(1) obtained more financial data than was needed by a user’s app, and (2) obtained log-in credentials (username and password) through its user interface, known as “Plaid Link,” which had the look and feel of the user’s own bank account login screen, when users were actually providing their login credentials directly to Plaid.