Last updated: 1 May 2026
This Privacy Policy explains how Rewardio handles your personal information when you use our website, create an account, earn cashback, or otherwise interact with our service. We’ve tried to write it plainly. Where we’ve had to use legal language, we’ve kept it as close to everyday English as we can.
In this policy, “Rewardio”, “we”, “us” and “our” refer to [Rewardio Ltd], the company that runs the Rewardio cashback platform and decides how your personal information is used. Under data protection law, that makes us the “controller” of your personal information.
If you’d rather skip ahead, here’s what’s covered:
- A quick summary
- The information we collect
- Where we get it from
- What we use it for, and why we’re allowed to
- Who we share it with
- Sending information outside the UK and EEA
- How long we keep it
- How we keep it secure
- Your rights
- Marketing and how to opt out
- Cookies
- Children
- Other websites we link to
- Changes to this policy
- How to contact us
- Notice for California residents
1. The short version
If you don’t want to read the whole thing, the headlines are:
- We collect the information we need to run a cashback service: who you are, what you bought via our links, and how to pay you. Plus some technical bits like your IP address when you use the site.
- We share information with the affiliate networks and merchants that pay us commission — that’s how cashback works. We also use a small number of trusted suppliers (hosting, email, payments) to run the service.
- We don’t sell your personal information to advertisers or anyone else.
- You have rights over your data — including access, correction, deletion, and opting out of marketing. We explain how to use them in section 9.
The full detail is below. If anything’s unclear, email us at info@rewardio.com and we’ll explain.
2. The information we collect
We group the personal information we hold about you into the following categories:
Account information. Your name, email address, password (stored in encrypted form, not as plain text), country, and the date you joined. If you sign in using a third-party login such as Google or Apple, we’ll receive basic profile details from them as part of that process.
Payout information. The PayPal email address (or other supported payout method) you give us so we can pay your cashback.
Transaction information. Details of the purchases you make through merchants featured on Rewardio — for example, the merchant name, order date, order value, and the cashback amount due. This information reaches us from the affiliate networks that track your purchases on our behalf.
Support and correspondence. Messages you send us, claims you raise about missing or incorrect cashback, replies to surveys, and any other communication between you and our team.
Technical information. Your IP address, the type of device and browser you’re using, the operating system on it, the pages you visit on Rewardio, the date and time you visit, and the website you came from (if any). This is collected automatically when you use the site.
Marketing preferences. Whether you’ve agreed to receive marketing emails from us, and the choices you’ve made about cookies.
Identity verification information (only if needed). In limited cases — for example, if we suspect fraud or need to confirm a payout request — we may ask you to provide ID. We don’t ask for this routinely.
Things we don’t collect. We don’t ask you for, and don’t want, “special category” information — that’s data about your health, race or ethnicity, religion, political views, sexuality, trade union membership, or biometric or genetic data. If you send us any of this voluntarily, we’ll handle it carefully but we’d rather you didn’t.
We may also produce anonymised or aggregated information from the data above — for example, “X% of users in the UK earned cashback from VPN merchants this month.” Once data is properly anonymised it stops being personal information, and we may use and share it freely for any business purpose.
If you don’t give us the information we genuinely need to run the service (like your email address or a payout method), we won’t be able to provide cashback to you. We’ll tell you when that’s the case.
3. Where we get your information from
There are three routes by which information about you reaches us:
Direct from you. Most of what we hold comes from you — when you register, log in, raise a claim, fill in a form, contact our team, or update your account.
Automatically, when you use the site. Cookies, server logs and similar technologies record technical and usage information as you browse. Our Cookies Policy explains this in more detail and how to control it.
From third parties we work with. This is mostly:
- Affiliate networks (such as Impact, Awin, and CJ) — they tell us when one of your purchases has tracked, the order value, and the commission earned, so we can credit cashback to your account.
- Merchants — occasionally, if a sale doesn’t track properly and we need to investigate a claim, we’ll exchange information with the merchant directly.
- Payment providers (such as PayPal) — they confirm to us when a payout has succeeded or failed.
