Exhibit A — Plaid Privacy (Dkt. 79.1)

Summary

Exhibit A (Dkt. 79.1) in the Plaid privacy litigation, a printout dated 9/12/2020 of Plaid's End User Privacy Policy, with an effective date of December 30, 2019. The policy states that it applies to Plaid Inc. and its subsidiaries, including Plaid Financial Ltd. and Plaid, B.V. It lists the information Plaid collects, including login information such as a username and password, data from financial accounts, device information, and information from developers. It then sets out how the information is used, the legal bases for processing for individuals in the EEA and the UK, retention practices, changes to the policy, and how to contact Plaid.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Record facts

Full text

EXHIBIT A 
 
 

9/12/2020
Terms and Privacy - Plaid
https://plaid.com/legal/ios/
1/8
EFFECTIVE DATE: DECEMBER 30, 2019
Privacy and security are very important to us at Plaid. This End User Privacy Policy (“Policy”) is
meant to help you (the “end user”) understand how we at Plaid collect, use, and share end user
information in our possession to operate, improve, develop, and protect our services, and as
otherwise outlined in this Policy. Please take some time to read this Policy carefully. Please
note: this Policy applies to Plaid Inc. and its subsidiaries, including Plaid Financial Ltd. and
Plaid, B.V. (collectively, “Plaid”, “we”, “our”, and “us”). To determine the relevant Plaid entity that
is responsible for processing your information, please see the “Contacting Plaid” section below.
A QUICK NOTE ABOUT PLAID
End User Privacy Policy
Background
📖
Information we collect

How we use your information
⇆
Our Lawful Bases for Processing (EEA and UK End Users Only)
How we share & store your info

Some Final Details…
ℹ
End User Privacy Policy
First, Some Background

9/12/2020
Terms and Privacy - Plaid
https://plaid.com/legal/ios/
2/8
Our mission at Plaid is to empower innovators by delivering access to the financial system. Our
technology provides an easy way for you to connect your bank account and other financial
accounts to software applications that can help you do things like save for retirement, manage
your spending, streamline credit applications, or transfer money. These software applications
are built and provided by our business customers (we’ll call them “developers” here), and
powered by Plaid. By delivering access to high-quality, usable financial account data that we’ve
translated and standardized, we enable developers to focus on building experiences that benefit
you.
ABOUT THIS POLICY
Our goal with this Policy is to provide a simple and straightforward explanation of what
information Plaid collects from and about end users (“End User Information”), and how we use
and share that information. We value transparency and want to provide you with a clear and
concise description of how we treat your End User Information.
Please note that this Policy only covers the information that Plaid collects, uses, and shares. It
does not explain what developers do with any End User Information we provide to them (or any
other information they may collect about you separately from Plaid). This Policy also does not
cover any websites, products, or services provided by others. We encourage you to review the
privacy policies or notices of developers or those third parties for information about their
practices.
As explained in greater detail below, Plaid has collected identifiers, commercial information,
electronic network activity information, professional information, inferences, and other types of
End User Information.
Information you provide. When you connect your financial accounts with a developer application
or otherwise connect your financial accounts through Plaid, where applicable, we collect
identifiers and login information required by the provider of your account, such as your
username and password, or a security token. In some cases, we also collect your phone
number, email address, security questions and answers, and one-time password (OTP) to help
verify your identity before connecting your financial accounts. When providing this information,
you give the developer and Plaid the authority to act on your behalf to access and transmit your
End User Information from the relevant bank or other entity that provides your financial accounts
(we’ll call them “financial product and service providers” in this Policy). You may also provide us
with identifiers and other information, including your name, email address, and phone number,
when you contact us or enter any such information on our websites.
Information we collect from your financial accounts. The information we receive from the
financial product and service providers that maintain your financial accounts varies depending
Our Data Practices
Information We Collect and Categories of Sources

