Spruce℠ Online and Mobile App Privacy Notice
Protecting your personal information is important to us. The following guidelines set forth our general privacy practices and principles that apply to information we collect through our Spruce website, SpruceMoney.com, and our Spruce mobile application that incorporates this privacy notice (“Spruce Digital Services”), which are owned or operated by Emerald Financial Services, LLC, or companies related by common ownership or control (collectively, “we,” “us,” or “our”).
We own and deliver the Spruce Digital Services. We have arranged with Pathward, N.A., Member FDIC (“Pathward”), to provide you with banking products and services, including your Spruce℠ Spending and Saving Accounts. To review Pathward’s privacy notice, click here. We provide program management and other services to Pathward in connection with your Spruce℠ Spending and Saving Accounts.
We utilize administrative, technical, and physical safeguards to protect your information. We protect information submitted to us, both during transmission and once we receive it. Please see “How do we secure your information?” for more information. If you have any questions about the security of our services, you can contact us by calling (855)-977-7823 (855-9-SPRUCE).
This privacy notice also details choices available to you regarding the use of, your access to, and how to update and correct your personal information.
If you enter into a business relationship with one of our companies under common ownership or control (collectively, “H&R Block Companies”), you should consult that business’s privacy notice. Additionally, if you access www.hrblock.com or set up a MyBlock℠ account, it will be governed by the privacy notice found here.
Special Note to Parents: Because of the nature of the services we provide, we do not market our services to children under the age of 13, nor do we knowingly collect information from children under the age of 13.
If you have questions or complaints regarding our privacy practices or principles, please contact us by calling (855)-977-7823 (855-9-SPRUCE).
What information do we collect?
As part of providing the Spruce Digital Services to you, we may collect information, including personal information, about you, your spouse, or your dependents when you use our services. Personal information is data that can be used to identify a person individually. The information we may collect includes, but is not limited to:
- Contact Information (e.g., name, phone number, address, and email address);
- Social Security Number and other government identification numbers (e.g., EIN, Driver’s License Number, and ITIN);
- Date of Birth;
- Financial Information (e.g., income, revenue, assets, expenses, and bank account information);
- Payment and Transaction Data (e.g., checking and savings account transactions, debit card account numbers, balances and payment history);
- Geo-Location Information;
- Website, Mobile Application, and Email Usage Data (e.g., interactions with a website, application or advertisement);
- Device Information (e.g., internet protocol (IP) address, device type, unique identifier, app version, operating system, network data, and phone state); and
- Login Information.
Where do we get this information?
You provide some of the information we collect as part of your application for Spruce℠ Spending and Saving Accounts through the Spruce Digital Services. We also receive information through certain digital technologies when you interact with us or use the products. Finally, other companies may share information with us.
We collect information directly from you.
To deliver the Spruce Digital Services and the services you request, customize your experience, and better serve you, we collect information you voluntarily provide as part of using the Spruce Digital Services and obtaining and using the Spruce℠ Spending and Saving accounts from Pathward. This information is obtained when includes setting up an online account, authenticating your identity, applying for, or using your Spruce℠ Spending and Saving accounts, and includes tax return information you provide as part of setting up your Spruce Spending and Savings accounts. If you choose not to provide certain information we request, we may be unable to serve you.
We collect information when you use our services.
We collect certain information and usage data whenever you interact with us, whether online, through our mobile application, or through an email. This data may include which websites you visit, what you click on, and when you performed those actions. These activities may be performed by us or a service provider acting on our behalf.
We utilize certain web and wireless technologies to collect this information. These technologies include cookies and web beacons. Please see “What types of web and wireless technologies (including cookies) do we use?” for an in- depth discussion of these technologies and how to opt out.
We collect information from other companies.
In accordance with their privacy notices, our business partners and unrelated third parties (including credit reporting agencies) may share certain information about you with us.
We also collect information when you request services or information from us or companies with whom we have a business relationship, enter contests or sweepstakes, or complete surveys or polls.
