Privacy Policy

This Privacy Policy ("Policy") explains how Refunduly ("Refunduly," "we," "us," "our") collects, uses, shares, protects, and retains information about you when you use our websites, applications, emails, and related services (together, the "Service"), and the choices and rights you have.

The Service is offered only to residents of the United States and Canada.

The short version: we collect information you give us, the order emails and other content you choose to send or connect, and information collected automatically when you use the Service. We use it to provide and improve the Service, to find you price-drop and refund opportunities, to communicate with you, to understand and market the Service, and to keep it secure. We share it with service providers and partners that help us do those things, and where the law requires.

KEY POINTS — PLEASE READ

WE PROCESS THE ORDER EMAILS AND OTHER CONTENT YOU SEND OR CONNECT. That is how the Service works. Section 6 explains how.

PLEASE DO NOT SEND US SENSITIVE INFORMATION. Section 4 explains what not to send and what happens if you do. You are responsible for what you choose to send us.

WE MAY USE INFORMATION COLLECTED THROUGH THE SERVICE TO DEVELOP AND TRAIN MODELS AND ALGORITHMS (SECTION 5.9), AND WE MAY CREATE, USE, AND LICENSE DE-IDENTIFIED AND AGGREGATE INFORMATION, INCLUDING ON COMMERCIAL TERMS (SECTIONS 5.10 AND 8.9). De-identified and aggregate information does not identify you, and we do not attempt to re-identify it.

WE AND OUR PARTNERS USE COOKIES AND SIMILAR TECHNOLOGIES FOR ANALYTICS AND ADVERTISING (SECTION 9). Section 9 explains your choices.

THIS POLICY MAY CHANGE, AND CHANGES TAKE EFFECT WHEN POSTED (SECTION 17).

THIS POLICY FORMS PART OF OUR TERMS OF SERVICE. The Terms govern your use of the Service. The disclaimers in Terms Section 24 and the limitations of liability in Terms Section 25 apply to claims arising under this Policy to the fullest extent the law permits. If you reside in the United States, Terms Section 29 requires most disputes — including disputes about this Policy — to be resolved by individual arbitration, and waives your right to a jury trial and to participate in a class action. If you reside in Canada, Terms Section 29.10 carves you out of those provisions.

Contents

1. Scope — What This Policy Covers
2. Definitions
3. Information We Collect
4. Information You Should Not Send Us
5. How We Use Information
6. Order Emails and Other Content You Send Us
7. Google User Data
8. How We Share Information
9. Cookies, Analytics, and Advertising
10. Where Information Is Processed
11. Security
12. Retention and Deletion
13. Your Rights and Choices
14. Communications
15. Children
16. Automated Processing
17. Changes to This Policy
18. Contact and Accountability
19. Additional Information for Canadian Residents

1. Scope — What This Policy Covers

1.1 What this Policy covers. This Policy covers the Service: our websites and marketing pages, our web and mobile applications, any email address we assign to your Account for receiving your email, our emails and notifications, and any other service we make available that links to this Policy or to our Terms of Service.

1.2 What this Policy does not cover. This Policy does not apply to third parties' websites, applications, or services, even where the Service links to them, shows information about them, or works with them — including retailers, marketplaces, and other merchants you buy from; email providers; payment processors; and any site you reach from the Service. When you follow a link from the Service to a retailer or other third party, that third party, and any partner involved in the link, may collect information about you under its own policies. We do not control third parties and are not responsible for their practices. We encourage you to read their privacy policies.

1.3 Who is responsible. Refunduly is the business that operates the Service and is the party responsible for the Personal Information described here — the "data controller," or the equivalent term under the law that applies to you. Our contact details are in Section 18.

1.4 Where the Service is offered. The Service is offered only to residents of the United States and Canada. We do not offer it to, target it at, market it to, or knowingly serve users located in the European Union, the European Economic Area, the United Kingdom, Switzerland, or anywhere else. If you access the Service from outside the United States or Canada, you do so on your own initiative, at your own risk, and you are responsible for compliance with any local law — see Terms Section 3.4.

