August 5, 2026
Able handles money, and money leaves a trail. Here is the short version of what we record about you, why, who else sees it, and what you can ask us to do with it. Read it in a few minutes; read the full policy for the detaill
Our promises. We will never sell your personal information. We will tell you plainly when the law, rather than our choice, is the reason we hold something. And we will give you as much control as regulation allows, and explain it when it allows none.
Able operates through more than one company. The Able company that provides your account or card is the controller of your information, and it is the one named in your terms -- you can check which in your settings. Some services are delivered with regulated partners, including our card issuing partner in Singapore; where a partner is a controller in its own right, its notice applies alongside ours. We also show short in-app explanations the first time you use a feature.
We don't ask for sensitive data like health or religion. Biometric data from your ID check is handled under specific legal grounds.
Depending on where you live, our legal grounds are: performing our contract with you (running your account), meeting legal obligations (identity checks, monitoring, reporting), our legitimate interests (fraud prevention, security, improvement), substantial public interest (biometric and financial-crime data), vital interests (emergencies), and your consent (marketing, non-essential cookies, location). You can withdraw consent any time.
We're required to know who our customers are and to watch how accounts are used -- this is the reason for much of what we collect. We verify you, screen you against sanctions and politically-exposed-person lists, monitor transactions for unusual patterns, and report suspicions where the law requires. Sometimes the law stops us telling you a report was made or why an account was restricted. We can't publish exactly how our controls work, because that would help people evade them.
Some decisions are made by our systems in seconds, without a person: approving or declining a payment, setting your risk rating, freezing a card after failed attempts. We use models and, in places, AI -- for fraud scoring, categorising your spending, drafting support replies (with a person accountable for anything material), and training our own models. We don't use your data to train third-party general-purpose AI, and our suppliers can't either. Where an automated decision significantly affects you, you can ask a person to review it.
When you pay, your card issuing partner, its processor and the card network each receive what they need to complete the payment, under their own rules. When you send money, payment rules require your name and account identifier to travel with it; when someone pays you, we confirm your details to the sender. Full card numbers are stored only in protected, tokenised form.
We do not sell your personal information. We share it only to deliver the service, meet a legal duty, or prevent fraud -- with other Able companies, our regulated partners and suppliers, the people you transact with, verification and fraud agencies, authorities, and (as a limited, hashed identifier) advertising platforms for campaign measurement, which you can opt out of. We require everyone we share your information with to protect it to the same standard set out in our full policy.
Worth knowing: if we or a fraud agency record that you present a fraud or money-laundering risk, other organisations may see it, and it can affect your access to services, financing or employment elsewhere. If you think a record is wrong, tell us and we'll investigate.
Your information may be handled in countries other than the one you live in, and international payments necessarily send data abroad. Wherever it goes, we protect it to the standard in our full policy, and where the law requires a specific transfer method we use one. We keep identity and transaction records for at least five years after your account closes because financial law requires it, support records up to six years, and website data up to about two years. Biometric data is deleted once your check is complete.
We encrypt data in transit and at rest, tokenise card numbers, restrict who can access records, and require multi-factor authentication and staff training. No system is immune, and we don't claim otherwise. Please use a strong password, turn on every authentication option, and tell us at once if someone else has access. Able will never ask you for a password, PIN or one-time code -- if someone does, it's not us.
Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it (where we're not required to keep it), send it to you or another provider, restrict or object to certain uses, withdraw consent, or have a person review a significant automated decision. You can delete your account in the app, from your account settings. Use the app or email us; we'll verify your identity and respond within about a month. Some rights are limited -- we can't delete records we must keep, or share details tied to a financial-crime investigation. Marketing is off with one tap, and opting out never stops security or service messages.
Able is for adults -- we don't offer accounts to anyone under 18. We update this policy when our services or obligations change, and tell you before a material change takes effect. For any question, or to exercise a right, contact our privacy team; if you're not satisfied with our answer, you can complain to your data protection authority.
This is a summary and is not the complete statement of how we handle your information. The full Privacy Policy is available at able.finance/privacy. Where this summary and the full policy differ, the full policy applies.