Privacy notice

This notice explains what we collect about you when you use CashBlack, why we collect it, who else sees it and what you can do about it. It covers the CashBlack website, the CashBlack UK app and the CashBlack browser extension.

Cashblack Ltd, registered in England and Wales under company number 12785292, whose registered office is 71-75 Shelton Street, London WC2H 9JQ, is the data controller. That means we decide what is collected and why, and we are answerable to you for it. You can reach us at support@cashblack.com.

What we collect

Your account. Your email address, and your name if you give us one. If you sign in with Google, Apple or Facebook we receive your email address, whether that provider has verified it, and the identifier that provider uses for you. We never receive your password from them, and if you sign in that way we hold no password for you at all.

Your money. Each time you click through to a retailer we record the click, which retailer it was and the cashback rate that applied at that moment. When a purchase is confirmed we record its value, the cashback earned and the currency. When you cash out we record the amount, the method and the payout details you gave us. Payout details are encrypted, and nobody at CashBlack can read them out of the database.

What you do in the app. We record meaningful actions: screens you open, searches you run, brands you save, offers you tap. This is how we tell which parts of CashBlack work and which do not.

Your device, in limited ways. If you use A.F.R.O.B.O.T to scan a product, the image and any text on it are processed on your phone and are not sent to us. If you use voice search, your speech is turned into text on your phone. What leaves your phone is the search words, not the picture and not the recording.

Where to send a notification. If you turn notifications on, your phone gives us an address for itself, issued by Apple or by Google. We store it against your account so we can tell you when cashback is confirmed or a payout has been sent, and we hold one for each device you sign in on. It identifies the handset rather than you, it is reissued whenever the app is reinstalled, and we delete ours when you sign out on that device. Turning notifications off in your phone's settings stops them arriving.

Security information, for team accounts. An admin account holds an encrypted second-factor secret and a record of the administrative actions taken on it.

What we do not collect

We do not collect your card number, your bank login or your banking password. Where CashBlack connects to a bank account for in-store cashback, that connection is made through a regulated open banking provider and we never see your credentials.

We do not track your location in the background. Location is used only while you are looking at a map or at businesses near you, and only if you allow it.

We do not sell your personal information to anybody.

Why we collect it, and our lawful basis

• To run your account and pay you cashback. Necessary to perform our contract with you.
• To work out what you have earned and to settle it when a retailer confirms a purchase. Necessary for our contract.
• To keep financial records. We have a legal obligation to keep company and tax records.
• To detect and prevent fraud and to keep accounts secure. Our legitimate interest in running a service that is not being defrauded, weighed against your interest in not being wrongly flagged.
• To understand which parts of the product work. Our legitimate interest in improving CashBlack. You can object to this and we will stop.
• To send you marketing email, where you have asked for it. Your consent, which you can withdraw at any time in Settings.

Who else sees it

We use a small number of companies to run CashBlack. Each receives only what it needs.

• Our affiliate partner, which tracks your click through to a retailer so the retailer knows the sale came from you and pays the cashback. It receives an identifier for your account and an identifier for the click. It does not receive your email address or your name.
• Our hosting and database providers, which store the information described above. The database is in London.
• Our email provider, which sends account email such as verification and password resets.
• Our error reporting provider, which tells us when something breaks.
• Retailers you buy from, who take your order through their own checkout in the ordinary way. What you buy is between you and them. We learn the value of the sale and the commission on it, not your basket.
• Sign-in providers, if you choose to use one: Google, Apple or Facebook.

Where your data goes

Your data is stored in the United Kingdom and the European Economic Area. Some of the companies above are based in the United States. Where data reaches them it is protected by the transfer safeguards the law requires, and we will tell you which ones if you ask.

How long we keep it

We keep your account information for as long as you have an account with us.

We keep financial records, meaning your cashback, the purchases it came from and your cashouts, for six years after the end of the tax year they fall in. We are required to.

When you delete your account we remove your name, your email address, your password, your linked sign-ins, and everything you browsed, searched or saved. We keep the financial records above with your name and contact details stripped out of them, so they no longer point at you. The delete page sets this out in full before you confirm.

Your rights

You have the right to ask us for a copy of what we hold about you, to have it corrected if it is wrong, to have it deleted, to object to us using it, to ask us to restrict how we use it, and to receive it in a portable form.

You can delete your account yourself, in the app or on this website, under Settings. It takes effect immediately and you do not need to ask us.

For anything else, email support@cashblack.com. We will answer within one month.

If you think we have got something wrong, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, and you can do that without coming to us first.

Cookies

Our cookies policy sets out what we store in your browser and how to control it.

Changes to this notice

If we change what we collect or why, we will update this notice and change the date at the top. Where the change is significant we will tell you directly rather than leave you to find it.