. We will have no liability from your inability to access the Permissioned Data Services due to your Provider’s policies or systems.

Your Consents

By clicking “Next” or accessing or using our Services, You authorize us to use your Credentials and Uploaded Data to access your accounts at your designated Providers and to deliver your Financial Data to Recipients. You represent that you have the authority to appoint, and here by expressly do grant, us and our affiliates, as applicable, a limited power of attorney, and you hereby appoint us and our affiliates, as applicable, as your attorney-in-fact and agent, with full power of substitution and resubstitution, for you, in all capacities, to access third-party websites, systems and applications and retrieve and use your Financial Data in connection with our Permissioned Data Services through whatever lawful means and with the full power and authority to do and perform each act and thing necessary to be done in connection with such activities as you could do in person, and authority to take any additional steps, all as necessary to access, retrieve, disclose and use your Financial Data as described in this Terms. You also expressly confirm that you authorize Providers to share and disclose your Financial Data to us on your behalf. You authorize us to assemble, evaluate, analyze, organize, or reformat your Financial Data in connection with our Permissioned Data Services.

You also agree that we may collect, use and share your Financial Data in accordance with our Privacy Notice https://www.finicity.com/privacy/ How  we collect, use, share, retain, and protect your personal information, including the personal information we collect in connection with the Services and our related retention practices, is described in our Privacy Notice https://www.finicity.com/privacy/

In addition, you agree we may access your accounts at Providers and retrieve Financial Data as is reasonably necessary for us to provide the Services or to complete any transaction you have requested or follow any instructions you have provided us.

Consent to Obtain and Share Medical Information

You understand and agree that the Financial Data that we obtain in connection with our Permissioned Data Services may include “medical information” as defined by applicable law. While we do not seek out medical information about our users, it is possible that medical information could be included in the Financial Data you provide. For example, when you provide payment information to us, that information could include information related to your receipt of health care services. You further agree that such medical information is relevant to process or effect the transaction, product, or service you have requested from Recipients or us. You are providing consent for us to share such medical information with Recipients for any legal purpose.

Terminating Your Consents

You may terminate your authorizations and agreements concerning our Permissioned Data Services that are outlined in this section (Your Consents) at any time under these Terms by calling our customer care department at 1 (855) 263-3072 or contacting us in writing at Attention: Legal Department, Finicity Corporation, 434 W. Ascension Way, Suite 200, Salt Lake City, Utah 84123.You agree that we shall have a reasonable period of time to process your notice of termination.

Your Promises to Us

By using our Services, you represent and warrant to us:

• You are at least 18 years of age;
• You agree to these Terms, including the Arbitration Agreement;
• All information you provide to us in connection with our Services will be truthful, accurate and not altered in any way;
• All Credentials or Uploaded Data you provide to us belongs to you and does not belong to anyone else;

• You will not attempt to gain unauthorized access to our Services;
• You will not impersonate any other person in using our Services;
• You will not send us, or engage in any communications with us that are, defamatory, threatening, obscene or harassing;

• You will not transmit any software viruses or any other computer code, files, or programs designed to interrupt, destroy, disrupt, or limit the operation or functionality of our Services;

• You will not copy, display, download, store, reproduce, republish, publicly display, distribute, post, transmit, decompile, reverse-engineer, disassemble, attempt to derive the source code of, modify, or create derivative works based on our Services, or content therein;
• You will only access our Services if you are in the United States;
• You will not access our Services from a country that is subject to sanctions issued by the government of the United States;

• You are not included on any list of Specially Designated Nationals, blocked, prohibited, or restricted persons by the government of the United States;

• You agree to comply with all export, re-export, and import control laws and regulations of all applicable jurisdictions and that you shall not, directly or indirectly, export, re-export, or release our websites to, or make our websites accessible from, any jurisdiction or country other than the United States; and

• You will not use our Services in connection with the actual or attempted contravention of any applicable laws.

Consumer Reports

We are a Consumer Reporting Agency. If you use our Permissioned Data Services to provide your Financial Data to Recipients that provide credit, housing, employment or banking products or services, or to Recipients that engage in similar eligibility determinations as defined by applicable law, your Financial Data will be released in the form of a consumer report. Under the Fair Credit Reporting Act (“FCRA”), you have certain rights. You can learn more about your rights under the FCRA and access our consumer portal, by visiting our website here.

