Capital One
- The policy allows AI training; it does not describe an opt-out.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
They collect lots of financial and device data, train models on it, share for ads, and cap at $10.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
- Uses your content for AI training with no opt-out
Collected
They collect identity, accounts, transactions, biometrics, location, contacts, photos, and device IDs.
Read the exact line
Privacy policy
“Contact or identity data, such as your name, mailing address, email address, phone number, date of birth, government-issued identifier (e.g., Social Security number”
Training
They use it for banking, fraud, ads, analytics, and training models to personalize and protect.
Read the exact line
Privacy policy
“including by developing and training models to be used in connection with our products and services (e.g., to protect against fraud and other harm or to personalize your experiences).”
Sharing
Affiliates, card and marketing partners, ad companies, vendors, and credit bureaus can get data.
Read the exact line
Privacy policy
“We may share information or allow companies to collect information through our Online Services in order to provide marketing services to us, including to target advertising to you”
Kept
They keep it as long as they think they need it for services, law, audits, and lawsuits.
Read the exact line
Privacy policy
“The personal information we collect will be retained for as long as reasonably necessary for the purposes set out in this Privacy Policy and consistent with our retention policies”
Controls
You can update account info, stop marketing email, and opt out of some targeted ads.
Read the exact line
Privacy policy
“You may opt out of having personal information shared for certain targeted advertising purposes, including by:”
Fine print
Site is as-is, you cover their legal costs, can be $10, and using it accepts new terms.
Read the exact line
Terms of service
“Unless otherwise indicated, when you use the Site after the effective date of the revised Agreement you accept the terms.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Opt out of certain targeted advertising
Enable Global Privacy Control, visit Your California Privacy Choices, Digital Advertising Alliance Opt Out Page, or TrustArc Preference Manager
Unsubscribe from marketing emails
Email Preferences page or the unsubscribe link in marketing emails
Review or update account information
Log into your account online, or customer support / contact on statements
Exercise access or deletion rights
Manage your data page or Capital One Disclosure
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They can use your information to train AI models. The policy does not give a way to turn that off.
Read the exact line
Privacy policy
“including by developing and training models to be used in connection with our products and services (e.g., to protect against fraud and other harm or to personalize your experiences).”
For example, your app activity could be used to train a model that personalizes offers.
They collect exact location and ad IDs, not just what you type into banking.
Read the exact line
Privacy policy
“precise location (e.g., latitude/longitude to find a nearby Capital One branch, café, or ATM), cookie IDs, device IDs, advertising IDs”
For example, the app can take latitude and longitude when you look for an ATM.
They collect biometric data to prove who you are. The policy does not describe a separate opt-in.
Read the exact line
Privacy policy
“Biometric information, such as physical or behavioral characteristics that are used or intended to be used to establish identity including for authentication or fraud prevention purposes.”
For example, a fingerprint or face scan used to log in could be stored as biometric information.
Third-party ad companies can track you across sites and apps and show targeted ads.
Read the exact line
Privacy policy
“These providers may then show you ads, including across the internet and mobile apps, and other devices, based in part on the information they have collected or that we have shared with them.”
For example, looking at a credit card page can lead to Capital One ads on other websites.
If your use of the site causes a legal fight, you may have to pay their costs.
Read the exact line
Terms of service
“You agree to , defend, and Capital One and our respective owners, affiliates, directors, officers, employees and agents from claims, losses, expenses, , damages and costs”
For example, if someone sues over something you posted or did on the site, you could owe their lawyer fees.
If they can be sued at all, they try to cap what they owe at ten dollars.
Read the exact line
Terms of service
“IN STATES WHERE THE EXCLUSION OR FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES MAY NOT APPLY, OUR IN THOSE STATES IS LIMITED AND ARE EXCLUDED TO THE GREATEST EXTENT PERMITTED BY LAW BUT SHALL, IN NO EVENT, EXCEED TEN DOLLARS ($10).”
For example, if a site error costs you money, they say they would owe at most $10.
Anything you send as feedback belongs to them, not you.
Read the exact line
Terms of service
“You agree that any suggestions, comments, and feedback you submit to Capital One (“Feedback”) shall be the property of Capital One.”
