Privacy Notice

Version 1.2. Effective 30 September 2026.

This Privacy Notice explains what data we collect when you use Cindy Rewards, what we do with it, and what choices you have.

Read it alongside our Terms of Service.

1. Who We Are

Cindy Rewards (cindyrewards.com) is operated by Burleywhag Limited, a company registered in England and Wales under company number 17077813, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

Burleywhag Limited is the data controller responsible for the personal data we process about you. Because we are established in the UK, UK data protection law (UK GDPR and the Data Protection Act 2018) applies to our processing, in addition to the rights US users have under state privacy laws such as the California Consumer Privacy Act.

We are registered with the UK Information Commissioner's Office (ICO) under registration number ZC125602.

Privacy and data requests: privacy@cindyrewards.com

2. The Data We Collect

Account data: your email address, sign-in method, gender, US state, month and year of birth, education level, race/ethnicity, and household income band.
Chat data: information about how you use AI assistants and chatbots such as ChatGPT (OpenAI), Claude (Anthropic), and Gemini (Google). This includes the content of your conversations and any related information contained in or associated with them, for example message metadata, timestamps, citations, and commercial interactions. You provide this data to us by uploading it through your personal secure account. Before we scrub it, this is your raw contribution.
Screening survey data: your answers to short questions we may ask before you can take part in a particular project, for example about how you use AI assistants or your interests. We use these answers primarily to decide whether you are eligible for that project. We may also use them to group contributors in our market research products, for example by how often they use AI assistants. Please do not include personal details or your employer's confidential information in any written answer.
Technical data: IP address, device and browser information, how you use the Service, and how you arrived at it (the campaign or link that brought you here), which we save to your account when you sign up. See Section 14 for cookies and tracking.
Communications: any emails you send us.
Referral data: your referral code, any referral code you entered at signup, and the status and amount of your referral rewards.
Derived data: labels our classifiers assign to your scrubbed contribution, such as topic, intent, and whether a conversation is work-related or personal.

3. How We Handle Your Chat Data (Scrubbing and Retention)

When you provide chat data, we remove personal and third party identifiers, including names, locations, email addresses, phone numbers, and similar details, using automated scrubbing.

We keep your scrubbed contribution, to build market research products about how people use AI assistants and to apply new analyses over time, until you close your account or ask us to delete it.

Scrubbing removes identifiers that software can detect, but not every detail. Your scrubbed contribution may still contain personal or sensitive information, so it remains personal information under California law.

Before any extract of your contribution is shared as a Snippet, a person reviews it and removes anything that could identify you, so Snippets are not personal information (Section 7). Conversations flagged as containing sensitive information are excluded from Snippets.

4. How We Separate and Protect Your Data

We hold your data in three separate stores and control access to each:

Identity store: your real identity, such as your email and login. It contains no conversation text and no demographics. Access to it is logged.
Mapping store: the link between your identity and a random contributor ID. This link is separately protected. We use it only to act on your requests, such as deletion, and access to it is restricted and logged.
Research store: your scrubbed contribution, keyed to your contributor ID, together with your demographics (gender, month and year of birth, US state, education level, race/ethnicity, household income band), any screening survey answers, and the provider. It contains no direct identity.

Our analysts and classifiers work only with research store data, on data keyed to a contributor ID rather than your identity.

We build aggregate datasets by combining many contributors' data into statistics and datasets that cannot be linked back to you. Once aggregate datasets are built, we cannot remove your data from them.

We protect against re-identification by:

storing your month and year of birth rather than a full date, and deriving age ranges for any downstream or saleable use;
holding location no finer than US state;
showing demographics only in broad bands, such as age ranges and US state, and combining or removing any demographic group that is too small to share safely.

5. Sensitive Information in Your Chats

Your chats may contain sensitive information, for example about health, finances, or personal life. At signup you are asked for explicit consent to retain this information, as required by Article 9(2)(a) UK GDPR. You can withdraw it at any time by asking us to delete your contribution. Without this consent you cannot use the Service.

6. How We Use Your Data

To run your account and compensate you.
To run our referral scheme and pay referral rewards. To check for referral abuse we review the referrer's and the invited person's technical data, account details and gift card delivery details together.
To measure how people find and sign up for the Service and credit the advertising channel or referral that brought them to us.
To check whether you are eligible for a project, using your screening survey answers.
To scrub your raw contribution and retain the result, and to classify and analyse it, including by applying new analyses in the future.
To build market research products that we provide to our business and research customers.
To send you essential service emails.
To secure the Service and detect fraud and abuse.
To comply with our legal obligations.

Our legal bases (UK GDPR)

UK GDPR applies to all of our processing. We rely on:

Your consent (Article 6(1)(a)) to retain your contribution and any screening answers, to classify and analyse it now and in the future, and to build market research products from it. You can withdraw consent at any time by requesting deletion.
Your explicit consent (Article 9(2)(a)) for any special category data in your contribution, as described in Section 5.
Performance of a contract (Article 6(1)(b)) to run your account, compensate you, pay referral rewards and assess your eligibility for projects.
Our legitimate interests (Article 6(1)(f)) to keep the Service secure and prevent fraud, to measure how people find and use the Service and credit the advertising or referral that brought them to us, where this is not overridden by your rights.
Legal obligation (Article 6(1)(c)) where the law requires us to process data.

