Role SummaryWe're looking for a Product Counsel, Data & Privacy to join our legal team as the first-line owner of data, privacy, and information-security legal work. Customer data is core to how Imprint's programs create value, and this role makes sure we share and protect that data the right way, advising on partner data sharing, privacy opt-outs, FCRA and credit data, GLBA/Reg P, data retention, and information security, while working at the pace of a startup that ships fast and takes its regulatory obligations seriously.
This is a high-ownership individual contributor role. You'll act as the
first-line legal resource for data-sharing and privacy questions across our ongoing and launching programs. You'll have your own coverage areas from day one, direct access to senior leadership, and real influence on how customer data powers our products. You'll report to our Associate General Counsel and work alongside a small, experienced legal team, partnering closely with our Product Counsel, Data, and Security teams.
This role is ideal for a self-driven attorney who thrives in fast-moving environments, builds strong cross-functional relationships, and takes pride in owning work end-to-end.
What Success Looks Like in the First 90 Days- Built strong working relationships with Data, Engineering, Security, and Compliance stakeholders.
- Taken ownership of day-to-day data-sharing and privacy opt-out reviews that require legal sign-off.
- Provided practical FCRA and GLBA/Reg P guidance on live matters and helped maintain the team's data-sharing and FCRA guides.
- Advised on data retention questions and at least one partner information-security or incident-response matter.
- Tracked and closed out legal requests with clear timelines and proactive communication to stakeholders.
Responsibilities- Serve as the go-to legal advisor on partner data sharing: what customer, account, and application data can be shared through integrations and offline feeds, and on what legal basis, and document that guidance for the Data and business teams.
- Advise on privacy opt-outs and suppression obligations, including processing partner privacy files and honoring opt-outs across data sets and downstream third parties; maintain business-facing data-sharing and opt-out guides.
- Provide practical FCRA guidance, including permissible purpose, use and reuse of credit reports, and the sharing of application and credit-decision outcomes.
- Advise on GLBA / Regulation P and consumer privacy notices, and draft, review, and maintain privacy notices and cardholder information-sharing notices.
- Interpret state privacy laws (CCPA/CPRA and emerging state regimes) and automated-decision-making / AI requirements, and advise on their impact on data use, credit scoring, and product design.
- Own data retention and deletion guidance: mapping regulatory retention obligations and destruction requirements and supporting the record-retention policy.
- Partner with Security and GRC on partner and vendor information-security risk assessments, testing constraints, and incident response (including forensics, chain of custody, and breach/authority notification).
- Provide product counseling to Product and Engineering on new features and builds that affect data sharing, privacy, or the customer experience, and draft the consents and data-related terms they need.
- Coordinate with Compliance on regulatory interpretation, monitoring, and exam preparation, and support the Associate General Counsel on escalated complaints, regulatory inquiries, and bank-partner matters.
- Translate complex data, privacy, and security requirements into clear, actionable guidance for cross-functional partners.
QualificationsRequired- J.D. from an accredited law school and active membership in good standing with at least one U.S. state bar.
- 4 to 8 years in data privacy law, with demonstrated expertise in GLBA/Regulation P, FCRA, and state privacy laws including CCPA, and consumer financial regulation.
- Experience in financial services, fintech, or a high-growth startup environment.
- Working knowledge of FCRA and GLBA / Regulation P, and familiarity with state privacy laws (CCPA/CPRA and newer state regimes) and their practical application to data sharing and product.
- Experience advising on data-sharing arrangements, privacy notices and opt-outs, and data retention.
- Strong contract review skills, including data sharing agreements, DPAs, and regulatory-facing documentation.
- Comfort partnering with security and information-security teams on vendor risk assessments, data protection, and incident response.
- Demonstrated ability to work autonomously, own work end-to-end, manage competing priorities, and deliver clear legal guidance under tight timelines.
- Strong communicator who proactively updates stakeholders and builds relationships across teams, able to explain a legal risk to an engineer, a data question to an analyst, and a regulatory nuance to a business leader with equal clarity.
- Willingness to research independently and verify findings with senior team members.
Nice to Have- Privacy certification (e.g., CIPP/US).
- Experience with FCRA in a lending or credit context, ECOA/Reg B adverse action, and automated decision-making / AI governance (e.g., state ADMT laws).
- Familiarity with data-security frameworks (PCI DSS, SOC 2, NIST) and breach/incident-response processes.
- Familiarity with additional consumer finance regulations (TILA/Reg Z, EFTA/Reg E, UDAAP, CAN-SPAM, TCPA) and their intersection with data and product.
- Experience in sponsor bank, banking-as-a-service, or fintech partnership environments.
- Experience with GDPR applicability and ROPA obligations.
- Experience working in a ticketing or project management system (e.g., Linear, Jira, Asana).
- Comfort with legal technology, AI-assisted workflows, and process automation.
- Experience with consumer credit products, such as credit cards or buy-now-pay-later.
- Experience building or standardizing privacy frameworks across multiple product lines or partner programs.
Perks & Benefits- Competitive compensation and equity packages
- Leading configured work computers of your choice
- Flexible paid time off
- Fully covered, high-quality healthcare, including fully covered dependent coverage
- Additional health coverage includes access to One Medical and the option to enroll in an FSA
- 20 weeks of paid parental leave for the primary caregiver and 8 weeks for all new parents
- Access to industry-leading technology across all of our business units, stemming from our philosophy that we should invest in resources for our team that foster innovation, optimization, and productivity
