Block, Inc.
Round 1 · Operational Triage · Operational Triage — Round 1 · assessed
🔴 Do Not Approve
Privacy score 84.0% · band Good
Hard no: the vendor explicitly does something disqualifying — Q16 (AI & Model-Training). An explicit gate violation beats the privacy score. Coverage note: the policy addresses 5 of 17 questions (29%); a vendor cannot reach the Best band below 70% coverage.
Hard-fail gate(s): Q16 — an explicit disqualifying practice. This beats the privacy score.
Quote check: 9 of 14 quotes found in the vendor's document. 5 not found (Q4, Q5, Q11, Q15, Q18). Each of those answers is set to unclear and cannot support an approval.
Dimension scorecard
| Dimension | Score | |
|---|
| Data Collection |
| 100.0% |
| Purpose & Use GATE ⚠ | n/a | — |
| Data Sharing GATE ⚠ | n/a | — |
| Data Sold GATE |
| 100.0% |
| Data Rights |
| 100.0% |
| Retention | n/a | — |
| Data Security | n/a | — |
| Breach Notice | n/a | — |
| Biometrics & Surveillance GATE | n/a | — |
| Payments | n/a | — |
| AI & Model-Training GATE ⚠ |
| 20.0% |
| Jurisdiction & Residency | n/a | — |
| Contract & Assurance |
| 100.0% |
Findings — 19 questions, every answer cited
Data Collection
Q1Does the vendor limit collection and use of staff personal information to what the service needs?
? Not addressed
T0
Answer: Unclear
Policy describes collection of extensive data categories (financial, identity, contacts, commercial, usage) but does not explicitly state a data minimization principle or limit collection to what the service needs.
Q2Does the vendor name the categories of sensitive staff data it holds (government ID or SSN, bank details, health or benefits data, biometrics)?
✓ Good
T3
Answer: Yes
“Financial Information: Bank account information and payment card numbers; Tax Information: Withholding allowances and tax filing status; Identity Information: Name, email address, postal address, signature, and phone number; Passport number, driver's license number, Social Security number, Taxpayer Identification number, or other government-issued identification number; Where additional verification is required and where you choose to share such information, photo identification, such as your passport or driver's license in combination with a photograph facial scan and biometrics extracted from such image”
Policy explicitly names SSN, government ID, bank account numbers, payment card numbers, and biometrics.
Purpose & Use
Q3Does the vendor commit to use the school's data only to provide the contracted service, and not for its own purposes? GATE
? Not addressed
T3
Answer: Unclear
“We use Your Customers' Data as part of our contractual obligation to provide the Services you request to you and, in the United States, as disclosed in the Privacy Notice for Users Who Do Not Apply or Sign Up for a Square Account or Other Services, or as instructed by your customers.”
Policy states data is used to provide Services and as instructed by customers, but also describes extensive internal uses (profiling, analytics, AI, marketing) of merchant/staff data that go beyond service provision.
Q4Does the vendor use school or staff data for marketing, profiling or product analytics beyond operating the service?
? Not addressed
T0
Answer: Unclear
Policy explicitly states use of merchant data for AI/ML, marketing, and product analytics beyond operating the service. · [verifier] quote not found verbatim in source
Quote not found in the document. The answer is set to unclear. What the model wrote: “We may use your Commercial Information (and other personal information you input or request us to analyse) in connection with artificial intelligence technologies to generate personalized features for your business. This enables us to provide the Services that you have requested that utilize these technologies. We may also use aggregated and deidentified transaction data to create economic indices, research reports, and similar publications that do not identify individual customers or merchants. We use your Identification Information to promote our products and Services to you. We use your Identification Information to personalise your use of our Services.”