To improve the security of our services, to protect your identity, and to protect your information, we may verify your personal information by matching the information you provide against other publicly available information that we obtain from identification verification companies.
How do we use your information?
We use your information to provide you the Spruce Digital Services you request. We may also use your information, as permitted by law, including: to service and report on your account; offer you relevant information, products, or services; and enhance our products and services. These activities may be performed by us, Pathward, or a service provider acting on either Pathward’s or our behalf.
- Spruce℠ Spending and Savings Accounts. Pathward will receive and use the information you provide through the Spruce Digital Services to set up the Spruce℠ Spending and Savings Accounts you request. We will use your information to set up and service your online account or authenticate your identity when you request certain services from us or Pathward. We may use your email address as your online username.
- Offer you products and services. We may use your information to contact you about products and services offered by us, our business partners, or another H&R Block company. H&R Block Companies are those related to us by common ownership or control. We may also use aggregated and anonymized information to identify individuals to offer our products and services.
- Geo-Location Uses. We may use your device location to provide you a list of nearby ATMs that are in the ATM network we make available to you, assess the level of interest in our services in a particular area, enhance the services we are providing you and other clients, and for fraud prevention purposes. You may at any time revoke our collection of this information by turning this off at the device level and not using our office locator.
- Mobile Devices. Subject to your control, our mobile services may request permission to dial a phone number, access your camera or photo library, access the internet, access your calendar, access biometric information stored on your device for log- in authentication purposes, send you push notifications, or wake/lock your mobile device.
- Security Enhancements. We may use your information, including device characteristics, to improve the security of our services, protect your identity, and protect your information.
- Unique Identifiers. We may assign you a unique identifier when you use our services. This unique identifier allows us to match information collected through our other various products and services. Generally, we use this information to help us better understand your use of our products and services and to customize your experience and better serve you.
- Automated Decision Making. We do not use automated decision making with respect to your information.
Who do we share your information with?
The privacy and security of your information is important to us. We do not sell or rent your information (including your social security number). We will disclose your information to Pathward so that Pathward can deliver you the Spruce Spending and Savings Accounts you request. We may also disclose your information as permitted by law or with your consent to other H&R Block Companies or to third parties with whom we have a written contract limiting the use and disclosure of your information. We may share your information to support the products and services you request or provide you information on products and services that may benefit you.
- H&R Block Companies. We may provide information to H&R Block Companies related by common ownership or control. These H&R Block Companies may use this information to support the products and services you request or market additional products and services to you. These activities may include providing customer service, delivering transaction information, or offering products like tax preparation or bookkeeping and payroll services. If you do not want us to share your personal information with H&R Block Companies for marketing, contact us by calling (855)-977-7823 (855-9-SPRUCE).
- Business Partners. We work closely with a variety of business partners that are not H&R Block Companies (e.g., Pathward that offers the Spruce℠ Spending and Saving accounts). We may offer products jointly with our business partners or they may be offered separately to you. These products may include account linking features with Plaid Inc., credit score information through Experian Information Solutions, Inc., or rewards programs offered by Dosh Holdings, LLC. We may share information that is related to such transactions with that business partner. Pathward receives your information anytime you interact with your Spruce℠ Spending or Savings Accounts or otherwise engage with the banking functionality. You will be able to recognize when other business partners are associated with your transaction when their logos or names appear or are shown with our logo. We require all business partners to have written contracts with us that require them to safeguard your information.
- Service Providers. We may disclose your personal information to service providers who perform business functions on our behalf, such as data processing and analysis, contest supervision, and direct mail or email production. We may also share your personal information, and a record of any transactions you conduct on our websites or offline with us, with a third-party advertising partner and its service providers to deliver advertising tailored to your interests when you visit certain other websites. Data shared for tailored advertising is made pseudonymous. We require all service providers to have written contracts with us that require them to safeguard your information.
