ATM Cash Advance・Instant Money

"If you authorize our access to your location data, we will share that data with third-party marketing partners, such as InMarket, in order to provide the services and features of Location Rewards. Even if you disable this, we may make certain assumptions about your location from your IP Address, or other information related to your use of the Services."

GPS location data is shared with third-party marketing partners like InMarket, and even if users disable location tracking, ATM.com still infers location from IP addresses and other signals.

"When you access the Services using a computer or mobile device, we may collect specific device information, including your MAC address and other unique device identifiers. We also collect information such as the type of device you are using, its operating system, and mobile network information, which may include your mobile phone number. Category E: Biometric information. Examples: Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns. Collected: YES"

ATM.com collects MAC addresses, unique device identifiers, mobile phone numbers, and confirms collecting biometric data including fingerprints, faceprints, voiceprints, and keystroke patterns — far beyond what a cash advance app requires.

"We may also gather information from your device to assist us with cross-device tracking. Sometimes, we may use the information we collect -- for instance, usernames, IP addresses and unique mobile device identifiers - to locate or try to locate the same unique users across multiple browsers or devices (such as smartphones or tablets), or work with service providers that do this, in order to provide you with a seamless experience across devices."

ATM.com actively tracks users across multiple browsers and devices using identifiers like IP addresses and device IDs, and works with third-party services to build cross-device user profiles.

"The ATM App uses an SDK developed by Prodege, GmbH ("Prodege"). When a user connects to this app, certain device and connection data (including Advertising ID, Device ID, and whether and how the user enabled access to the same) is automatically sent, via our app, to Prodege servers to enable Rewarded Activities to display through our app. Prodege may share such data with third parties, clients and business partners, for commercial purposes."

Embedded SDKs from Prodege automatically transmit device identifiers to third-party servers upon app use, and Prodege further shares this data with its own third parties for commercial purposes — creating a chain of data sharing beyond the user's direct relationship with ATM.com.

"We reserve the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on the website and update the notice's effective date. YOUR CONTINUED USE OF OUR WEBSITE FOLLOWING THE POSTING OF CHANGES CONSTITUTES YOUR ACCEPTANCE OF SUCH CHANGES."

ATM.com can change the privacy policy at any time at their sole discretion, and merely continuing to use the service is treated as acceptance of the new terms — no affirmative consent required.

"We will retain your information for the period necessary to fulfill the purposes outlined in this Policy unless a longer retention period is required or permitted by law. Please remember, however, if we have already disclosed some of this user profile information to third parties, we cannot force the deletion or modification of any such user profile information by the parties to whom we have made those disclosures."

No specific retention period is defined — data is kept as long as deemed 'necessary,' and ATM.com disclaims ability to delete data already shared with third parties, meaning user data may persist indefinitely across partner systems.

"To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by: Emailing us with the contact information described below under CONTACT US. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to: Complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you."

There is no self-service account deletion option — users must email a request and go through a verification process. ATM.com also lists broad exceptions that allow them to deny deletion requests, including the vague 'ongoing business relationship' justification.