{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"52528494-9dc1-47d6-85b0-cd445dc3572a","screeningDate":"2026-10-23T11:44:00.385Z","publicationGate":"published","company":{"id":"eaf6c865-63a3-4c4f-bd2b-00eb6d0071d5","name":"Wise","slug":"wise","industry":"FinTech"},"policy":{"id":"6e4db68c-6998-43dd-83ba-08eeab76e7f9","name":"Privacy Policy","type":"privacy","jurisdiction":"EU","sourceUrl":"https://wise.com/gb/legal/privacy-notice-personal-en"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-23T11:44:00.377Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":2,"sha256":"24c8d27f01acbce767c162ffbe4ae8a7b84223110b9383a7dc9c2b7723d84475","capturedAt":"2026-07-19T03:55:20.801Z"},"current":{"version":3,"sha256":"c98c9db2c903d6a34b8e2770153a37be8a6ab820a31508dc870af76a3d2cdae5","capturedAt":"2026-10-23T11:44:00.377Z"}},"analysisLineage":{"status":"verified","requestSha256":"cb41b435079bc5467aff7bfef175d835406e40afd02078fd9aa7940c07f153d2","responseSha256":"cd623c759e5b46402b5abda0e91a268cf8c85dca57b4e7d17cb4c59aee9d1564","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"24c8d27f01acbce767c162ffbe4ae8a7b84223110b9383a7dc9c2b7723d84475","charLength":59215,"byteLength":59405,"rangeUnit":"utf16-code-unit","includedRanges":[[0,59215]],"excludedRanges":[]},"new":{"sha256":"c98c9db2c903d6a34b8e2770153a37be8a6ab820a31508dc870af76a3d2cdae5","charLength":59215,"byteLength":59405,"rangeUnit":"utf16-code-unit","includedRanges":[[0,59215]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-07-19T03:55:20.801Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://wise.com/gb/legal/privacy-notice-personal-en","requestedUrl":"https://wise.com/gb/legal/privacy-notice-personal-en","finalUrl":"https://wise.com/gb/legal/privacy-notice-personal-en","capturedAt":"2026-10-23T11:44:00.377Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"The Wise Privacy Policy remains unchanged, with no new privacy implications for users or businesses.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"17e72515-975d-43e8-b71f-7891b529f17c","overallRisk":"Medium","overallScore":6,"screeningDate":"2026-07-19T03:55:20.809Z"},"scoreDelta":1,"direction":"higher","reasons":[{"icon":"warning","textEn":"Extensive collection of sensitive biometric data for KYC and fraud.","textIt":"Ampia raccolta di dati biometrici sensibili per KYC e frodi.","deltaScore":0,"evidenceQuote":"In some jurisdictions we will also collect facial scan data extracted from your photo or video (known as ‘biometric data’).","evidenceSide":"old","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"Automated decisions can impact users, though human review is available.","textIt":"Decisioni automatizzate possono impattare gli utenti, ma è disponibile revisione umana.","deltaScore":0,"evidenceQuote":"These processes may make an automated decision to reject your application or a proposed transaction, to block a suspicious attempt to log into your Wise account, or to close your account.","evidenceSide":"old","relatedKpi":"kpiAutomatedDecision","anchorStatus":"verified"},{"icon":"warning","textEn":"Broad sharing of personal data with numerous third parties.","textIt":"Ampia condivisione di dati personali con numerose terze parti.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiThirdPartySharing","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"No significant changes were found between the old and new versions of the policy.","textIt":"Nessuna modifica significativa è stata riscontrata tra le vecchie e nuove versioni della policy.","sentiment":"neutral"},{"textEn":"The policy continues to detail extensive collection of personal and biometric data.","textIt":"La policy continua a descrivere un'ampia raccolta di dati personali e biometrici.","sentiment":"negative"},{"textEn":"Automated decision-making processes are used, with a right to human review.","textIt":"Vengono utilizzati processi decisionali automatizzati, con diritto a revisione umana.","sentiment":"neutral"},{"textEn":"Data sharing with various third parties, including for marketing and fraud prevention, is broad.","textIt":"La condivisione dei dati con terze parti, anche per marketing e prevenzione frodi, è ampia.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Wise, as a financial institution, must ensure comprehensive GDPR compliance, especially concerning sensitive data and international transfers. Future AI Act compliance will be relevant for its AI usage.","complianceNoteEn":"GDPR, AI Act (future)"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Individuals face risks from extensive biometric data collection and automated decisions, though GDPR rights like access, deletion, and human review are explicitly mentioned. Cross-border transfers are controlled via SCCs and UK IDTA.","complianceNoteEn":"GDPR Art. 9, 22, 44"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Wise operates globally, requiring adherence to a multitude of international data protection laws. The policy outlines country-specific provisions to address regional requirements.","complianceNoteEn":"Global Compliance"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Individuals globally benefit from general data rights, but face risks from extensive data collection and sharing. International data transfers are managed with legal mechanisms.","complianceNoteEn":"Global Data Protection"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Wise must navigate various state privacy laws (e.g., CCPA) and federal financial regulations like GLBA. Compliance with these diverse frameworks is crucial for its operations.","complianceNoteEn":"CCPA, GLBA"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"California residents have CCPA rights, including data access, deletion, and limiting sensitive data use. The policy notes Wise does not sell personal information for compensation.","complianceNoteEn":"CCPA, GLBA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Certified"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Certified"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 3?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/52528494-9dc1-47d6-85b0-cd445dc3572a","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"85efd90fd608a397b4b6d675a7c3fdfe3aaca1e2c86a0cc5e6319f7a147f9fe0"}