Last updated:
Jul 16, 2026
Here you will find our Gramm-Leach-Bliley Act (“GLBA”) Privacy Notice and our Privacy Notice.
Gramm-Leach-Bliley Act (“GLBA”) Privacy Notice
| FACTS | WHAT DO WE DO WITH YOUR PERSONAL INFORMATION? |
|---|---|
Why? | Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do. |
What? | The types of personal information we collect and share depend on the product or service you have with us. This information can include:
documents
|
How? | All financial companies need to share customers’ personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers’ personal information; the reasons we choose to share; and whether you can limit this sharing. |
| Reasons we can share your personal information | Do we share? | Can you limit this sharing? |
|---|---|---|
For our everyday business purposes— such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus | Yes | No |
For our marketing purposes— to offer our products and services to you | Yes | Yes |
For joint marketing with other financial companies | No | We don't share |
For our affiliates’ everyday business purposes — information about your transactions and experiences | Yes | No |
For our affiliates’ everyday business purposes — information about your creditworthiness | Yes | Yes |
For our affiliates to market to you | Yes | Yes |
For non-affiliates to market to you | Yes | Yes |
To limit our sharing
You may update your data sharing preferences by contacting us at privacy@nu.com. |
Questions ?
Contact us: by phone at +1 888 880 0755, or by writing to 101 West Chapel Hill Street, Suite 300, Durham, NC 27701, or by email at privacy@nu.com.
Who we are ?
| Who is providing this notice? |
|---|
Nu United States LLC (“Nu”). |
What we do
| How does the company protect my personal information? | How does the company collect my personal information? | Why can’t I limit all sharing? |
|---|---|---|
To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings. We also maintain other physical, electronic and procedural safeguards to protect this information and we limit access to information to those employees for whom access is appropriate. We never sell your personal information. | We collect your personal information, for example, when you: ● Open an account or provide account information ● Use your credit or debit card ● Make transactions in your account ● Apply for a loan ● Contact us for assistance We also collect personal information from others, such as credit bureaus, affiliates, or other companies | Federal law gives you the right to limit only: ● Sharing for affiliates' everyday business purposes - information about your creditworthiness ● Affiliates from using your information to market to you ● Sharing for nonaffiliates to market to you State laws and individual companies may give you additional rights to limit sharing. See below for more on your rights under state law. |
Definitions
| Affilitates | Nonaffiliates | Joint marketing |
|---|---|---|
Companies related by common ownership or control. They can be financial and nonfinancial companies. | Companies not related by common ownership or control. They can be financial and nonfinancial companies. ● Non-affiliates we share with can include third party issuing banks, credit reporting agencies, service providers, and government entities. | A formal agreement between nonaffiliated financial companies that together market financial products or services to you. ● Not applicable. |
We may change this GLBA Notice from time to time. If we make any changes, we will change the version date. You will receive advance notice of any materially significant changes to this GLBA Notice.
Special notice for residents of CALIFORNIA: We will not share information we collect about you with nonaffiliates unless the law allows. For example, we may share information with your consent, to service your accounts, or to provide rewards or benefits you are entitled to.
Special notice for residents of NORTH DAKOTA: We will not share your information with nonaffiliated third parties, except for our everyday business purposes, for marketing our products and services to you or for joint marketing, with your consent (as required), or as otherwise permitted by law.
Special notice for residents of VERMONT: We will not disclose information about your creditworthiness to our affiliates, and will not disclose your personal information, financial information, credit report, or health information to nonaffiliated third parties to market to you, other than as permitted by Vermont law, unless you authorize us to make those disclosures. Additional information concerning our privacy policies can be found at the contact channels indicated in the section “Questions?” above.
Thank you for choosing Nu. This Privacy Notice (“Notice”) was created by us to show our commitment to always handling your personal data with security, privacy, and transparency. It describes the personal data wecollect, how it is used, stored, and shared, and presents your rights regarding such data.
PERSONAL DATA is any information that directly or indirectly defines a specific natural person, as defined by the applicable law.