- Sign-in providers (such as Google or Apple), if you choose to sign in that way.
- Analytics providers (such as Google Analytics), which help us understand how the site is used.
4. What we use it for, and the legal basis
Under UK and EU data protection law, every use of your personal information has to fit within one of a small number of “legal bases”. The ones we rely on are:
- Contract — using your data is necessary to provide the service you’ve signed up for.
- Legitimate interests — using your data is reasonably necessary for our business and doesn’t override your rights and freedoms. We’ve thought carefully about this balance for each use below.
- Consent — you’ve agreed, and you can change your mind whenever you want.
- Legal obligation — we’re required by law to use the data in a particular way.
The table below sets out what we do, what information it involves, and which basis applies.
| What we use your data for | Information involved | Legal basis |
| Setting up your account, signing you in, and keeping it running | Account information | Contract |
| Tracking your shopping trips and crediting cashback to your account | Account information, transaction information, technical information | Contract; legitimate interests (paying cashback we owe you, and being paid commission we’ve earned) |
| Paying out your cashback to PayPal or another supported method | Account information, payout information, transaction information | Contract |
| Investigating missing or disputed cashback claims | All of the above, plus support correspondence | Contract; legitimate interests (resolving claims fairly) |
| Replying to your support enquiries | Account information, support correspondence | Contract; legitimate interests (running a responsive service) |
| Detecting and preventing fraud, account takeovers, and abuse of the service | Account information, transaction information, technical information, identity verification information where used | Legitimate interests (protecting members, merchants and our business); legal obligation |
| Sending service emails — confirmations, cashback updates, account notices, policy changes | Account information, marketing preferences | Contract; legitimate interests (keeping you informed about your account) |
| Sending marketing emails about offers, deals, and new merchants | Account information, marketing preferences | Consent (where required); legitimate interests (telling existing members about similar services), with an opt-out in every email |
| Improving the site, running analytics, and understanding which features people use | Technical information, transaction information (in aggregated form where possible) | Legitimate interests (developing the product); consent for non-essential cookies |
| Personalising what you see — for example, recommending merchants based on what you’ve previously clicked or earned cashback from | Account information, transaction information, technical information | Legitimate interests (showing you more relevant offers); consent where required |
| Keeping accounting and tax records | Transaction information, payout information | Legal obligation |
| Responding to lawful requests from courts, regulators, or law enforcement | Whatever is requested and legally required | Legal obligation; legitimate interests (cooperating with authorities) |
| Negotiating or completing a sale, merger, or restructuring of our business | Any data, where relevant | Legitimate interests (continuity of the business) |
If we ever want to use your information for a genuinely new purpose that doesn’t fit any of the above, we’ll let you know first and explain the basis we’re relying on.
5. Who we share it with
We share personal information only where we need to. The recipients fall into the following groups:
Affiliate networks. When you click through to a merchant from Rewardio, your click is passed through an affiliate network. The network records the click and, if a sale completes, reports the transaction back to us. This is how cashback gets tracked at all. The networks we work with include Impact, Awin, and CJ, among others.
Merchants. In rare cases — usually when a tracking issue means we have to investigate a claim manually — we’ll share enough information with the merchant to identify the transaction.
Service providers we use to run Rewardio. These act on our instructions and only for the purposes we’ve set, under written contracts that require them to keep your data secure and confidential. They include:
- Cloud hosting and infrastructure providers
- Database and storage providers
- Email delivery services for transactional and marketing emails
- Customer support tools
- Analytics providers
- Payment processors (such as PayPal)
- Fraud detection and security services
- Professional advisers (lawyers, accountants, auditors) where appropriate
Authorities and other legal recipients. We’ll disclose information where the law requires us to, where a court or regulator orders it, or where we genuinely believe disclosure is needed to protect Rewardio, our members, or others — for example, to investigate fraud or enforce our terms.
A buyer or successor business. If we sell, merge, restructure, or transfer all or part of the business, your information may be transferred as part of that — but the buyer would be bound by this policy (or a successor policy with at least equivalent protections), and you’ll be notified if there’s any material change.
