Mastercard Max promises to help customers find relevant card perks, but its launch announcement and product page leave questions about the information behind those suggestions.
Mastercard announced the AI benefits assistant on 21 October 2026, with an initial launch involving C6 Bank in Brazil. The company says recommendations adjust to a customer's card, eligibility, location and context through participating banks' digital channels.
For customers, the practical question is how that personalisation works. The reviewed pages describe the experience without fully explaining its data flows.
That limits what readers can establish from them. It does not demonstrate that privacy safeguards are missing.
What Does Mastercard Max Know About You?
Mastercard's product page says recommendations draw on eligibility, context and behaviour. Customers can ask about their benefits in their own words.
However, the page does not define which behavioural information informs those recommendations.
Neither the product page nor the launch announcement specifies whether Max receives account balances or transaction histories. They also do not explain whether location comes from a conversation, bank information or a device permission.
These are different ways of supplying information. Entering a destination into a chat, for example, would not establish that an assistant has continuing access to a phone's location.
The reviewed pages do not establish which approach Max uses.
Who Handles the Information?
Mastercard says it manages the agent models, content and orchestration behind Max. Banks can embed the service in their digital channels or connect it to existing assistants.
The product page also lists a software development kit and a web-hosted experience as integration options.
Those options explain how banks can deploy the assistant. They do not identify every organisation that might process a conversation.
Neither reviewed Max page names external model providers or specifies processing locations.
This is a limit of those pages, rather than evidence that the information is unavailable elsewhere. Customers seeking those details can check the notices accompanying their bank's implementation.
Are Conversations Used to Train AI?
Mastercard's Global Privacy Notice discusses AI and machine learning. Its reference to AI training appears within the section addressing anonymisation and aggregated reports.
The US Privacy Addendum separately says Mastercard does not collect, use or sell personal information to train large language models.
The reviewed Max pages do not specify a conversation retention period or describe human review and transcript deletion arrangements.
Mastercard's global notice provides general retention criteria, rather than a Max-specific timetable. It also says practices can vary by country and that product-specific notices may apply.
Helpful Guidance Has a Commercial Purpose
Mastercard markets Max to banks as a way to support engagement, card usage and spending. Its announcement also identifies opportunities to sell additional products to customers. These are stated business objectives, rather than evidence of measured results.
That purpose belongs alongside the promised convenience. Helping someone find an existing entitlement could benefit the customer while encouraging card use.
It does not, by itself, establish that conversations are used to target additional products. Readers can distinguish between guidance about benefits already included with their card and an offer requiring another purchase.
What Should Customers Check?
Mastercard says Max was designed with privacy, security and responsible data practices at its core. The reviewed launch pages do not provide enough technical detail to independently assess that assurance.
Customers can look for explanations of what information reaches the assistant, who processes conversations and how long records are kept. They can also ask whether any personalisation or location-based functions are optional.
Mastercard's global notice directs readers to financial institutions' policies where it processes information on their behalf.
The unresolved questions therefore concern the bank's actual implementation: what Max receives, how it is used and which choices customers have.
