{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"449c973d-b19b-4d7c-976b-ffcb63bf0665","screeningDate":"2026-07-06T22:10:09.404Z","publicationGate":"published","company":{"id":"51f8db0f-3aef-472e-91d7-da30b3ceec4d","name":"Plaid","slug":"plaid","industry":"FinTech"},"policy":{"id":"ff752150-58b8-4675-b2c6-2fa37e5a66cb","name":"Privacy Policy","type":"privacy","jurisdiction":"US","sourceUrl":"https://plaid.com/legal"},"sourceConfidence":{"state":"review-required","lastCheckedAt":"2026-07-06T09:39:08.878Z","retrievalChannel":"other","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":null,"current":{"version":1,"sha256":"8cd752cc9c499f6a0c444e9588f418b1fd12628c521190313a626bf51b3baa28","capturedAt":"2026-07-06T22:10:09.396Z"}},"assessment":{"summary":"Plaid collects extensive personal and financial data, uses it for AI training, and shares it broadly, but offers a portal for some user control.","overallRisk":"High","overallScore":7,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"warning","textEn":"Explicitly uses user data for AI system training.","textIt":"Utilizza esplicitamente i dati utente per l'addestramento AI.","deltaScore":2,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"alert","textEn":"Collects a very broad range of sensitive financial data.","textIt":"Raccoglie un'ampia gamma di dati finanziari sensibili.","deltaScore":2,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Broad data sharing with many third parties and affiliates.","textIt":"Ampia condivisione di dati con terze parti e affiliati.","deltaScore":2,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Extensive collection of personal, financial, and device data.","textIt":"Ampia raccolta di dati personali, finanziari e del dispositivo.","sentiment":"negative"},{"textEn":"User data is explicitly used to train Plaid's AI systems.","textIt":"I dati utente sono esplicitamente usati per addestrare i sistemi AI di Plaid.","sentiment":"negative"},{"textEn":"Data is shared with app developers, financial institutions, and many service providers.","textIt":"I dati sono condivisi con sviluppatori, istituzioni finanziarie e molti fornitori di servizi.","sentiment":"negative"},{"textEn":"Plaid Portal offers tools to view connections and delete data.","textIt":"Plaid Portal offre strumenti per visualizzare le connessioni e cancellare i dati.","sentiment":"positive"},{"textEn":"Data is transferred internationally, including to the US, with safeguards.","textIt":"I dati sono trasferiti a livello internazionale, inclusi gli Stati Uniti, con garanzie.","sentiment":"neutral"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using Plaid must ensure their contracts and DPIAs cover Plaid's data processing, especially AI use and international transfers under GDPR.","complianceNoteEn":"GDPR Art. 28, 35, 44"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"Extensive data collection, AI training, and US data transfers raise significant GDPR concerns. Users face high risk regarding their financial privacy and control.","complianceNoteEn":"GDPR Art. 5, 6, 9, 44"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises must conduct thorough due diligence on Plaid's practices, especially regarding data residency, AI use, and compliance with diverse global regulations.","complianceNoteEn":"Cross-border Data Transfer"},{"region":"Global","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The extensive data collection, AI training, and international transfers pose significant privacy challenges across diverse global jurisdictions.","complianceNoteEn":"Global Privacy Standards"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises must ensure their agreements with Plaid align with state privacy laws and industry-specific regulations for financial data.","complianceNoteEn":"GLBA, State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Broad data collection, sharing, and AI training raise concerns under state privacy laws like CCPA/CPRA. The biometric data notice is a positive step.","complianceNoteEn":"CCPA/CPRA, Biometric Laws"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"not-assessed","assessedCount":0,"mappedFieldCount":4,"evidence":[]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"not-assessed","assessedCount":0,"mappedFieldCount":4,"evidence":[]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"not-assessed","assessedCount":0,"mappedFieldCount":4,"evidence":[]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"not-assessed","assessedCount":0,"mappedFieldCount":4,"evidence":[]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 1?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/449c973d-b19b-4d7c-976b-ffcb63bf0665","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"a43a0ecff54774afc2106c416d6e8188bb4ca57f0b2a8ac9c15484c77ec9ce17"}