Data Sharing
Q5Does the vendor limit sharing with third parties to the purpose for which the data was collected? GATE
? Not addressed
T0
Answer: Unclear
Policy names service providers for service delivery and compliance, but also mentions sharing with 'potential partners' and 'marketing or event providers' without clear limitation to service purpose. Sharing with affiliates and business units for internal purposes is also described. · [verifier] quote not found verbatim in source
Quote not found in the document. The answer is set to unclear. What the model wrote: “We may share the personal information described in the 'Information We Collect About You' section with the following categories of service providers and third parties: Service support partners... Technology providers or potential partners to store information, provide software, automated systems (including relevant artificial intelligence technologies), or programs to help us provide the Services; Marketing or event providers that help us run our advertising campaigns, contests, special offers, or other events or activities; Identity verification providers to help us with fraud prevention and to assist us in meeting our AML, KYC, background checking and other compliance requirements; Fee collection service providers to help us enforce our legal rights; Financial partners, like financial institutions, payment networks, payment card associations, and credit bureaus that help us provide the Services.”
Q6Does the vendor publish or offer a list of sub-processors, naming its cloud host, and commit to notice before adding one?
? Not addressed
T3
Answer: Unclear
“To access compliance documentation, such as PCI and SOC reports and related documentation, visit the Square Trust Center.”
Policy references a Trust Center for compliance documentation but does not publish a named sub-processor list or commit to notice before adding sub-processors. Cloud host (AWS, Azure, Google Cloud) is not named.
Data Sold
Q7Is staff or school personal information ever sold or rented to any outside party? GATE
✓ Good
T3
Answer: No
“While we do not sell personal information as that term is commonly understood, we have, 'sold or shared' over the last 12 months Usage Data for the purpose of interest-based advertising (or 'targeted advertising') as described below.”
Policy states it does not sell personal information in the traditional sense, though it does disclose sharing Usage Data for targeted advertising, which may qualify as 'sharing' under CCPA.
Data Rights
Q8Does the vendor support access, correction and deletion requests from the school, with a stated process or response time?
✓ Good
T3
Answer: Yes
“You may submit an access, deletion, or correction request through our dedicated online portal at privacy.block.xyz (for Sellers: click the Square logo and then select 'Business owner' on the 'What type of data are you looking to manage?' page; for Buyers: click the Square logo and then select 'Customer') or by calling us at 1.844.213.7377. Once we receive your request, we will verify it by requesting that you confirm certain personal information associated with your account.”
Policy describes a clear process for access, deletion, and correction requests via online portal or phone, with verification step. No specific response time is stated.
Q9Does the school keep ownership of its data, with return or deletion at the end of the contract?
? Not addressed
T3
Answer: Unclear
“We store your information for as long as is necessary for the purposes identified in this Privacy Notice, including to provide our Services, to comply with legal obligations, to enforce and prevent violations of our Terms of Services, to protect against fraudulent activity, and to defend our legal rights, property and users.”
Policy does not explicitly state that the school/merchant owns its data or commit to return/deletion at end of contract. Retention is described as 'as long as necessary' with case-by-case determination.
Retention
Q10Does the vendor state a retention period for staff data after the service ends, and whether deletion is automatic?
? Not addressed
T3
Answer: Unclear
“We store your information for as long as is necessary for the purposes identified in this Privacy Notice, including to provide our Services, to comply with legal obligations, to enforce and prevent violations of our Terms of Services, to protect against fraudulent activity, and to defend our legal rights, property and users. The retention periods for your information are determined on a case-by-case basis that depends on the following factors: The nature of the information and why it is collected and processed.”
Policy states retention is determined case-by-case and 'as long as necessary' but does not state a specific retention period after service ends or whether deletion is automatic.
Data Security
Q11Does the vendor disclose baseline safeguards: encryption in transit and at rest, single sign-on with MFA for admin roles, and an independent attestation (SOC 2, ISO 27001) or equivalent?
? Not addressed
T0
Answer: Unclear
Policy names encryption in transit and at rest (end-to-end encryption, industry-standard cryptographic protocols) and ISO 27001 certification. PCI DSS Level 1 compliance is also stated. · [verifier] quote not found verbatim in source
Quote not found in the document. The answer is set to unclear. What the model wrote: “All card-present payments are encrypted from end to end. We use industry-standard cryptographic protocols and message formats to transfer data. Square performs data encryption within the card reader at the moment of swipe. We've achieved the renowned ISO 27001 certification. PCI Data Security Standard, Level 1”
Breach Notice
Q12Does the vendor commit to notify the customer of a security incident without undue delay, with a stated hour count?