These rights include allowing you to obtain from us a copy of your consumer report that we currently have on file and certain information related to your consumer report for a reasonable charge or in some circumstances, free of charge. You are entitled to a free copy of your consumer report from us when: (i) you have been denied credit, insurance or employment in the past 60 days as a result of your consumer report; (ii) you certify in writing that you are unemployed and intend to apply for employment within 60 days; (iii) you are a recipient of public welfare assistance; or (iv) you have reason to believe that your consumer report is inaccurate due to fraud. Your rights under the FCRA also include the ability to dispute inaccurate information in your consumer report without charge. Accurate information cannot be changed. Given the nature of our Services, contact your Provider to correct any inaccurate information concerning your account with the Provider. You do not have to purchase your consumer report or other information from us to dispute inaccurate or incomplete information in our file, to the extent we maintain a consumer file on you.

If you would like to obtain a copy of your consumer report, dispute inaccurate information in your consumer report, or exercise any of your other rights under the FCRA, please contact us at www.finicity.com/consumer-reporting-agency or at Mastercard Attn Open Finance Compliance, 2200 Mastercard Boulevard, O’Fallon, MO 63368-7263, or by phone at 1 (855)263- 3072.

Security and Privacy

Our information security practices are described in our Privacy Notice https://www.finicity.com/privacy/. Additional information concerning our information security practices is also available on our website, here.  https://www.finicity.com/security/

You are responsible for maintaining the confidentiality and security of your Credentials. We reserve the right to deny or limit your access to our Services if we believe that any loss, theft, or unauthorized use of your Credentials has occurred.

Consent to Electronic Records

Your Consent

You consent to receive electronically any disclosure, notice, document, or communication that is required by law to be provided to you in writing from us (a “Record”) in connection with any of our Services. While we may provide any Record to you electronically, we are not obligated to do so and may elect to send a Record to you by mail.

Paper Copies

If you would like to create a paper copy of any Record, please use the save and print functions of your computer of mobile device.

Withdrawing Consent

You may withdraw your consent to receive Records electronically by calling our customer care department at 1 (855) 263-3072 or contacting us in writing at Attention: Legal Department, Finicity Corporation, 434 W. Ascension Way, Suite 200, Salt Lake City, Utah 84123. If you do so, we may terminate your ability to receive our Services.

Consent to Call Monitoring and Recording

You consent to us monitoring and recording any telephone call between you and us.

Intellectual Property Rights

We grant you a limited, non-exclusive, revocable, and nontransferable license to download, install, and use the Services for your own use on a computer or a mobile device owned or otherwise controlled by you strictly in accordance with these Terms and any other agreement you have with us. You acknowledge and agree that the Services are provided under license, and not sold, to you. You do not acquire any ownership interest in the Services, or any other rights other than to use the Services in accordance with the license granted and subject to all terms, conditions, and restrictions under these Terms. We own and retain all rights, title, and interest in and to the Services and their features, functionality design, structure, selection, coordination, expression, arrangement, and entire contents, including text, data, design, source code, software, photos, images, graphics, user interfaces, trademarks, logos, sound, video, and other information, including any updates. We also own and retain any and all present and future intellectual property rights with respect to the Services anywhere in the world, including copyright, know-how, designs, patents and trademarks, and any application or right to apply for registration of those rights.

U.S. Government Rights

Our websites are commercial computer software, as such term is defined in 48 C.F.R. §2.101. Accordingly, if you are an agency or employee of the U.S. Government or any contractor there for, you receive only those rights with respect to our Services as are granted to all other endusers under license, in accordance with (a) 48 C.F.R. §227.7201 through 48 C.F.R. §227.7204, with respect to the Department of Defense and their contractors, or (b) 48 C.F.R. §12.212, with respect to all other U.S. Government licensees and their contractors.

Third-Party Applications and Websites

Our websites may contain links to third-party websites, mobile applications, content, or services.Such third-party websites, mobile applications, content, or services are subject to separate terms of use or conditions. Please read those separate terms of use or conditions carefully. You agree that we are not responsible for third-party websites, mobile applications, content, or services, including those to which we provide links to on our websites.