7. Who We Share Data With

We share personal information with service providers who may only use it to provide their service to us, for example hosting, database and authentication, AI classification of scrubbed text, email, error monitoring, and gift card fulfilment.

Analytics and advertising providers receive technical data about your visit through tags on our website, as described in Section 14. We do not send them your name, email address, answers or contributions. We have enabled the restricted processing options these providers offer for US users.

If you joined using someone's referral code, that person can see your first name and the status and amount of their reward. They cannot see your full name, email address or anything else about you.

We sell and share aggregate data and Conversation Snippets ("Snippets"), and nothing else, with our business and research customers. A Snippet is a short extract of a scrubbed conversation, no longer than 140 characters, from which personal and third party identifiers have been removed. Neither is personal information and neither can identify you.

We may also share data with authorities where legally required, and with a successor entity if we sell or restructure our business.

We do not sell your personal information. We never sell or share your raw contribution or your individual account data. Analytics and advertising providers receive technical data about your visit for measurement, as described in Section 14, and we restrict how they may use it. We only share demographic information in aggregated form, for example the age ranges of a group of contributors.

8. Your Privacy Rights

If you are a California resident, you have rights under the CCPA/CPRA. You can know what personal information we hold and how we use it, delete it, correct inaccurate information, opt out of any sale or sharing of your personal information, and limit the use of sensitive personal information.

Under UK GDPR, which applies to everyone who uses the service, you also have the right to access your data, ask us to correct or delete it, restrict or object to certain processing, receive a copy in a portable format, and withdraw your consent at any time (withdrawal does not affect processing that was lawful before you withdrew).

To exercise any of these, email privacy@cindyrewards.com or use the self-service option on our website. We will verify your request and respond within the time the law allows. We will not discriminate against you for exercising your rights. You can also complain to the ICO (ico.org.uk) or, if you are in the EU, to your local data protection authority.

On selling and sharing: other than the technical data our analytics and advertising providers receive (Section 14), we do not sell or share your individual personal information. We only sell and share aggregate data and Snippets, which are not personal information. Snippets that are shared have had personal and third party identifiers removed.

On deletion: when you close your account or ask us to delete your data, we resolve your contributor ID through the mapping store and delete your scrubbed contribution from the research store, along with the identity and mapping records linked to you. Once your data has been built into aggregate datasets or Snippets, we cannot remove it from them. You keep any gift cards already paid to you.

9. Notice of Financial Incentive

We provide you a gift card in exchange for uploading your data. Under California law this is a "financial incentive," and we are required to describe it here.

What the incentive is. A gift card for each valid upload. The current amount and any limits are shown in the Service before you upload.
What data it relates to. The raw contribution you provide, and the scrubbed contribution we retain from it.
How you join and how you withdraw. You join by signing up. You can withdraw at any time by closing your account, which deletes your data (Section 8).
How we value the data. We make a good-faith estimate of the value of your data based on what we pay to acquire and process comparable data. The gift card reflects that value.

Participation is voluntary.

10. How Long We Keep Your Data

Raw contribution: held only as long as needed to scrub it, and for no more than 90 days, then deleted.
Scrubbed contribution (research store): retained so we can operate and develop our market research products, including future analysis. Deleted within 30 days of a verified deletion request or account closure.
Account data: kept while your account is active; deleted within 30 days of account closure or a verified deletion request (except records we must keep by law).
Screening survey data (research store): kept alongside your scrubbed contribution and deleted within 30 days of a verified deletion request or account closure. Once used in aggregate datasets, it cannot be removed from them.
Aggregate data and Snippets: kept indefinitely. Not personal information and cannot be linked back to you.
Communications and records: kept as long as needed to handle disputes and meet legal obligations.

11. International Transfers

Where we transfer personal data out of the UK, we use a legally recognized safeguard such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

12. Security

We use reasonable technical and organizational measures to protect your data. These include encrypting data in transit and at rest, limiting access to those who need it for their role, requiring multi-factor authentication on our systems, and holding your identity separately from your contribution as described in Section 4.

13. Children

The Service is not for anyone under 18. You must confirm you are 18 or over to sign up. If we discover we have collected data from someone under 18, we will delete it and close the account.

14. Cookies and Tracking

We use cookies and similar technologies on cindyrewards.com.

Our cookies. Login cookies keep you signed in. Two short-lived cookies (one lasting up to 30 days, one up to an hour) record how you arrived at the Service, such as the campaign in the link you clicked and the referring website, so we can credit the advertising or referral that brought you here. This information is saved to your account when you sign up.

Third-party tags. We use Google Analytics and advertising pixels from the platforms we advertise on, such as Reddit, to measure how people find and sign up for the Service. These receive your IP address, device and browser information, the pages you visit and which signup steps you complete, but not your name, email address, answers or contributions. The providers process this data under their own privacy policies and may set their own cookies.

You can block or delete cookies in your browser settings. If you block our login cookies, the Service will not work.

15. Changes to This Notice

We may update this Notice from time to time. If we make material changes, we will tell you by email or through the Service before they take effect.