For example, an idea you email about the app can be used by them with no payment to you.
They can cut off site access without warning if they think you broke the rules.
Read the exact line
Terms of service
“Your rights under this Agreement will cease without notice if you fail to comply with any of its terms.”
For example, they could block the website for you without emailing first.
Partner companies, not just Capital One staff, can receive your information.
Read the exact line
Privacy policy
“We may share information with companies that we have partnered with to offer or enhance products and services for Capital One customers or prospective customers.”
For example, a co-branded card partner may get data about you.
You can stop marketing emails, but they may still email about your account.
Read the exact line
Privacy policy
“You can visit our Email Preferences page to opt out of receiving our marketing emails.”
For example, you can unsubscribe from offers but still get statements.
They say they use security measures, but they also say nothing is 100% safe.
Read the exact line
Privacy policy
“We have an information security program that includes administrative, technical, and physical measures that are designed to protect information within our company.”
For example, they claim they lock down systems, yet they do not promise no breaches.
Words to know
Legal words from the lines above, in plain English.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- opt out
- Something is on by default and stays on until you find the setting and turn it off. For example, your chats may be used for training unless you go into settings and switch it off.
- targeted advertising
- Ads chosen for you based on what you have done across other apps and websites, not just this one. For example, you look at shoes in one app and see shoe ads in a totally different app the next day.
- precise geolocation
- Your exact position, usually from GPS, often accurate to within a few metres. For example, an app can tell not just your city but which building you are in right now.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- device identifiers
- Codes that single out your phone or computer, used to recognise you across apps and sites. For example, the advertising ID on your phone lets two unrelated apps know they are seeing the same person.
- biometric
- Measurements of your body that identify you, like your face, fingerprint or voice. For example, a selfie used to unlock the app or a voice recording matched to you.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
- limitation of liability
- A cap on what the company will ever pay you if something goes wrong, often only what you paid in the last year. For example, if a leak of your data costs you thousands, the most you may get back is a month's subscription fee.
- warranty
- A promise that a product will work as described; most apps say they make no such promise at all. For example, if a paid feature never works on your phone, a no-warranty clause says that is your problem.
How we got here · grade F · score 29/100 · 14 of 15 policy answers backed by a verified quote · 2 not stated
What does the app collect beyond what it needs to work?
They collect far more than login and messages: SSN, credit data, precise location, contacts, photos, advertising IDs, and demographics.
Does it record your voice, face or body, and what happens to that?
They collect biometric information to identify you for login and fraud. They do not say it is deleted after the session.
Are your chats and uploads used to train AI models, and is that off by default?
They say they develop and train models using information they collect. No training opt-out is described.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They and third-party providers use cookies, pixels, and SDKs for targeted ads across sites and apps. Some opt-outs exist.
Do they sell or share your data, and can you opt out?
They share with affiliates, business and marketing partners, and vendors. You can opt out of some targeted-ad sharing.
What rights do they take over what you type and what the AI makes?
Feedback you submit becomes their property and they can use it without limits. Broader AI input/output ownership is not spelled out.
How long do they keep your data after you delete it, and can you delete it in the app?
They keep data as long as they think they need it. Extra access or deletion is through their manage-data pages or contact, not a 30-day in-app wipe.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe an information security program with administrative, technical, and physical measures, and say no method is 100% secure.
Is there a real age gate, and are teens protected?
Online services are generally not directed to people under 18. They ask children not to provide information except for certain products.
Will they tell you when the rules change, and is the policy specific?
Both documents are dated. Privacy is updated by posting. Terms say using the site after a change means you accept.
Can they close your account without warning, and can you get your data out first?
If they say you broke the site terms, your rights end without notice and they can stop access immediately.
If something goes wrong, who pays?
The site is as-is, damages are disclaimed, liability may be capped at $10, and you must indemnify them for claims from your use.
Do subscriptions renew on their own, and can you get a refund?
These documents do not describe app subscriptions, auto-renewal, or refunds for the website itself.
The privacy policy is 4,556 words at a college graduate level (Flesch reading ease 32.3); the terms are 2,435 words at a college level.
