Privacy Policy

At Preffin, we care about your privacy and are committed to protecting your personal data. This Privacy Policy describes how we collect, use, disclose, and protect your information when you use our Services.

1. Information We Collect

1.1 Information You Provide

Account Information:

• Name, email address, phone number
• Password and account credentials
• Profile information and preferences

Payment Information:

• Credit/debit card details (first 6 and last 4 digits, expiration date)
• Transaction history at participating merchants

Communications:

• Customer support inquiries and correspondence
• Feedback, reviews, and survey responses

1.2 Information Collected Automatically

Transaction Data:

• Purchase amounts, dates, and times at participating merchants
• Merchant identifiers and location information
• Transaction verification status

Device and Usage Information:

• Device type, operating system, and version
• IP address and approximate location
• App usage patterns, features accessed, and session duration
• Advertising identifiers (with your consent)

Location Data:

• Precise location (with your permission) to identify nearby participating merchants
• Approximate location derived from IP address

1.3 Information from Third Parties

• Card Networks and Payment Processors: Transaction data from Fidel API to detect purchases
• Bank Verification Services: Account verification data from Plaid
• Merchant Partners: Transaction details to verify and validate purchases
• Social Login Providers: Basic profile information if you sign in with Google, Apple, or Facebook

2. How We Use Your Information

Purpose	Data Used
Provide Services: Process transactions, calculate and distribute cashback rewards, manage your account	Account info, payment info, transaction data
Verify Transactions: Confirm purchases at participating merchants and prevent fraud	Transaction data, card info, bank verification
Personalize Experience: Show relevant offers, nearby merchants, and personalized recommendations	Location, usage data, transaction history
Communications: Send service updates, cashback notifications, and promotional offers	Contact info, preferences
Improve Services: Analyze usage patterns, fix bugs, develop new features	Usage data, device info, feedback
Security and Fraud Prevention: Detect and prevent fraudulent activity, protect accounts	All categories as needed
Legal Compliance: Comply with laws, respond to legal requests, enforce our terms	All categories as needed

3. How We Share Your Information

3.1 Service Providers

We share information with trusted service providers who assist in operating our Services:

• Fidel API: Card-linking and transaction detection
• Plaid: Bank account verification
• Merchant Network: Facilitating cashback redemption at participating merchants
• Cloud Hosting: Data storage and infrastructure
• Analytics Providers: Understanding usage patterns
• Customer Support: Handling inquiries and issues

3.2 Merchant Partners

We share limited transaction data with participating merchants to validate purchases and confirm cashback eligibility. We do not share your personal contact information with merchants for their marketing purposes without your consent.

3.3 District and Sponsor Partners

We may share aggregated, anonymized data with district partners and sponsors to demonstrate program effectiveness. We do not share personally identifiable information without your consent.

3.4 Legal Requirements

We may disclose information when required by law or to:

• Comply with legal process or government requests
• Protect the rights, property, or safety of Preffin, our users, or others
• Detect, prevent, or address fraud, security, or technical issues
• Enforce our Terms of Service

3.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change.

4. Data Retention

We retain your information for as long as necessary to:

• Provide the Services and maintain your account
• Comply with legal obligations (e.g., tax records, fraud prevention)
• Resolve disputes and enforce our agreements

When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law.

5. Your Rights and Choices

5.1 Access and Portability

You can request a copy of your personal data in a portable format.

5.2 Correction

You can update your account information at any time through the app or by contacting us.

5.3 Deletion

You can request deletion of your account and personal data. Note that deletion may result in forfeiture of unredeemed cashback.

5.4 Marketing Opt-Out

You can opt out of marketing communications by:

• Clicking "unsubscribe" in any marketing email
• Adjusting notification preferences in the app
• Contacting us at privacy@preffin.com

5.5 Location Data

You can disable location services through your device settings. Note that this may limit certain features.

5.6 Do Not Track

We honor Global Privacy Control (GPC) signals. We do not currently respond to browser Do Not Track signals.

6. Security

We implement industry-standard security measures to protect your information, including:

• Encryption of data in transit and at rest
• Secure authentication and access controls
• Regular security audits and monitoring
• Employee training on data protection

However, no method of transmission over the Internet is 100% secure. Please protect your account credentials and notify us immediately of any unauthorized access.

7. Children's Privacy

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn that we have collected information from a child under 18, we will delete it promptly.

8. Third-Party Links and Services

Our Services may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third parties. We encourage you to review their privacy policies.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Remember your preferences and login status
• Analyze usage patterns and improve our Services
• Deliver relevant content and offers

You can manage cookie preferences through your browser settings. Disabling cookies may affect functionality.

10. State-Specific Privacy Rights

10.1 California Residents (CCPA/CPRA)

California residents have additional rights:

• Right to Know: Request disclosure of personal information collected, used, and shared
• Right to Delete: Request deletion of personal information
• Right to Correct: Request correction of inaccurate information
• Right to Opt-Out: Opt out of "sale" or "sharing" of personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights

We do not sell your personal information. We may share information with advertising partners for targeted advertising, which may constitute "sharing" under CCPA. You can opt out by clicking "Your Privacy Choices" in the app.