The Controller of your personal data, that is, the company responsible for deciding how to handle your personal data, will be Nu United States LLC ("Nu" or “we”, “our”, “us”). By using our app, our website, or any of the products and services available to you through our app or website (“Services”), you acknowledge the contents of this Notice. For this reason, we recommend that you read the Notice until the end. If you don't agree to this Notice, or to any changes we subsequently make to this Notice, you must immediately stop using our Services or otherwise providing any information to us. If you have any questions about this Notice or our privacy practices, our channel listed in the "Contact us" section are at your disposal.
This Notice is applicable to:
Our Services are offered in partnership with the sponsor bank Lead Bank, Member FDIC, which provides banking services while we distribute and service these offerings, such as credit card, debit card, accounts, among other Services. All Services provided by Lead Bank are also subject to Lead Bank’s Privacy Policy. We are not responsible for the privacy practices of Lead Bank, which maintains their own Privacy Policy located at https://lead.bank/privacy-and-terms. By using our Services, you confirm that you have received the Lead Bank Privacy Policy and acknowledge the privacy practices disclosed therein. We also highlight that neither we nor any of our affiliates constitute a consumer reporting agency.
This Notice is part of our Terms and Conditions, which governs the use of our Services. Any terms we use in this Notice without defining them have the definitions given to them in the Terms and Conditions. By using them, you acknowledge the content of this Notice and of the Terms and Conditions.
We also refer you to our Gramm-Leach-Bliley Act (“GLBA”) Privacy Notice, which may apply to personal data we collect, use, and share in connection with offering you financial products or services, whether that information is obtained from you, from third parties, or by any other lawful means.
Finally, our Services are not intended for children under the age of 18 years old, and we do not knowingly collect personal data from children under the age of 18. If we discover that we have information from a child under the age of 18, particularly if we discover we have information from children under 13 years old in a manner that is inconsistent with the Children’s Online Privacy Protection Act (“COPPA”), we will delete it as quickly as possible. If you believe that a child under the age of 18 may have provided his or her information to us, please contact us through the channel listed in the "Contact us" section below.
To operate effectively, companies offering financial products and services like us need to use customer personal information. In the following section, we indicate the personal data we collect about you, and our reasons for using it.
We are not responsible for the accuracy, use or misuse of any content or information that you disclose or receive to us through the use of our Services.
When you provide us with personal data from third parties, you confirm that they have been made aware of this Notice.
SOCIAL SECURITY NUMBERS are treated as confidential and may only be accessed by and disclosed to our employees and others with a legitimate business need in accordance with applicable laws and regulations. Social Security numbers are subject to safeguards, and must be stored, transmitted, and disposed of in accordance with our internal policies created and maintained to protect confidential information from unlawful disclosure and to limit access. These restrictions apply to all Social Security numbers collected or retained by us and related service providers and vendors. Sharing your personal data with us is optional, but some personal data is essential for us to provide our Services. If you don't provide it, we won't be able to provide our Services to you. To opt out of the sharing of personal data with us, please submit a request through the channel indicated in the “Contact us” section below.
COOKIES are internet files that temporarily store what you are visiting on the network. We use cookies on our websites and also receive information from partners regarding cookies placed on their respective websites. We may use cookies to enhance your browsing experience, serve personalized content, and analyze our traffic. You can manage your cookies preferences through the pop-up cookie banner that appears when you first visit our website, or by changing your browser settings on your device to refuse the use of some cookies.
Regarding your GEOLOCATION DATA, you may opt out of its collection at any time by changing your settings on your mobile device. However, if you do so, certain features of our Services may not be available to you or the performance of certain features of our Services may be limited or not work at all.
We use Plaid Inc. (“Plaid”) as an intermediary to gather your data from financial institutions. By using our Services, you grant us and Plaid the right, power, and authority to act on your behalf to access and transmit your personal and financial information from the relevant financial institution. You agree to your personal and financial information being transferred, stored, and processed by Plaid in accordance with the Plaid Privacy Policy. We maintain contractual safeguards with Plaid to ensure that your information is processed in accordance with all applicable security and privacy standards. We may also collect information directly from financial institutions to allow us to tailor product offerings to you.
