Coinbase
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
Coinbase collects ID, biometrics, and money data, shares it widely, can close you anytime.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
They collect ID, selfies/videos, biometrics, SSN, bank data, transactions, devices, and partner ads data.
Read the exact line
Privacy policy
“Biometric information generated based on photos or videos you provide in order for us to verify your identity”
Training
They use it to run accounts, meet AML laws, fight fraud, personalize the app, and target marketing.
Read the exact line
Privacy policy
“We use your personal information to deliver, personalize, operate, improve, create, and develop our Services”
Sharing
Affiliates, ID vendors, advertisers like Meta, regulators, and other crypto firms can get your data.
Read the exact line
Privacy policy
“This involves disclosing to our third-party service providers conversion data, including IP address, with advertisers such as Meta to create custom audience lists”
Kept
They keep data for legal and AML reasons, including biometrics, even after you close or delete.
Read the exact line
Privacy policy
“We retain biometric information (as part of our retention of Supplemental Identification Information) for the period required for financial regulatory compliance”
Controls
You can request access or deletion in the Dashboard or by contacting them.
Read the exact line
Privacy policy
“You can use these tools by visiting your Dashboard.”
Fine print
They can close you with no notice; you cover their legal costs; $100.
Read the exact line
Terms of service
“We may terminate or suspend your access to and use of the Services with immediate effect, at our sole discretion for any reason, at any time and without notice to you.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Open the Dashboard to request access or deletion
Log into your account and go to your Dashboard
Opt out of marketing emails and pushes
Account settings, Support Portal, or dpo@coinbase.com
Object to legitimate-interest processing
Email dpo@coinbase.com
Cancel a Commerce account
Follow account closure instructions on the Coinbase Commerce website
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They take face data from your selfie or video to check who you are.
Read the exact line
Privacy policy
“Biometric information generated based on photos or videos you provide in order for us to verify your identity”
For example, when you upload a passport photo and a selfie, a vendor turns that into biometric data they keep for compliance.
They can shut your Commerce account instantly without telling you first.
Read the exact line
Terms of service
“We may terminate or suspend your access to and use of the Services with immediate effect, at our sole discretion for any reason, at any time and without notice to you.”
For example, you could lose access to invoicing overnight with no email warning.
You promise to pay their legal bills if your use of the service leads to a claim.
Read the exact line
Terms of service
“You will and CBTL and its officers, directors, employees and agents from and against any claims, disputes, demands, liabilities, damages, losses, and costs and expenses”
For example, if a customer sues over a payment you took through Commerce, you may have to cover Coinbase’s lawyers.
They send data like your IP to Meta so they can target ads at people like you.
Read the exact line
Privacy policy
“This involves disclosing to our third-party service providers conversion data, including IP address, with advertisers such as Meta to create custom audience lists”
For example, after you visit Coinbase, you might see Coinbase ads on Facebook because they shared conversion data.
Face/ID biometrics are kept as long as money laws say, not just until you delete.
Read the exact line
Privacy policy
“We retain biometric information (as part of our retention of Supplemental Identification Information) for the period required for financial regulatory compliance or otherwise as required by applicable law.”
For example, closing your account may not wipe the selfie match they stored for KYC.
If they mess up, they say they owe you at most $100.
Read the exact line
Terms of service
“IN NO EVENT SHALL CBTL’ TO YOU FOR ALL DAMAGES (OTHER THAN AS MAY BE REQUIRED BY APPLICABLE LAW IN CASES INVOLVING PERSONAL INJURY) EXCEED THE AMOUNT OF ONE HUNDRED U.S. DOLLARS ($USD100.00)”
For example, if a bug costs you far more than $100, the contract still tries to cap them at $100.
If you invite friends, they collect those phone numbers or emails.
Read the exact line
Privacy policy
“Referral Information: Your contacts’ phone or email addresses if you choose to invite friends to Coinbase.”
For example, typing a friend’s email to invite them stores that contact with Coinbase.
The license over what you upload is meant only to run Commerce, not to own your content.
Read the exact line
Terms of service
“The rights you grant in this license are for the limited purpose of operating and providing our Services.”
For example, they can show your invoice text in the app, but they say they do not claim ownership of it.
You must be 18. They say they will close accounts they think belong to kids.
Read the exact line
Privacy policy
“The Sites and Services are not directed to persons under the age of 18, and we do not knowingly request or collect any information about persons under the age of 18.”
For example, a 17-year-old who signs up is supposed to have the account closed and data deleted.
Words to know
Legal words from the lines above, in plain English.
- biometric
- Measurements of your body that identify you, like your face, fingerprint or voice. For example, a selfie used to unlock the app or a voice recording matched to you.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- data subject rights
- The legal rights you have over your data, such as seeing it, fixing it, deleting it or moving it. For example, you can email the company and ask for a copy of everything it holds about you.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- limitation of liability
- A cap on what the company will ever pay you if something goes wrong, often only what you paid in the last year. For example, if a leak of your data costs you thousands, the most you may get back is a month's subscription fee.
How we got here · grade F · score 31/100 · 15 of 15 policy answers backed by a verified quote · 4 not stated
What does the app collect beyond what it needs to work?
They collect ID documents, photos and videos, SSN, employment and spouse data, bank details, device IDs, referrals, blockchain data, and marketing-partner data.
Does it record your voice, face or body, and what happens to that?
They create biometric data from photos or videos for ID checks and share it with third-party verification vendors who also retain it.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They get data from marketing partners and send conversion data including IP addresses to advertisers such as Meta.
Do they sell or share your data, and can you opt out?
They share with affiliates, vendors, advertisers, and other crypto firms. You can object to some marketing via settings or the dashboard.
What rights do they take over what you type and what the AI makes?
Commerce terms say you keep ownership of user content and grant a license only to operate and provide the services.
How long do they keep your data after you delete it, and can you delete it in the app?
You can request deletion in the dashboard, but they keep data including biometrics as long as AML and other laws require.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They say they use reasonable technical and organizational safeguards and require vendors to do the same. No audit or VDP is described here.
Is there a real age gate, and are teens protected?
Services are for 18+. They say they do not knowingly collect from kids and will close suspected under-18 accounts. No age-proof method is described.
Will they tell you when the rules change, and is the policy specific?
The privacy policy is dated and they say they will give reasonable notice of material changes. Retention periods are not given as exact days.
Can they close your account without warning, and can you get your data out first?
Commerce terms let them suspend or terminate at any time for any reason with no notice.
If something goes wrong, who pays?
Services are as-is, liability is capped at $100, and you must indemnify them for claims tied to your use.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 8,195 words at a professional or legal expert level (Flesch reading ease 25.1); the terms are 6,676 words at a college graduate level.
