The short answer
A privacy policy is not written to inform you. It is written to make a set of data practices legally defensible while sounding reassuring. Read linearly and it works exactly as designed: you get tired somewhere around paragraph nine and conclude it seems fine.
Read it out of order and it becomes a useful document. Six sections carry essentially all the information, they are always present because regulation requires them, and none of them is the introduction.
Fifteen minutes is enough if you know where to go.
Read these six, in this order
1. Who is the controller. Usually the first or last section, often titled “Who we are”. You are looking for a legal entity name and a country. This is the single most consequential fact in the document, because it determines which law applies, which regulator you complain to, and who you can actually sue. If the brand is “Fluxpay” and the controller is “Fluxpay Technologies Pte. Ltd., Singapore”, your GDPR rights depend on entirely different mechanics than if it were an Irish entity.
2. The retention section. Search for “retain”, “retention” or “how long”. You want a period. What you will usually find is “as long as necessary for the purposes described”, which is a non-answer with legal cover. A policy that gives actual periods — 90 days for logs, seven years for transaction records because tax law requires it — is telling you the company has done the work internally. A policy that never commits to a number has either not done it or does not want to be held to it.
3. The sharing section. Titled “Disclosure”, “Sharing”, or “Who we share with”. The important distinction is between named third parties and categories. “We share data with our service providers” is a category and tells you nothing — it covers three vendors or three hundred. Look for a linked sub-processor list. Its existence is a meaningful signal; its absence is one too.
4. Legal basis, if the policy is GDPR-shaped. Search for “legitimate interest”. This is the flexible basis, and its scope tells you where the company has decided it does not need your consent. Legitimate interest for fraud prevention is uncontroversial. Legitimate interest for “improving and developing new products” is doing much heavier lifting, and it is where analytics and model-training frequently live.
5. International transfers. Search “transfer”, “outside the”, “third country”. You want to know where data physically goes and what mechanism legitimises it — standard contractual clauses, an adequacy decision, or the EU-US Data Privacy Framework. A policy that says data “may be processed globally” with no mechanism named is either badly drafted or hoping you will not ask.
6. The change clause. Almost always the final section. Two versions exist. Either the company notifies you of material changes and gives you a period to object, or it posts the new version and your continued use constitutes acceptance. The second is standard and mostly unavoidable, but combined with a vague retention clause it means today’s reading has a short shelf life.
Four phrases and what they actually mean
“We may share your information with trusted partners.” Trusted has no legal content. It is a warmth word inserted before a disclosure. Read the sentence without it and see what remains.
“We do not sell your personal data.” Often true and frequently irrelevant. “Sell” has a narrow statutory meaning in some jurisdictions and none in others. Data can be shared, licensed, disclosed to partners, or used to target advertising without any of it being a sale. If the policy denies selling but describes extensive sharing three paragraphs later, both statements are accurate.
“Aggregated and anonymised data.” The important question is whether anonymisation is genuine and irreversible, because if it is, that data leaves the scope of data protection law entirely and the company can do anything with it. Transaction data is notoriously difficult to anonymise — spending patterns are close to unique fingerprints, which what your bank transaction history actually reveals covers in detail. Where “aggregated and anonymised” is doing a lot of work in a policy, treat it as a claim rather than a fact.
“Industry-standard security measures.” No information content whatsoever. Every company says this. It is compatible with excellent security and with none. Look instead for named certifications with scope, or a public security page.
Signals that are worth more than the prose
A dated version, with a changelog. Companies that publish a version history have a governance process. Most do not.
A linked, specific sub-processor list. Naming your vendors is a commitment that costs something to maintain.
Numbers in the retention section. Discussed above, and the most reliable single signal in the document.
A named DPO with a real contact route. Required for many organisations, and a functioning address is easy to test.
A stated process for deletion and access requests. Not merely “you have the right to request deletion” — the mechanism. An in-app control is a stronger signal than an email address, and an email address is stronger than a postal form.
The two-document trap
For any app that connects to a financial account, the privacy policy is rarely the whole story. There will be a second document — terms of service, a consent screen, or a data-sharing authorisation — that grants permissions the privacy policy describes only in the abstract.
In Open Banking specifically, the consent screen is the operative legal moment, not the privacy policy. The scopes on that screen define what the app can actually read. What you actually agree to when an app connects to your bank covers what those scopes mean.
Where the two documents disagree — and they do — the more specific one usually governs.
What to do with what you find
The realistic outcome of this exercise is not that you refuse to use the app. It is that you calibrate how much you feed it.
If retention is unbounded and sharing is described only by category, use the service for what it is good at and do not treat it as a permanent archive of your financial life. If the policy is specific, dated, and names its processors, you can extend more trust — not because the company is virtuous, but because it has made commitments that can be checked and enforced.
Fifteen minutes buys you that calibration. It does not buy you certainty, and nothing does.