Privacy Policy
This Privacy Policy explains how Rewaffi collects, uses, stores, shares, and protects information when you browse the public website, use its cashback and shopping rewards service, or create an account. Rewaffi is the affiliate publisher and service operator, not the merchant; an eligible reward depends on merchant or affiliate-provider attribution, confirmation, payment, and reconciliation.
Last updated: September 9, 2026
1. About Rewaffi
Rewaffi helps consumers discover supported merchants or submit supported shopping links, start a purchase through a Rewaffi tracking link, and track an eligible reward or cashback. Merchants sell and fulfil the products. Affiliate providers supply attribution, order, commission, and reconciliation data. Rewaffi does not independently decide whether a merchant recorded or approved an order.
2. Information We Collect
Rewaffi may collect: • Account and contact information: email address, full name or display name, phone number, language and currency preferences, referral code, and the internal Supabase user identifier. • Google sign-in information described in Section 3, including email, name, and profile image or avatar when Google supplies them. • Shopping and rewards information: submitted product or merchant URLs, tracking links, referral information, shopping sessions, clicks, order and transaction IDs, merchant or product details, timestamps, order value, commission, status, rejection or reversal reasons, and settlement or reconciliation data. • Payout and verification information when needed: account-holder name, bank or account details, MoMo or VNPay phone number, identity-verification information, and external transfer references. • Technical and security information: IP address and necessary network data, browser or device and user-agent data, access times, login/session state, cookies and local storage, performance and error telemetry, and security logs. Rewaffi uses a secure random browser guest ID for guest shopping sessions; it does not use browser fingerprinting.
3. Google Sign-In and Google User Data
Users may choose to authenticate with Google. The Rewaffi web source sends the Google provider to Supabase Auth and adds only the account-selection prompt; it does not send a custom Google scope or request access to Gmail, Google Drive, Google Calendar, Contacts, YouTube, or other unrelated Google services. For authentication and account management, Rewaffi uses the basic identity information supplied through Google Sign-In: your email address, display name or full name, and profile image or avatar when available, together with the internal Supabase user/account ID. Supabase Auth stores the authentication identity, and Rewaffi stores the corresponding account/profile fields needed to create and secure your Rewaffi account, display your profile, support account recovery, and associate eligible shopping activity with the correct account. Rewaffi does not sell Google user data or share it with merchants or providers for their independent advertising. It may be processed by Supabase and other infrastructure providers described in Section 5 only as needed to provide authentication, hosting, security, support, and the disclosed service.
4. How We Use Information
We use information to: • create, authenticate, secure, and manage Rewaffi accounts; • create tracking links, preserve referral and guest-session attribution, and connect eligible activity to an account; • receive and display clicks, orders, commission status, rewards, and reconciliation updates from affiliate providers; • review eligibility, process provider-paid rewards or cashback, accept payout requests, and make manual transfers through supported channels; • prevent fraud, spam, abuse, account takeover, and attribution manipulation; • provide customer support and investigate order, privacy, security, or payout questions; • measure performance and improve the product; and • meet accounting, tax, affiliate, e-commerce, security, and lawful-authority requirements.
5. How Information Is Shared
Rewaffi shares only information needed for the disclosed purpose and does not sell personal data. Depending on the action, relevant information may be shared with: • Rewaffi partners and merchants for tracking-link operation, attribution, order support, and reconciliation; • infrastructure and service processors, including Supabase, Cloudflare, Vercel, Sentry, and Google/Firebase or Ahrefs Analytics when those optional tools are enabled; • a Vietnamese bank, MoMo, or VNPay when a valid commission transfer is requested; and • professional advisers, tax services, or competent authorities when needed to protect rights, resolve disputes, or comply with law. Google user data is not sold and is not shared so another party can independently advertise based on your Google profile.
6. Google API Data Use and Limited Use
Google user data received through Google Sign-In is used only to authenticate and manage your Rewaffi account, display the profile information you choose to provide, secure the account, and support the disclosed shopping-rewards service. Rewaffi does not use Google user data for unrelated services, sell it, or use it for advertising. Rewaffi's use and transfer of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements.
7. Data Storage and Security
Data is processed on Rewaffi systems and by the service providers described in this Policy. Rewaffi uses access controls, Supabase Row Level Security, secret and token protection, rate limits, bounded operational logs, and account-scoped session and cache handling. Some providers or backups may process data outside Vietnam; Rewaffi applies the safeguards and transfer requirements that apply to those activities. No online service can guarantee absolute security, so protect your credentials and never send Rewaffi your password, one-time code, or payment-card PIN.
8. Data Retention
Account information is kept while an account is active and for as long as needed for the purposes in this Policy. Operational logs are generally retained for about 30 to 365 days depending on their type. Order, commission, payout, financial, tax, reconciliation, security, fraud, and dispute records may be retained as needed to operate the service, prove transactions, resolve issues, or comply with law. When no lawful purpose remains, data is deleted, anonymized, or restricted; backup rotation may take additional time.
9. Account and Data Deletion
You can request account deletion from Dashboard → Settings → Security using the existing Delete account flow, or contact support@rewaffi.com. The current account-deletion operation is a soft deletion: it disables the active account record rather than promising immediate removal of every copy. Rewaffi will delete, anonymize, or restrict data when legally and operationally possible, but may retain financial, order, reconciliation, tax, security, fraud, and dispute records for the periods required for legitimate purposes or law. Rewaffi may verify your identity before completing a request.
10. Cookies and Analytics
Rewaffi uses first-party cookies and browser storage for login and session security, referral attribution, the secure guest ID, interface preferences, and application cache. Required attribution, security, settlement, and server-operational records are separate from optional browser analytics. Optional browser analytics are disabled by default; if the approved environment flag enables them, Rewaffi may use Firebase Analytics and Performance, Vercel Analytics and Speed Insights, Ahrefs Analytics, and client page or behavior events to understand usage and performance. Production error monitoring uses Sentry with default personal-data collection disabled. You can block or delete browser storage, but login, guest-session claiming, and other features may stop working.
11. Children's Privacy
Rewaffi is intended for people aged 18 or older. We do not knowingly invite or create accounts for children. If you believe a child has provided personal information, contact support@rewaffi.com so Rewaffi can review the situation.
12. Changes to This Privacy Policy
Rewaffi may update this Policy when the product, authentication providers, analytics configuration, affiliate providers, or applicable law changes. The updated version and its effective or last-updated date will be posted on this page. Material changes may also be announced through the Dashboard or email when appropriate.
13. Contact
For privacy, Google Sign-In, account deletion, order, reward, or security questions, contact support@rewaffi.com. Include enough information for Rewaffi to locate the relevant account or transaction, but never include a password, one-time code, or payment-card PIN.