The article claims geolocation data, which you aren't going to get from the public blockchain.

Where's that coming from? Maybe other unspecified "public" sources.

It seems suspicious though, like they are getting it from geolocating IP addresses of their users, and correlating those to transactions -- that is not public info at all. But perhaps they get the geolocation info from some other source unrelated to their users?

Personally if my bank was also in the business of spying on financial transactions commercially... I wouldn't feel super secure about my choice of bank.