Disclaimer of Warranties

YOU ACKNOWLEDGE AND AGREE THAT THE SERVICES AND ANY THIRD-PARTY SERVICES AVAILABLE THROUGH OUR WEBSITES ARE PROVIDED “AS IS” AND “AS AVAILABLE.” NEITHER WE, NOR OUR AFFILIATES NOR ANY OF OUR LICENSORS NOR ANY RECIPIENT NOR ANY PROVIDER NOR ANY OF OUR OR THEIR PARENT COMPANIES, SUBSIDIARIES, AFFILIATES, AGENTS, DIRECTORS, EMPLOYEES, PREDECESSORS IN INTEREST, SUCCESSORS AND ASSIGNS (COLLECTIVITY, THE “FINICITY PARTIES”) MAKE ANY WARRANTY, EXPRESS OR IMPLIED, AND DISCLAIM ANY AND ALL WARRANTIES WITH RESPECT TO THE SERVICES OR ANY THIRD-PARTY SERVICES AVAILABLE THROUGH OUR WEBSITES; IN WHOLE OR INPART, INCLUDING ANY IMPLIED WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, TITLE, OR NON-INFRINGEMENT. YOU UNDERSTAND AND EXPRESSLY AGREE THAT ANY USE OF THE SERVICES OR THIRD-PARTY SERVICES AVAILABLE THROUGH OUR WEBSITES WILL BE AT YOUR SOLE RISK. THE FINICITY PARTIES DO NOT WARRANT THE COMPREHENSIVENESS, COMPLETENESS, CORRECTNESS, LEGALITY, OR ACCURACY OF THE SERVICES OR THIRD-PARTY SERVICES AVAILABLE THROUGH OUR WEBSITES, IN WHOLE OR INPART, OR THAT THE SERVICES WILL BE SECURE, UNINTERRUPTED OR ERROR FREE. YOU ARE SOLELY RESPONSIBLE FOR ANY DAMAGE TO YOUR COMPUTER SYSTEM OR OTHER DEVICE OR LOSS OF DATA THAT RESULTS FROM YOUR USE OF THE SERVICES OR THIRD- PARTY SERVICES AVAILABLE THROUGH OUR WEBSITES.

Indemnification

You agree to indemnify, hold harmless, and fully compensate the Finicity Parties from any and all third-party claims, liability, losses, damages, expenses and costs (including reasonable attorneys’ fees) caused by or arising from your use of our Services, your violation of these Terms, your violation of any other agreement you have with us, any violation of law, or violation of the rights of any third party.

Limitation of Liability

YOU AGREE THAT THE FINICITY PARTIES WILL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR EXEMPLARY DAMAGES, INCLUDING DAMAGES FOR LOSS OF PROFITS, GOODWILL, USE, DATA OR OTHER INTANGIBLE LOSSES IN CONNECTION WITH THE SERVICES, EVEN IF THE FINICITY PARTIES HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Complaints and Disputes

Most concerns can be resolved quickly by calling our customer care department at 1 (855) 263-3072. You can also contact us at Mastercard Attn Open Finance Compliance, 2200 Mastercard Boulevard, O’Fallon, MO 63368-7263. If your concern relates to your consumer report, you may also submit your concern or dispute at www.finicity.com/consumer- reporting-agency

Arbitration Agreement

Please read this section carefully, as it affects your rights. You have the right to reject the arbitration of disputes as detailed below.

Agreement to Arbitrate

You and we agree that any Claim, upon the election of either you or us, shall be resolved by legally binding arbitration. This agreement to arbitrate is intended to be broadly interpreted and to make all Claims between you and us subject to arbitration to the fullest extent permitted by law. A “Claim” means any dispute, claim, or controversy (whether based on contract, tort, intentional tort, constitution, statute, ordinance, common law, or equity, whether pre-existing, present, or future, and whether seeking monetary, injunctive, declaratory, or any other relief) arising from or relating to these Terms, our Services, or the relationship between you and us, including: claims arising prior to or after the date of the Terms; claims that are currently the subject of purported class action litigation in which you are not a member of a certified class; disputes, claims, or controversies that are brought as counterclaims, cross claims, third party claims or otherwise. For purposes of this Arbitration Agreement, “we” means the Finicity Parties (as defined above). These Terms evidence a transaction in interstate commerce, and thus the Federal Arbitration Act governs the interpretation and enforcement of this ArbitrationAgreement.

Small Claims Court

Notwithstanding anything in this Arbitration Agreement to the contrary, either party may bring an individual action in small claims court, so long as the action is not removed or appealed to a court of general jurisdiction. If an action that is brought in small claims court is removed or appealed to a court of general jurisdiction or is part of a class or representative action, either party may immediately cause or compel such Claim to be arbitrated pursuant to the terms of this Arbitration Agreement.

Jury Trial and Class Action Waiver

You and we each waive our right to a trial by jury. Further, you and we agree that each may bring Claims against the other only in an individual capacity and not as a plaintiff or class member in any purported class or representative proceeding.

