Brex Privacy Policy
Revised May 7, 2020
Brex Inc. and Brex Treasury LLC (“Brex”) provide financial products and services to growing companies. We understand that by using Brex, you place your trust in us to handle your data and personal information appropriately, including your personal information and the personal information of individuals affiliated with your company, such as your company’s employees, contractors, or beneficial owners.
We want to make sure that you have all the information necessary about how we process—a fancy way of collectively saying use, collect, transmit, store, share, and erase—personal information, which does not include anonymized or aggregated data, so you can make an informed decision about how you want to interact with our products and services.
We know that you may have questions about how we process your personal information, so we have laid out how we process personal information about you. We’re always open to inquiries and suggestions on how we can improve; please reach out to our Privacy Team at privacy@brex.com.
Table of Contents
- Personal Information We Process and How We Process It
- How We Use Personal Information
- How We Share Personal Information
- Where We Store Personal Information
- Other Important Information About Your Personal Information
- Brex Cash and Your Personal Information
- Your Choices About Your Personal Information
- Changes to This Privacy Policy
- Contacting Us
- Previous Privacy Policies
1. Personal Information We Process and How We Process It
The personal information we process depends on the products you use and how you access them. We process information when you directly interact with Brex in the following ways:
- Filling out an application and creating a Brex Account
- Making a purchase using your physical or virtual Brex Card
- Using Brex Cash (such as sending or receiving funds via ACH, Wire, or Check, or investing in securities)
- Browsing brex.com or using dashboard.brex.com
- Using our iOS or Android mobile apps
- Connecting accounts to your Brex Account
- Calling, chatting, or interacting with Brex (such as with our Customer Experience or Sales, or texting us a copy of a receipt)
- Interacting with us at a conference, webinar, or event
Information We Process When You Use Our Products and Services
Information needed to apply and create a Brex Account
If you are opening a Brex Account, we need to process a certain amount of preliminary information about you, your company, and individuals associated with your company to create a Brex Account to comply with our legal and regulatory obligations. When you apply for a Brex Account, we may process:
- Your name
- Your title or role on your team
- Your email
- Your phone number
- Your address
- Your date of birth
- Your password (hashed) - unique, long, and strong, please
- Information related to your company, including the company’s legal name, address, copies of your company’s corporate documents, and Employer Identification Number (EIN)
- Information about individuals on your leadership team or individuals who have an ownership interest in your company
- Bank account information
- Other information pertaining to your identity such as copies of a passport, driver’s license, or other national ID
- Your Tax Identification Number (TIN) or your Social Security Number (SSN)
- Revenue information (such as information related to Shopify, Amazon, or other ecommerce revenue platforms)
- Personal information provided to us from third-party companies we partner with to offer services to you (see below).
Information needed to use our products and services
We need to process personal information when your company assigns you a Brex Card or otherwise allows you to use our products and services (for example as an employee or authorized representative). To use these services, we may process:
- Your name
- Your email
- Your phone number
Information processed when you make a transaction
Each time you make a payment using a Brex Card, we receive information about your transaction. We may receive this information directly from you or from our financial partners (including Emigrant Bank or Sutton Bank) or the card networks (Mastercard or Visa). We may process:
- Payment method information (card number, card type, PIN)
- Purchase amount
- Purchase date
- Purchase location
- Whether you made the purchase online or in a store
- Receipt information
- Information provided to us by the card network associated with transactions, merchants, or cardholders
Information automatically processed when you visit our websites or use our mobile app
We process personal information automatically when you visit our website or use our mobile app to make our services work, to prevent fraud and enhance security, to understand your preferences, and to tailor services to you for the best possible experience. We may process:
Browser and device information.
- IP address
- Mobile and other hardware or device identifiers
- Operating system
- Browser information, such as type and version
- Referring and exit pages, including landing pages and pages viewed
- Device event information, including crash reports, request and referral URLs and system activity details
Information about your use of our website or mobile app.
- Your location
- What you click on and what you type, time you spend on our websites, and other user experience information
Cookies and trackers. We also use cookies and other activity tracking tools to help our website function effectively. These tools allow us to:
- Provide you services such as those that allow you to chat with our Customer Experience team
- Perform website and mobile analytics
- Improve the advertisements you see
- Help prevent fraud and prevent attacks against our websites and services
- Advertise and promote Brex products and services, and additional products and services from our partner companies
We use cookies and trackers to assign you a unique identifier so we can record:
- Websites you visit
- Length of time the advertisement was visible
- IP Address
You can block these at any time using your web browser settings, but doing so may limit browsing experience and your ability to use certain features of our services.