1.5 No admission of applicability. We provide the disclosures in this Policy, and honor the rights described in it, in the interest of transparency and as a matter of good practice. Nothing in this Policy is, or should be construed as, an admission, acknowledgment, or representation that any particular privacy or data-protection statute applies to Refunduly, or that Refunduly meets any applicability or jurisdictional threshold under any such statute — whether that threshold is based on revenue, on the number of consumers whose information is processed, on revenue derived from selling or sharing personal information, or on anything else. We reserve all rights, defenses, and objections available to us under applicable law, including the right to assert that a given statute does not apply to us, to a particular individual, or to a particular processing activity. Where a statute does apply, the rights and disclosures in this Policy are provided only to the extent of, and subject to every exemption and limitation in, that statute.

2. Definitions

• "Account" means the account you register to access the Service.
• "Applicable Law" means the laws, regulations, and rules that apply to you or to us in connection with the Service.
• "De-identified Information" means information that does not identify, and cannot reasonably be linked, directly or indirectly, to you or to any household or device, including aggregate statistics derived from information about many users.
• "Intake Address" means a unique email address we assign to your Account for receiving email you forward to the Service.
• "Order Data" means order and purchase information you send, connect, or enter into the Service — whether by forwarding email, by connecting an email account where that option is offered, or by entering product links or order details yourself — together with anything we extract or derive from it.
• "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you — or as Applicable Law otherwise defines that term or the equivalent term "personal data" or "personal information." Personal Information does not include De-identified Information or aggregate information.
• "Sensitive Information" means the categories of information that Applicable Law treats as sensitive or as a special category — including government identification numbers, financial account and payment card numbers, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, health and medical information, genetic and biometric data, and information about sex life or sexual orientation.
• "Service Provider" means a third party that processes information on our behalf to help us provide, operate, secure, improve, or market the Service.

3. Information We Collect

The information we collect depends on how you use the Service.

3.1 Information you give us. This includes:

• Account information, such as your name, email address, password, and the profile information your sign-in provider shares with us when you use it to sign in.
• Preferences and settings, such as your notification choices and information you tell us about the retailers, memberships, and shopping preferences relevant to the Service.
• Content you submit, such as the emails you forward to us, product links and order details you enter, and anything else you upload or send through the Service.
• Communications, such as messages you send us, support requests, feedback, and responses to surveys.
• Subscription information. If you subscribe to a paid plan, our payment processor collects your payment details directly. We receive limited information from it, such as a customer reference, your plan, subscription status, and billing history.

3.2 Order Data. From the emails and other content you send or connect, and from the product links and details you give us, we collect and derive Order Data — for example, the retailer, the items, prices, quantities, order identifiers, product links and identifiers, purchase and delivery dates, and return, refund, and cancellation status — together with other information contained in those messages. Section 6 explains how we handle the messages themselves.

3.3 Information collected automatically. When you use the Service, we and our Service Providers and partners automatically collect:

• Device and connection information, such as your IP address, browser and device type, operating system, device and online identifiers, and your approximate location derived from your IP address;
• Usage information, such as the pages and screens you view, the features you use, the links and buttons you click, how long you spend, how you scroll and move through a page, and similar interactions — which some tools capture as a recording of your session;
• Referral and campaign information, such as the page or advertisement that brought you to the Service and the campaign information in the link you followed;
• Logs and diagnostic information, such as request records, error and crash reports, and performance data; and
• Information from cookies and similar technologies, as described in Section 9.

3.4 Information from third parties. We receive information from:

• sign-in providers, such as Google, when you use them to sign in;
• email account providers, where you connect an email account (Section 7);
• our payment processor, about your subscription and payments;
• email delivery providers, about the delivery of our messages — for example, whether they were delivered, bounced, or marked as spam;
• providers of price and product data, and publicly available sources, including retailer web pages, about the products in your Order Data;
• advertising, analytics, and marketing partners, about your interactions with our advertisements and with the Service; and
• partners involved in links to retailers, which may tell us, for example, whether a purchase followed a link.

3.5 Combining information. We may combine the information we collect from different sources and at different times — including information collected when you visited the Service before you created an Account — with your Account and with each other, and use the combined information for the purposes in Section 5.

4. Information You Should Not Send Us

Because you decide what email and content reaches the Service, this Section matters. Read it before you set up forwarding or connect an account.

4.1 Do not send us Sensitive Information. We do not need, want, or ask for Sensitive Information. Please do not forward, upload, or otherwise send us any Sensitive Information, and please do not set up a forwarding rule broad enough to sweep it in. If Sensitive Information nevertheless reaches us inside content you send, we do not intentionally extract it or build records from it, we do not use or disclose it for any purpose that would give rise to a right to limit its use under Applicable Law, and it is handled and deleted along with the rest of that content as described in Sections 6 and 12. You send us such information at your own risk, and to the fullest extent the law permits we are not responsible for it.

