When a user connects their financial institution (e.g. bank) with Plaid for a fintech app or service, what type of authorization to one's transactions does that connection provide? Is it a one-time inquiry (e.g. recent transactions / account status), or similar to continuous access via an API key/secret, including future transactions? In the latter case, how can the user revoke the access? Would changing the password be sufficient?
Their End User Privacy Policy states that,
in general, we collect the following types of identifiers, commercial information, and other personal information from your financial product and service providers:
- Account information, including financial institution name, account name, account type, account ownership, branch number, IBAN, BIC, account number, routing number, and sort code;
- Information about an account balance, including current and available balance;
- Information about credit accounts, including due dates, balances owed, payment amounts and dates, transaction history, credit limit, repayment status, and interest rate;
- Information about loan accounts, including due dates, repayment status, balances, payment amounts and dates, interest rate, guarantor, loan type, payment plan, and terms;
- Information about investment accounts, including transaction information, type of asset, identifying details about the asset, quantity, price, fees, and cost basis;
- Identifiers and information about the account owner(s), including name, email address, phone number, date of birth, and address information;
- Information about account transactions, including amount, date, payee, type, quantity, price, location, involved securities, and a description of the transaction; and
- Professional information, including information about your employer, in limited cases where you’ve connected your payroll accounts or provided us with your pay stub information.
- The data collected from your financial accounts includes information from all accounts (e.g., checking, savings, and credit card) accessible through a single set of account credentials.
When you use your device to connect to our services through a developer’s application, we receive identifiers and electronic network activity information about that device, including internet protocol (IP) address, timezone setting and location, device location
We may use the information we collect about you to derive inferences. For example, we may infer your location or your annual income based on the information we have collected about you from you or other sources.
But it's still not clear if they have an ongoing authorization to future transaction data.