Information processed when you interact with Brex teams
We may process personal information about you when you call, chat, email, or interact with members of Brex teams (such as Customer Experience, Sales, or Marketing), including:
- Your name
- Your email, phone number, or other contact information
- Content of your communications, including, in some cases recorded calls, and survey responses
Information processed when you join a webinar or event
We may process personal information about you when you join Brex at an event in person or online via a webinar. We may collect this information directly or obtain it from a third-party service provider. We may process:
- Your name
- Your email or other contact information
- Registration date and time
- Webinar attendance information, when you joined a webinar, when you left, if you were paying attention, and what country you joined from
Information processed when you enter into a sweepstakes, contest, or other promotion
We may process personal information when you enter a sweepstakes, contest, or promotion to administer those programs, including:
- Your name
- Your email, phone number, or other contact information
- Other personal information required for you to participate
Information processed when you use Brex Cash
Brex Treasury LLC may process personal information about you when you use Brex Cash to deposit or send checks, send or receive an ACH or wire, or interact with Brex Cash sales or customer experience representatives. We may process:
Brex Account and Brex Cash Information
- Information associated with your Brex Account
- Available funds
- Lifetime earned yield
- Available points
Information related to an ACH payment.
- Recipient name or company
- Sender name or company
- Amount sent
- Amount received
- Routing and account numbers
- Recipient bank and account name
- Account type
- Other information generated when a payment is made through the ACH Network
Information related to a wire transfer.
- Recipient name or company
- Sender name or company
- Amount sent
- Amount received
- Routing and account numbers, including IBAN & SWIFT code
- Recipient bank and account name
- Recipient address and country
- Wire instructions or purpose of payment
- Other information generated when a payment is made through an electronic payment transfer network
Information related to the processing of a check.
- Recipient name or company
- Sender name or company
- Amount sent
- Amount received
- Memo
- Recipient address and country
- Recipient email
- Pictures of a check and related information (routing and account numbers, address of sender, telephone of sender, signatures of sender and endorser).
Information Processed from Our Business Partners and Service Providers
We process personal information we receive from financial partners, identity verification services, and other third-party service providers, and information you share with us about your use of their products and services:
- To comply with regulatory and reporting obligations
- To facilitate your use of our products or services, or other products and services
- To underwrite your account
- To conduct fraud monitoring, prevention, and detection
- To fulfill commitments to our business partners
- To fulfill requests made by you
Information necessary to comply with regulatory and legal requirements
When you open a Brex Account as a company owner or an administrator on behalf of a company, or you provide information of an individual with an ownership interest in a company, we process personal information we receive from identity verification services and other third-party service providers that we must keep to comply with the law, including:
- Your name
- Your phone number
- Your SSN
- Your current or previous addresses
- Your date of birth
Information processed to integrate third-party products and services with your Brex Account
When you choose to link your Brex Account with products and services provided by our business partners, we process personal information we receive from them to ensure our products and services work properly together.
Your bank. To underwrite, provide you the highest credit limit possible, and determine your eligibility for Brex Rewards, we require you to give us information about your company’s finances and access to your company’s bank account. We use third-party service providers to process information about your company’s bank account activity. When you link your bank account, we may process the bank account credentials and all information associated with the bank accounts associated with those credentials, including:
- Unique identifiers associated with your bank
- Account names
- Bank account type
- Transaction history and related information
- Account balances
- Bank routing and account numbers
If you do not link your bank directly, we process information you provide with copies of your bank statements and other financial information about your company .
To link your bank account with your Brex Account, a third-party service provider may use and store your bank account credentials. We do not store your bank account credentials on Brex systems.
Brex Account connections. We offer the ability to connect your Brex Account with accounting services (such as QuickBooks Online, Xero, and Netsuite), travel services, and other products and services. We both provide personal information to and receive personal information from these services on your behalf.
Accounting and expenses services. When you direct us to connect your Brex Account to these services, we collect certain information to make those integrations work, including:
- Unique identifiers associated with the third-party connected account
- Information associated with your general ledger account
- General ledger account codes
- Locations
- Classes
- Departments
- Email addresses
The information we collect may differ based on the accounting service and the choices you make relating to that service.
