Rewardly Privacy Policy

This Privacy Policy explains how Rewardly Protocol, Inc. ("Rewardly", "we") handles personal information when you use the Rewardly account, applications, websites and messaging channels (the "Service") and when you participate in loyalty programs operated by participating property owners (each a "Program" run by a "Program Owner").

This is the single, canonical policy for all regions in which the Service operates, including the United States, the European Economic Area and United Kingdom, India, and the Middle East.

1. Two roles: your account, and the Programs you join

Your Rewardly account. We collect and control the information that makes up your Rewardly account — your name, contact details, sign-in credentials and settings ("Account Data"). One account lets you join any available Program without registering again; joining or leaving a Program is always your choice.

Program activity. When you join a Program, the records of your activity in it — enrolment, receipts you submit, purchases, points and redemptions ("Program Data") — are controlled by that Program's Owner, and we process them only as the Program Owner's service provider to run the Program.

Each Program Owner presents its own program terms and, where required, a notice of financial incentive when you join. We do not share one Program's data with any other Program, and we do not use your membership in one Program to market another to you.

2. What we collect

Identifiers — name, email address, phone number, account credentials.

Commercial information — receipts and proof-of-purchase you submit, points, redemptions and reward activity in Programs you join.

Device and usage information — app and browser type, device identifiers, IP address, log and diagnostic data.

Location — the general location of receipt submissions where relevant to validation; precise location only if you enable it.

Communications — messages you exchange with us or through the Service's channels.

We collect this information from you, from your device, and from Programs' validation of your submissions. We do not knowingly collect information from anyone under eighteen (18), and we do not use the Service to profile children.

3. How we use it

We use personal information to: create and secure your account; operate the Programs you join, including validating receipts (using automated and manual review) and administering points and redemptions; provide support; prevent, detect and investigate fraud and abuse; comply with law; and improve the Service, including improving our validation models.

We may create and use de-identified data that can no longer reasonably identify you, and we commit to not re-identifying it.

4. What we share — and what we never do

We share personal information only:

• with the Program Owner of each Program you join (your Program Data for that Program);
• with service providers who process it for us under contract (hosting, analytics, communications, fraud prevention) and who may not use it for their own purposes;
• in a corporate transaction such as a merger, subject to this Policy; and
• where required by law.

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not run third-party advertising in the Service.

Participating businesses in a Program see only the transactions you make with them, plus any aggregate reporting the Program Owner elects to share.

5. Your privacy rights — United States (California)

If you are a California resident, you have the right to: know and access the personal information we hold about you; delete it; correct inaccuracies; portability of certain data; limit the use of sensitive personal information (we collect none beyond account credentials); and non-discrimination for exercising your rights.

Because we do not sell or share personal information as the CCPA defines those terms, there is nothing to opt out of; we honour the Global Privacy Control signal where applicable.

To exercise rights over Account Data, contact us. For Program Data, we will forward your request to the relevant Program Owner and assist them in responding within the CCPA's timelines. You may use an authorised agent; we will verify requests using your account information.

6. Loyalty programs and financial incentives

Programs are loyalty programs that provide rewards in exchange for participation, which California law treats as a financial incentive.

Each Program Owner's notice of financial incentive, presented when you join its Program, describes that Program's incentive, the categories of information involved, and how to withdraw.

You may leave any Program, or close your Rewardly account, at any time; the value of a Program's incentive is reasonably related to the value of the information you provide, as described in the Program Owner's notice.

7. Your privacy rights — European Economic Area, United Kingdom and Switzerland

Where the GDPR or UK GDPR applies: Rewardly is the controller of Account Data, and each Program Owner is the controller of its Program Data, with Rewardly acting as its processor.

Our legal bases are performance of our contract with you (operating your account and the Programs you join), our legitimate interests (securing the Service and preventing fraud), consent where we ask for it, and legal obligation.

You have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent at any time, and the right to lodge a complaint with your supervisory authority.

Where personal data is transferred outside your region, we use appropriate safeguards, including the European Commission's Standard Contractual Clauses.

8. Your privacy rights — India

Where India's Digital Personal Data Protection Act, 2023 applies: for Program Data, the Program Owner is the Data Fiduciary and Rewardly the Data Processor; for Account Data, Rewardly is the Data Fiduciary.

We process personal data on the basis of your consent, given when you sign up and when you join a Program, and you may withdraw it at any time with the same ease with which it was given.

You have the rights to access, correction, erasure and grievance redressal, and to nominate another person to exercise your rights in the event of death or incapacity.

Our Grievance Officer can be reached at grievance@rewardly.live and will acknowledge complaints within the timelines the law prescribes.

Where a Program Owner requires that its members' personal data be processed and stored within India, that is configured for the Program and recorded in the Program Owner's agreement.

9. Middle East and other regions

Where regional data protection laws apply, such as the UAE Federal Personal Data Protection Law, we honour the rights they grant — including access, correction, deletion and objection — through the same contacts below, and we transfer personal data across borders only with appropriate safeguards.

10. Cookies and similar technologies

We use cookies to keep you signed in, remember preferences, understand usage and measure performance.

Only essential cookies load by default. You can change your choices at any time through the cookie settings on our website or your browser. We honour the Global Privacy Control signal.

11. Retention and security

We keep Account Data while your account is active and for up to twenty-four (24) months after closure, unless a longer period is required by law or needed to resolve disputes or prevent fraud.

Program Data is retained as directed by the Program Owner and deleted or returned when a Program ends, subject to legally required archives.

We protect personal information with safeguards including encryption in transit (TLS 1.3) and at rest (AES-256), role-based access controls, logging, and periodic independent security testing. No system is perfectly secure; if a breach affects you, we will notify you and the relevant Program Owner as the law requires.

12. Changes and contact

We will post any changes to this Policy here and, for material changes, notify you in the Service or by email before they take effect.

Questions or requests:

privacy@rewardly.live (privacy rights, all regions) grievance@rewardly.live (India Grievance Officer)

Rewardly Protocol, Inc., 16192 Coastal Highway, Lewes, Delaware 19958, USA