Privacy Policy
This explains what we collect about you, why we collect it, who we pass it to, and the control you have over it.
1. Who is responsible for your data
[COMPANY LEGAL NAME] of [REGISTERED ADDRESS] is the data controller. Our data protection contact is [DPO / PRIVACY EMAIL].
Our registration with [SUPERVISORY AUTHORITY] is [REGISTRATION NUMBER].
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Email, username, password hash, country, referral code, sign-up date | You |
| Activity | Offers completed, rewards credited, bonus codes claimed, referrals, chat messages | You and our advertising partners |
| Financial | Balances, withdrawal requests and destinations, deposit records | You and our payment providers |
| Technical | IP address, approximate location from it, browser and device, timestamps | Automatically, when you use the site |
| Verification | Identity and age documents, where we are required to check them | You |
| Support | Emails and messages you send us | You |
We never see or store your full card number. Card and wallet payments are handled entirely by our payment processor; we only receive a token, the last four digits and the result.
We do not store your password. We store a bcrypt hash of it, which cannot be reversed.
3. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Running your account, crediting rewards, paying withdrawals | Performance of our contract with you |
| Matching offer completions back to your account | Performance of our contract |
| Preventing fraud, multi-accounting and abuse | Our legitimate interest in a service that is not being defrauded |
| Identity, age and anti-money-laundering checks | Legal obligation |
| Keeping financial records | Legal obligation |
| Service emails about your account and payouts | Performance of our contract |
| Marketing emails | Your consent — withdrawable at any time |
| Non-essential cookies and analytics | Your consent |
We do not sell your personal data, and we do not use it for automated decisions that have a legal effect on you without a human being able to review them.
4. Who we share it with
- Advertising and offer networks (for example ayeT Studios) — we pass an identifier so a completion can be matched back to your account and you can be paid. They are separate controllers for what they collect inside their own offers, under their own policies.
- Payment and payout providers — to send money to you, or to take a deposit from you.
- Identity verification providers — where a check is required.
- Infrastructure providers — hosting and email delivery, acting on our instructions.
- Authorities — where the law, a regulator or a court requires it.
- A buyer, if the business is sold, subject to the same protections.
Public parts of the service show a shortened version of your name (for example
ale***) or your chosen username on leaderboards, the payouts feed and chat. Your
email address is never shown publicly.
5. International transfers
Some providers are outside [YOUR REGION]. Where data is transferred, we rely on an adequacy decision or on Standard Contractual Clauses with appropriate safeguards. Ask us for a copy at [PRIVACY EMAIL].
6. How long we keep it
| Data | Kept for |
|---|---|
| Account and activity | While your account is open, then [PERIOD] |
| Financial and transaction records | [e.g. 6 years], as required by law |
| Verification documents | [PERIOD] after the check |
| Chat messages | The most recent 300 messages; older ones are deleted automatically |
| Self-exclusion records | Kept as long as needed to enforce the exclusion |
7. Your rights
Depending on where you live, you can ask us to:
- Access the personal data we hold about you, as a copy.
- Correct anything inaccurate — you can edit most of it yourself on your profile.
- Delete it, where we have no overriding legal reason to keep it.
- Restrict or object to processing based on legitimate interests.
- Port it to another provider in a machine-readable format.
- Withdraw consent at any time, for anything based on consent.
Email [PRIVACY EMAIL]. We respond within one month. You can also complain to [SUPERVISORY AUTHORITY + LINK], though we would rather you came to us first.
Deleting your account does not delete records we are legally required to keep, such as transaction history and anti-money-laundering checks. Those are retained for the periods in section 6 and are not used for anything else.
8. Cookies and browser storage
We keep this deliberately small.
| What | Purpose | Essential? |
|---|---|---|
rl_token (local storage) | Keeps you signed in between pages | Yes |
rl_api_base (local storage) | Development override for the API address | Yes |
| Chat draft state (session storage) | Stops you losing a half-typed message | Yes |
| [ANALYTICS, IF ANY] | [PURPOSE] | No — consent required |
Essential storage is what makes signing in work; it cannot be switched off without breaking the service. If you add any non-essential cookie you must ask for consent before setting it.
9. Security
- Traffic is encrypted with HTTPS.
- Passwords are stored as bcrypt hashes, never in readable form.
- Sessions use signed tokens that expire.
- Sign-in and registration are rate-limited to slow down guessing attacks.
- Administrative access is restricted to named accounts.
No system is perfectly secure. If we discover a breach that puts you at risk, we will tell you and the relevant authority without undue delay.
10. Children
RewardLane is strictly for adults aged 18 or over. We do not knowingly collect data from children. If you believe a child has registered, contact [PRIVACY EMAIL] and we will close the account and delete the data.
11. Changes
If we change how we use your data in a way that affects you, we will email you and post a notice before the change takes effect.
12. Contact
[COMPANY LEGAL NAME]
[REGISTERED ADDRESS]
Privacy: [PRIVACY EMAIL]
Support: [SUPPORT EMAIL]
See also our Terms of Service and Responsible Play page.