4.2 Do not send us other people's information. An order email may incidentally mention someone other than you — a gift recipient's name and shipping address, for example. We do not intentionally extract or build records from that information. Please do not forward emails containing other people's orders.

4.3 Your representations about what you send. By forwarding email to your Intake Address, connecting an account, or otherwise submitting content to the Service, you represent and warrant, each time, that: (a) you are the intended recipient of that content or are otherwise entitled to possess and disclose it; (b) you have the right to send it to us and to have us process it as this Policy describes; and (c) doing so does not breach any law, contract, confidentiality obligation, or third-party right. You are responsible for what you send us and, as set out in Terms Section 26, for claims arising from it.

4.4 Mail sent to your Intake Address by others. Your Intake Address is a credential — anyone who has it can send mail to it. Mail that arrives at your Intake Address is processed as content associated with your Account, whoever sent it, and it is your responsibility to keep the address confidential and to tell us promptly if it is exposed. We can replace it on request. See Terms Sections 4.3 and 9.4.

4.5 We may refuse, quarantine, or discard. We may quarantine, decline to process, or delete any message or content sent to the Service — including anything that fails an authenticity check, appears to be spam or an attack, is disproportionately large or frequent, or that we reasonably believe should not have been sent to us. We are under no obligation to process, store, retain, or return any message or content, and to the fullest extent the law permits we are not liable for declining to.

5. How We Use Information

We use the information described in Section 3 for the following purposes.

5.1 Providing the Service. To detect and organize your orders; monitor prices; identify refund, price-adjustment, price-match, and return-and-rebuy opportunities; calculate what they are worth; and show them to you.

5.2 Running your Account. To create and manage your Account, authenticate you, verify your email address, manage your Intake Address and connected accounts, process your subscription, and provide support.

5.3 Communicating with you. To send service messages, notifications, alerts, and summaries; respond to your requests; and, as permitted by Section 14, send you news, offers, and other marketing.

5.4 Personalizing the Service. To tailor the Service to you — for example, to your retailers, memberships, preferences, and settings.

5.5 Analytics, research, and improvement. To understand how people find and use the Service; measure and improve its performance, reliability, and accuracy; diagnose and fix problems; test changes; and develop new features, products, and services.

5.6 Marketing and advertising. To promote the Service, including on third-party websites, applications, and platforms, and to measure and improve the effectiveness of our marketing and advertising, including by learning whether a visit or signup followed an advertisement (Section 9).

5.7 Security, integrity, and abuse prevention. To verify inbound email and other content, detect, investigate, and prevent fraud, abuse, spam, unauthorized access, and violations of our Terms, and protect the Service, our users, and others.

5.8 Legal and business purposes. To comply with Applicable Law; respond to lawful requests and legal process; establish, exercise, or defend legal claims; resolve disputes; enforce our agreements; and evaluate, negotiate, or complete a transaction of the kind described in Section 8.6.

5.9 Model and algorithm development. We may use information collected through the Service — including Order Data, email and other content, price and product data, and usage information — to develop, train, test, evaluate, and improve the models, algorithms, parsers, classifiers, and other software used to operate and improve the Service and to build new features. One limit applies and is not discretionary:

• Google data is excluded. Information obtained through Google APIs, including anything obtained through a Gmail connection, is not used to develop, improve, or train generalized artificial-intelligence or machine-learning models, and is used only as Section 7 and the Google API Services User Data Policy permit. Where those rules and this Section 5.9 conflict, Section 7 controls.

5.10 De-identified and aggregate information. We may create De-identified Information and aggregate statistics from information collected through the Service — for example, about orders, prices, price changes, savings, retailers, and how the Service is used — and we may use, publish, disclose, and license that information to third parties, including on commercial terms we determine, for any lawful purpose and without restriction. In doing so we commit, and require our recipients to comply, as follows:

• we take reasonable measures to ensure De-identified Information cannot be associated with, or reasonably linked to, you, your household, or your device;
• we maintain and use it only in de-identified form, and we do not attempt to re-identify it, except solely to test that our de-identification works; and
• we contractually require any recipient to maintain it in de-identified form, not to attempt re-identification, and not to disclose it onward except on the same terms.

