Privacy Policy

Last updated: 20 July 2026

1. Controller

Weybey Labs Ltd. (operating the REWARTS brand)
2482 Yonge Street North, Unit 1218
Toronto, Ontario, M4P 2H5, Canada
Ontario Corporation Number 1001524076
Email: contact@rewarts.com

This policy covers the rewarts.com website and, once launched, the Rewarts mobile application (the "App") and the card-linked cashback service. We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR and other applicable data-protection laws.

2. Data we process

a) Website visitors

Technically necessary data processed by our hosting infrastructure (Lovable Labs Incorporated, with content delivery by Cloudflare, Inc.): IP address, date and time of access, browser type. The website sets no analytics or marketing cookies; see the Cookie Policy.

b) App users (once the App launches)

• Account data: name, email address, country, login credentials, and — where legally required for withdrawals — identity-verification data.
• Card data: when you link a card, your card number is entered directly with, and tokenized by, service providers certified to the Payment Card Industry Data Security Standard (PCI DSS). Rewarts never receives or stores your full card number; we hold only a token, the card scheme, and truncated digits for display.
• Transaction data: for purchases made with a linked card at participating merchants, we receive matching data (merchant, amount, currency, date/time, offer identifier) from the card schemes via our regulated partner network, solely to attribute your cashback correctly.
• Payout data: the details of the payout option you choose (e.g. account identifier), processed by licensed third-party payment providers.
• Support and device data: messages you send us, and technical App data (device type, OS version, crash logs) needed to run and secure the App.

3. Purposes and legal bases

• Providing the Service (account, card linking, cashback attribution, balance, payouts) — performance of a contract, Art. 6(1)(b) GDPR. Enrolment of your card for transaction monitoring occurs only at your request when you link a card, and is additionally based on your explicit consent, Art. 6(1)(a) GDPR, which you can withdraw at any time by unlinking the card.
• Security, fraud prevention and abuse detection — legitimate interests, Art. 6(1)(f) GDPR.
• Legal obligations (e.g. anti-money-laundering checks by payment providers, accounting, responding to authorities) — Art. 6(1)(c) GDPR.
• Communications about the Service — contract performance; marketing communications only with consent, which you can withdraw at any time.

4. Recipients

We share personal data only as needed to run the Service: PCI DSS-certified card-enrolment and transaction-matching providers and the card schemes (Visa, Mastercard) within our regulated partner network; licensed payment providers executing payouts; hosting and IT providers (including Lovable Labs Incorporated and Cloudflare, Inc.); and professional advisers or authorities where legally required. We do not sell personal data, and we do not share your data with participating merchants in a form that identifies you.

5. International transfers

Where personal data is transferred outside the EU/EEA or the UK (including to Canada and the United States), we rely on adequacy decisions where available and otherwise on EU Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework, with supplementary measures where appropriate.

6. Retention

Account and transaction data are kept for the life of your account and thereafter only as long as required by statutory retention periods (typically 6–10 years for transaction-related records) or for the establishment, exercise or defence of legal claims. Website server logs are retained by our hosting providers for short security-relevant periods. Card tokens are deleted when you unlink the card or close your account.

7. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests, as well as the right to withdraw consent at any time with effect for the future. Contact contact@rewarts.com. You also have the right to lodge a complaint with a data-protection supervisory authority, in particular in the EU/EEA member state of your habitual residence.

8. Cookies

See our Cookie Policy for the technologies used on this website and how to manage them.

9. Changes

We will update this policy as the Service evolves — in particular at App launch — and indicate the date of the latest revision above. For material changes affecting App users we will notify you in the App or by email.