CCPA Disclosure Table

Category of Personal Information	Collected	Disclosed for Business Purposes	Sold/Shared
Identifiers (name, email, phone, IP address)	Yes	Service providers, payment processors	No
Financial Information (card numbers, bank account)	Yes	Payment processors (Plaid, Dwolla)	No
Commercial Information (transaction history, cashback)	Yes	Service providers, merchant partners	No
Geolocation Data (precise location)	Yes (with consent)	Service providers	No
Internet Activity (app usage, browsing)	Yes	Analytics providers	Advertising partners (sharing only)
Inferences (preferences, characteristics)	Yes	Service providers	Advertising partners (sharing only)
Sensitive Personal Information (precise geolocation)	Yes (with consent)	Service providers	No

We retain each category of personal information as described in Section 4 (Data Retention). We do not knowingly sell or share personal information of minors under 16.

How to Exercise Your Rights

To submit a request:

• Click "Your Privacy Choices" in the app settings
• Email privacy@preffin.com with subject "PRIVACY REQUEST"
• Call our privacy hotline (number in app)

We will verify your identity before processing requests. You may designate an authorized agent to submit requests on your behalf with proper documentation.

Opt-Out Preference Signals

We honor Global Privacy Control (GPC) signals. When we detect a GPC signal, we will treat it as a valid opt-out request for that browser or device. For more information, visit globalprivacycontrol.org.

Appeals

If we deny your privacy request, you may appeal by emailing privacy@preffin.com with "APPEAL" in the subject line. We will respond within the timeframe required by law.

10.2 Virginia, Colorado, Connecticut, and Other States

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, and others) have similar rights to access, correct, delete, and opt out. Contact us to exercise your rights.

11. Third-Party Payment Services

11.1 Plaid

When you link a bank account for cashback redemption or card verification, you may be prompted to connect through Plaid, Inc. Plaid collects your bank login credentials and account information to verify your identity and account ownership. Plaid's use of your information is governed by Plaid's Privacy Policy. To exercise privacy rights regarding data collected by Plaid, contact Plaid directly.

11.2 Participating Merchants

When you use your cashback balance at a participating merchant, we share limited transaction information with that merchant to facilitate the redemption. This may include your Preffin user ID and the cashback amount applied to your purchase.

12. Third-Party Advertising

We may use third-party advertising partners to serve ads and measure their effectiveness. These partners may use cookies, pixels, and similar technologies to collect information about your activity on our Services and other websites.

To opt out of interest-based advertising:

• Web: Visit optout.aboutads.info or optout.networkadvertising.org
• Mobile: Download the AppChoices app at aboutads.info/appchoices
• Device Settings: Adjust "Limit Ad Tracking" (iOS) or "Opt out of Ads Personalization" (Android) in your device settings

13. Analytics

We use third-party analytics services, including Google Analytics, to understand how users interact with our Services. These services collect information such as pages visited, time spent, and device information.

You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on. Learn more about Google's privacy practices at google.com/policies/privacy/partners.

14. GDPR Rights (European Users)

While our Services are primarily intended for U.S. users, if you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to Access: Obtain confirmation of whether we process your data and receive a copy
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data in certain circumstances
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
• Right to Lodge a Complaint: File a complaint with your local data protection authority

Legal Basis for Processing: We process your data based on: (a) your consent; (b) performance of a contract with you; (c) compliance with legal obligations; or (d) our legitimate interests (such as fraud prevention and service improvement).

Data Transfers: Your data may be transferred to and processed in the United States. We rely on Standard Contractual Clauses approved by the European Commission to ensure adequate protection for such transfers.

15. Data Breach Notification

In the event of a data breach that compromises your personal information, we will notify affected users as required by applicable law. Notification may be provided via email, in-app notification, or prominent posting on our website. We will also notify relevant regulatory authorities as required.

Our notification will include: (a) description of the incident; (b) types of information involved; (c) steps we are taking; (d) steps you can take to protect yourself; and (e) contact information for questions.

16. De-Identified Information

Where we maintain or use de-identified information, we will continue to maintain and use that information only in a de-identified form and will not attempt to re-identify the information, except to test our de-identification processes.

17. International Users

Our Services are intended for users in the United States. If you access our Services from outside the U.S., your information will be transferred to and processed in the United States, which may have different data protection laws than your country. By using the Services, you consent to this transfer.

18. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our Services and updating the "Last Updated" date. For significant changes, we will provide additional notice (such as email or in-app notification). Your continued use after changes constitutes acceptance.

19. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us:

• Email: privacy@preffin.com
• Support: support.preffin.com
• Mail: Preffin, Inc., Attn: Privacy, St. Louis, MO

We will respond to your request within the timeframes required by applicable law (typically 30-45 days).