? Not addressed
T0
Answer: Unclear
Policy does not commit to notifying customers of security incidents without undue delay or within a stated timeframe. No breach notification commitment to the customer is disclosed.
Biometrics & Surveillance
Q13For products that capture faces, fingerprints or other biometric identifiers: does the vendor require written notice and consent before collection, and publish a retention and destruction schedule? GATE
— N/A
T0
Answer: N/A
not applicable to this product type
Q14Does the vendor use customer video, images or biometric data for its own analytics or model training?
— N/A
T0
Answer: N/A
not applicable to this product type
Payments
Q15For products that take card payments: does the vendor state PCI DSS compliance and name the scope it covers for the customer?
? Not addressed
T0
Answer: Unclear
Policy states PCI DSS Level 1 compliance and clarifies that merchants using Square for all storage, processing, and transmission of payment card data do not need to validate PCI compliance themselves, indicating Square covers these functions. · [verifier] quote not found verbatim in source
Quote not found in the document. The answer is set to unclear. What the model wrote: “PCI Data Security Standard, Level 1. Since Square adheres to PCI compliance we don't require account holders to validate PCI compliance. Merchants who use Square for all storage, processing, and transmission of payment card data do not need to validate PCI compliance for those transactions.”
AI & Model-Training
Q16Does the vendor use customer or staff data, including uploaded documents, to train or improve AI or machine-learning models? GATE
✗ Concern
T3
Answer: Yes
“We may use your Commercial Information (and other personal information you input or request us to analyse) in connection with artificial intelligence technologies to generate personalized features for your business. This enables us to provide the Services that you have requested that utilize these technologies.”
Policy explicitly states use of customer/staff data in connection with AI technologies to generate personalized features.
Q17Does the vendor disclose automated decisions that affect staff (screening, scheduling, pay, access) and offer human review?
? Not addressed
T0
Answer: Unclear
Policy does not disclose automated decisions affecting staff (screening, scheduling, pay, access) or offer human review. Profiling and automated processing are mentioned but not in the context of decisions affecting individuals.
Jurisdiction & Residency
Q18Does the vendor disclose where data is stored and which privacy laws it complies with?
? Not addressed
T0
Answer: Unclear
Policy discloses storage locations (United States, Japan, UK, EU, Australia) and names compliance regimes (Privacy Act Australia, GDPR/UK GDPR implied by EU/UK entity designation, CCPA for California). · [verifier] quote not found verbatim in source
Quote not found in the document. The answer is set to unclear. What the model wrote: “We use third-party service providers to process and store your information in the United States, Japan, the UK, the EU, and other countries. Square complies with the Privacy Act 1988 (Cth)(Privacy Act) and with the 13 Australian Privacy Principles (APPs) in the Privacy Act. If your Country of Residence is the European Union, Squareup International Ltd. is the Data Controller responsible for your personal data. If your Country of Residence is the United Kingdom, Squareup Europe Ltd. is the Data Controller responsible for your personal data.”
Contract & Assurance
Q19Does the vendor offer a data-processing agreement or equivalent written terms to customers?
✓ Good
T3
Answer: Yes
“You can review Square's Data Processing Agreement for more information on when Square is acting as a business or a service provider.”
Policy references a Data Processing Agreement available to customers.
Jurisdiction & residency — your footprint
Vendor does not disclose data-storage location or applicable privacy regimes. Shown alongside the verdict, not folded into the score —
a vendor can be strong on privacy yet leave residency gaps for specific countries.
| Country | Privacy law | Coverage |
|---|
| United States (federal) | FERPA / COPPA / PPRA | ⚠ Gap |
| Illinois | SOPPA | ⚠ Gap |
| Texas | Texas Education Code ch. 32 (student data privacy) | ⚠ Gap |
| California | SOPIPA / CCPA | ⚠ Gap |
| GDPR (overlay) | Applies when a school holds data on EU or UK students, families or staff | ⚠ Gap |