Some payment masking services use words like “privacy” in their marketing. What this actually means is misleading at best. What’s actually happening is not what people would be happy with when they think of the PG definition of privacy:
Privacy is the assurance that your data is only seen by the parties you intend to view it.
On privacy.com, they state:
Your privacy secured.
We don’t sell your data to advertisers or third parties. Like all card companies, we make money from merchant transaction fees. Your information stays private.
While this may be true, it doesn’t mean much for what the user wants to get out of the service. In terms of payment tracking, it’s like if you have a completely telemetry free browser, but it can only visit facebook.com, and then it said on its marketing pages that it’s a completely private browser, because there’s no telemetry. Some “private” browser that is.
Just to poke at privacy.com again, “selling your data” and “sharing your data” is not the same. Another example of how accurate marketing is essential to an honest product.
In order for you to be assured of privacy, according to Privacy Guides’ definition, you must know which parties are going to view your data. Then you must also intend for them to view it once understanding the implications.
So which parties see every purchase with a virtual card? I don’t even know completely, so someone else should chime in. But a draft is: the virtual card company and its bank, tied to your verified ID, plus the card networks and payment processors, like with any regular card.
Payment masking services should be required to accurately inform their users of the privacy implications of their services, in plain language on the same pages that they state the word “privacy.”
There’s precedent for this. Privacy Guides criteria on VPNs requires VPN providers to have accurate marketing around anonymity. This is implemented very well by IVPN, on their front page! Similar honest marketing requirements, but for privacy, should be imposed on the payment masking services category.
An accurate privacy policy is not a sufficient replacement for accurate marketing when the marketing is conjuring perceptions of the service for users that are so different from reality.