- Marketing Arrangements. We may provide information to companies with whom we have a joint marketing arrangement. We require all marketing service providers to have written contracts with us that require them to safeguard your information. We do not share your information with third parties for their marketing purposes without your consent or without providing you the opportunity to opt-out of such sharing.
- Persons Who Acquire Our Assets or Business. If we sell or transfer any of our business or assets, certain information about our clients may be a part of that sale or transfer. In the event such sale or transfer results in a material change to this privacy notice, we will notify you. The notification procedure will be the same as the procedure we use to notify you of a change to this privacy notice as described below.
- Responses to Legal Requests. We may disclose your information when we have a good faith belief that such disclosure is required or permitted by law pursuant to a legal request. This may occur in connection with a court order, legal process, or other judicial, administrative or investigative proceeding that produces a request for information from us. In certain situations, we may be required to disclose your information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
- Protection of You, H&R Block and Others. We may disclose your information when we believe that disclosure is necessary to protect your rights and safety, the rights and safety of others, or our rights and safety. We may disclose your information to proper federal, state, or local officials in order to, and only to the extent necessary, inform the officials of activities that may constitute, or may have constituted, a violation of any criminal law or to assist the official in investigating or prosecuting a violation of criminal law.
- Aggregate Data. We may use or disclose aggregate information compiled using information that does not identify you individually or personally. This may include, for example, the total number of visitors from a particular state or the average user age.
- Third-Party Online Advertisements. We may allow third parties to place advertisements for their products or services on our website. If you interact with these advertisements, you must disclose your personal information (e.g., IP Address) to these advertisers. If you click on a third-party advertisement, you will be directed to their website and your interactions with them will be governed by their privacy notice.
What types of web and wireless technologies (including cookies) do we use?
We, and our service providers, use commonly used technologies, such as cookies or similar technologies, to remember you and to personalize your experience with features and advertisements. We, and our service providers, use these technologies to help us know your usage patterns, track your preferences, and analyze how you use our services. We may receive reports on an individual or aggregate basis based on these technologies. You may opt-out of some of these technologies.
- Cookies. Cookies are a commonly used software technology that allow us to customize our websites for you by placing small files on your computer or mobile device as you visit various components of our websites. The purpose of cookies is to make your experience more convenient and personal. For example, knowing what products interest you, helps us tailor your experience to meet your needs.
Cookies are small alphanumeric identifiers that a web server transfers to your computer via your Internet browser. When your Internet browser visits a web page, a cookie is set with a unique number. This number is recorded in a small text file that is transmitted to your computer and stored in the cookie directory of your hard drive. Then, when you visit each webpage on which the cookie technology is enabled, the website can recognize your browser as a unique user.
You may also adjust your browser settings to accept or deny all cookies, or to request your permission each time a site attempts to set a cookie. Although cookies are not required for some parts of our services, our services may not work properly if you disable cookies entirely. Clearing cookies from your web browser may revoke a prior opt-out you have selected.
- Local Storage Objects HTML5. We, and third parties with whom we partner to provide certain features on our website or to display advertising based upon your web browsing activity, use HTML5 to collect and store information. Various browsers may offer their own management tools for removing HTML5.
- Clear GIFs or Web Beacons. We employ a software technology called clear gifs (also known as pixel tags or web beacons), that help us better manage content on our websites by allowing us to understand usage patterns, fix issues, and improve the products and services offered to you on our websites. We may use clear gifs in our emails to let us know which emails have been opened by recipients. This allows us to gauge the effectiveness of certain communications and the effectiveness of our marketing campaigns. These activities may be performed by us or a service provider acting on our behalf.
- Log Files. Like most websites, we use log files. Information collected in log files may include IP addresses, unique device IDs, browser type, Internet Service Provider (ISP), referring/exit pages, the files viewed on our site (e.g., HTML pages, graphics, etc.), platform type, date/time stamp, and number of clicks. We utilize this information to analyze trends, administer the site or mobile application, track user’s movement in the aggregate, and gather broad demographic information for aggregate use.