De-identified Information and aggregate information are not Personal Information, and disclosing them is not a sale or sharing of Personal Information.

5.11 Other purposes. For any other purpose we describe to you when we collect the information, or with your consent.

6. Order Emails and Other Content You Send Us

6.1 Automated processing. Email and other content you send or connect is processed automatically: we check messages for authenticity, match them to your Account, and identify order-related information, which we keep as Order Data. Messages that fail our checks may be quarantined or discarded without being added to your Account.

6.2 What we keep. We keep the Order Data we extract. We may keep a message, or parts of it, for a limited period where that is needed — for example, to add support for a retailer we cannot yet read, to troubleshoot a message that did not import correctly, or to keep the Service secure — and we protect stored message content with encryption. For messages that are not order-related, we generally keep only limited information about the message, such as its sender, subject, time, and how it was handled.

6.3 Access by our personnel. Our personnel access message content only where that is needed — for example, to provide support you ask for, to investigate a security issue or suspected abuse, to maintain and improve how the Service reads messages, or to comply with Applicable Law. Where you connect a Google account, the stricter rules in Section 7 apply instead.

7. Google User Data

7.1 Limited Use. Refunduly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

7.2 What that means here. For data accessed through a Gmail connection, where that option is offered:

• Strict scope. We use it only to detect order-related emails and to provide the features described in this Policy, and we extract only what the Service needs — retailer, item, price, quantity, order number, product identifier, purchase date, and return, refund, and cancellation status. We do not read or extract personal, non-commercial correspondence.
• No human access. We do not allow anyone to read it, except with your explicit permission, for security purposes, to comply with Applicable Law, or where the data has been aggregated and is used for internal operations.
• No advertising, and no generalized model training. We do not use it to serve or target advertising, and we do not use it to develop, improve, or train generalized artificial-intelligence or machine-learning models.
• No onward transfer. We do not transfer it to anyone except as necessary to provide or improve those features, to comply with Applicable Law, or as part of a merger, acquisition, or sale of assets with your explicit prior consent.

7.3 This Section controls. Where anything else in this Policy would permit a use or disclosure of data obtained through Google APIs that this Section 7 does not, this Section 7 controls. It is not subject to change by any other part of this Policy.

7.4 Disconnecting. You can disconnect a Gmail connection at any time in the app, or revoke our access at myaccount.google.com/permissions. Revoking access stops future collection; it does not by itself delete Order Data already extracted — use the deletion path in Section 12.3 for that.

8. How We Share Information

8.1 Service Providers. We share information with Service Providers that perform services for us, such as hosting, infrastructure, and storage; email delivery and receipt; authentication; payment processing; customer support; price, product, and other data services; data processing, including artificial-intelligence and machine-learning services; security and fraud prevention; error monitoring and diagnostics; analytics; and marketing and advertising services. We require them to protect the information and to use it only to provide their services to us. We may add, replace, or remove Service Providers at any time.

8.2 Advertising and analytics partners. We work with advertising and analytics partners that collect information through cookies and similar technologies on the Service, as described in Section 9. They use it to provide their services to us — for example, to measure our advertising and help us show ads for the Service — and, subject to their own privacy policies, may combine it with information they collect elsewhere.

8.3 Our payment processor. Our payment processor collects your payment details directly and processes them under its own privacy policy. We do not receive your full payment card number.

8.4 Retailers and link partners. When you follow a link from the Service to a retailer, the retailer and any partner involved in that link may receive information such as the fact that you arrived from Refunduly and whether you made a purchase. We may receive a commission or other compensation in connection with those links.

8.5 Affiliates. We may share information with any current or future parent, subsidiary, or affiliate of Refunduly, which will handle it consistently with this Policy.

8.6 Business transfers. If Refunduly is involved in a merger, acquisition, financing, reorganization, bankruptcy, insolvency, receivership, sale of assets, or any similar transaction — including during confidential negotiations for one — information we hold, including Personal Information, may be disclosed, transferred, or assigned as part of it, and may become an asset of the acquirer. The acquirer will be required to handle Personal Information in accordance with this Policy or to give you prior notice of materially different practices. See Terms Section 31.3.

