Privacy policy
Last updated September 18, 2026.
What we collect
Account data: your company name, email, and a hashed password. Reward data: recipient email addresses and names you send us, amounts, references, and any metadata you attach. Payment data: handled entirely by Stripe; we store only a Stripe customer ID and transaction references, never card or bank numbers. Usage data: API request logs (path, status, IP, timing) retained for 30 days.
How we use it
To deliver rewards, maintain your balance, show you history, send transactional email, and prevent fraud. We do not sell data or use it for advertising.
Who we share it with
Recipient email addresses and names are shared with our gift card fulfilment provider so the reward can be delivered. Payment data goes to Stripe. We may disclose data when legally required.
Recipients
If you received a reward, the sender provided your email address. We use it only to deliver that reward. Contact the sender or us to ask questions.
Retention and deletion
Reward records are retained for as long as your account exists, and for 7 years afterwards where required for financial record-keeping. You can request deletion of your account by emailing us.
Security
API keys are stored hashed. Provider credentials are encrypted at rest. All traffic is HTTPS.