We do not sell your personal information to third parties for their own marketing purposes. We don’t share your data with advertising networks to target you with ads about other companies’ products. (See section 16 for what “sale” specifically means under California law.)
6. Sending information outside the UK and EEA
Some of the providers we work with are based outside the UK and the European Economic Area (EEA), or process data in countries that are. Where that happens, we make sure one of the following is in place:
- The country has been formally recognised by the UK Government and/or European Commission as offering an adequate level of data protection; or
- The transfer is covered by Standard Contractual Clauses (the EU’s approved contract terms) and, for UK data, the UK International Data Transfer Addendum or the UK International Data Transfer Agreement; or
- Another lawful safeguard recognised by the relevant data protection law applies.
If you’d like more detail about a specific transfer or to see a copy of the safeguards in place, contact us at info@rewardio.com.
7. How long we keep your information
The simple version: we keep your data for as long as we need it for the purpose we collected it, then we delete or anonymise it.
The more useful version:
- While your account is open, we keep your account data, transaction history, and related records.
- After you close your account, we keep enough information to handle ongoing or potential disputes, finalise pending cashback, and meet our legal obligations. In practice this usually means up to 6 years for financial and transactional records, in line with UK tax and accounting requirements.
- Support correspondence is typically kept for up to 3 years from the last contact.
- Marketing data is kept until you withdraw consent or unsubscribe — after which we’ll keep a minimal record of your opt-out so we don’t accidentally email you again.
- Backups may take a little longer to fully purge, but data in backups isn’t actively used.
If a longer or shorter retention period is required by law, that takes precedence.
8. How we keep your information secure
We use industry-standard technical and organisational measures to protect your information, including:
- Encrypted connections (HTTPS) across the site
- Encrypted storage of passwords (we don’t store them in plain text and our team can’t see them)
- Access controls so only people who need your data can reach it
- Logging and monitoring to detect unusual activity
- Contracts with our suppliers that require them to maintain comparable protections
No system can be guaranteed 100% secure, and we can’t promise absolute security — but if a breach happens that affects you, we’ll let you know in line with our legal obligations, and we’ll notify the relevant regulator where required.
You have a part to play too: pick a strong, unique password, don’t reuse it on other sites, and don’t share it with anyone. If you think someone has accessed your account without permission, email us straight away.
9. Your rights
Data protection law gives you a set of rights over your personal information. They are:
The right to be informed — about what we do with your data. That’s what this policy is for.
The right of access — to a copy of the information we hold about you.
The right to correct anything that’s wrong or incomplete.
The right to erasure (“the right to be forgotten”) — to ask us to delete your data, where there’s no good reason for us to keep it. This isn’t absolute: if we need to keep something for legal, tax, or fraud-prevention reasons, we’ll explain why.
The right to restrict processing — to ask us to pause certain uses of your data, for example while we look into a correction request.
The right to object — to certain uses of your data, particularly anything based on legitimate interests or used for direct marketing.
The right to data portability — to get the information you’ve given us in a structured, commonly used, machine-readable format, and to send it to another service. This applies where we hold the data based on consent or contract and process it by automated means.
The right to withdraw consent — at any time, where consent is the basis for what we’re doing. Withdrawing consent doesn’t undo anything we did before you withdrew it, but it stops further use.
The right not to be subject to fully automated decisions that have a significant effect on you. We don’t make decisions about you using automated processing alone.
The right to complain — to your local data protection authority. In the UK that’s the Information Commissioner’s Office (ICO) — ico.org.uk. In the EU it’s the supervisory authority in your country. We’d ask you to come to us first so we can try to put things right, but you don’t have to.
To use any of these rights, email info@rewardio.com. To make sure we’re not handing your data to someone pretending to be you, we may ask you to confirm your identity before we act on a request — typically by responding from the email address registered to your account.
We aim to respond within one calendar month. If your request is unusually complex, or you’ve made several requests, we may extend that by up to two more months — and we’ll tell you why if so. There’s no fee, unless your request is clearly unfounded or excessive, in which case we may charge a reasonable amount or decline.