Ecommerce revenue platforms. When you connect to an ecommerce revenue platform like Shopify or provide us ecommerce revenue data via other platforms like Amazon, Paypal or Braintree, we receive data about your ecommerce revenue account, including:
- Account data
- Product, order, and payment data
- Store analytics
- Any other data that you may share with us related to those accounts
Travel services. When you book travel through dashboard.brex.com/travel, we process information from our travel partners about your travel plans, including:
- Unique identifiers associated with the travel service
- Details about your booked flight
- Details about your hotel reservation
- Rewards balances and transfer information
Program partners. We get information from financial service providers such as our issuing bank, card networks, and financial institutions that process payments on our behalf to make our services work. The information we get includes personal information related to your transactions using a virtual or physical Brex Card as described above.
Information processed to conduct fraud monitoring, prevention, and detection
We process personal information from our business partners, financial service providers, credit reporting agencies, identity verification services, public sources, and other third parties to prevent fraud.
Information processed as a result of a business partnership, referral, or agreement
We enter into agreements with financial partners and other businesses that provide products and services related to ours, and as a result of these partnerships, Brex may receive personal information related to that particular relationship or partnership. We may process information about:
- You and your relationship with the business partner
- Your email or other contact information
- Your membership or relationship status with the business partner
2. How We Use Personal Information
We process your personal information for the reasons stated specifically in this policy, but we may also process personal information about you to:
Operate our business and provide tailored services to you.
- Communicate with you about the products and services by phone, text, email, or chat
- Monitor, prevent, and detect fraud or unauthorized activity
- Secure our systems and products
- Mitigate financial loss, claims, liability, and other harm to our users, Brex, our partners, or third parties
- Manage, operate, and improve the performance of our products and services
- Determine eligibility for Brex products or services
- Help you make or receive a payment via ACH, wire, or check
- Use Brex Cash information to underwrite Brex Card
- Provide you with tailored recommendations
- Identify, fix, and troubleshoot bugs and errors
- Facilitate reporting, analyze performance, and auditing
- Understand how you use our services so we can make enhancements or improvements
- Facilitate business relationships or comply with contractual obligations
- Comply with our regulatory, legal, and other compliance obligations
- Advertise or market services and products to you
- Determine eligibility for, calculate, and provide Brex Rewards
- Compare information for accuracy and verify it with third parties
- If you elect to share information about your geolocation, we will use this information to enhance the security of our products and services and to prevent fraud
Provide you with support.
- Help identify and troubleshoot problems with your account
- Survey your opinions through surveys or questionnaires
- Communicate with you and respond to your specific requests or questions
- Manage and send you notifications, confirmations and important information about your account and our products and services
Anonymized and aggregated data
To better target advertisements, improve, and market our products and services, and for other promotional purposes, we may reasonably transform personal information into de-identified information removing or masking information that could be used to identify you and by aggregating or combining de-identified data with other information. If you don’t want us to use your data in anonymized or aggregate form for promotional purposes, contact us at privacy@brex.com.
Sharing for business purposes only
Brex may provide personal information to third parties to improve our products and services, to operate our business, and to help Brex market to potential customers. We may share all of the categories of information listed in this Privacy Policy with other companies:
- To operate Brex’s products and services or support general operations of Brex’s business
- To integrate the products and services of our business partners with your Brex Account
- To use third-party cloud services to host our website and store the information we process about you
- For any other legitimate business purpose
No sale of personal information
We do not and will not sell or allow our service providers to process your personal information for their own use without your express consent, unless the processing of that information is either required by law or we determine that disclosure is reasonably necessary to enforce our rights, protect our property or operations, or enforce the rights and protect the property or operations of our business partners and customers.
Making a payment
We share some personal information about you, such as your name and information about the payment method, with the person or merchant you are paying.
Anonymous or aggregated information
We may share anonymized or aggregated information, or other data that does not directly identify you or your company, with third parties.
Affiliate sharing
Brex Inc. may share personal information we process about you with other Brex companies to provide additional services to you, determine eligibility for new products and offers, and for other legitimate business interests.
Brex Cash. If applicable, Brex Inc. shares information related to your Brex Account with Brex Treasury LLC in order to provide Brex Cash services to you. With your express consent, Brex Treasury LLC shares data with Brex Inc. to help Brex Inc. underwrite Brex Card and tailor your Brex Card services.
