Privacy Policy

Draft for review. This text is a starting point. Before launch it must be checked by the site's owner, ideally with a lawyer, and the parts in [square brackets] completed.

This Privacy Policy explains what personal data Yield Pulse collects, why, who receives it and what your rights are. It applies to the website [yieldpulserewards.com] and its services (the "Service"). You accept it when you create an account.

1. Who is responsible

The controller of your personal data is [operator's legal name], [address] ("we", "us"). For privacy questions use the Contact page [or write to (privacy email address)].

[If the operator is not established in the EU or the UK: the name and address of our representative in the EU and in the UK (Article 27 GDPR and UK GDPR).]

2. What we collect

• Account data: username, email address and password (stored only as a secure hash). If you sign in with Google, the identifiers Google sends us.
• Earnings and activity: the offers you complete and their rewards as our partners report them, your balances and their history, cash-out requests, referrals, leaderboard results and notifications.
• Payout data: for each cash-out, the method (and the gift card, if you chose one), the amount, the email address it is sent to and its order ID.
• Messages: what you write to our support or through the contact form, and our answers.
• Technical and security data: IP addresses and the country they come from, browser and device information (user agent), a random device identifier stored in a cookie, the times of visits and logins, and the results of our security checks (for example whether several accounts use the same device or address).
• Preferences: for example whether your name appears on leaderboards and in the live earnings feed.
• Notifications on your phone: if you allow them in our app, the address your phone gives us to receive them (a "push token") and whether it is an Android phone or an iPhone.

We don't ask for your real name, postal address, phone number or identity documents. If we ever need to verify your identity before a payout (see the Terms), we will tell you what we need and why.

Your answers to surveys go directly to the partner that runs the survey, under its own privacy policy. We don't receive them: only whether you completed the survey and its reward.

3. Why we use it, and on what legal basis

The legal bases under the GDPR and the UK GDPR are given in brackets.

• To provide the Service: create and run your account, credit rewards, pay you, run referrals and leaderboards, and answer you (performance of our contract, Art. 6(1)(b)).
• To prevent fraud and keep the Service secure: detect multiple accounts, bots and abuse (offer partners check for VPNs and proxies themselves), protect payouts and meet our partners' anti-fraud requirements (our legitimate interest in a fair, secure service, Art. 6(1)(f)). Some rewards are held automatically for a while (for example on new accounts or for large offers) and automated checks flag activity for review. Decisions to close an account or decline a cash-out are taken by our staff, and you can ask for any decision about you to be reviewed by a person, give your point of view and contest it, through the Support or Contact page.
• To send service emails: email confirmation, password resets, payout and security notices and answers to your messages (contract and legitimate interest). We don't send marketing emails.
• To send notifications to your phone, if you allow them in our app: new rewards, cash-outs, our answers to you, our announcements and security notices (your consent, Art. 6(1)(a)). You can turn them off at any time in your phone's settings.
• To meet legal obligations, such as keeping financial records (Art. 6(1)(c)).
• To share data with offer partners when you open their offerwalls (contract, and your consent where the law requires it, Art. 6(1)(a)). You can withdraw your consent by no longer using the offerwalls or by closing your account; this doesn't affect what happened before.

4. Who receives it

• Offer partners (offerwalls): when you open an offerwall we give the partner your member ID — a random code, not your email or username — and the partner may also receive your IP address and device data directly from your browser. Partners use this data to show you offers, track completions, prevent fraud and report your rewards to us, under their own privacy policies. We and our partners may exchange information about suspected fraud. Our current partners are the offerwalls shown on the Earn page: [list each active offerwall with a link to its privacy policy, and add any disclosure text a partner requires].
• Service providers who process data for us, only on our instructions and under contracts that require them to protect it: hosting [provider and country], Cloudflare (network protection and the Turnstile check against bots), Resend (sending our emails), Backblaze (storing the backup copies of our database, in the EU) and Google (only if you sign in with Google).
• Payouts: our payout provider receives the email address of your account, the amount and the reward you chose, and emails you the payout. For PayPal, you give your PayPal account to the payout provider yourself when you claim it, and PayPal handles the payment under its own privacy policy.
• Notifications: our notification provider receives your phone's push token and the text of each notification, and delivers it through Google's (Android) or Apple's (iPhone) notification service.
• Other members: your username, partly hidden (for example ah•••23), may appear on the leaderboards, in the live earnings feed and on the Referrals page of the member who invited you. You can hide it in Settings.
• Authorities and advisers, when the law requires it or to defend our rights.
• A new owner: if Yield Pulse or its business is sold, merged or otherwise transferred, your data passes to the new owner, who must keep protecting it as this policy says. We will tell you before it happens.

