American Express
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- Staff may review your content; the policy does not describe an opt-out.
Amex collects ID, money, device, cookie, and sometimes biometric data, profiles you for ads, and keeps records for years after you leave.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
They collect ID, money and credit history, device and cookie data, and sometimes health or face data.
Read the exact line
Privacy policy
“Personal Data may include: your identification data, including name and address, date of birth and contact details digital data from your online behavior”
Training
They use it for accounts, fraud and credit checks, automated decisions, profiles, and personalized ads.
Read the exact line
Privacy policy
“We use fully automated processes to help us make certain decisions about you, including to asses certain attributes about you in order to provide our services to you.”
Sharing
Group companies, vendors, credit bureaus, partners, and ad networks can get your data.
Read the exact line
Privacy policy
“third parties that participate in the same digital advertising network as us, so that they may also use Personal Data collected by us on our websites”
Kept
After you close an account they keep data about 5 years, and 10 years for money-laundering rules.
Read the exact line
Privacy policy
“For example, your Personal Data will be stored by American Express for 5 years after the closure of your online account.”
Controls
You can update data online, reject ad cookies, and object to profiling and marketing.
Read the exact line
Privacy policy
“If you do not want us to collect Personal Data about you through cookies or similar technologies for advertising purposes, you can choose to reject the installation of cookies”
Fine print
The site is as-is with almost no ; they can change website rules if you keep using it.
Read the exact line
Terms of service
“ALL CONTENT, PRODUCTS, AND SERVICES ON THE SITES, OR OBTAINED FROM A LINKED SITE, ARE PROVIDED TO YOU "AS IS" OF ANY KIND”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Reject advertising cookies
Cookie banner: Set Cookie Preferences, or browser settings as in the cookies policy
Update or correct your personal data
www.americanexpress.com/en-iec/ after logging in, or contact them
Object to profiling or marketing
Your Rights section; click the rights link in the statement, or DPO-Europe@aexp.com
Ask for a copy or deletion of your data
Rights request via the privacy statement link, DPO-Europe@aexp.com, or Avenida Partenón 12-14, 28042 Madrid
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They build profiles from how you browse and spend, then use that to target ads, including across other sites.
Read the exact line
Privacy policy
“We show you personalized advertisements based on your individual customer and customer group profiles and other information collected through cookies and similar technologies”
For example, looking at travel pages could lead to Amex or partner ads following you on other websites.
Ad-network companies can use data Amex collected on its sites for their own ads.
Read the exact line
Privacy policy
“third parties that participate in the same digital advertising network as us, so that they may also use Personal Data collected by us on our websites, applications and digital spaces for their own legitimate advertising purposes”
For example, an ad network could use your Amex site visits to target you elsewhere.
Even after you leave, some records stay for a decade.
Read the exact line
Privacy policy
“Personal Data necessary to fight money laundering will be stored for 10 years after the closure of your account, in accordance with applicable anti-money laundering legislation.”
For example, closing your card today would not wipe AML records until ten years later.
Software can approve, deny, or change credit without a person deciding first.
Read the exact line
Privacy policy
“This means that we will use software and/or artificial intelligence to automatically assess your personal circumstances in order to identify or predict risks or certain outcomes.”
For example, an automated check could cut your credit line based on spending patterns.
Calls and messages can be recorded and listened to for training and quality.
Read the exact line
Privacy policy
“we may monitor, transcribe or record any communications between you and us, including telephone calls, for these purposes”
For example, a support call about a charge could be transcribed and reviewed.
They may collect face or similar biometric data to identify you, with consent when it is optional.
Read the exact line
Privacy policy
“biometric data used for identification purposes”
For example, they may ask to use facial recognition to log you in.
If you post on their boards, they can reuse your ideas however they want.
Read the exact line
Terms of service
“American Express may use and provide information contained in any such postings (including any ideas, concepts, know-how or other intellectual property) to any of its parent company, subsidiaries and affiliates for any purpose whatsoever”
For example, a product idea you type in a forum could be used by Amex with no payment to you.
They do not promise the website is accurate or safe, and they limit what you can claim if it fails.
Read the exact line
Terms of service
“ALL CONTENT, PRODUCTS, AND SERVICES ON THE SITES, OR OBTAINED FROM A LINKED SITE, ARE PROVIDED TO YOU "AS IS" OF ANY KIND”
For example, if a site error leads you to a bad decision, they say they are not .
If they change website rules, keeping using the site counts as agreeing.
Read the exact line
Terms of service
“Your continued use of the Sites after that date constitutes your agreement to the revised modified Terms of Service.”
For example, a new rule could apply the next time you log in, without a separate yes.
For big privacy-policy changes they say they will tell you in writing or on the site.
Read the exact line
Privacy policy
“If it is a material change, we will notify this to you. We will do this by contacting you in writing”
For example, they may email you to read an updated privacy statement.
Words to know
Legal words from the lines above, in plain English.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- as is
- You get the service in whatever state it is in, with no promise that it works or will keep working. For example, if the app deletes your photos by mistake, it is not promising to fix that or pay you back.
- warranty
- A promise that a product will work as described; most apps say they make no such promise at all. For example, if a paid feature never works on your phone, a no-warranty clause says that is your problem.
- targeted advertising
- Ads chosen for you based on what you have done across other apps and websites, not just this one. For example, you look at shoes in one app and see shoe ads in a totally different app the next day.
- biometric
- Measurements of your body that identify you, like your face, fingerprint or voice. For example, a selfie used to unlock the app or a voice recording matched to you.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
How we got here · grade F · score 34/100 · 15 of 15 policy answers backed by a verified quote · 4 not stated
What does the app collect beyond what it needs to work?
They collect ID, device and browsing data, financial and credit history, cookies, location for some services, and sometimes health or biometric data.
Does it record your voice, face or body, and what happens to that?
They process biometric data to identify you and stop fraud. Optional uses such as facial recognition need your express consent.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
They may monitor, transcribe, or record communications, including phone calls, for quality and training. No opt-out is described.
Are you profiled or tracked for advertising?
They profile you and show personalized ads on their sites and on third-party and social platforms, using cookies and ad partners.
Do they sell or share your data, and can you opt out?
They share with group companies, vendors, credit systems, merchants, and ad networks. Cookie and marketing choices let you limit some ad use.
What rights do they take over what you type and what the AI makes?
Forum postings are not confidential; they may use ideas in those posts for any purpose across the group.
How long do they keep your data after you delete it, and can you delete it in the app?
You can ask them to delete data, but they keep account data about 5 years after closure and AML data 10 years.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They create individual and group customer profiles from behavior and transactions. You may object, but viewing or switching off a memory feature is not described.
Do they commit to basic security, and have they leaked data?
They describe technical, physical, and access controls and require vendors to protect data. No independent audit is named here.
Is there a real age gate, and are teens protected?
Not stated in the documents.
Will they tell you when the rules change, and is the policy specific?
The privacy statement is dated and says they will notify you of material changes. Website terms instead bind you by continued use.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
The site is as-is with no warranties, and they disclaim almost all damages from using the sites.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 8,265 words at a professional or legal expert level (Flesch reading ease 29.6); the terms are 2,547 words at a professional or legal expert level.