Initiating Arbitration

A party who intends to seek arbitration must first send to the other, by certified mail, a written signed notice of dispute (“Notice”). The Notice to Finicity should be addressed to: Attention: Legal Department, Finicity Corporation, 434 W. Ascension Way, Suite 200, Salt Lake City, Utah 84123 (“Notice Address”). The Notice to you shall be sent to the address we have on file for you. The Notice must describe the nature and basis of the Claim and set forth the specific relief sought (“Demand”). If you and we do not reach an agreement to resolve the Claim within 30 days after the Notice is received by the other party (during which time the statute of limitations shall be tolled), you or we may commence an arbitration proceeding. In the event a Claim is filed with a court, either you or we may immediately cause or compel such Claim to be arbitrated pursuant to the terms of this Arbitration Agreement.

You are entitled to an arbitration award of at least $7,500 if: (1) you give us Notice of a Claim and a Demand on your own behalf (and not on behalf of any other party) and comply with all of the requirements of this Arbitration Agreement; (2) we refuse to provide you with the Demand you requested before an arbitrator is appointed; and (3) the arbitrator awards you money damages greater than the last amount you requested at least ten days before the arbitration commenced. This $7,500 minimum award is a single award that applies to all Claims you have raised or could have raised in the arbitration. Multiple awards of $7,500 are not contemplated by this clause.

You may obtain more information about arbitration from www.adr.org.

Arbitrator and Arbitration Procedures

The arbitration will be administered by the American Arbitration Association (“AAA”) and will be governed by the Commercial Dispute Resolution Procedures and the SupplementaryProcedures for Consumer Related Disputes (collectively, “AAA Rules”). If the AAA is unavailable or refuses to arbitrate the parties’ dispute for any reason, the arbitration shall bead ministered and conducted by a widely-recognized arbitration organization that is mutually agreeable to the parties, but neither party shall unreasonably withhold or delay their consent. If the parties cannot agree to a mutually agreeable arbitration organization, one shall be appointed pursuant to Section 5 of the Federal Arbitration Act. The AAA Rules are available online at www.adr.orgby calling the AAA at 1 (800) 778-7879, or by writing to the Notice Address.

All issues are for the arbitrator to decide. The arbitrator may award relief, including but not limited to, damages, restitution, declaratory relief, and injunctive relief. Any such relief shall only be in favor of the individual party seeking relief and only to the extent necessary to provide relief warranted by that party’s individual Claim. The arbitrator’s decision shall be legally binding. The arbitrator shall be bound by the terms of these Terms.

Discovery and/or the exchange of non-privileged information relevant to the Claim will be governed by the AAA Rules.

Fees

In the event that you file for arbitration, you may send us a written request at the Notice Address requesting that we pay all AAA filing, administration and arbitrator fees for any arbitration initiated in accordance with the Notice requirements above. We will pay all such costs if the request is reasonable and the related claim is not in connection with twenty (20) or more demands for arbitration that are filed relating to the same or similar subject matter with the same counsel submitting demands or different counsels that appear to be coordinating claims (a “Mass Arbitration”). If, however, the arbitrator finds that either the substance of your Claim or the relief sought in the Demand is frivolous or brought for an improper purpose (as measured by the standards set forth in Federal Rule of Civil Procedure 11(b)), then the payment of any fees by us or you will be governed by the AAA Rules. In such case, you agree to reimburse us for all monies previously disbursed by us that are otherwise your obligation to pay under the AAA Rules.
The arbitrator may make rulings and resolve disputes as to the payment and reimbursement of fees and expenses at any time during the proceeding or in the final award, pursuant to applicable law and the AAA Rules.

Arbitration Location

Unless you and we agree otherwise, any arbitration hearings will take place in the county (or parish) of your home address. If your Claim is for $10,000 or less, we agree that you may choose whether the arbitration will be conducted solely on the basis of documents submitted to the arbitrator, through a telephonic hearing, through an online hearing, or by an in-person hearing as established by the AAA Rules. If your Claim exceeds $10,000, the type of hearing will be determined by the AAA Rules.

Class Arbitration

The arbitrator may not consolidate more than one person’s Claims and may not otherwise preside over any form of a representative or class proceeding. The arbitrator may award injunctive relief only in favor of the individual party seeking relief and only to the extent necessary to provide relief warranted by that party’s individual Claim. If this Class Arbitration Section is found to be unenforceable or invalid, then the entirety of this Arbitration Agreement shall be null and void.

Public Injunctive Relief

If you or we seek public injunctive relief as a remedy for any Claim against one another (a“Public Injunctive Relief Request,”) you and we agree that Public Injunctive Relief Request cannot be arbitrated. Instead, that Public Injunctive Relief Request shall be adjudicated by a court after all other Claims to be decided in arbitration under this Arbitration Agreement are resolved in arbitration. You and we agree to jointly request that the court stay the Public Injunctive Relief request until after the remaining Claims have been finally resolved in arbitration. The enforceability, validity and effect of this Public Injunctive Relief section shall be determined exclusively by a court, and not by the administrator or any arbitrator.

