Scope and roles
This notice applies to www.rebatecardx.com, app.rebatecardx.com, card.rebatecardx.com and the related RebateCardX services. It does not replace the separate privacy notices and card terms supplied by an issuing, identity-verification or other regulated provider for an approved program.
A merchant may determine why customer order information is sent to us for a rebate campaign. In that context, the merchant remains responsible for its customer relationship and instructions, while we process the information to operate the campaign. We act for our own purposes when administering accounts, security, compliance, support and legal obligations.
Information we collect
We limit collection to information needed to operate, secure and support the platform and an approved rebate program.
- Account information, including name, business email, role, organization, verification status and authentication and security records.
- Merchant onboarding information, including entity, ownership and control information, business profile, review decisions and encrypted documents supplied for KYB review.
- Commerce and campaign information, including store identifiers, products, order and fulfillment references, return and refund events, rebate rules, award status and amounts in USD.
- Cardholder claim information, including email, consent records and the minimum identity attributes needed to coordinate provider verification. Identity evidence requested by the provider is governed by the provider flow and applicable disclosures.
- Masked card and transaction information, such as a provider token, last four digits, status, merchant name, dates and integer-cent amounts. The platform does not accept or store a complete card number, card security code or PIN.
- Technical, audit and support information, including request identifiers, IP-derived security signals, device and browser data, timestamps, access decisions, communications and incident records.
How we use information
We use personal information for the business and operational purposes described below and as otherwise disclosed when information is collected.
- Create and protect accounts, verify email ownership, apply role and tenant permissions and provide step-up verification.
- Review merchant eligibility, administer campaigns, evaluate qualifying commerce activity and manage claims, cards, funding, disputes, support and reconciliation.
- Deliver transactional email, prevent fraud and misuse, investigate security events, maintain append-only audit evidence and enforce platform agreements.
- Comply with lawful requests and obligations applicable to the operator and coordinate obligations assigned to participating providers.
- Improve reliability and capacity using operational measurements that do not require advertising profiles.
How information is disclosed
We disclose information only as needed to operate an approved service, follow merchant instructions, protect the platform or comply with law. We do not sell personal information or share it for cross-context behavioral advertising.
Recipients may include the sponsoring merchant, Cloudflare for hosting and security, Brevo for transactional email, Shopify or another connected commerce provider, Lithic and the issuing or regulated entities identified in program documents, identity-verification and sanctions-screening providers, professional advisers and authorities with lawful jurisdiction.
Retention and protection
We retain information according to its purpose, program obligations, dispute and reconciliation periods, legal requirements and documented deletion rules. Privacy requests and deletion events are recorded so they can be completed across relevant systems. Encrypted objects are kept in private storage and access is limited by role and tenant.
We use encryption, access controls, tenant isolation, audit trails and security monitoring appropriate to the information handled. No system can guarantee absolute security. Never send a complete card number, card security code, PIN, password or encryption key by email or support message.
US privacy choices
Depending on your state and relationship with us, you may have the right to request access, correction or deletion, obtain a portable copy, or appeal a denied request. Some information may be retained when needed for security, fraud prevention, transactions, legal obligations or another permitted purpose.
Send requests to privacy@rebatecardx.com. We verify requests before disclosing or changing information and will not discriminate against a person for exercising an applicable privacy right. An authorized agent must provide evidence of authority.
Children, updates and contact
RebateCardX is not directed to children under 18 and does not knowingly provide cardholder accounts to them.
We may update this notice as the platform, provider relationships or legal requirements change. The effective date identifies the current version. Contact privacy@rebatecardx.com for privacy questions and security@rebatecardx.com to report a security concern.