NerdWallet California Privacy Policy

Effective date: Oct. 20, 2023

This California Privacy Policy contains disclosures required by the California Consumer Privacy Act (“CCPA”) and applies only to “personal information” that is subject to that law. Most of our data collection, use, and sharing practices are governed by our Gramm-Leach-Bliley Privacy Policy, however, if you are a California resident, CCPA may apply to our Services as they relate to business products featured on our site (for example, business credit cards and small business loans). This California Privacy Policy should be read in conjunction with the NerdWallet Privacy Policy and NerdWallet Terms of Use, which are incorporated herein by reference.

A. Personal Information We Collect, Disclose for a Business Purpose, and Sell

We collect the categories of personal information about California consumers identified in the chart below and use and disclose to third parties this information for business or commercial purposes. In addition, as is common practice among companies that operate online, we allow certain third parties, including non affiliated business partners, advertising networks, analytics providers, and other advertising providers, to directly collect information about your online activities on the Site and across your browsers and devices using cookies, web beacons, mobile advertising identifiers and other technologies. These third parties may use this information to display online advertisements tailored to your interests and preferences across your browsers and devices, to conduct ad campaign measurement and Site analytics, to detect, prevent and report fraud, or to carry out their own business and commercial purposes. The collection of information by some of these third parties may constitute a “sale” of personal information, as defined under the CCPA. For more information about these practices, please review the "Third-Party Web Beacons and Third-Party Buttons" section of the NerdWallet Privacy Policy. Or, for more information about how to opt out of personal information sharing that constitutes a sale under the CCPA, please refer to the "Your Rights Regarding Personal Information" section below.

B. Categories of Sources

We collect this personal information directly from you. We may also, at your direction, receive credit reports or scores from consumer reporting agencies such as TransUnion or Equifax, or third-party services that provide a mechanism to share information you have provided to the third party through the use of an application program interface (API), such as Facebook Connect or the Twitter API. In addition, you may direct and enable us to collect personal information you maintain in financial accounts with other third-party financial institutions and similar companies. We may also collect personal information about you (for example, information regarding how you interact with our Services) using automated tools as described elsewhere in this policy.

C. Why We Collect, Use, and Share California Information

We use and disclose the personal information we collect for our commercial and business purposes, as further described in this Privacy Policy.

Commercial purposes include, without limitation: marketing, advertising, authentication, identity resolution, fraud prevention, fulfillment services, and fulfilling the requests of our customers.

Business purposes, as identified in the CCPA, include: audits and related activities; legal compliance; detecting and protecting against security incidents, fraud, and illegal activity; debugging services and systems; administrative and support services such as processing orders and payments and analytics; internal research and operations; activities to maintain and improve our Services; and other one-time uses.

We disclose the categories of personal information designated above to the following categories of third parties: service providers, lending partners, referral partners, joint marketing partners, credit reporting agencies, financial service aggregators, government entities, advertising networks, internet service providers, data analytics providers, operating system providers, professional services organizations, and social networks.

We also allow third parties to collect information about your use of our site through third party cookies and the data collected by these third parties cookies may be used to display cross-context behavioral online advertisements tailored to your interests and preferences across your browsers and devices or to conduct ad campaign measurement.

D. Your Rights Regarding Personal Information

California residents have certain rights with respect to the personal information collected by businesses. If you are a California resident, you may exercise the following rights regarding your personal information, subject to certain exceptions and limitations:

1. For certain categories of personal information, the right to request a list of what personal information (if any) we disclosed to third parties for their own direct marketing purposes in the preceding calendar year and the names and addresses of those third parties.

2. The right to know the categories and specific pieces of personal information we collect, use, disclose and, if applicable, sell about you; the categories of sources from which we collected your personal information; our purposes for collecting or, if applicable, selling your personal information; the categories of your personal information that we have disclosed for a business purpose or, if applicable, sold; and the categories of third parties to whom we have disclosed for a business purpose or, if applicable, sold personal information.