You understand that you are providing written instructions in accordance with the Fair Credit Reporting Act (FCRA) and other applicable law for us to request and receive copies of consumer reports, scores and other information about you from third parties. You further understand that your instructions let us obtain such information at any time for as long as you use our Services. Other third parties may provide additional information, such as employment, income, vehicle or driver information, or other information based on your credit profile, that allows us to customize product offerings and better evaluate applicants.
We must have a valid lawful basis for using your personal data. For this reason, we will only process your personal data in the following hypotheses:
We may use ARTIFICIAL INTELLIGENCE tools in the processing of your personal data for personalizing and improving our Services, investigating and implementing measures to prevent and combat frauds, among other purposes allowed by the applicable legal and regulatory obligations and in line with the commitments made in this Notice.
In certain circumstances, we may disclose your personal data to third parties for the purposes stated below:
| Third party | Purpose of sharing |
|---|---|
Other companies in our group |
|
Business partners, service providers, and other third parties |
possible proactive invitations to prospects
|
Authorities and regulatory bodies |
|
Upon your request |
|
When sharing your personal data with third parties, we will require them to use the personal data exclusively for the limited purpose for which we provide it, as well as to maintain reasonable security measures for the protection of such information, and comply with the provisions as outlined in this Notice and in the applicable data protection laws.
We do not sell, trade, or rent your personal data to third parties. We only share your personal data with third parties with your authorization, in connection with the provision of our Services, or other limited circumstances as specified herein.
When using our Services, you may be redirected to third-party websites or applications. Once redirected to a third-party website or application, privacy practices will be governed by their privacy notices and terms of use. We cannot control or be responsible for the privacy practices and content of third parties. Please read the applicable privacy notices carefully to understand how they collect and process your data.
We use various types of security measures to ensure the integrity of your personal data, such as information security standards practiced by the industry when collecting and storing personal data. Personal data may also be stored by means of cloud computing technology and other potential future technologies, always seeking to improve and enhance our services and security. We have a robust, highly qualified team responsible for ensuring that we adopt the best security practices, including:
You should also help protect your data. For this reason, we also recommend you never share your password with anyone; it is personal and non-transferable, and always be careful when posting your personal data on social networks or any other public environment. Keep your app and operating system updated to ensure maximum security.
We use commercially reasonable safeguards to help protect and secure your personal data. Although we work to protect the security of your account and other data that we hold in our records, please be aware that no method of transmitting data over the internet or storing data is completely secure.
If you suspect unauthorized activity with respect to your use of our Services, or you suspect a security incident has occurred, please contact us immediately through the channel listed in the "Contact us” section below.
Our Services are operated in the U.S. and are intended for a U.S. audience. If you visit or use one of our Services, your personal data may be stored or processed in the U.S.
To this end, we comply with all the requirements established by current legislation and adopt the best security and privacy practices to ensure the integrity and confidentiality of your personal data.
In certain jurisdictions you may be entitled under applicable law to have rights and choices with respect to your personal data, including: information about what personal data we have about you, access to this personal data, update, review, delete or restrict the processing of your personal data. Where we process your personal data based on consent, you have the right to withdraw your consent at any time with respect to future processing.
You may be entitled to exercise additional rights under the CCPA, as set forth herein.
We will not discriminate against you for exercising these rights.
To exercise any of your rights, please submit a request through the channel indicated in the “Contact us” section below.
We may require additional information from you to help us verify your identity and process your request. If we are unable to verify your identity, we may deny your request.
You may elect not to receive promotional emails from us either by unsubscribing to an email you receive from us or by contacting us through the channel indicated in the "Contact us" section below. If you unsubscribe from receiving emails from us, we may still send you non-promotional emails, such as emails about your account or our ongoing business relations, unless you withdraw your consent to receive electronic communications.
When applicable, and even if you stop using our Services, we may store your personal data for an additional period for auditing purposes, for compliance with legal or regulatory obligations, for the regular exercise of our rights, or also for the necessary period in accordance with the legal basis that justifies the retention of the data, always in compliance with the applicable law.
Your data will always be kept in a secure and controlled environment and will be deleted or anonymized as soon as its maintenance is no longer necessary or justifiable in accordance with the applicable data protection law.
