Privacy.com

FINANCE & FINTECH

LAST UPDATED 31 AUG 2026

OF 100

PARANOIA SCORE

WHAT THE POLICIES SAY

Privacy.com is a US virtual-card service operated by Lithic, Inc. (d/b/a Privacy.com), founded in 2014. Cards are issued by partner Patriot Bank, N.A. under Visa and Mastercard licenses; bank accounts are linked via Plaid, which stores users' bank login credentials so Privacy.com does not. As a regulated fintech it collects full KYC data — name, birth date, government ID/Social Security number, bank and card information — plus transaction, device, and geolocation data, and exchanges account information with consumer reporting agencies. Its privacy policy states it does not sell user information for advertising or marketing purposes; revenue comes from interchange fees and paid plans. The website uses analytics and marketing/retargeting cookies and does not respond to Do Not Track signals. Identity and account data are retained 5-6 years after account closure under financial regulations.

TIMELINE

NO ENTRIES ON FILE YET.

TOOLS WE RECOMMEND

PLUS

RECEIPTS

19 ON FILE

COLLECTION

Privacy.com's own explainer on Plaid states that users connect a funding bank account by logging in to their bank through Plaid's integration, that Plaid then transmits information such as the account and routing number to Privacy.com, and that Privacy.com does not obtain or store the user's bank login credentials on its own systems.

privacy.com ↗

[2020-06-24] · COLLECTION

As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Is it clear why the service collects the personal data that it does? — Mostly.

privacyspy.org ↗

[2023-12-15] · COLLECTION

Privacy.com's privacy policy, last updated 2023-12-15, states that to verify identity and eligibility it collects name, email address, phone number, birth date, government-issued identification number, and payment card and bank information, and that for anti-fraud purposes it collects transaction data (when, where and how a transaction takes place, including devices and payment methods used) and device data (hardware model, operating system, unique device identifiers, mobile network data, browser type, and IP address).

privacy.com ↗

[2024-11-08] · COLLECTION

The service's policy indicates some personal data may be kept for business interests or legal obligations.

privacy.com ↗

[2024-11-08] · COLLECTION

The service's policy indicates blocking first-party cookies may limit your ability to use the service.

privacy.com ↗

[2026-04-16] · COLLECTION

Privacy.com's California Consumer Privacy Act Notice, last updated 2026-04-16, lists Social Security number among collected identifiers, along with geolocation data derived from device location and IP address, and inferences drawn from personal information to create a profile; it names publicly available databases, joint marketing partners, third-party identity verification services, and consumer reporting agencies among its sources of personal information.

privacy.com ↗

[2020-06-24] · OWNERSHIP TRANSPARENCY

As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Yes.

privacyspy.org ↗

[2021-05-20] · OWNERSHIP TRANSPARENCY

TechCrunch reported on 2021-05-20 that Privacy.com, founded in 2014, changed its corporate name to Lithic and raised $43 million in Series B funding led by Bessemer Venture Partners to focus on its B2B card-issuing platform, with Privacy.com continuing as the consumer brand; the article states the company makes money on interchange fees and that the consumer product is free.

techcrunch.com ↗

[2021-07-28] · OWNERSHIP TRANSPARENCY

A company press release dated 2021-07-28 states that Lithic (founded by Bo Jiang, Jason Kruse, and David Nichols as Privacy.com in 2014) raised a $60 million Series C led by Stripes, bringing total funding to $110 million, with participation from Bessemer Venture Partners, Index Ventures, Exor, Rainfall, Tusk Venture Partners, and Commerce Ventures.

prnewswire.com ↗

[2023-12-15] · OWNERSHIP TRANSPARENCY

Privacy.com's privacy policy, last updated 2023-12-15, identifies the operating company as Lithic, Inc., doing business as Privacy.com, headquartered at 228 Park Ave S, New York, NY, and the site footer discloses that the Privacy card is issued by Patriot Bank, N.A., Member FDIC, pursuant to licenses from Mastercard International Incorporated and Visa U.S.A. Inc.

privacy.com ↗

[2020-06-24] · SHARING

As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — No.

privacyspy.org ↗

[2023-12-15] · SHARING

Privacy.com's privacy policy, last updated 2023-12-15, permits sharing personal information with third parties providing the service or performing functions on its behalf, with financial institutions, processors, and payment card associations involved in the payment process, with government and law enforcement where reasonably necessary, and in connection with mergers, acquisitions, or asset sales; the same policy states that Privacy.com does not sell user information for advertising or marketing purposes.

privacy.com ↗

[2024-05-06] · SHARING

Privacy.com's Cardholder Agreement, last updated 2024-05-06, states that third-party services including Plaid Technologies, Inc. will store the bank account access credentials users provide and will access those bank accounts to provide and improve the services, and separately that information about the user or their account may be reported to a consumer reporting agency.

privacy.com ↗

[2024-11-08] · SHARING

The service's policy indicates you are prohibited from publishing any third party’s personally identifiable information without their consent.

privacy.com ↗

TRACK RECORD

Privacy.com publishes a Vulnerability Disclosure Policy inviting security researchers and the public to report vulnerabilities, privacy issues, or exposed data, naming in-scope systems (api.privacy.com, demo.privacy.com, sandbox.privacy.com) and committing to respond promptly, remediate in a timely manner, and extend safe harbor for good-faith research.

privacy.com ↗

TRACK RECORD

Privacy.com's security page states that the company is PCI-DSS compliant, complies with the international ISO 27001 standard, and is SOC 1 and SOC 2 Type 2 certified, and describes technical safeguards including PBKDF2 password hashing, TLS with HSTS for all web traffic, and biannual encryption key rotation; the certifications are self-attested on the page and no third-party audit reports are published there.

privacy.com ↗

[2024-11-08] · TRACK RECORD

The service's policy indicates you must report to the service any unauthorized use of your account or any breach of security.

privacy.com ↗

[2023-12-15] · TRACKING TECH

Privacy.com's privacy policy, last updated 2023-12-15, discloses three cookie categories on its website — Strictly Necessary (always on and cannot be disabled), Analytics, and Marketing cookies used for advertising measurement and retargeting — and states that its services do not currently change the way they operate upon detecting a Do Not Track signal.

privacy.com ↗

[2026-04-16] · TRACKING TECH

Privacy.com's California Consumer Privacy Act Notice, last updated 2026-04-16, lists internet or network activity information (interactions with its online services) among the categories of personal information collected and disclosed for operational business purposes, and includes personalization, advertising, and marketing of its products among the stated uses of personal information.

privacy.com ↗

DATA SOURCES

ToS;DR

CC BY-SA · TOSDR.ORG ↗

PrivacySpy

CC BY · PRIVACYSPY.ORG ↗

Claims are summarized from these sources and may be edited from the original. Text adapted from a CC BY-SA source is shared under CC BY-SA.

LAST REVIEWED 2026-08-31 · METHODOLOGY v1.7