3. The right to request that we delete the personal information we have collected from you.

4. The right to data portability, meaning you have the right to obtain and reuse personal data covered by the CCPA for your own purposes.

5. The right to limit the use of your sensitive personal information to specifically permitted purposes.

6. The right to correct inaccurate personal information we have on you.

7. The right to opt out of our sale(s) or sharing of your personal information.

8. The right not to receive discriminatory treatment for the exercise of the privacy rights conferred by the CCPA.

E. Our Retention of Your Personal Information

Unless you specifically ask us to delete your personal information, we retain your personal information as long as it is necessary to comply with our data retention requirements and provide you with the Services you have requested and successfully run our business. However, even if you request a deletion, we may be required to maintain your information for as long as necessary to:

• comply with our legal or regulatory compliance needs (e.g. maintaining records of transactions you have made with us);

• to exercise, establish or defend legal claims; and/or

• to protect against fraudulent or abusive activity on our Services.

This means we may keep different information for different periods. If your account is canceled because you’ve not used it in a long time, we may delete this information straight away.

There may be occasions where we are unable to fully delete, anonymize, or de-identify your information due to technical, legal, regulatory compliance or other operational reasons. Where this is the case, we will take reasonable measures to securely isolate your personal information from any further processing until such time as we are able to delete, anonymize, or de-identify it.

F. How to Exercise Your California Consumer Rights

To Exercise Your Right to Request, Know or Delete

To exercise your California consumer rights to request, know or delete, please visit our Privacy Preferences page. You may also submit your CCPA request by:

• Sending us an email at [email protected] with the subject line "CCPA Request" and the relevant right identified in the body of the email, or

• Navigating to https://support.nerdwallet.com, clicking “Submit a Question,” then selecting “Other Questions or Concerns” from the drop-down menu and submitting with “CCPA Request” in the subject line and the relevant right identified in the body of your request.

To Opt Out of Sales or Sharing of Personal Information

To the extent that the third-party information collection on the Site constitutes the sale or sharing of personal information, we provide you with instructions for how you can exercise your right to opt out of certain cookie-related collection and use practices.

On certain of our websites, users can make choices regarding the use of cookies and related technologies through a cookie banner management tool. On all our other websites and digital properties, users can:

1. Visit privacyrights.info to opt out from sales of this type of personal information by third-party businesses that participate in the DAA’s CCPA Opt-Out Tool, and

2. Visit myaccount.google.com/data-and-personalization, scroll down to the “Ad personalization” section, click "Go to ad settings" and toggle "Ad personalization" to OFF, and

3. Follow the instructions in the "Third-Party Web Beacons and Third-Party Buttons" section in the NerdWallet Privacy Policy to opt out of interest-based advertising and other cookie-related information collection and processing.

To exercise any other CCPA rights, please visit our Privacy Preferences page, or navigate to https://support.nerdwallet.com, click “Submit a Question,” then select “Other Questions or Concerns” from the drop-down menu and submit with “CCPA Request” in the subject line and the relevant right identified in body of your request.

G. Verification Process and Required Information

Note that we may need to request additional information from you to verify your identity or understand the scope of your request, although you will not be required to create an account with us to submit a request or have it fulfilled. We will require you to provide information that we have on record for identity verification purposes. In certain circumstances, we may decline a request to exercise the right to know and/or right to deletion, particularly where we are unable to verify your identity.

H. Authorized Agent

You may designate an authorized agent to make a CCPA request on your behalf by writing to us at the contact information provided above. To the extent we are unable to verify your identity when you make the designation request, we may request additional information from you. Note, if designating an entity to act on your behalf, the CCPA requires that such entity must be registered with the California Secretary of State.

I. Minors' Right to Opt-In

We do not sell the personal information of consumers we know to be under 16 years of age.

J. Small Business Loan Information

From time to time, you may provide us with your personal information for the purpose of requesting small business loans from one or more of our partners. You agree that the disclosure of your personal information in connection with your request is not a sale of your personal information under the CCPA.

Previous Versions of This Policy