Affirm
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- Staff may review your content; the policy does not describe an opt-out.
Affirm collects SSN, bank data, and photos, shares for ads and merchant marketing.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
They take your name, SSN, bank logins, device IDs, sometimes location, photos, and shopping-page data.
Read the exact line
Privacy policy
“This includes your full name, date of birth, Social Security number, Individual Taxpayer Identification Number, email address, mailing address, phone number, password and account preferences”
Training
They use your data to run loans, fight fraud, market to you, and improve products with AI tools.
Read the exact line
Privacy policy
“Understand our customer base may be used to conduct research and analysis, develop new or improved products and Services, in the utilization of artificial intelligence and/or machine learning tools”
Sharing
Banks, merchants, ad partners, credit bureaus, and fraud vendors can get your information.
Read the exact line
Privacy policy
“To certain third parties as necessary to offer and improve our Services, including vendors who assist with identity verification, servicers of loans and lines of credits, business/strategic partners, partner and underwriting financial institutions, credit bureaus”
Kept
They keep your information as long as they need it or the law requires, even after you close.
Read the exact line
Privacy policy
“Affirm will retain your Personal Information for as long as is necessary to complete the purposes for which it was collected, or as may be required by law.”
Controls
You can limit merchant marketing sharing in account settings and some ads via Your Privacy Choices.
Read the exact line
Privacy policy
“To opt-out of information disclosure to merchants for marketing, log into your Affirm account at www.affirm.com/u/ and update your "Data Sharing" setting”
Fine print
You must be 18. You them.
Read the exact line
Terms of service
“If you do not want this Section to apply, you must send Affirm a signed notice within 30 calendar days after you agree to be bound by the Agreement”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Turn off merchant Data Sharing
Log into www.affirm.com/u/ → Other Settings → Data Sharing
Opt out of sale/sharing cookies
Your Privacy Choices link in the website footer
Request account closure if loans are paid off
Affirm Help Center at helpcenter.affirm.com or contact through My account
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They can take your bank login and full account history, not just a payment token.
Read the exact line
Privacy policy
“This includes bank account online login information, bank account numbers, bank account details including transaction history, routing numbers and/or debit card numbers”
For example, if you link a checking account, they may store your login and see your other transactions.
Your face photo can go to outside ID vendors that run facial recognition.
Read the exact line
Privacy policy
“These photographs may be used by our identity verification vendors for verifying your identity or detecting fraud (including through facial recognition technologies controlled by such vendors).”
For example, a selfie you take to prove who you are may be processed by a vendor’s face-matching system.
Using Affirm means merchants can get your info to advertise to you unless you turn that off.
Read the exact line
Privacy policy
“When you accept this Notice and use our Services, you consent to us disclosing your information to merchants you interact with for those merchants to market to you.”
For example, a store you paid with Affirm could email you extra offers using data Affirm sent.
Ad companies can track you on Affirm and other sites to target ads.
Read the exact line
Privacy policy
“These third parties may use tracking technologies to collect or receive information through the Services and elsewhere on the internet and use that information to provide measurement services and targeted ads.”
For example, after you browse Affirm, you might see Affirm or merchant ads on another website.
If someone sues them over how you used Affirm, you may have to pay their legal bills.
Read the exact line
Terms of service
“You agree to , defend and hold Affirm and its Affiliates harmless from any , including reasonable attorneys' fees, related to your use of the Services or any violation of these Terms of Service.”
For example, a dispute over a purchase you financed could lead to you covering Affirm’s lawyer costs.
They can shut off your access right away if they decide you broke the rules.
Read the exact line
Terms of service
“The privileges granted to you under this Agreement will terminate immediately and automatically without notice from Affirm if, in our sole discretion, you fail to comply with any term or provision of these Agreement.”
For example, they could lock you out of the app without warning if they think you misused it.
People or vendors can keep and review your support calls and chats.
Read the exact line
Privacy policy
“Note that recordings and transcripts of customer service interactions may be stored by us and/or our vendors on our behalf for quality assurance and training purposes.”
For example, a call about a late payment could be recorded and used to train staff.
Closing the account does not wipe your records.
Read the exact line
Privacy policy
“If you close your Affirm account, we will mark your account in our database as "Closed," but will keep your account information in our database to comply with our legal obligations.”
For example, after you pay off loans and close, they still keep your identity and loan history.
You have to be an adult; they rely on you saying you are.
Read the exact line
Terms of service
“To be eligible to use the Services, you must be at least 18 years old (19 years old if you are a ward of the state in Nebraska) and a resident of the United States or its territories”
For example, a 17-year-old is not allowed to open an Affirm account under these terms.
They say they use firewalls, encryption, and limited employee access, but they do not guarantee safety.
Read the exact line
Privacy policy
“Affirm maintains physical, electronic and procedural security measures to guard against unauthorized access to systems and uses safeguards such as firewalls and data encryption.”
For example, your SSN is supposed to sit behind encryption, yet they still warn no system is perfect.
Words to know
Legal words from the lines above, in plain English.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- opt out
- Something is on by default and stays on until you find the setting and turn it off. For example, your chats may be used for training unless you go into settings and switch it off.
- biometric
- Measurements of your body that identify you, like your face, fingerprint or voice. For example, a selfie used to unlock the app or a voice recording matched to you.
- consent
- Your clear agreement to something, given by an action like ticking a box or tapping Accept. For example, a pop-up asking if the app may use your location is asking for consent.
- tracking pixels
- Tiny invisible images or bits of code in a page, app or email that report back when and where you opened it. For example, a pixel in a marketing email tells the sender the moment you read it.
- targeted advertising
- Ads chosen for you based on what you have done across other apps and websites, not just this one. For example, you look at shoes in one app and see shoe ads in a totally different app the next day.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
- limitation of liability
- A cap on what the company will ever pay you if something goes wrong, often only what you paid in the last year. For example, if a leak of your data costs you thousands, the most you may get back is a month's subscription fee.
How we got here · grade F · score 32/100 · 15 of 15 policy answers backed by a verified quote · 4 not stated
What does the app collect beyond what it needs to work?
They collect far more than a checkout needs: SSN or ITIN, bank logins and history, precise location if enabled, photos, browser-extension cart data, and ad IDs.
Does it record your voice, face or body, and what happens to that?
They may take photos and send them to ID vendors that use facial recognition, and they record support calls. Jumio may process biometric data.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Customer service calls and chats may be recorded and stored for quality assurance and training, with no opt-out described.
Are you profiled or tracked for advertising?
They and advertising partners use cookies and similar tools for personalized ads across sites and devices.
Do they sell or share your data, and can you opt out?
They share with merchants for marketing and treat some ad tracking as a CCPA sale or share, with account and cookie opt-outs.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
You request account closure through help or contact; they still keep information for legal and fraud reasons with no set wipe deadline.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe firewalls, encryption, building access controls, and limiting employee access, but no independent audit.
Is there a real age gate, and are teens protected?
You must be at least 18 (19 in some Nebraska cases) and you warrant that you are eligible.
Will they tell you when the rules change, and is the policy specific?
The notices are dated. They may change terms and say continued use after posting means you accept, with a reasonable effort to flag material changes.
Can they close your account without warning, and can you get your data out first?
They can end access immediately without notice if they decide you broke the rules, and they may close unused accounts.
If something goes wrong, who pays?
Services are as-is with very broad liability limits, and you must indemnify Affirm for use of the services.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 5,428 words at a college graduate level (Flesch reading ease 36.2); the terms are 11,436 words at a college level.