Right to Reject Arbitration

You understand that you may reject the provisions of this Arbitration Agreement, in which case neither you nor we will have the right to elect arbitration and this Arbitration Agreement shall be void. Rejection of this Arbitration Agreement will not affect the remaining parts of this Terms. To reject this Arbitration Agreement, you must send us written notice of your rejection within 60 days after the date after you agreed to these Terms. You must include your name and address. The notice of rejection must be mailed to Attention: Legal Department, Finicity Corporation, 434 W.Ascension Way, Suite 200, Salt Lake City, Utah 84123. This is the only way that you can reject this Arbitration Agreement.

Changes to Arbitration Agreement

We agree that if we make any change to this Arbitration Agreement (other than a change to the Notice Address) and you did not initially reject this Arbitration Agreement, you may reject any such change pursuant to the process in the Right to Reject Arbitration section. If you so reject, the terms of the Arbitration Agreement that existed prior to your rejection shall remain in effect.

Entire Agreement

These Terms constitute the entire agreement between you and us with respect to our Services and supersede all prior or contemporaneous understandings and agreements, whether written or oral, with respect to our Services. These Terms may be translated into other languages for convenience, but the English version shall be the governing version.

Governing Law

These Terms shall be governed by the laws of the State of New York without regard to any conflict of laws principles that would require or permit the application of the laws of any other jurisdiction.

Assignment

You may not assign, novate or otherwise transfer any of your rights or obligations under these Terms. We may assign, novate or otherwise transfer any of our rights or obligations under these Terms in our sole discretion without notice to you.

Waiver; Interpretation

Our failure or delay in enforcing any of your obligations or exercising any our rights or remedies under these Terms shall not operate as a waiver. Additionally, if we waive a particular obligation, right, or remedy in one circumstance, in whole or in part, it does not preclude us from subsequently requiring compliance with such obligation or exercising our right or remedy on other occasions. Use of the word “include” or any derivations thereof means to include without limitation.

Severability

Except as otherwise provided in the Class Arbitration section of the Arbitration Agreement, if any provision of these Terms is held invalid or unenforceable under applicable law, the remainder of the provision will be amended to achieve as closely as possible the effect of the original term and all other provisions of these Terms will continue in full force and effect.

Survival

The following provisions of these Terms shall survive your use of our Services and the termination of your ability to access our websites: Your Promises to Us; Consent to CallMonitoring and Recording; Intellectual Property Rights; Disclaimer of Warranties; Indemnification; Limitation of Liability; Arbitration Agreement; Governing Law; Assignment; Waiver; Interpretation; Severability; Survival; and any other provision that by its nature survives.

4857-7573-4757\4

Open Finance Privacy Notice (U.S.)

Last updated: November 19, 2025

This Privacy Notice (the “Privacy Notice”) is provided by Finicity Corporation, a wholly owned subsidiary of Mastercard International Inc. (“Finicity,” “we,” and/or “us”).

This Privacy Notice applies to the information you provide to us in connection with our Open Finance solutions including, for example, through Mastercard Data Connect and our other online services, websites, applications, and related services that link to this Privacy Notice (collectively the “Services”). It explains the types of personal information we collect, and how we collect, use, maintain, protect, and disclose this information. This Privacy Notice also tells you about the rights and choices you may have when it comes to your personal information. If you have questions, you can contact us at ob.privacy@mastercard.com for more information.

You may access our Services through other third parties and their related applications and services that you have authorized to access your information in order for those third parties to provide a product or service to you. This Privacy Notice does not explain what those third parties do with any Personal Information we provide to them on your behalf, or any other information they may separately collect about you. We encourage you to review those third parties’ privacy notices and applicable terms and conditions for more information about their data practices.

We process your Personal Information in accordance with applicable law and our applicable obligations. By accessing or using our Services, you agree to the collection, use, and processing of your Personal Information as set forth in this Privacy Notice.

If you are a job applicant, please refer to the Mastercard Applicant Privacy Notice for further information.

