What we collect from customers
We collect only what is needed to pay rewards safely and to give brands useful reports.
- Mobile number, verified by OTP
- Location at the time of the scan (needed to stop misuse) and the town it falls in
- The UPI ID you choose and the account-holder name your bank returns
- Answers to any questions the brand asks, and your shop name if you give it
- Device and network details needed for security, such as IP address
What we collect from brands
Business and contact details, user names and emails, payout provider keys (stored encrypted), and the records of campaigns, codes and payments.
How it is used
To verify claims, prevent fraud, pay rewards, show the brand reports about its own campaigns, provide support, and meet legal duties. We do not sell personal data and do not use it for advertising.
Who it is shared with
- The brand whose code you scanned (only its own customers' data)
- The SMS provider that sends your OTP
- The payout provider that pays your reward and checks your UPI ID
- Authorities, when the law requires it
Storage and security
Data is kept in an access-controlled, encrypted database. Sensitive values such as payout keys and claim links are encrypted again by the application. Staff access needs a password and an authenticator app, and every change is recorded in a tamper-evident log.
How long we keep it
Payment and claim records are kept for 8 years for tax and audit purposes. Other personal data is deleted or anonymised when it is no longer needed.
Your rights
You can ask to see, correct or delete your personal data, or withdraw consent, by writing to the grievance officer below. Some payment records must be kept by law.
Grievance officer
Grievance Officer, RebateX, India. Email hello@rebatex.in. We reply within 7 days and resolve within 30 days.