9/12/2020
Terms and Privacy - Plaid
https://plaid.com/legal/ios/
3/8
on the specific Plaid services developers use to power their applications, as well as the
information made available by those providers. But, in general, we collect the following types of
identifiers, commercial information, and other personal information from your financial product
and service providers:
Account information, including financial institution name, account name, account type,
account ownership, branch number, IBAN, BIC, and account and routing number;
Information about an account balance, including current and available balance;
Information about credit accounts, including due dates, balances owed, payment amounts
and dates, transaction history, credit limit, repayment status, and interest rate;
Information about loan accounts, including due dates, repayment status, balances, payment
amounts and dates, interest rate, guarantor, loan type, payment plan, and terms;
Information about investment accounts, including transaction information, type of asset,
identifying details about the asset, quantity, price, fees, and cost basis;
Identifiers and information about the account owner(s), including name, email address, phone
number, date of birth, and address information;
Information about account transactions, including amount, date, payee, type, quantity, price,
location, involved securities, and a description of the transaction; and
Professional information, including information about your employer, in limited cases where
you’ve connected your payroll accounts.
The data collected from your financial accounts includes information from all your accounts
(e.g., checking, savings, and credit card) accessible through a single set of account credentials.
Information we receive from your devices. When you use your device to connect to our services
through a developer’s application, we receive identifiers and electronic network activity
information about that device, including IP address, hardware model, operating system, which
features within our services you access, and other technical information about the device. We
also use cookies or similar tracking technologies to collect usage statistics and to help us
provide and improve our services. You can find more information about how we use cookies and
your related choices in our Cookie Policy.
Information we receive about you from other sources. We also receive identifiers and
commercial information about you directly from the relevant developer or other third parties,
including our service providers, bank partners, and identity verification services. For example,
developers may provide information such as your full name, email address, phone number, or
information about your financial accounts and account transactions.
Inferences we derive from the data we collect. We may use the information we collect about you
to derive inferences. For example, we may infer your location or your projected income based
•
•
•
•
•
•
•
•

9/12/2020
Terms and Privacy - Plaid
https://plaid.com/legal/ios/
4/8
on the information we have collected about you from other sources.
We use your End User Information for a number of business and commercial purposes,
including to operate, improve, and protect the services we provide, and to develop new services.
More specifically, we use your End User Information:
To operate, provide, and maintain our services;
To improve, enhance, modify, add to, and further develop our services;
To protect you, developers, our partners, Plaid, and others from fraud, malicious activity, and
other privacy and security-related concerns;
To develop new services;
To provide customer support to you or to developers, including to help respond to your
inquiries related to our service or developers’ applications;
To investigate any misuse of our service or developers’ applications, including violations of
our Developer Policy, criminal activity, or other unauthorized access to our services; and
For other notified purposes with your consent.
For individuals in the European Economic Area (“EEA”) or the United Kingdom (“UK”), our legal
basis for processing your End User Information will depend on the information concerned and
the context in which we collected or processed it. Generally, however, we will normally only
collect and process End User Information where:
we need to fulfill our responsibilities and obligations in any contract or agreement with you (for
example, to comply with our end user services agreements);
to comply with our legal obligations under applicable law;
the processing is necessary for our legitimate interests and not overridden by your data
protection interests or fundamental rights and freedoms (for example, to safeguard our services;
to communicate with you; or to provide or update our services); and
you have given your consent to do so.
To the extent we rely on consent to collect and process End User Information, you have the right
to withdraw your consent at any time per the instructions provided in this Policy.
How We Use Your Information
•
•
•
•
•
•
•
Our Lawful Bases for Processing (EEA and UK End Users Only)
•
•
•
•

9/12/2020
Terms and Privacy - Plaid
https://plaid.com/legal/ios/
5/8
We share your End User Information for a number of business purposes:
With the developer of the application you are using and as directed by that developer (such as
with another third party if directed by you);
To enforce any contract with you;
With our data processors and other service providers, partners, or contractors in connection
with the services they perform for us or developers;
If we believe in good faith that disclosure is appropriate to comply with applicable law,
regulation, or legal process (such as a court order or subpoena);
In connection with a change in ownership or control of all or a part of our business (such as a
merger, acquisition, reorganization, or bankruptcy);
Between and among Plaid and our current and future parents, affiliates, subsidiaries and
other companies under common control or ownership;
As we believe reasonably appropriate to protect the rights, privacy, safety, or property of you,
developers, our partners, Plaid, and others; or
For any other notified purpose with your consent.
We may collect, use, and share End User Information in an aggregated, de-identified, or
anonymized manner (that does not identify you personally) for any purpose permitted under
applicable law. This includes creating or using aggregated, de-identified, or anonymized data
based on the collected information to develop new services and to facilitate research.
We do not sell or rent personal information that we collect.
We retain End User Information for no longer than necessary to fulfill the purposes for which it
was collected and used, as described in this Policy, unless a longer retention period is required
or permitted under applicable law. As permitted under applicable law, even after you stop using
an application or terminate your account with one or more developer, we may still retain your
information (for example, if you still have an account with another developer). However, your
information will only be processed as required by law or in accordance with this Policy.
Please refer to the “Your Data Protection Rights” section for options that may be available to
you, including the right to request deletion of End User Information. You can also contact us
about our data retention practices using the contact information below.
How We Share Your Information
•
•
•
•
•
•
•
•
Our Retention Practices