Service providers
We share your personal information with our service providers that operate and provide services on our behalf. These service providers need access to your personal information to perform information processing, manage or enhance our customer information, tailor services to you and your preferences, and perform other services related to our business. We work with our service providers to make sure that they do not sell the personal information that we share with them.
Advertising
We may use third parties to send advertisements on our behalf. We may only share a very limited set of personal information required to deliver our advertisements to you (such as an email address to deliver the message to you), and we do not permit these third parties to use or share your personal information to advertise unaffiliated products or services to you. These third parties may also use cookies or similar tracking tools to identify you through your browser usage. While you may disable these tools in your browser settings, you may still receive non-targeted advertisements we sent as part of a general marketing campaign.
Financial and business partners
We share personal information to facilitate the services we provide to you with our business and financial partners.
Card issuing partners. Brex Inc. partners with Emigrant Bank and other banks to issue cards to you. Brex owns and controls the transaction data and other personal information we share with card issuing partners. We share the personal information you provide in your application for a Brex Account with our card issuing partners to comply with our contractual obligations and to facilitate compliance with their and our regulatory obligations. Our card issuing partners do not sell or use your personal information or use any related data to market or to develop products and services, or for any other purpose not authorized by us.
Credit reporting agencies. We share information about you and your account with credit reporting agencies to verify information about your business, to report on your business’s performance, and to report late payments, missed payments, or other defaults, which in some cases may contain personal information.
Card network partners. Mastercard or Visa separately processes information related to your use of your cards. For more information on how Mastercard and Visa handle your personal information, please visit Mastercard’s Global Privacy Notice or Visa’s Global Privacy Notice, respectively.
Brex Cash partners. Brex Treasury LLC shares transaction data and personal information about you with its financial institution partners and service providers, including banks that we use to help process transactions and funds in which your money is invested, to comply with contractual obligations, and allow us to execute on your transaction or investment instructions. Brex owns and controls the transaction data and other personal information we share with these partners.
Partnerships and referrals. We share personal information to facilitate referral partnerships. For example, if you were referred to us through an organization we may provide confirmation to that organization that your company opened a Brex Account with us, and information relating to your Brex Account activity solely for the purpose of calculating any referral fees we owe related to the referral.
Sharing authorized by you, your users, or authorized representatives
We continually enhance our products and services by integrating with products and services provided by other companies. For these integrations to work and with your explicit consent, we may need to share your personal information with them. Information we share with these companies will be used and disclosed according to that company’s privacy policy. You should review the privacy policy of any company that has access to your personal information related to the integration with your Brex Account.
Accounting and expenses integrations. We offer integrations with many popular accounting services (such as QuickBooks Online, Xero, and Netsuite). We share information with those services solely as directed by you, your users, or authorized representatives.
Travel partners. We share personal information with our travel partners. Our travel partners use this information solely to book travel and provide services to you.
Corporate transactions
In the event of a corporate sale, merger, reorganization, dissolution or similar event, personal information and data we process from you may become part of the assets we transfer or share in preparation for any such transaction. Any acquirer or successor of Brex may continue to process personal information consistent with this Privacy Policy.
Compliance and compelled disclosure
We may share personal information:
- to comply with applicable law, regulation or payment network rules
- to enforce our contractual rights or comply with contractual obligations
- to protect the rights, privacy, safety and property of Brex, you, our customers, our business partners, or others
- to respond to requests from auditors, courts, law enforcement agencies, regulators, and other public and government authorities, which may include authorities outside your country of residence. When complying with court orders and other similar legal processes, Brex strives for transparency. We will make reasonable efforts to notify our customers and users of any disclosure of their personal information, unless we are prohibited by law, court order, or exigent circumstances prevent us from doing so.
4. Where We Store Personal Information
We provide and direct our services only to companies incorporated in the United States and for use exclusively by their employees or authorized representatives. We may process and store personal information for the purposes described in this Privacy Policy in the United States or any other country in which Brex, its subsidiaries, affiliates, or service providers operate. We will store this information while we continue to provide products and services to you, to operate our business, comply with contractual obligations, and for as long as required by law.
If you ask us to delete specific personal information (see “Your Choices About Your Personal Information” below), we will honor your request unless deleting the information prevents us from billing for our products and services, calculating taxes, conducting required audits, or carrying out other legitimate business functions, or we are required by law or contractual obligation to keep that information.
