About the Job
In the U.S., co-branded cards alone account for over $300 billion in annual spend, and most still run on decades-old legacy bank systems. Imprint is the modern alternative: flexible, embeddable, and built for how people actually pay today. Backed by Kleiner Perkins, Thrive Capital, Ribbit, and Khosla Ventures, we're...
We're looking for a Product Counsel, Data & Privacy to join our legal team as the first-line owner of data, privacy, and information-security legal work. Customer data is core to how Imprint's programs create value, and this role makes sure we share and protect that data the right way, advising on partner data shari...
This is a high-ownership individual contributor role. You'll act as the first-line legal resource for data-sharing and privacy questions across our ongoing and launching programs. You'll have your own coverage areas from day one, direct access to senior leadership, and real influence on how customer data powers our ...
Key Responsibilities
Serve as the go-to legal advisor on partner data sharing: what customer, account, and application data can be shared through integrations and offline feeds, and on what legal basis, and document that guidance for the Data and business teams.
Advise on privacy opt-outs and suppression obligations, including processing partner privacy files and honoring opt-outs across data sets and downstream third parties; maintain business-facing data-sharing and opt-out guides.
Provide practical FCRA guidance, including permissible purpose, use and reuse of credit reports, and the sharing of application and credit-decision outcomes.
Advise on GLBA / Regulation P and consumer privacy notices, and draft, review, and maintain privacy notices and cardholder information-sharing notices.
Interpret state privacy laws (CCPA/CPRA and emerging state regimes) and automated-decision-making / AI requirements, and advise on their impact on data use, credit scoring, and product design.
Own data retention and deletion guidance: mapping regulatory retention obligations and destruction requirements and supporting the record-retention policy.
Partner with Security and GRC on partner and vendor information-security risk assessments, testing constraints, and incident response (including forensics, chain of custody, and breach/authority notification).
Provide product counseling to Product and Engineering on new features and builds that affect data sharing, privacy, or the customer experience, and draft the consents and data-related terms they need.
Coordinate with Compliance on regulatory interpretation, monitoring, and exam preparation, and support the Associate General Counsel on escalated complaints, regulatory inquiries, and bank-partner matters.
Translate complex data, privacy, and security requirements into clear, actionable guidance for cross-functional partners.
Required Skills & Abilities
J.D. from an accredited law school and active membership in good standing with at least one U.S. state bar.
4 to 8 years in data privacy law, with demonstrated expertise in GLBA/Regulation P, FCRA, and state privacy laws including CCPA, and consumer financial regulation.
Experience in financial services, fintech, or a high-growth startup environment.
Working knowledge of FCRA and GLBA / Regulation P, and familiarity with state privacy laws (CCPA/CPRA and newer state regimes) and their practical application to data sharing and product.
Experience advising on data-sharing arrangements, privacy notices and opt-outs, and data retention.
Strong contract review skills, including data sharing agreements, DPAs, and regulatory-facing documentation.
Comfort partnering with security and information-security teams on vendor risk assessments, data protection, and incident response.
Demonstrated ability to work autonomously, own work end-to-end, manage competing priorities, and deliver clear legal guidance under tight timelines.
Strong communicator who proactively updates stakeholders and builds relationships across teams, able to explain a legal risk to an engineer, a data question to an analyst, and a regulatory nuance to a business leader with equal clarity.
Willingness to research independently and verify findings with senior team members.
Privacy certification (e.g., CIPP/US).
Experience with FCRA in a lending or credit context, ECOA/Reg B adverse action, and automated decision-making / AI governance (e.g., state ADMT laws).
Familiarity with data-security frameworks (PCI DSS, SOC 2, NIST) and breach/incident-response processes.
Familiarity with additional consumer finance regulations (TILA/Reg Z, EFTA/Reg E, UDAAP, CAN-SPAM, TCPA) and their intersection with data and product.
Experience in sponsor bank, banking-as-a-service, or fintech partnership environments.
Experience with GDPR applicability and ROPA obligations.
Experience working in a ticketing or project management system (e.g., Linear, Jira, Asana).
Comfort with legal technology, AI-assisted workflows, and process automation.
Experience with consumer credit products, such as credit cards or buy-now-pay-later.
Experience building or standardizing privacy frameworks across multiple product lines or partner programs.