We don't sell your personal data, and we don't use it for targeted advertising.

5. International transfers

[Our servers are located in (country).] The backup copies of our database are stored in the Netherlands. Some partners and service providers are outside the UK or the European Economic Area, for example in the US (such as Cloudflare, Resend, Google, Apple, our payout provider and our notification provider). In those cases we rely on adequacy decisions (including the EU–US Data Privacy Framework where the recipient is certified) or on the European Commission's Standard Contractual Clauses and the UK's International Data Transfer Addendum.

6. How long we keep it

We keep your data while your account exists, with these limits: notifications are deleted after 6 months; the requests offer partners send us when you complete an offer are deleted after 12 months (the reward itself stays in your history); support and contact conversations are deleted 12 months after they are closed; your phone's push token is deleted when you log out of the app, when it stops working or when you are signed out of every device. Copies in our backups are deleted when the backups expire, within 30 days.

Closing your account. You can delete your account in Settings: it is deleted 14 days after you ask, and logging in before then cancels it. If nobody logs in to an account for 12 months, we email you and close it 30 days later unless you log in.

When an account is closed, we delete your email address (also from your payout records), username, password, Google sign-in, notifications, your phones' push tokens and support conversations. We keep only:

• the records of your rewards, balances and payouts (with their order IDs), linked to an anonymous account, as long as tax and accounting law requires, up to [10] years after closing;
• security data (IP addresses, device identifiers and the results of our fraud checks) for 6 months after closing, so that deleting an account can't be used to get around our rules or to escape a reversal;
• the record of your request and of how we handled it.

7. Cookies

We only use cookies the Service needs:

• yp.session_token and related cookies keep you signed in (up to 30 days).
• yp_did is a random device identifier, set when you open the sign-up or login page, used to keep accounts secure and detect fraud (up to 400 days).
• yp_ref remembers a referral link you opened, for 30 days, so the member who invited you is credited.
• yp_ann remembers the last announcement you closed, so it doesn't show again (up to one year).
• Cloudflare sets cookies for network protection and for the check against bots.

We don't use advertising or analytics cookies. Offerwall partners may set their own cookies on their walls; their policies explain them.

8. Your rights

If you live in the UK or the EU (including Germany), you can ask for access to your data, a copy in a portable format, correction, deletion and restriction of processing, and object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time. You can also complain to a data protection authority: in the UK the Information Commissioner's Office (ico.org.uk); in Germany the data protection authority of your federal state.

If you live in the US, depending on your state (for example California, Colorado, Connecticut, Virginia, Utah or Texas) you can ask to know what personal information we collect and how we use it, to get a copy, and to have it corrected or deleted, and you can opt out of its sale or use for targeted advertising — we do neither. California residents may withdraw their consent to the sharing of their data with offer partners at any time, as described in section 3. We won't treat you differently for using your rights.

You can delete your account yourself in Settings (see section 6). To use your other rights, contact us from the Support page or the Contact page. We may need to confirm your identity first. We answer within one month (UK and EU) or 45 days (US), and tell you if we need longer. If a request is clearly unfounded or excessive, for example because it is repeated, we may charge a reasonable fee or refuse it, and we will tell you why.

9. Children

The Service is only for people aged 18 or older. We don't knowingly collect data from anyone younger and we don't share such data with partners. If we learn that someone under 18 has an account, we close it and delete its data as section 6 describes.

10. Security

We protect your data with measures such as encrypted connections, hashed passwords, encrypted secrets, access limited to the staff who need it, two-step verification for staff and a log of staff actions. No system is completely secure, so please use a strong password that you don't use anywhere else. If a security incident puts your personal data at risk, we report it to the data protection authority within 72 hours where the law requires it, and tell you without delay when it is likely to put your rights at high risk.

11. Changes

We may change this Privacy Policy at any time and without prior notice, for example when we add a partner or a feature. A change applies as soon as we publish it on this page, and the date at the top shows when it was last updated, so please check this page from time to time. Where the law requires us to tell you about a change before it applies, or to ask for your consent, we will.