  1. The Personal Information We May Collect and Where it Comes From
  2. How We Use Your Personal Information
  3. How We Disclose Your Personal Information
  4. How We Protect Your Personal Information
  5. How Long We Keep Your Personal Information
  6. Your Rights and Choices
  7. Children’s Privacy
  8. International Transfers
  9. Updates to this Privacy Notice
  10. Contact Us

1. The Personal Information We May Collect and Where it Comes From

When you use our Services to connect your financial account from your bank, financial institution, payroll provider, or other entity that provides your financial account, we will access and collect information from financial accounts (e.g., checking, savings, credit card, etc.) accessible through a set of credentials or an authenticated access token on your behalf. We also collect information from the devices you use to access our Services, and from affiliates, service providers, or third parties, including to protect you and others against fraud.

In this Privacy Notice, “Personal Information” means any information relating to an identified or identifiable individual (or household or device that identifies a consumer or household, where required by applicable law). The Personal Information we collect, use, and disclose depends on the Services that you use, the information available from your financial account, and other factors. The categories of Personal Information we collect are:

Categories of Personal Information We Collect Examples
Information from your financial account Account identifying details (such as account name, type, number, owner, and identifying or routing information for the financial institution); account balance information; revolving credit account information (including balance owed, due dates, payment details, transaction history, credit limits, repayment status, and interest rates); payroll account information (including employer details, employment description, W2 and tax related information, income amount and dates paid, and amounts withheld for taxes, benefits, and insurance); loan account information (including due dates, repayment status, balances, payment details, interest rates, guarantor, loan types, and payment plans and terms); investment account information (including transaction information, type of asset, identifying details about the asset, quantity, price, fees, and cost basis); identifying information about the account owner(s), (including name, email address, phone number, date of birth, and address information); and transaction or other commercial information (including merchant, amount, date, payee, type, quantity, price, location, involved securities, and memo or description of the transaction)
Identifiers Personal and business contact information (e.g., name, email address, postal address, phone number, job title), date of birth, social security number, unique personal identifiers or numbers, online identifier, internet protocol (IP) address, account name, authentication information, and similar identifiers
Authentication information Credentials, username, password, security questions and responses, Personal Identification Numbers (PINs), multi-factor authentication responses, security tokens, and/or other information required to authenticate you and to connect your financial account(s) through the Services
Product and service information Registration and payment information, first name, last name, email, phone/mobile device number, date of birth, social security number
Device, internet, and other electronic network activity information Device hardware model, operating system, browser type, referring URLs, and other information collected via automated means such as cookies or web beacons when you interact with our Services. Please review our Cookie Notice for more information about how we use cookies and your options related to cookies.
Geolocation data Using your IP address and other device information, we collect your time zone setting and geographic area
Inferences drawn from personal information Inferences may include fraud signals, such as the number of times a data element has been queried in a period of time or the last time a data element has been seen, to identify behavioral patterns and insights for our fraud prevention and identity verification services (e.g., patterns confirming that a provided address is genuine), authentication risk scores, transaction risk factors, risk reason codes, income, employment, cash flow information, your likelihood to make a payment on a given day, and your regular payments (e.g., utilities, rent subscription services)
Audio information Audio recordings (including call recordings for customer service purposes)
Professional or Employment-Related Information Business-to-business (“B2B”) information (such as job title, department, and name of organization); professional employment information; and payroll provider information
Commercial Information Information we create or retain that is fundamental to our business, e.g., bank statements, bank transactions, records of personal property; products or services purchased or obtained; purchase history; consumer habits or tendencies; banking account numbers; bank routing numbers; W-2s and other tax-related documentation, and credit scores
Sensitive Personal Information Some of the data above may be considered “Sensitive Personal Information” under applicable state privacy laws.  We do not use or disclose sensitive personal information for purposes which would require us to offer consumers the right to limit our collection and processing of this data under those laws.

We collect this Personal Information from various categories of sources, including:

  • Your bank or financial institution.
  • Directly from you or your devices.
  • Our affiliates within the Mastercard group, including to monitor and prevent fraud. For more information, please see the Mastercard Fraud & Security Notice.
  • Third parties that you have authorized to access your information in order to provide a product or service to you.
  • Service providers, including analytics providers.
  • OS/platform providers.
  • Publicly accessible sources.
  • Third party data providers, who may collect the information from publicly available sources, directly from individuals, or other sources.

