Who's peering at your financial information online?

If you want to set up an online money-manager account - the kind you see at Mint.com or perhaps on your bank's website - you had better read the "terms and conditions" and find out.

What if a third-party company will have access to your private data? You should know why and what they can do with it.

I recently received an invitation to sign up for Money Manager from American Express.

I was skeptical.

But the thought of having my entire financial picture in one place seemed irresistible. I could categorize expenses, track my spending, make pie charts and graphs, make a budget and receive alerts if I get too close to my spending limits. Besides, I thought, isn't most of my personal information online already?

I decided to speak with some local privacy sources and discuss my concerns with American Express. Here's some of what I learned:

• It's not about money management, it's about gaining access to consumers' data.

Gurpreet Dhillon, professor of information security at Virginia Commonwealth University's School of Business, said money-manager sites collect and store a wealth of valuable consumer information that can be used to generate income.

In some cases, though, money-manager accounts are offered more as a service to help customers manage their personal finances.

• Computers, not people, peer at your online data. Computer programs impersonally mine everyone's data looking for whatever information the company is seeking to extract in order to, say, target offers to certain ones, as American Express does, or present money-saving products and services in exchange for commissions when people purchase them, as Mint.com does.

"It wouldn't be somebody sitting there saying, 'Let me look at Iris Taylor's spending,' " American Express spokeswoman Desiree Fish said. "It's all done through the system. It's all done on an aggregated basis."

• Money-manager accounts can be a gold mine for identity thieves, too.

By storing all of your information on one site, "what you're doing is consolidating databases," Dhillon said. "You're making it easy for someone not only to access it, but to package it and sell it to someone else."

• So, deal with a reputable, established company.

"The law's ability to deal with identity theft after it happens is limited," said Kevin Walsh, an assistant professor at the University of Richmond School of Law. "Better try to avoid it by dealing only with established companies that have a long-term interest in protecting their customers' privacy."