- Traffic Data. We collect information relating to traffic on our website. We may collect and record information on pages visited, mouse movements and clicks, scrolling activity, keystroke data that you voluntarily enter on our website, HTML data on a page visited, IP address or information your browser provides to our web server, such as, browser type, operating system, language, screen resolution, referring URL, etc. Our collection of website traffic information is anonymized and does not include personally identifiable information. We utilize this data to improve our website and the products and services offered to you.
- Online Behavioral Advertising. We allow third- party companies, such as Google DoubleClick Campaign Manager, to serve ads and collect certain pseudonymous information when you visit our websites. These companies may use this information (e.g., click stream information, browser information, time and date, device ID, geo-location, IP address, or subject of advertisements clicked or scrolled over), during your visits to our websites in order to provide advertisements about goods and services likely to be of greater interest to you and to enhance your consumer experience across the different devices that you use. These companies typically use a cookie or third-party web beacon to collect this information. We may engage different providers to provide similar services from time to time. To opt-out of this type of advertising you may refuse to accept cookies or by visiting the Network Advertising Initiative’s opt-out page. Options you select are browser and device specific.
- Mobile Device Information. We may record data from your mobile device such as Apple IDFA, general characteristics of your device and other device IDs
- Mobile Analytics. We use mobile analytics software to allow us to better understand the functionality of our mobile software on your phone. This software may record information such as how often you use the application, the events that occur within the application, aggregated usage, performance data, and where the application was downloaded from.
How do we respond to web browser “do not track” signals?
We treat the data of everyone who comes to our websites in accordance with this privacy notice, whatever their “do not track” setting. While we do not respond to web browser “do not track” signals, we give you choices about receiving promotional offers from us or third parties. You can exercise your choices as described in this privacy notice. If you are located in California, you may prevent us from storing cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts by declining cookies in the cookie banner presented to you when you visit our website.
How do we secure your information?
The security of your personal information is important to us. We utilize administrative, technical, and physical safeguards to protect your information. If you have any questions about the security of our services, you can contact us by clicking here.
We protect information submitted to us, both during transmission and once we receive it. Nevertheless, no method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, we cannot guarantee its absolute security.
We maintain administrative, technical, and physical safeguards that comply with applicable law and federal standards and that are designed to restrict access to your information. These safeguards include programs and specifications for physical security and records retention and disposal; computer and communication security measures reflected in system design, password protection, and data management practices; and other measures to restrict access to the data we hold in physical and electronic forms.
If we collect sensitive information (such as your social security number), we will encrypt the transmission of that information using secure socket layer technology (SSL).
If we share your information with our service providers, we require all service providers to have written contracts with us that require them to safeguard your information and prohibit them from selling, retaining, using, or disclosing your information for any purpose other than for the specific purpose of performing the contract.
We may notify you by email, mail, or telephone in the event of a data security incident, and where permitted by law.
How long do we keep your information?
In accordance with applicable laws, we keep your information for as long as needed to serve you, maintain your account, as needed to operate our business, or to improve our offerings or develop new ones.
We retain your information (including geo-location data) for as long as your account is active or as needed to provide you services. We may retain or use your information as necessary to comply with our policies, legal obligations, resolve disputes, and enforce our agreements.
For more information, please see the “Updating or deleting your information” section of this privacy notice.
Business partners’ products and services, including social media features
This privacy notice does not apply to products or services offered by our business partners on or through our Spruce Digital Services (such as Pathward who provides the Spruce℠ Spending and Saving accounts you request). Pathward receives your information any time you interact with your Spruce℠ Spending or Savings Accounts or otherwise engage with the banking functionality. You will be able to recognize when other business partners are associated with your transaction when their logos or names appear or are shown with our logo. You should carefully read the privacy notices and any terms and conditions applicable to such business partner’s products or services. When you request products or services from such companies, you give us permission to provide these business partners with information about you necessary to fulfill or process your request.