2. How We Use Your Personal Information

We use your Personal Information in a manner consistent with this Privacy Notice. For some processing activities, we may use techniques such as artificial intelligence and machine learning to process and analyze data. Specifically, we may collect, use, and disclose your Personal Information for the following purposes:

  • To provide, maintain, improve, and enhance our Services;
  • To verify your identity, which is required to give you access to our Services, including for account creation and for fielding disputes and data requests;
  • To remember you when you return to our Services to manage your eligible financial account connections and permissions;
  • To provide you with certain information that we derive from your Personal Information, such as your income based on your pay checks;
  • To protect you and others against fraud;
  • If you subscribe to a Service requiring payment, to process the initial payment and all subsequent payments;
  • To help us improve and personalize the content and functionality of our Services;
  • To help us understand your usage of the Services to improve the Services;
  • To communicate with you regarding customer service matters, questions and other various comments you may send to us;
  • To communicate various technical and administrative messages regarding the Services, including notices of technology updates;
  • To generate insights, such as your income or employment, your likelihood to make a payment on a given day, or your regular payments, in support of services you request from a third party who you have authorized to access your information;
  • Where permissible by law, to generate de-identified and/or aggregated data that we may use or disclose for any lawful purpose, including purposes described in this Privacy Notice;
  • Auditing related to your interaction with the Services;
  • Debugging to identify and repair errors that impair existing intended functionality;
  • Undertaking internal research for technological development and demonstration;
  • To maintain legal and regulatory compliance;
  • To enforce compliance with our Terms and Conditions and Policies; and
  • For any other purpose disclosed to you at the time we collect or receive the Personal Information, or otherwise with your consent.

3. How We Disclose Your Personal Information

When you authorize third parties, and their related applications and services that you have authorized, to access your information in order to provide a product or service to you, we disclose your Personal Information, including from the categories identified above in Section 1, to those third parties. We only provide your Personal Information to a third party after such third party has a signed a confidentiality contract with us, and we provide your Personal Information to such third parties only for business purposes.

We may also disclose your Personal Information as follows:

  • With your consent and at your discretion;
  • To third-party service providers that we employ to provide services on our behalf, including security, fraud prevention or identity verification, development, or other business processes;
  • To partners (such as financial institutions or payment processors that facilitate payment transactions) with whom we collaborate to provide services, so that they may use the Personal Information or de-identified, anonymized and/or aggregated data derived from that Personal Information to provide their services, including to third parties that you have authorized to access your information in order to provide a product or service to you;
  • To our affiliates within the Mastercard group; for more information, please see the Mastercard Global Privacy Notice;
  • As reasonably necessary to comply with applicable law, an investigation, or other legal process, such as a court order or a subpoena;
  • When we believe disclosure is necessary to protect individuals’ vital interests, to enforce our applicable Terms of Use, prevent Mastercard against harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity; or
  • To service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets.

To protect our Services from security-related abuse without disrupting your experience, we have implemented Google reCAPTCHA, which operates in the background to ensure that every connection request comes from a real person. This tool may collect personal data such as your IP address, browser information, and user behavior like mouse movements and keystrokes to determine if you are a bot. The information collected by reCAPTCHA is governed by Google’s Privacy Policy and Terms of Service. According to Google, “Google processes information submitted via use of the [s]ervice only as necessary to provide and maintain the [s]ervice, and ensure that the [s]ervice’s security, threat detection, protection, and response capabilities remain effective against evolving threats. Such information will not be used for any other purpose, such as personalized advertising by Google.”

4. How We Protect Your Personal Information

The security of your Personal Information is important to us. We have implemented and maintain administrative, technical, and physical security controls that are designed to safeguard your Personal Information, including physical, electronic, and procedural safeguards consistent with industry-standard practices. Please recognize that protecting your Personal Information is also your responsibility. We urge you to take every precaution to protect your Personal Information when you are on the internet and when you communicate with us and with other parties through the internet. Change your passwords often, use a combination of letters and numbers, and make sure you use a secure browser. If you have reason to believe that your interaction with us or our partners is no longer secure, please let us know immediately by contacting us as indicated in the Contact Us section below. By using our Services, you agree that we may communicate with you electronically regarding security, privacy, and administrative issues relating to your use of our Services. If we learn of a security breach involving your Personal Information, we may attempt to notify you electronically via any email or mobile device number we may have on file for you. If you have any questions about the security of your Personal Information, please email us at  ob.privacy@mastercard.com.

5. How Long We Keep Your Personal Information

We take measures to delete your Personal Information or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it, unless we are required by law to keep this information for a longer period. When determining the retention period, we take into account various criteria, such as the type of products and services requested by or provided to you, the nature and length of our relationship with you, possible re-enrolment with our products or services, the impact on the services we provide to you if we delete some information from or about you, mandatory retention periods provided by law and the statute of limitations.

6. Your Rights and Choices

You may decline to share certain Personal Information with us, in which case we may not be able to provide to you some of the features and functionalities of our Services. Where required by applicable law, we will indicate whether and why you must provide us with your Personal Information, as well as the consequences of failing to do so.

