{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"4ee896c8-0630-4d8f-b571-78aae3c51db3","screeningDate":"2026-10-23T11:44:36.570Z","publicationGate":"published","company":{"id":"eaf6c865-63a3-4c4f-bd2b-00eb6d0071d5","name":"Wise","slug":"wise","industry":"FinTech"},"policy":{"id":"3e616451-ba60-46e6-9634-d5925da2d56a","name":"Privacy Policy","type":"privacy","jurisdiction":"Global","sourceUrl":"https://wise.com/gb/legal/privacy-notice-personal-en"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-23T11:44:36.556Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"24c8d27f01acbce767c162ffbe4ae8a7b84223110b9383a7dc9c2b7723d84475","capturedAt":"2026-07-19T03:55:44.125Z"},"current":{"version":3,"sha256":"c98c9db2c903d6a34b8e2770153a37be8a6ab820a31508dc870af76a3d2cdae5","capturedAt":"2026-10-23T11:44:36.556Z"}},"analysisLineage":{"status":"verified","requestSha256":"cb41b435079bc5467aff7bfef175d835406e40afd02078fd9aa7940c07f153d2","responseSha256":"fcb60c4dc72a2d4f8ee2ec0d028ff8747b063094617023a60c610847802165b0","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"24c8d27f01acbce767c162ffbe4ae8a7b84223110b9383a7dc9c2b7723d84475","charLength":59215,"byteLength":59405,"rangeUnit":"utf16-code-unit","includedRanges":[[0,59215]],"excludedRanges":[]},"new":{"sha256":"c98c9db2c903d6a34b8e2770153a37be8a6ab820a31508dc870af76a3d2cdae5","charLength":59215,"byteLength":59405,"rangeUnit":"utf16-code-unit","includedRanges":[[0,59215]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-07-19T03:55:44.125Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://wise.com/gb/legal/privacy-notice-personal-en","requestedUrl":"https://wise.com/gb/legal/privacy-notice-personal-en","finalUrl":"https://wise.com/gb/legal/privacy-notice-personal-en","capturedAt":"2026-10-23T11:44:36.556Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"Wise's Privacy Policy remains unchanged, detailing extensive data collection, AI use, and global sharing practices with regional rights.","overallRisk":"Medium","overallScore":6,"previousPublicChange":{"id":"2e62256f-eb3a-45c5-95ba-e7b297822af5","overallRisk":"Medium","overallScore":6,"screeningDate":"2026-07-19T03:55:44.131Z"},"scoreDelta":0,"direction":"unchanged","reasons":[{"icon":"warning","textEn":"Biometric data collected for identity verification and fraud prevention.","textIt":"Dati biometrici raccolti per verifica identità e prevenzione frodi.","deltaScore":0,"evidenceQuote":"In some jurisdictions we will also collect facial scan data extracted from your photo or video (known as ‘biometric data’).","evidenceSide":"old","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"AI models used for financial crime and fraud prevention with limited transparency.","textIt":"Modelli AI usati per crimini finanziari e prevenzione frodi con trasparenza limitata.","deltaScore":0,"evidenceQuote":"We may use Artificial Intelligence (“AI”), including machine learning models and generative AI large language models (LLMs) to improve the efficiency and effectiveness of our services and our financial crime and fraud prevention processes.","evidenceSide":"old","relatedKpi":"kpiAlgoTransparency","anchorStatus":"verified"},{"icon":"alert","textEn":"Broad sharing of personal data with various third parties, including advertisers.","textIt":"Ampia condivisione di dati personali con terze parti, inclusi inserzionisti.","deltaScore":0,"evidenceQuote":"Advertisers and advertising networks to select and serve relevant advertisements to you and others, including via cookies, pixels, and other technologies.","evidenceSide":"old","relatedKpi":"kpiThirdPartySharing","anchorStatus":"verified"}],"keyPoints":[{"textEn":"Wise collects extensive personal data, including biometrics, geolocation, and user interactions.","textIt":"Wise raccoglie dati personali estesi, inclusi biometrici, geolocalizzazione e interazioni utente.","sentiment":"negative"},{"textEn":"AI is used for service improvement and fraud prevention, with user notification for direct AI interaction.","textIt":"L'IA è usata per migliorare i servizi e prevenire frodi, con notifica per interazioni dirette con l'IA.","sentiment":"neutral"},{"textEn":"Data is shared broadly with group companies, financial partners, advertisers, and fraud agencies globally.","textIt":"I dati sono ampiamente condivisi con aziende del gruppo, partner finanziari, inserzionisti e agenzie antifrode.","sentiment":"negative"},{"textEn":"Automated decisions are made for applications and transactions, with a right to request human review.","textIt":"Decisioni automatizzate per richieste e transazioni, con diritto a revisione umana.","sentiment":"neutral"},{"textEn":"Specific data protection rights are detailed for users in the EEA, California, India, Japan, UK, and Mexico.","textIt":"Diritti specifici sulla protezione dei dati sono dettagliati per utenti in SEE, California, India, Giappone, UK e Messico.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Wise's use of SCCs and the UK Addendum for international transfers supports GDPR compliance for businesses. However, extensive data processing necessitates robust Data Processing Agreement management.","complianceNoteEn":"GDPR Art. 28, 46"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"GDPR ensures strong rights for individuals, including explicit consent for sensitive data like biometrics and the right to human review for automated decisions. Users should be aware of data transfers outside the EEA.","complianceNoteEn":"GDPR Art. 6, 9, 22, 44"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Companies relying on Wise for financial services need to understand Wise's global data practices to align with their own international compliance obligations. This includes cross-border data transfer rules.","complianceNoteEn":"International Data Transfers"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Global users benefit from general data rights, but specific protections vary significantly by local jurisdiction. Awareness of biometric data collection and automated decision-making processes is crucial.","complianceNoteEn":"Global Privacy Standards"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses using Wise must ensure their own compliance with various US state privacy laws, especially regarding data shared with third parties. The policy's broad data sharing requires careful vendor assessment.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"CCPA/CPRA grants rights like data access, deletion, and opt-out of sharing, though financial data often falls under GLBA exemptions. Biometric data collection remains a key privacy consideration.","complianceNoteEn":"CCPA/CPRA, GLBA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Certified"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Certified"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/4ee896c8-0630-4d8f-b571-78aae3c51db3","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"a186271778fb914467d7ee588fd22bf4b761cb859a2f16054a852b762cce7430"}