The Spruce Digital Services may contain links to business partners’ websites or offers for services from business partners. This privacy notice does not apply to these products or services, or to products or services offered by H&R Block Personalized Services, LLC or by Wave Financial, Inc., each of which has its own policies. You should carefully read the privacy policies and any terms and conditions applicable to such products or services.
Your use of social media features may use scripting or may require us to share your IP address and which page you are visiting to enable the feature to function properly. Social media features and widgets are either hosted by a business partner or hosted directly on our site, and your interactions with these features are governed by the privacy notice of the company providing it. Examples of these features are the Twitter “Heart” button, the “Share This” button, and interactive mini programs that run on our services.
Updating or deleting your information
You may contact us regarding your information by calling (855)-977-7823 (855-9-SPRUCE). You may also access or, where available, update your information at sprucemoney.com or on the Spruce mobile app.
You can close your Spruce℠ Spending and Saving accounts by calling (855)-977-7823 (855-9-SPRUCE). The types of information that you can access and update may change over time. Remember, some of the information we collect does not identify you personally or is not stored in an online accessible format and thus, may not be accessible through your Spruce℠ Spending and Saving account.
When you update or delete your information, we may maintain a copy of the information in our records. Additionally, if you request that we permanently delete your account or information, we may still retain and use your information as necessary to comply with our legal obligations.
You may choose to limit our use or our ability to share your information in certain circumstances. Our ability to offer you certain products and services and your experience may be affected by your choice. If you withdraw your consent to electronic communications, we may close your accounts and terminate your access to them. To-opt out of all other communications or limit our sharing of your information with our H&R Block Companies or our nonaffiliates, call us at (855)-977-7823 (855-9-SPRUCE). You may, however, continue to receive email communications related to your Spruce℠ Spending and Saving accounts, such as servicing messages or transaction notifications.
Where permitted by law, we may use your information (subject to your consent, where required) to communicate with you about products and services available through H&R Block or our business partners. If at any time you wish to limit your receipt of such communications, you may click here. At your request and subject to the limitations below, we will make reasonable efforts to limit all such marketing communications to you. We will also provide you the ability to stop receiving marketing emails by following the unsubscribe instructions included in each marketing communication. We will respond to requests within a reasonable timeframe.
The above paragraphs only apply to personal information we obtain through your use of the Spruce Digital Services covered by this privacy notice. You may still receive offers from other H&R Block Companies where they obtain your contact information through other sources.
Please see “What types of web and wireless technologies (including cookies) do we use?” for information on how to opt-out of various web and wireless technologies we use.
Accessing Our Services from Outside the United States
We process your information to provide the products and services you request and for our legitimate business interests, including marketing and fraud prevention.
Our services are hosted on servers located in the United States and we use service providers located in the United States to bring you our products and services. The transfer of your information to the United States is necessary to deliver our products and services. Please be aware that the laws in the United States may not provide the same level of protection to your personal information as your home country.
If you are accessing the Spruce Digital Services from the European Union, you have certain rights regarding the processing of your personal information. For instance, if the information you provide contains special categories of personal data, we will only process it with your explicit consent, which can be withdrawn at any time. You have the following additional rights:
- You have the right to access and correct your information.
- You have the right to obtain erasure of your information, object to or restrict processing activities related to your information, or withdraw your consent to the processing of your information after you have provided it.
- You have the right to obtain a copy of your information in a structured, commonly used, machine readable format.
- You have the right to lodge a complaint with your local supervisory authority regarding our processing of your information.
If you are accessing our products or services from Brazil, you have certain rights regarding the processing of your personal information.
