Published 8:24 PM EST Feb 24, 2020
If you use Venmo, OKCupid or Grindr, Braze.com knows where you’ve been and who you’ve interacted with.
You might be wondering what exactly Braze.com is and why it grabs their geographic, associations and more.
I found out Friday that after I composed a message on the PayPal-owned digital payments app Venmo to pay my personal trainer Jarek, Venmo passed on my geographic locations and associations (including Jarek) to Braze, which calls itself a “customer engagement” company.
How did that happen? I wasn’t alone.
Just last month, the Norwegian Consumer Council issued a blistering report showing what happened to users of the dating sites OKCupid and Grindr in the background, after people revealed all about their interests.
OkCupid “shared highly personal data about sexuality, drug use, political views, and more,” with Braze, according to the report.
Grindr, a popular dating and social app used by gay and bisexual men, sent data to Braze about the “relationship type” men were seeking on the app, per the report.
I asked PayPal twice why it sent my personal information to Braze, and it declined to comment. After our report posted Saturday, we put the question to Braze as well, on Twitter and got a non-response from the company.
It offered the same statement it gave to Mashable when the Norwegian report first was released.
Braze “takes the security and privacy of its customers’ data very seriously and discloses, in compliance with applicable privacy law, how it processes data,” the company says. “We give our customers total and absolute control over what data they share with Braze, and we only collect first-party data.”
We reminded Braze spokeswoman Hannah Blackington that at no time was the company given authority to take my data.
She clarified: “The use of the word ‘customer’ in our statement refers to brands (Braze customers) not consumers.”
On Twitter, I issued a challenge for the firm to delete it immediately.
It declined to take me up on the offer.
Look who’s tracking you now: Venmo did what with my data?
Too much sharing: Dating apps like Grindr, Tinder and OkCupid collect, share your personal data
Meanwhile, on the Braze website, the firm is pretty open about how it looks to take data from consumers. Braze tells companies it seeks to know the latest interactions with “your brand, along with data exclusive to their behaviors and interests.”
In her e-mail to USA TODAY, Blackington said that brands use the Braze “customer engagement platform” to send app push notifications, web push, email and text messages “to their customers in a more meaningful way that provides value to their customer experience.”
On its website, Braze notes that it works with customers like Venmo, Seamless, HBO, Disney and Urban Outfitters “to facilitate real-time experiences between brands and consumers in a more authentic and human way.”
Patrick Jackson, the chief technology officer of security firm Disconnect translates:
“It’s marketing mumbo jumbo for ‘Braze collects detailed information about your users so you can deliver marketing campaigns,’” that allow companies to, say, target a customer in my Manhattan Beach, California, ZIP code who might be associated with a personal trainer.
“This would all be possible based on the data Venmo allows Braze to collect,” he adds. “They call these freakish detailed messages, ‘real-time experiences.’”
Jackson, who monitored my iPhone to find out which firms were passing on data to others and discovered the Venmo-Braze connection, reminds that users are the “harmed party” here.
“Nowhere in this statement is Braze sympathetic to users. NO users, or very few, are cool with sending their very personal location data and contacts to a big data company they’ve never heard of.”
When asked point-blank why Venmo passed on my information to Braze, PayPal declined to answer. Instead, it said, “We go to great lengths to protect our customers’ personal information, and we do not sell or rent personal data with unaffiliated third parties for their own marketing purposes.”
We posed the the same question to Braze. The answer: “It would require reaching out to that specific company where an end-user is a customer. In this case, I understand that you’ve reached out to Venmo but we cannot answer any specific questions on Venmo’s behalf.”
On Twitter, reader Sean Wilson played devil’s advocate and noted that since Braze does push notifications for firms, in this instance, it probably just let my trainer know that he was paid. “Is that such a bad thing?”
Jackson says it is.
“Venmo needs a third-party company to collect sensitive details from you to tell Jarek (the trainer) he was paid? Doesn’t make sense. The data collected about Jarek was not used to send a push notification,” he said. “It was used to add to Braze’s wealth of information it knows about you and Jarek, and that will help them better market you with super detailed messaging (e-mail, push notification) in the future.”