“but do not share or sell your transaction information to third parties for marketing or advertising.”

The wording only says they can’t share or sell transactions for those two reasons but I’d imagine analytics may be a valid reason?

Fraud analytics gets an exception from most regulator laws.