Make a privacy request

Use this form to exercise any of your privacy rights. It reaches the team that can act on it and gives you a reference number. You do not need an account, and there is no charge.

What you can ask for

• A copy of your data (access / portability) — everything we hold about you, in a machine- readable file you can take elsewhere.
• Correction — fix something that is wrong.
• Deletion — delete your account and your personal information. Read the note below first: some records we are legally required to keep.
• Opt out of sale or sharing — we do not sell personal information, so this is already true for everyone; ask anyway and we will confirm it in writing.
• Withdraw consent, or object to a particular use.

What happens next

• We acknowledge your request and give you a reference number.
• We may need to confirm it is really you before we hand over or delete anything — that is a requirement, not an obstacle, and we will only ask for what we need.
• We answer within 45 days for requests under California law, and within one month where the GDPR or UK GDPR applies. If we need longer we will tell you before the deadline and say why.
• We will not treat you differently for asking.

What deletion cannot remove

Some records we are required to keep even after you ask us to delete: the identity records card-network rules and federal law oblige us to retain (including the USA PATRIOT Act's customer-identification requirements), transaction and settlement records our sponsor banks and the card networks require, and anything under a legal hold. We will delete everything else, tell you specifically what we kept, and tell you which rule requires it. We will not use a retained record for anything except the obligation that requires it.