8.7 Legal, regulatory, and protective disclosure. We may disclose information, including Personal Information, to the extent Applicable Law permits: in response to a subpoena, court order, warrant, or other legal process; at the request of a government or regulatory authority conducting an investigation; where we believe in good faith that disclosure is necessary or appropriate to comply with Applicable Law, to enforce our Terms or this Policy, to detect or prevent fraud, abuse, or a security incident, to establish, exercise, or defend legal claims, or to protect the rights, property, life, health, security, or safety of Refunduly, our users, or any third party. Nothing in this Section obliges us to contest a legal process on your behalf, and we are not liable for a disclosure made in good-faith reliance on it.

8.8 With your consent or at your direction. We share information where you ask us to or consent to it.

8.9 De-identified and aggregate information. We may disclose and license De-identified Information and aggregate statistics to third parties as described in Section 5.10, including on commercial terms. This is not a disclosure of Personal Information.

9. Cookies, Analytics, and Advertising

9.1 What these technologies are. Cookies are small text files placed on your device by a website. Similar technologies include pixel tags and web beacons, local and session storage in your browser, software development kits in apps, and tools that record how you interact with a page. In this Policy "cookies" covers all of them. Some are set by us and some by our Service Providers and partners.

9.2 How we use them.

9.3 Your choices. Most browsers accept cookies by default. You can block or delete cookies in your browser settings, and limit advertising identifiers in your device settings; if you block strictly necessary cookies you will not be able to sign in. You can opt out of interest-based advertising from many advertising companies through the opt-out tools offered by the Digital Advertising Alliance, the Network Advertising Initiative, and the Digital Advertising Alliance of Canada, and through the ad settings of the platforms where you see ads. Opting out does not stop you from seeing ads; they may simply be less relevant. Your choices apply only to the browser or device on which you make them.

9.4 Consent where required. Where Applicable Law requires your consent for particular cookies or similar technologies, we will ask for it before using them.

9.5 Do Not Track and Global Privacy Control. Browsers may send signals such as Do Not Track or Global Privacy Control. We respond to such signals to the extent Applicable Law requires, and not otherwise.

10. Where Information Is Processed

We and our Service Providers process information in the United States and in other countries where they operate. If you are in Canada, your information will be transferred to, stored in, and processed outside Canada, including in the United States, where privacy laws differ from Canadian law and where your information may be accessible to the courts, law enforcement, and national-security authorities of those countries under their law. By using the Service you consent to that transfer. We require our Service Providers by contract or other means to protect the information they handle for us.

11. Security

11.1 What we do. We maintain administrative, technical, and physical measures designed to protect information within our systems, including encryption of data in transit, encryption of sensitive data at rest, password hashing, access controls, and monitoring.

11.2 No guarantee. No method of transmission over the internet and no method of electronic storage is completely secure. While we strive to use commercially acceptable means to protect your information, we cannot and do not guarantee, warrant, or ensure that unauthorized access, disclosure, alteration, or loss will never occur, and to the fullest extent the law permits we disclaim liability for it. See Terms Sections 18, 24, and 25.

11.3 Your responsibilities. The security of your information depends in part on you. You are responsible for keeping your password and your Intake Address confidential, for using a strong and unique password, for the security of the devices, browsers, and email accounts you use to reach the Service, and for telling us promptly at [email protected] if you believe your Account or Intake Address has been compromised. We are not responsible for a compromise that results from your failure to do so.

11.4 Breach notification. If a breach of security affecting your Personal Information occurs, we will notify you and the relevant authorities to the extent and within the time Applicable Law requires, without unreasonable delay. Providing that notification is the full extent of our obligation to you in respect of a breach, except as Applicable Law otherwise requires.

12. Retention and Deletion

12.1 How long we keep information. We keep Personal Information for as long as we need it for the purposes described in this Policy, and then delete or de-identify it. How long that is depends on the kind of information and why we have it. In general:

12.2 When we keep information longer. Notwithstanding the above, we may retain information for as long as is reasonably necessary, and Applicable Law permits, to: comply with a legal, regulatory, tax, audit, or accounting obligation; establish, exercise, or defend a legal claim, including where we reasonably anticipate litigation or a dispute; respond to or document a complaint, request, or regulatory inquiry; preserve information subject to a legal hold or lawful preservation request; maintain records of fraud, abuse, security incidents, and terminated or suspended Accounts so that we can prevent recurrence; and keep the records necessary to demonstrate our own compliance with this Policy. In determining an appropriate period we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, whether those purposes can be achieved by other means, and applicable legal requirements.

