[boling11]

Hey there!

I'm one of the founders. Just wanted to hop in here and clarify our current practices.

We do not sell any data to third parties (anonymized or not). We’re never going to do it for direct marketing purposes or anything like that.

The intent behind the non-personally identified information sharing clause is to potentially provide breach notification warnings to merchants:

Example: if a large number of locked cards were used at merchant X, and then subsequently stolen from merchant X, and used at other merchants, we could notify merchant X and our customers that shopped at merchant X (likely before anyone else in the ecosystem knew).

This is not a service we're planning to provide in the near term. Any other information we collect is solely for the purposes of fraud prevention, not marketing.

I definitely hear you on the language in the policy though, and it is something we intend to tighten up