10. Marketing and how to opt out
When you sign up to Rewardio, you can choose whether you’d like marketing emails — things like featured deals, new merchants, and promotions. You’re in control:
- Every marketing email we send has an unsubscribe link at the bottom. One click and you’re out.
- You can also change your preferences at any time from your account settings.
- If you opt out, we’ll still send you essential service messages (cashback confirmations, payout updates, security notices, changes to this policy or our terms). These aren’t marketing, and we can’t switch them off without closing your account.
We don’t sell your details to other companies for them to market to you.
11. Cookies
We use cookies and similar technologies on the Rewardio site. Some are essential to make the site work and to track cashback correctly; others help us understand how the site is used or improve your experience. We explain all of this — and how to control it — in our Cookies Policy.
12. Children
Rewardio is for adults. The service isn’t aimed at, marketed to, or designed for anyone under 18, and you have to be 18 or over to register. We don’t knowingly collect personal information from children. If you think a child has given us their information, email info@rewardio.com and we’ll delete it.
13. Other websites we link to
Rewardio is built around sending you to merchants’ own websites. Once you click through, you’re on their site, governed by their privacy and cookie policies, not ours. We’re not responsible for how those sites handle your information. We’d recommend checking the privacy policy of any site you’re not familiar with before you share information with it.
14. Changes to this policy
We’ll update this policy from time to time — for example, if we add new features, work with new categories of supplier, or to reflect changes in the law. The “Last updated” date at the top tells you when the current version was published.
For minor changes (clarifications, typo fixes, reorganising sections) we’ll just update the page. For changes that genuinely affect how we use your data, we’ll let you know in advance — usually by email — so you have a chance to read it and make any choices you want to.
If you keep using Rewardio after a change takes effect, that means you’ve accepted the updated policy. If you don’t agree with a change, you can close your account.
15. How to contact us
The simplest way to reach us about anything in this policy — questions, complaints, rights requests, or anything else privacy-related — is by email:
info@rewardio.com
We aim to reply within a few working days. For formal data protection requests, we’ll respond within the timescales set out in section 9.
If you’re not satisfied with how we’ve handled a privacy issue, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk (UK) or to your local data protection authority in the EEA. We’d genuinely prefer you let us try to fix it first, though.
16. Notice for California residents
If you live in California, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you some additional rights. Most of these overlap with the rights in section 9, but there are a few specifics worth calling out.
Categories of personal information we collect. Within the past 12 months we have collected the following categories of personal information about California residents: identifiers (name, email, account ID, IP address); customer records (payout details, transaction history); commercial information (merchants you’ve shopped with, cashback earned); internet and network activity (clicks, pages viewed, browsing on Rewardio); and inferences drawn from the above (for example, which merchant categories you tend to use).
Sources, purposes, and recipients. These are described throughout this policy — sections 2, 3, 4 and 5 cover the same ground in detail.
Sale or sharing of personal information. Rewardio does not sell your personal information for money. We also do not “share” your personal information for cross-context behavioural advertising as that term is defined under the CCPA. We do disclose information to affiliate networks and merchants for the purpose of tracking and paying your cashback — that’s the core service, not advertising.
Sensitive personal information. We don’t collect or use sensitive personal information for any purpose that would trigger the right to limit its use under CCPA.
Your rights as a California resident.
- The right to know what personal information we’ve collected about you, where we got it, why we have it, and who we’ve shared it with.
- The right to a copy of that information.
- The right to ask us to correct inaccurate information.
- The right to ask us to delete your information (subject to legal exceptions).
- The right not to be discriminated against for exercising any of these rights — we won’t deny you service, charge you a different price, or give you a worse experience because you used your rights.
To exercise any of these, email info@rewardio.com with the subject line “California Privacy Request”. We’ll verify your identity (typically by asking you to reply from your registered account email) before acting. You can also designate an authorised agent to make a request on your behalf — they’ll need to provide written proof of authorisation, and we’ll still verify your identity directly.
This is version 1.0 of the Rewardio Privacy Policy.