12.3 Deleting your Account. Email [email protected] from your Account email address and we will delete your Account and the Personal Information associated with it, except for information covered by Sections 12.2 and 12.4. We act on deletion requests within the time Applicable Law requires. Deletion is permanent and cannot be reversed, and we cannot restore information once it has been deleted.

12.4 Backups. Deleted information may persist in backups for a period after it is removed from live systems, until those backups are rotated out on their normal schedule. Backups are not used to restore individual Accounts and are not used to answer access requests, and information held in them is not otherwise processed.

12.5 We may delete information. We may delete information from our systems, without notice to you, once we determine it is no longer necessary for the purposes described in this Policy. We do not undertake to store your information indefinitely, and — except where Applicable Law requires otherwise — we are not liable for the deletion or loss of any information. Keep your own copies of anything you need.

13. Your Rights and Choices

13.1 Your rights. Depending on where you live, you may have the right to:

• access the Personal Information we hold about you and obtain a copy of it;
• know what we collect, use, disclose, and retain — this Policy is that disclosure;
• correct inaccurate or incomplete Personal Information;
• delete your Personal Information (Section 12.3);
• port your Personal Information to another party, in a structured, commonly used, machine-readable format, where the right applies and it is technically feasible;
• withdraw consent to optional processing — for example, by disconnecting an account or unsubscribing from marketing email;
• opt out of the sale or sharing of Personal Information, of targeted advertising, and of profiling with legal or similarly significant effects, where the right applies to you and to the processing in question; and
• not be discriminated against for exercising any of these rights, to the extent Applicable Law provides.

13.2 How to make a request. Email [email protected] from your Account email address, describing what you want. For advertising and cookie choices, see Section 9.3.

13.3 Verification. We will ask you to verify control of the Account before we act, and we may require information that matches what we already hold. We may decline a request we cannot verify, and we may decline a request where Applicable Law permits or requires us to.

13.4 Limits on requests. So that we can handle requests fairly and securely:

• We may decline or charge a reasonable fee for a request that is manifestly unfounded, excessive, repetitive, or unreasonably burdensome, where Applicable Law permits.
• We may limit how often you may exercise a right, to the extent Applicable Law permits.
• We may be unable to provide all of the information requested, or to act on part of a request, where doing so would compromise the security or integrity of the Service, reveal a trade secret or confidential commercial information, disclose another person's information, or conflict with a legal obligation. Where we decline, we will tell you why.
• Following a deletion request, we may retain information as described in Sections 12.2 and 12.4, including records of the request itself, for audit and record-keeping purposes.

Otherwise, we do not charge for these requests, and we respond within the time Applicable Law requires.

13.5 Authorized agents. You may use an authorized agent to make a request on your behalf where Applicable Law allows. We may require written authorization signed by you, proof of the agent's authority, and verification of your own identity directly with us, and we may deny a request from an agent who does not provide it.

13.6 Appeals. If we deny a request and the law of your state or province gives you a right to appeal, you may appeal by replying to our decision with "Privacy Rights Appeal" in the subject line and enough information for us to identify the original request and the basis for the appeal. We will review and respond within the statutory period. If we deny the appeal, we will tell you how to complain to your Attorney General or other regulator.

13.7 Regulators. If you are unsatisfied with our response, you may contact your privacy regulator — in Canada, the Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information for Quebec residents; in the United States, your state Attorney General. We ask, as a courtesy, that you raise the issue with us first.

14. Communications

14.1 Service messages. We send messages that are part of providing the Service — for example, order and price-drop alerts, reminders, account verification and security messages, billing messages, and administrative announcements. You can turn off some alerts and summaries in your settings. We reserve the right to send you service-related and administrative messages that you cannot opt out of, for as long as you have an Account. If you do not wish to receive them, close your Account under Section 12.3.

14.2 Marketing. We may send you news, offers, and other marketing messages as Applicable Law permits, including with your consent where it is required. Every marketing email carries a working unsubscribe link, and you may also unsubscribe by emailing [email protected]. It may take a short time for an opt-out to take effect across our systems.

14.3 Push and in-app notifications. Where you allow them, we send push notifications to your device. You can revoke that permission at any time in your browser or device settings, or turn notifications off in the Service.

14.4 Email measurement. Our emails may contain pixels or tracked links that tell us whether a message was opened or a link was clicked, which we use to understand and improve our communications.

