Privacy Policy
Rewardaroo Pty Ltd (ABN 21 697 112 191).
Last updated: 19/05/2026
This Privacy Policy describes how we collect, use, store, share and protect your personal information when you use rewardaroo.com and the Rewardaroo service.
We operate as if we are bound by the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), even where the small business exemption may otherwise apply.
If you have questions or concerns about your privacy, contact us at support@rewardaroo.com.
1. What we collect
1.1 Information you give us directly
When you create an account or use the service, we collect:
- Your name
- Your email address
- A password (stored as a hash, never in plain text)
- Your residential state or postcode (used for state-specific prize draw eligibility)
- Your date of birth (used to verify you are 18+ and to verify age for alcohol-related deals)
- Your payment details, processed by Stripe (we never store your card number)
- Any information you provide when contacting us (support emails, forms, surveys)
1.2 Information collected automatically
When you use the site, we automatically collect:
- Your IP address
- Browser type and version
- Pages visited, time spent, and links clicked
- Referring website
- Device type and operating system
- Approximate location (city level, derived from IP address)
1.3 Information from third parties
If you sign in using a third-party account (such as Google), we receive the name and email address associated with that account.
We don’t buy personal information from data brokers.
2. Why we collect it
We use your personal information to:
- Provide the service you’ve paid for (account access, deal recommendations, draw entries)
- Process payments and prevent fraud
- Send you transactional emails (receipts, account notifications, password resets)
- Send you the member newsletter and product updates (you can opt out at any time)
- Verify your eligibility for state-restricted deals and prize draws
- Verify you are 18+ for alcohol-related content
- Improve the service through analytics and member research
- Comply with our legal obligations
We don’t use your personal information for any purpose that isn’t reasonably necessary for one of the above.
3. Marketing
We send the monthly newsletter and occasional product updates to active members. You can unsubscribe from any marketing email by clicking the unsubscribe link at the bottom, or by emailing support@rewardaroo.com.
Unsubscribing from marketing emails doesn’t stop transactional emails (receipts, password resets, draw winner notifications, account-related notices). You’ll still receive these for as long as you have an account.
We don’t share your email address with third-party marketers. We don’t sell your personal information to anyone.
4. Who we share it with
We share personal information with the following categories of service providers, only to the extent necessary for them to provide their service:
| Provider | Purpose | Location of data |
|---|---|---|
| Stripe | Payment processing | United States (PCI-DSS compliant, contractual APP commitments in place) |
| VentraIP | Web hosting | Australia |
| Amazon Web Services (used by some of our service providers) | Backend infrastructure | Australia (Sydney region where available) |
| Google (Google Analytics, Workspace) | Analytics and email | United States and Australia |
| An email delivery service (e.g. Postmark, SendGrid) | Transactional and marketing email | United States |
| RankMath, LiteSpeed and similar WordPress plugins | Site operation | Vary; see provider terms |
Where service providers are based overseas, we take reasonable steps to ensure they handle your personal information consistently with the Australian Privacy Principles, including by relying on their contractual privacy commitments and Privacy Shield / GDPR-equivalent frameworks where applicable.
We may also disclose your personal information:
- To affiliate or partner platforms when you click through to redeem a deal (limited to information needed to attribute the referral, such as an anonymous tracking ID — never your name or email)
- Where required by law (court order, regulatory request)
- To protect our rights, our members, or the public from harm
- To a buyer in the event of a sale of the business (subject to that buyer agreeing to handle your information in accordance with this policy)
5. Affiliate tracking
When you click through to a partner site through Rewardaroo, the partner may receive a tracking identifier that lets us record the referral for commission purposes. This identifier doesn’t contain your name, email or any direct personal information. The partner’s own privacy policy governs how they handle any further information you provide to them.
6. Cookies and analytics
We use cookies and similar technologies to:
- Keep you signed in
- Remember your preferences
- Measure how the site is used (Google Analytics)
- Track referrals for affiliate commission purposes
- Detect and prevent fraud
You can disable cookies in your browser settings, but the service won’t work properly without them (you won’t be able to stay signed in).
Google Analytics is configured to anonymise IP addresses where possible. You can opt out of Google Analytics tracking via the Google Analytics Opt-Out Browser Add-on.
7. Storage and retention
7.1 Where your data lives
Account information, payment records and prize draw records are stored on Australian-hosted servers operated by our hosting provider.
Some processing happens via overseas service providers (see section 4).
7.2 How long we keep it
| Data type | Retention period | Reason |
|---|---|---|
| Account information (while you’re a member) | For as long as your account is active | To provide the service |
| Account information (after you close your account) | 90 days, then deleted or de-identified | Account recovery, billing reconciliation |
| Payment records | 7 years | Tax law (ATO record-keeping requirements) |
| Prize draw entry records and winner records | 7 years | Trade promotion permit conditions |
| Marketing email subscription status | Until you unsubscribe, plus 12 months | To honour your unsubscribe preference |
| De-identified analytics data | Indefinitely | Business analytics; data cannot be linked back to you |
| Support correspondence | 24 months from last contact | Dispute resolution |
If you close your account, we’ll delete or de-identify your personal information within 90 days, except where we’re required to retain it for one of the purposes above.
8. Security
We take reasonable steps to protect your personal information. These include:
- HTTPS encryption on all pages
- Password hashing (we never store passwords in plain text)
- Payment processing through PCI-DSS compliant providers
- Limited access to personal information within our team
- Regular software updates and security patches
- Monitoring for unauthorised access
No system is completely secure. If you become aware of a security issue, please report it to support@rewardaroo.com.
9. Data breach response
If we become aware of a data breach that’s likely to result in serious harm to affected individuals, we will:
- Contain the breach as quickly as possible
- Assess the risk and the personal information affected
- Notify the Office of the Australian Information Commissioner (OAIC) within the timeframes required by the Notifiable Data Breaches scheme
- Notify affected individuals directly by email, with information about what happened, what data was affected, and what steps to take
10. Your rights
You have the right to:
- Access the personal information we hold about you. Email support@rewardaroo.com and we’ll provide it within 30 days.
- Correct any inaccurate or outdated information. You can update most details from your account settings, or email us.
- Delete your account and personal information (subject to legal retention obligations described in section 7).
- Object to specific uses (such as marketing emails — use the unsubscribe link).
- Complain to us at support@rewardaroo.com. If you’re not satisfied with our response, you can escalate to the OAIC at oaic.gov.au.
You can exercise any of these rights for free.
11. Children
Rewardaroo is not intended for users under 18. We don’t knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us and we’ll delete it.
12. Cross-border disclosure
As noted in section 4, some of our service providers are based overseas. By using the service, you consent to your personal information being disclosed to recipients in those countries (primarily the United States, where Stripe, Google, and most email services are located).
Where we disclose personal information to overseas recipients, we take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles. We rely on:
- Contractual commitments from major service providers
- Service providers’ compliance with frameworks like SOC 2, ISO 27001, PCI-DSS, and (for EU-based providers) the GDPR
- Industry-standard practices for the size and nature of our service
13. Changes to this policy
We may update this Privacy Policy from time to time. The updated version is published with the Last updated date at the top.
If we make a material change that reduces your privacy protections, we’ll notify you by email at least 14 days before it takes effect.
14. Contact
Rewardaroo Pty Ltd ABN 21 697 112 191 Brisbane, Queensland, Australia
Privacy queries: support@rewardaroo.com
If you’re not satisfied with our response:
Office of the Australian Information Commissioner Website: oaic.gov.au Phone: 1300 363 992