"including card transactions and checking account balances," It's hard to imagine how anyone could even consider this being OK without the user being asked and

"including card transactions and checking account balances," It's hard to imagine how anyone could even consider this being OK without the user being asked and being able to revoke permission anytime.