14.5 Delivery. We cannot guarantee that any message will be delivered, delivered on time, or not filtered as spam. See Terms Sections 7 and 19.

15. Children

The Service is for adults 18 and over. We do not knowingly collect Personal Information from anyone under 18, and we do not knowingly sell or share the Personal Information of anyone under 16. If we learn that we hold information from someone under 18, we will delete it and terminate the Account. If you believe a child has provided us information, contact [email protected].

16. Automated Processing

The Service is automated: software reads the content you send or connect, extracts Order Data, compares prices, and decides when to notify you. These are informational alerts only. No automated processing we perform produces a decision that has a legal effect on you or that similarly significantly affects you — we do not make eligibility decisions about you, and nothing the Service does affects your credit, insurance, employment, housing, or access to any service. A person always decides whether to act on an alert: you. The alerts may be wrong, late, or absent; see Terms Sections 6, 7, and 24.

17. Changes to This Policy

17.1 We may change this Policy. We may update this Policy at any time to reflect changes in the Service, in our practices, in the providers we use, or in Applicable Law.

17.2 When a change takes effect. When we update this Policy we post the revised version on this page and update the date shown above. The revised Policy takes effect when it is posted, except where Applicable Law requires advance notice or your consent, in which case we will provide that notice or seek that consent before the change applies to you.

17.3 Your continued use. By continuing to use the Service after a revised Policy takes effect, you accept it. If you do not agree with a change, stop using the Service and close your Account under Section 12.3. We encourage you to review this page periodically.

17.4 Relationship to the Terms. This Section 17 governs changes to this Policy and controls over Terms Section 30 in respect of them, as Terms Section 1.3 provides. Terms Section 30 continues to govern changes to the Terms themselves.

18. Contact and Accountability

Refunduly is the business responsible for the Personal Information described in this Policy. The role below is accountable for privacy compliance — including for the purposes of Canada's Personal Information Protection and Electronic Documents Act and Quebec's Act respecting the protection of personal information in the private sector — and is where requests under Section 13 should be sent:

[email protected]

We investigate every complaint we receive about this Policy or our handling of information, and we aim to resolve it promptly. We ask that you cooperate with that process and give us the information we need to do it.

19. Additional Information for Canadian Residents

This Section applies to residents of Canada, and supplements the rest of this Policy. Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") applies to us regardless of our size, so nothing in Section 1.5 limits this Section.

19.1 Consent. We collect, use, and disclose your Personal Information with your consent, or as PIPEDA and applicable provincial law otherwise permit or require. By creating an Account and using the Service you consent to the collection, use, and disclosure described in this Policy, including the use of cookies and similar technologies for analytics and advertising described in Section 9, the transfer to and processing outside Canada described in Section 10, and the creation and licensing of De-identified Information described in Sections 5.10 and 8.9. Where you connect an email account, that connection is a separate, express, opt-in consent.

Withdrawing consent. You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice, by emailing [email protected], and you can opt out of interest-based advertising as described in Section 9.3. Withdrawing consent to processing that is necessary to provide the Service means we can no longer provide it, and we may close your Account. Withdrawal does not affect the lawfulness of processing carried out before it.

19.2 Accountability. The role identified in Section 18 is the individual accountable for our compliance with PIPEDA and, for Quebec residents, is the person responsible for the protection of personal information under Quebec's private-sector privacy law.

19.3 Transfers for processing. As Section 10 states, our Service Providers may be located outside Canada, including in the United States. Transferring Personal Information to a Service Provider for processing does not require your consent beyond that described in this Policy, but you should know that while it is in another country it is subject to the law of that country and may be accessible to that country's courts and authorities. We use contractual and other means to require a comparable level of protection.

19.4 Access and correction. You may request access to, and correction of, the Personal Information under our control, as described in Section 13. We will respond within the time PIPEDA requires. We may refuse access where the law requires or permits us to — for example, where granting it would reveal Personal Information about another person, would compromise the security of the Service, or would reveal confidential commercial information — and where we refuse we will tell you why and inform you of your right to complain.

19.5 Automated decision-making. Section 16 applies. We do not use your Personal Information to render a decision based exclusively on automated processing that produces legal or similarly significant effects.

19.6 Complaints. Complaints go first to [email protected]. If you are unsatisfied with our response you may complain to the Office of the Privacy Commissioner of Canada, or — if you are a Quebec resident — to the Commission d'accès à l'information du Québec.