Legal
Privacy Policy
How we collect, use, and safeguard your information
1. Introduction
Rewardly Protocol, Inc. (“Rewardly,” “we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our coalition rewards platform and related services.
This policy applies to Coalition Operators who manage rewards programs, Merchants participating in coalitions, and End Users who earn and redeem rewards.
By using our Services, you consent to the collection and use of information in accordance with this policy.
2. Information We Collect
2.1 Information you provide
| Category | Examples |
|---|---|
| Account information | Name, email, phone number, company name, job title |
| Payment information | Billing address, payment card details (processed by third-party providers) |
| Coalition data | Coalition name, merchant lists, branding assets, earn/redemption rules |
| Transaction data | Receipt images, purchase amounts, participant information, timestamps |
| Communications | Support tickets, emails, survey responses, feedback |
2.2 Information collected automatically
- Device information: device type, operating system, unique device identifiers
- Log data: IP address, browser type, pages visited, access times
- Location data: approximate location based on IP address; precise location only with consent
- Usage data: features used, actions taken, time spent on pages
2.3 Information from third parties
We may receive information from identity verification services, payment processors, and Coalition Operators who onboard you to their programs.
3. How We Use Information
We use the information we collect to:
- Provide, maintain, and improve our Services
- Process transactions and send related notifications
- Validate receipts and prevent fraud
- Send administrative messages (security alerts, updates)
- Respond to your inquiries and provide customer support
- Analyze usage patterns to improve user experience
- Comply with legal obligations and enforce our terms
- Send marketing communications (with your consent)
3.1 Legal bases (for EU/UK users)
We process personal data based on: contract performance, legitimate interests, legal compliance, and consent.
5. Data Security
We implement industry-standard security measures to protect your data:
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Ongoing internal security reviews
- Access controls and authentication requirements
- Secure, access-controlled data centers
- Employee security training and background checks
However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.
6. Data Retention
We retain your information for as long as necessary to:
- Provide you with our Services
- Comply with legal and regulatory requirements
- Resolve disputes and enforce our agreements
Account data is retained for 3 years after account closure. Transaction records may be retained longer for legal compliance. Anonymized data may be retained indefinitely for analytics.
7. Your Rights
Depending on your location, you may have the following rights:
- Access: request a copy of your personal data
- Correction: request correction of inaccurate data
- Deletion: request deletion of your data (“right to be forgotten”)
- Portability: request your data in a machine-readable format
- Objection: object to processing based on legitimate interests
- Restriction: request restriction of processing
- Withdraw consent: withdraw consent at any time
To exercise these rights, contact us at privacy@rewardly.live. We will respond within 30 days.
7.1 California residents (CCPA)
California residents have additional rights including the right to know what personal information is collected, the right to delete, and the right to opt out of sale (though we do not sell data).
9. Children's Privacy
Our Services are not intended for children under 13 (or 16 in the EU). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.
10. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place, including Standard Contractual Clauses for EU/UK data transfers.
11. India — Digital Personal Data Protection Act
Where a programme operates in India, the Digital Personal Data Protection Act, 2023 (“DPDP Act”) applies to personal data processed through the Services. This section explains how it maps onto the roles described above.
11.1 Who is the Data Fiduciary
The Coalition Operator running the programme is the Data Fiduciary for its members’ personal data: it determines the purpose and means of processing. Rewardly acts as a Data Processor on the Operator’s instructions under a written agreement, and processes member data only to provide the Services.
11.2 Notice and consent
Members are given notice of the categories of personal data collected, the purposes of processing, and how to withdraw consent and raise a grievance, at or before the point of enrolment. Consent may be withdrawn at any time with the same ease with which it was given; withdrawal does not affect processing already carried out on that basis.
11.3 Rights of a Data Principal
- Access — a summary of the personal data processed and the processing activities undertaken
- Correction and completion — of inaccurate or incomplete personal data
- Erasure — of personal data no longer necessary for the purpose it was collected for, subject to legal retention requirements
- Grievance redressal — a response from the Data Fiduciary before approaching the Data Protection Board
- Nomination — nominating another individual to exercise these rights in the event of death or incapacity
Requests should be made to the Coalition Operator running the programme, as Data Fiduciary. Where a request reaches Rewardly directly, we will refer it to the relevant Operator and support them in responding within the statutory period.
11.4 Children’s data
The Services are not directed at children. Where the DPDP Act applies, verifiable parental consent is required before processing the personal data of a child under 18, and tracking, behavioural monitoring, and targeted advertising directed at children are not permitted.
11.5 Data within India
Programme data is isolated per programme. Where an Operator requires that its members’ personal data be processed and stored within India, that can be configured for the programme; the applicable arrangement is recorded in the Operator’s agreement.
11.6 Breach notification
On becoming aware of a personal data breach, Rewardly notifies the affected Coalition Operator without undue delay so that it can meet its own obligations to notify the Data Protection Board of India and affected Data Principals.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the “Last updated” date. For significant changes, we will provide additional notice via email.
13. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us:
- Privacy contact: privacy@rewardly.live
- Entity: Rewardly Protocol, Inc.