Privacy Notice

This notice explains what we collect about you when you use CashBlack, why we collect it, who else sees it and what you can do about it. It covers the CashBlack website, the CashBlack UK app and the CashBlack browser extension.

Cashblack Ltd, registered in England and Wales under company number 12785292, whose registered office is 71-75 Shelton Street, London WC2H 9JQ, is the data controller. That means we decide what is collected and why, and we are answerable to you for it. You can reach us at support@cashblack.com.

What We Collect

Your account. Your email address, and your name if you give us one. If you sign in with Google, Apple or Facebook we receive your email address, whether that provider has verified it, and the identifier that provider uses for you. We never receive your password from them, and if you sign in that way we hold no password for you at all.

Your money. Each time you click through to a retailer we record the click, which retailer it was and the cashback rate that applied at that moment. When a purchase is confirmed we record its value, the cashback earned and the currency. When you cash out we record the amount, the method and the payout details you gave us. Payout details are encrypted, and nobody at CashBlack can read them out of the database.

The browser extension. Its searches are anonymous and we do not record them. We record which part of the extension a click came from and, if you sign in from the extension, that you did and which version you were using (never the token), and we use these for your own badges. Our browser extension policy sets out everything the extension reads and sends.

What you do in the app. We record meaningful actions: screens you open, searches you run, brands you save, offers you tap. This is how we tell which parts of CashBlack work and which do not.

Counting app installs. The first time the app opens after it is installed, it sends us a random number it made for itself, whether the phone is an iPhone or an Android, which country's app it is and the app version. We use it only to count how many times the app has been installed. It is not linked to your account or to anything that identifies your phone, and it never includes an advertising identifier.

Your device, in limited ways. If you use A.F.R.O.B.O.T to scan a product, the image and any text on it are processed on your phone and are not sent to us. If you use voice search, your speech is turned into text on your phone. What leaves your phone is the search words, not the picture and not the recording.

A.F.R.O.B.O.T search. When you search, we receive your search words or a product's barcode, your market and, if you give one, a postcode or your location, and we use them only to find Black-owned alternatives and stores near you. If our own catalogue has no match, we look up the barcode or the words, and nothing about you, in Open Food Facts, Open Beauty Facts and Open Products Facts, free public product databases. A postcode is turned into a map position by postcodes.io. No artificial intelligence service receives your searches.

Where to send a notification. If you turn notifications on, your phone gives us an address for itself, issued by Apple or by Google. We store it against your account so we can tell you when cashback is confirmed or a payout has been sent, and we hold one for each device you sign in on. It identifies the handset rather than you, it is reissued whenever the app is reinstalled, and we delete ours when you sign out on that device. Turning notifications off in your phone's settings stops them arriving.

Messages you send us from the website. If you write to us through the Contact page, the Work With Us application or another form on the website that writes to us, we keep your name, your email address, what you wrote and, if you give them, your phone number and your company, and we email it to the CashBlack inbox it is for. We use it only to answer you and to follow up on what you asked about.

Security information, for team accounts. An admin account holds an encrypted second-factor secret and a record of the administrative actions taken on it.

What We Do Not Collect

We do not collect your card number, your bank login or your banking password. Where CashBlack connects to a bank account for in-store cashback, that connection is made through a regulated open banking provider and we never see your credentials.

We do not track your location in the background. Location is used only while you are looking at a map or at businesses near you, and only if you allow it.

We do not sell your personal information to anybody.

Why We Collect It, And Our Lawful Basis

• To run your account and pay you cashback. Necessary to perform our contract with you.
• To work out what you have earned and to settle it when a retailer confirms a purchase. Necessary for our contract.
• To keep financial records. We have a legal obligation to keep company and tax records.
• To detect and prevent fraud and to keep accounts secure. Our legitimate interest in running a service that is not being defrauded, weighed against your interest in not being wrongly flagged.
• To understand which parts of the product work. Our legitimate interest in improving CashBlack. You can object to this and we will stop.
• To send you marketing email, where you have asked for it. Your consent, which you can withdraw at any time in Settings.
• To answer a message you send us from the website. Our legitimate interest in replying to people who write to us, and, for a business applying to join, the steps you asked us to take before any contract.
• To pass your email address to a stall you bought from at a CashBlack IRL event, so it can email you about its own products and offers. The soft opt-in under regulation 22(3) of the Privacy and Electronic Communications Regulations 2003, which lets a business you have bought from email you about its own similar products and offers, as long as you were given a simple way to refuse when you bought and in every email after. You can refuse on the pass, unsubscribe in any email from the stall or ask us to stop.

Who Else Sees It

We use a small number of companies to run CashBlack. Each receives only what it needs.

• Our affiliate partner, which tracks your click through to a retailer so the retailer knows the sale came from you and pays the cashback. It receives an identifier for your account and an identifier for the click. It does not receive your email address or your name.
• Our hosting and database providers, which store the information described above. The database is in London.
• Our email provider, which sends account email such as verification and password resets, and carries a message you send us from the website to our own inbox.
• Our error reporting provider, which tells us when something breaks.
• Addaiaspora, our group's analytics service. When you sign up, when you click through to a retailer and when the app first opens after it is installed, we send it your IP address. It turns that into an approximate city and then discards it. CashBlack does not store your IP address. When you sign up we also send it your first name and the first letter of your last name, which appear in an internal dashboard seen only by CashBlack and Addaiaspora staff and are deleted after 90 days.
• Retailers you buy from, who take your purchase through their own checkout in the ordinary way. What you buy is between you and them. We learn the value of the sale and the commission on it, not your basket.
• Sign-in providers, if you choose to use one: Google, Apple or Facebook.
• Stalls you buy from at a CashBlack IRL event. When you get a CashBlack IRL event pass and then buy from a stall, and that purchase is confirmed rather than voided, we share your email address with that stall, which is named on the pass page, so it can email you about its own products and offers. We do not share it if you ticked “No thanks, don't email me” on the pass, and we never share it with a stall you did not buy from. Every email from the stall must let you unsubscribe, and you can ask us to stop sharing your email address at any time by emailing support@cashblack.com.

Where Your Data Goes

Your data is stored in the United Kingdom and the European Economic Area. Some of the companies above are based in the United States. Where data reaches them it is protected by the transfer safeguards the law requires, and we will tell you which ones if you ask.

How Long We Keep It

We keep your account information for as long as you have an account with us.

We keep financial records, meaning your cashback, the purchases it came from and your cashouts, for six years after the end of the tax year they fall in. We are required to.

When you delete your account we remove your name, your email address, your password, your linked sign-ins, and everything you browsed, searched or saved. We keep the financial records above with your name and contact details stripped out of them, so they no longer point at you. The delete page sets this out in full before you confirm.

Your Rights

You have the right to ask us for a copy of what we hold about you, to have it corrected if it is wrong, to have it deleted, to object to us using it, to ask us to restrict how we use it, and to receive it in a portable form.

You can delete your account yourself, in the app or on this website, under Settings. It takes effect immediately and you do not need to ask us.

For anything else, email support@cashblack.com. We will answer within one month.

If you think we have got something wrong, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, and you can do that without coming to us first.

Cookies

Our cookies policy sets out what we store in your browser and how to control it.

Changes To This Notice

If we change what we collect or why, we will update this notice and change the date at the top. Where the change is significant we will tell you directly rather than leave you to find it.