Privacy Policy

Last updated: October 2026

1. Data We Collect

We collect your email address (stored encrypted), display name, and card type preferences. With your permission, we also access your device location to power location-based notifications (see section 2). Open Banking account information features are in development and not currently enabled; when offered, transaction data will be accessed only with your explicit consent through an FCA-authorised Open Banking provider under PSD2. This is read-only account information access; we do not initiate payments, never use the data for marketing, and never sell it.

2. Location Data

If you grant permission, the app accesses your device location, including precise location and location while the app is in the background, to provide our Nudge feature. When you are at or near a participating shop or venue, we use your location to send a notification showing which of your cards earns the most rewards there. To find nearby venues, your approximate location may be sent to our servers to look up shops close to you; this lookup is used only to return nearby results and is not retained.

We use location solely to provide these recommendations. We do not build a profile of your movements, we do not keep a history of your location, we do not use location for advertising, and we never sell it. Location-based notifications are optional: you can turn location access off in your device settings whenever you choose, which disables these notifications while the rest of the app continues to work.

3. How We Use Your Data

Your data is used solely to provide personalised card recommendations, track your rewards, and improve our service. We never sell your data to third parties.

4. Data Security

All sensitive data is encrypted using AES-256. Passwords are hashed with bcrypt. For Open Banking we do not store bank access or refresh tokens; we store only an encrypted provider customer reference and the consent reference. We use TLS for all data in transit.

5. Your Rights (UK GDPR)

You have the right to access, rectify, delete, and port your personal data. You can exercise these rights by contacting privacy@rewards4all.co.uk. We will respond within 30 days. You can also delete your account and all associated data directly in the app; see our account deletion page.

6. Data Retention

We retain your data for as long as your account is active. Open Banking data is subject to 90-day PSD2 consent windows. You can delete your account and all associated data whenever you choose.

7. Cookies

We use essential cookies for authentication. We do not use tracking or advertising cookies.

8. Contact

Data Protection Officer: privacy@rewards4all.co.uk