You have the right to confirm if we are processing your information; to access your data; to correct incomplete, inaccurate or out-of-date data; to anonymize, block, or delete unnecessary or excessive data or data that is not being processed in compliance with Brazilian law; to the portability of data to another service or product provider, by means of an express request; to delete personal data processed with the consent of the data subject; to information about public and private entities with which the controller has shared data; to information about the possibility of denying consent and the consequences of such denial; and to revoke consent.
To exercise your rights, or if you otherwise have questions about the processing of your personal data, you may submit a request to exercise your rights by clicking here or calling (855)-977-7823 (855-9-SPRUCE).
Additional Information for California Residents
California law requires us to disclose the following additional information related to our privacy practices. If you are a California resident, the following privacy disclosures apply to you in addition to the rest of this privacy notice.
- Categories of Personal Information Collected and Disclosed. California law requires organizations to disclose whether certain categories of personal information are collected, disclosed for an organization’s “business purpose”, “sold” and/or “shared” for purposes of cross-context behavioral advertising (as those terms are defined under California law). Most of the personal information we collect, share, and disclose is subject to the Gramm-Leach-Bliley Act and other federal laws. Such information is not subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively “California Privacy Law”), and while not required, may be included in the table below. In addition, we may have collected, shared, and disclosed personal information in various contexts that may be subject to California Privacy Law, which is reflected in the table below. Please note that the following table is comprehensive, and we collect different information about people based on their relationship and interactions with us.
Disclosures for Business Purposes
Sharing for Cross Context Behavioral Advertising
- California Sensitive Information Disclosure. Some of the personal information we collect is considered “sensitive personal information” under California law. We collect the following categories of sensitive personal information (as defined under California law): Social security, driver’s license, state identification card, or passport number; and account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account. This information is collected in order to process transactions, comply with laws, manage our business, or provide you with products and services. Note that we do not use such information for any purposes that are not identified within the California Privacy Rights Act Section 1798.121. We do not “sell” or “share” sensitive personal information for purposes of cross-context behavioral advertising.
- Your Privacy Rights. If you are a California resident, you may have the following rights over your information:
- For the period covering the 12 months preceding your request, you may request that we disclose to you the categories and specific pieces of information collected about you, as well as certain information about our collection and use of your personal information.
- You may request that we delete information we collected from you, subject to certain exceptions.
- You may request that we correct inaccuracies in the personal information that we maintain about you.
- You may opt-out of the sharing of your personal information for purposes of cross-context behavioral advertising.
- You have the right not to be discriminated against for exercising your rights over your information.
Please note, not all of the rights described above are absolute, and they do not apply in all circumstances. In some cases, we may limit or deny your request because the law permits or requires us to do so, or if we are unable to adequately verify your identity.
You or an authorized agent acting on your behalf may submit a request to exercise your rights by clicking here or calling (855)-977-7823 (855-9-SPRUCE). We will request personal information from you, such as your name, address, state of residence, email address, phone number, last four digits of your social security number, and your birth year, to verify your identity in order to process your request. To have an authorized agent submit a data subject access request on your behalf, we require you to submit a form that verifies your identity and that you have authorized the agent to act on your behalf.
To prevent online tracking based targeted advertising (e.g., cookies), opt out of social media and targeting/advertising cookies in the prompt presented to you in our cookie banner. You may change your cookie setting preferences while on sprucemoney.com by clicking on Cookie Preferences.
If you have questions or concerns regarding this Privacy Notice, contact us by calling (855)-977-7823 (855-9-SPRUCE), or by mail through the mailing address below. If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.
Privacy Notice Updates
We may update this privacy notice to reflect changes to our information practices. If we make a material change to this privacy notice, including a material change in the way we use any personal information collected, we will notify you by using one of the following methods at least thirty (30) days prior to the effective date of such change: (1) we will post a notice on our website describing the change; or (2) we will send you an email notifying you of the change.
This Privacy Notice is effective January 1, 2023.
©2023 Emerald Financial Services, LLC. All rights reserved.
Emerald Financial Services, LLC
One H&R Block Way
Kansas City, MO 64105