We may from time to time change this Privacy Notice, but we always value transparency: whenever a relevant change is made, we will send you a notice indicating the new version in effect, and we will promptly post any Privacy Notice's changes to this page.
By continuing to use our Services after a change in this Notice, you will be agreeing to the new conditions - but you can always express your disagreement through our contact channels, if applicable. To stay informed of our privacy practices, we recommend you review this statement on a regular basis as you continue to use our Services.
If, after reading this Notice, you still have any questions or, for any reason, need to contact us for matters involving your personal data, you can contact us by phone at +1 888 880 0755, or by writing to us at 101 West Chapel Hill Street, Suite 300, Durham, NC 27701, or by emailing privacy@nu.com.
We are here to help you easily exercise your privacy rights and manage your personal data.
Residents of some U.S. states may have rights with respect to their personal information, such as rights to access, delete, or correct such information, and to opt out of certain processing activities. These rights do not apply where personal information is governed instead by federal financial privacy laws, such as the GLBA. For example, these rights do not apply to information that we collect about individuals who apply for or obtain our financial products and services for personal, family, or household purposes.
California residents
If you are a California resident, you have the right to ask businesses covered under the CCPA about personal data they have collected, sold, and disclosed for a business purpose about the customer in the past 12 months, submit an access, change, or deletion request, and opt out of the sale and sharing of personal information, if applicable.
If you would like to exercise your rights, have any questions about this section, or whether any of the following rights apply to you, please contact us through our channel indicated in the "Contact us" section.
These provisions do not apply to personal information collected, processed, shared, or disclosed by financial institutions pursuant to the GLBA or the FCRA. If there are any conflicts between this section and any other provisions of this Notice and you are a California resident, the portion that is more protective of personal data shall control to the extent of such conflict.
We will not discriminate against you for exercising your rights under the CCPA. We will not deny you our Services, charge you different prices or rates, or provide you a lower quality of goods and services if you exercise your rights under the CCPA. However, we may offer different tiers of our Services as allowed by applicable data privacy laws (including the CCPA) with varying prices, rates or levels of quality of the goods or services you receive related to the value of personal data that we receive from you.
We will not share your information with nonaffiliated third parties, except for our everyday business purposes, for marketing our Services to you, with your consent (when required), or as otherwise permitted by law. You may opt-out of data sharing with nonaffiliated third parties for marketing purposes by contacting us at privacy@nu.com.
Do Not Track (DNT) is a privacy preference that users can set in certain web browsers. When these web browsers allow you to instruct your browser to respond to DNT signals to the online services that you visit, it informs them that you do not want your online activities to be tracked. At this time, our Services are not designed to respond to DNT signals or similar mechanisms from browsers. However, we may update this
Notice, as appropriate, to reflect developments in this area.
Alaska, Illinois, Maryland and North Dakota residents
We will not share your information with nonaffiliated third parties, except for our everyday business purposes, for marketing our Services to you or for joint marketing, with your consent (when required), or as otherwise permitted by law. You may opt-out of data sharing with nonaffiliated third parties for marketing purposes by contacting us at privacy@nu.com.
Massachusetts, Mississippi and New Jersey residents
We will not share your information from deposit or share relationships with non-affiliates either for them to market to you or for joint marketing, except for our everyday business purposes, for marketing our Services to you, with your consent (when required), or as otherwise permitted by law. You may opt-out of data sharing with nonaffiliated third parties for marketing purposes by contacting us at privacy@nu.com.
Vermont residents
We will not share your information with nonaffiliated third parties, except for our everyday business purposes, for marketing our Services to you, with your consent (when required), or as otherwise permitted by law. We will not disclose information about your creditworthiness to our affiliates , and will not disclose your personal information, financial information, credit report, or health information to nonaffiliated third parties to market to you, other than as permitted by Vermont law. Additional information concerning our privacy policies can be found at the contact channels indicated in the section “Questions?” above. You may opt-out of data sharing with nonaffiliated third parties for marketing purposes by contacting us at privacy@nu.com.
Version date: July 16, 2026