Depending on your country or state, you may have the right to access, correct, or delete any Personal Information we hold about you; know more about the categories of Personal Information we collect, use, and disclose, as well as our sources of Personal Information and categories or a specific list of third parties with whom we disclose it; confirm whether we have processed your Personal Information; opt out of, object to, or restrict some uses of your Personal Information (including targeted advertising, sale of personal information, and profiling in furtherance of decisions that produce legal effects); and withdraw any consent provided.

You also have the right not to receive discriminatory treatment for the exercise of your privacy rights, subject to certain limitations. We will not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise your rights, except where the different price or level of quality of good or service is reasonably related to the value of the data that we receive from you.

Submit Requests. To exercise your rights under the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) or any other applicable privacy law granting such rights, please submit your request via our Data Privacy Consumer Rights Portal or call (855) 263-3072 and select option 3.

Verification. Requests for access, deletion, or correction of Personal Information are subject to our ability to reasonably verify your identity in light of the information requested pursuant to applicable law requirements, limitations, and regulations. We are committed to securing your personal information. When consumers exercise their rights through our Data Privacy Consumer Rights Portal, a two-step verification will enable their account to be guarded by an extra layer of security. To aid us in verifying your identity and identifying any relevant personal information on our systems, we will request any usernames that you previously shared with Finicity systems (if applicable), corresponding bank names, and last 4 digits of corresponding account numbers. We will also request a signed affidavit (we provide a suggested template which can be signed physically or electronically) affirming your state of residence, and that you are the consumer whose personal information is the subject of your request.

How to Appeal. If your request is denied, you have the right to appeal the decision by calling us at (855) 263-3072 and selecting option 3 or submitting a request through our Data Privacy Consumer Rights Portal  as described above in the “Submit Requests” subsection.

Authorizing an Agent. If you are acting as an authorized agent to make a request to know, delete, correct, or opt out on behalf of a consumer, you may submit a request via our Data Privacy Consumer Rights Portal  or call (855) 263-3072 and select option 3. Please note that we will require you to attach a written authorization signed by the resident whose Personal Information will be subject to the request.

Finicity does not sell or “share” (disclose for targeted advertising purposes) your Personal Information.

Finicity does not use or disclose sensitive personal information for purposes which would require us to offer consumers the right to limit our collection and processing of this data under applicable law.

Do Not Track. Because there is not yet a consensus on how companies should respond to web browser-based do-not-track (“DNT”) mechanisms, Finicity does not respond to web browser-based DNT signals at this time. To learn more about browser tracking signals and DNT, visit https://allaboutdnt.com.

7. Children’s Privacy

You must be at least 18 years old to use our Services. We do not knowingly direct our Services to individuals under 18 years old (“Minors”), nor do we knowingly collect, use, or disclose Personal Information about Minors who use our Services. If you use our Services, you represent that you are at least the age of majority under the laws of the jurisdiction of your place of residence. If you believe a Minor has provided us with Personal Information, please alert us at  ob.privacy@mastercard.com. If we learn that we have collected Personal Information from a Minor, we will promptly take steps to delete such information.

Finicity does not have actual knowledge that we sell or “share” (disclose for targeted advertising purposes) Personal Information of consumers under 16 years of age.

8. International Transfers

Our Services are hosted in the United States and are directed to people inside the United States. If you choose to use the Services from other regions of the world with laws governing data collection and use that may differ from United States law, then please note that you are transferring your Personal Information outside of those regions to the United States for storage and processing. Also, we may transfer your Personal Information from the United States to other countries or regions in connection with storage and processing of data, fulfilling your requests, and operating the Services. We comply with applicable legal requirements when transferring Personal Information to countries other than the country where you are located.

9. Updates to this Privacy Notice

We may revise this Privacy Notice to reflect how we collect, use, and process Personal Information at any time and in our sole discretion. If we make any material changes to how we treat Personal Information we have already collected about you, we will attempt to notify you by any email or mobile device number we may have for you, by a notice on our website, or by other means. You are advised to review this Privacy Notice periodically for any changes. Your continued use of our Services after such modifications will constitute your acknowledgment of the modified Privacy Notice. Changes to this Privacy Notice are effective when they are posted on this page.

10. How to Contact Us

Questions regarding this Privacy Notice, our information practices, or other aspects of privacy in connection with the use of our Services should be directed to our Data Privacy Officer, who can be reached by email at  ob.privacy@mastercard.com .

Finicity Mailing Address:
Mastercard Attn Open Finance Compliance
2200 Mastercard Boulevard
O’Fallon, MO 63368-7263

Click here to view our Cookie Notice