9/12/2020
Terms and Privacy - Plaid
https://plaid.com/legal/ios/
6/8
We operate internationally, and as a result, will transfer the information we collect about you
across international borders, including from the EEA or UK to the United States, for processing
and storage. To the extent that the information we collect about you is transferred from the EEA
to territories/countries for which the EU Commission has not made a finding that the legal
framework in that territory/country provides adequate protection for individuals' rights and
freedoms for their personal data, we will transfer such data consistent with applicable data
protection laws, including through the use of the EU Commission-approved standard contractual
clauses. You can ask for a copy of these standard contractual clauses by contacting as set out
below.
Under applicable law, and subject to limitations and exceptions provided by law, if you are
located in the EEA or UK, and in certain other jurisdictions, you may have certain rights in
relation to the End User Information collected about you and how it is used, including the right
to:
Access End User Information collected about you;
Request that we rectify or update your End User Information that is inaccurate or incomplete;
Request, under certain circumstances, that we restrict the processing of or erase your End
User Information;
Object to our processing of your End User Information under certain conditions provided by
law;
Where processing of your End User Information is based on consent, withdraw that consent;
Request that we provide End User Information collected about you in a structured, commonly
used and machine-readable format so that you can transfer it to another company, where
technically feasible; and
File a complaint regarding our data protection practices with a supervisory authority (if you are
in the EEA or UK, please refer to the following link for contact details:
https://edpb.europa.eu/about-edpb/board/members_en).
Under the California Consumer Privacy Act (“CCPA”), and subject to certain limitations and
exceptions, if you are a California resident, you may have the following rights with respect to
Some Final Details…
International Data Transfers
Your Data Protection Rights
•
•
•
•
•
•
•

9/12/2020
Terms and Privacy - Plaid
https://plaid.com/legal/ios/
7/8
End User Information we have collected about you that constitutes personal information under
the CCPA:
To request access to more details about the categories and specific pieces of personal
information we may have collected about you in the last 12 months (including personal
information disclosed for business purposes);
To request deletion of your personal information;
To opt-out of any “sales” of your personal information, if a business is selling your information;
and
To not be discriminated against for exercising these rights.
To exercise your data protection rights, where applicable, you can submit a request using our
online form (available here ), or contact us as described in the “Contacting Plaid” section below.
You may be required to provide additional information necessary to confirm your identity before
we can respond to your request.
We will consider all such requests and provide our response within a reasonable period of time
(and within any time period required by applicable law). Please note, however, that certain
information may be exempt from such requests, for example if we need to keep the information
to comply with our own legal obligations or to establish, exercise, or defend legal claims.
We may update or change this Policy from time to time. If we make any updates or changes, we
will post the new policy on Plaid’s website at https://plaid.com/legal and update the effective date
at the top of this Policy. We will also notify developers of any material changes in accordance
with our developer agreements, as they are generally best positioned to notify their end users
about such changes to this Policy, as appropriate.
If you have any questions or complaints about this Policy, or about our privacy practices
generally, you can contact us at privacy@plaid.com or by mail at:
If you reside outside the EEA or UK:
Plaid Inc.
Attn: Legal
PO Box 7775 #35278
San Francisco, California 94120-7775
U.S.A.
•
•
•
•
Changes To This Policy
Contacting Plaid

9/12/2020
Terms and Privacy - Plaid
https://plaid.com/legal/ios/
8/8
If you reside in the EEA or UK:
Plaid Financial Ltd.
Attn: Legal
New Penderel House, 4th Floor
283-288 High Holborn
London, United Kingdom, WC1V 7HP

File and source

File

gov.uscourts.cand.359040.79.1.pdf

Size

96,466 bytes

SHA-256

6a3c68b59523030d066fc44bc2a63792bd8d67c0bc649e59761ff170acaa0614

Our copy

gov.uscourts.cand.359040.79.1.pdf

Original

storage.courtlistener.com