5. Other Important Information About Your Personal Information
Security
We use organizational, technical, and administrative measures to protect personal information; however, no data security program is entirely secure. Please contact us at privacy@brex.com immediately if you believe that your personal information or any other confidential information that you have provided to us is no longer secure or has been lost or stolen. If we confirm that there has been a breach of personal information or confidential data related to you, we will notify you.
Use by minors
If you are under the age of 16, you may not have a Brex Account or use our products or services. We do not knowingly process any information from, or direct any of our products or services to children under the age of 16. Please do not provide us with any personal information related to children under the age of 16.
Personal information related to administrators, employees, company owners, and authorized persons or representatives
In some circumstances, we require you to provide us with personal information relating to another person (such as providing us with personal information about the owners of your business during the application process or providing us with personal information about your employees). Do not provide us with any personal information unless you have obtained consent of these persons or you are sure the disclosure of the personal information is otherwise permitted by law or contract. You must inform all other persons whose information you share with us how we process personal information and all other terms of this Privacy Policy.
Brex Account users
Our products and services are intended for use only by companies, and you may only use a Brex Account or Card if you are an employee or other authorized representative of a company that has opened a Brex Account. The company’s administrator is responsible for the Brex Account and cards associated with that company. An administrator can: restrict, suspend, or terminate your access to or ability to use the services, access personal information about you, access or retain information stored with us, and restrict your ability to edit, restrict, modify, or delete information associated with your use of our products and services.
6. Brex Cash and Your Personal Information
When you sign up for Brex Cash, information related to and collected as a result of your use of that product will be collected by Brex Treasury LLC. Information directly related to your use of the Brex Cash product, as highlighted above, is owned and controlled by Brex Treasury LLC. All other personal information, including information related to your Brex Account, is controlled and owned by Brex Inc.
7. Your Choices About Your Personal Information
Electronic communications
You may choose not to receive promotional emails from us by following the unsubscribe/opt-out instructions in those emails, but we may still send you non-promotional messages relating to material or transactional information about our products and services such as updates to our platform agreement, privacy notices, security alerts, and other notices relating to your access to or use of our products and services.
Deletion or closure of a Brex Account
Closure or deletion of your company’s Brex Account will mean that you permanently lose access to the personal information and data associated with the Brex Account. Certain personal information or de-identified information associated with your company’s Brex Account may nonetheless remain on systems owned or maintained by Brex where required to comply with the law, our contractual obligations, or carrying out legitimate business functions.
Application rejection
To comply with legal and regulatory obligations, we retain certain personal information associated with rejected applications for Brex Accounts.
California rights
If you are a California resident, you have certain rights over the information that we have about you. You can:
- Access a copy of any personal information we have about you
- Delete any personal information we have about you when we do not have legal or contractual obligations to keep the information or a need for the information to carry out a legitimate business function
- Correct any personal information we have about you either in your settings, by contacting your Brex Account administrator, or by contacting us as provided below
Exercising your choices
To exercise your choices about your personal information, please contact our Customer Experience team at (833) 228-2044 during available support hours. We will need to verify your relationship to the Brex Account (for example, if you’re an administrator of a Brex Account) and verify your identity. Verification will require that you verify your email and phone number and provide a copy of a government issued ID to us. We may take additional steps to verify that you are authorized to make the request. If you are an end user of Brex’s services and not a direct customer of Brex (for example, your company uses Brex and you’re an employee or authorized representative of that company), you should direct requests relating to your personal information to the administrator of your company’s Brex Account. We will not discriminate against you for exercising any of your rights.
Sale of personal information (“Do Not Sell My Personal Information”). We do not sell your personal information.
8. Changes to This Privacy Policy
We may make minor updates to this Privacy Policy, and we encourage you to visit this site from time to time to be aware of and review any updates. We will notify you of material changes, changes that limit any of the rights you have related to the manner in which we process your personal information under this Privacy Policy, or that we are required to disclose by law, via a prominent notice on our website, login screen, your mobile app, or via email at least 30 days prior to the changes taking effect. We also provide information about how our Privacy Policy has changed over time in the Previous Privacy Policies section or on our Github.
9. Contacting Us
If you have concerns, questions, or would just like to better understand our privacy practices at Brex, please send an email to privacy@brex.com or if you prefer to contact us by mail, please write to Brex Inc., Attn: Legal, 405 Howard St, Floor 2, San Francisco, CA 94105.