Privacy Policy – Abitback.com

Who we are

abitback is a referral-sharing platform at https://abitback.com, operated from the UK. For any privacy question or to exercise your rights, contact admin@abitback.com.

The short version

If you create an account, we store your account details and the referrals you submit.
We log limited technical data (like a hashed IP) to keep the referral system fair and to prevent abuse.
We use cookies to keep you logged in and to remember your country.
We use a small number of third-party services (spam protection, retailer logos, email delivery) described below.
We don’t sell your data or use it for advertising.

What we collect and why

Account information

When you register, we collect your username, email address, and password (passwords are stored hashed by WordPress — we never see them in plain text). This is needed to give you an account, let you log in, and attribute the referrals you submit to you.

Referrals you submit

When you submit a referral, we store the referral code or link, the retailer, the country, the reward amounts you enter, and a timestamp. This is the core function of the site — your referral is shown to other users on rotation.

Anti-abuse and fairness data

To keep the referral rotation fair and prevent gaming, we store a hashed or partial record of the IP address used when a referral is submitted or reported, and counts of impressions, clicks and reveals on referrals. We use this to detect duplicate submissions, self-clicking, and coordinated abuse. We do not use it to identify you personally beyond fraud prevention.

The incentive marketplace (if you use it)

If you take part in incentive offers, we store your claims, any store credit balance, disputes, and related transaction records. This is necessary to operate the marketplace, resolve disputes, and meet our record-keeping obligations.

Communications

We send transactional emails — for example, password resets, and notifications when your referral is approved, paused, or needs reconfirming. We use these to operate your account; they are not marketing.

Technical data

Like most websites, our server and security tools may process standard technical information such as IP address, browser type, and pages requested, for security, debugging, and preventing abuse.

Cookies

We use cookies for the following purposes:

Login/session cookies — set by WordPress to keep you logged in and remember your display preferences. Login cookies last up to two days, or two weeks if you choose “Remember Me”; they are removed when you log out.
Country preference cookie — remembers which country’s referrals to show you.
Extension authentication cookie — if you use the abitback browser extension, a token cookie lets the extension act on your behalf. It contains an access token, not your password, and can be cleared by logging out.
Spam-protection / security cookies — set by reCAPTCHA on our login, registration and submission forms (see Third parties below).

You can control cookies through your browser settings, but disabling essential cookies will prevent login from working.

Third-party services we use

We keep third parties to a minimum. The ones we use:

Google reCAPTCHA — protects our login, registration and submission forms from bots. Google may process your IP address and interaction data under Google’s privacy policy (https://policies.google.com/privacy). reCAPTCHA is subject to Google’s terms.
Logo.dev — supplies retailer logos shown on the site. When a logo loads, your browser requests it from logo.dev; this is a standard image request.
Email delivery — outgoing emails are sent via [your mail provider, e.g. “our web host’s mail server” / “SendGrid” / “Mailgun”], which processes the recipient address and message to deliver it.
Hosting — the site and database are hosted by [YOUR HOST], which stores the data described in this policy on our behalf.

[If you add analytics later — e.g. Google Analytics, Plausible — you MUST add it here and disclose what it collects.]

We do not sell or rent your personal data, and we do not use it for advertising or to assess creditworthiness.

Embedded content from other websites

Pages on this site may include embedded content (such as retailer logos or, if present, videos). Embedded content from other websites behaves as though you visited that other website, which may collect data about you, use cookies, and monitor your interaction with that content.

How long we keep your data

Account data — for as long as your account exists. Delete your account and we remove your personal profile data, except where we must keep records for legal, security, or dispute-resolution reasons.
Referrals — while active or paused in the system; removed when you delete them or your account (subject to the exceptions above).
Marketplace/transaction records — retained as long as needed to resolve disputes and meet legal/accounting obligations.
Anti-abuse data (hashed IPs, engagement counts) — retained only as long as useful for fraud prevention, then removed or further anonymised.
Security logs — retained for a limited period for security purposes.

Your rights

Depending on where you live (and under UK/EU GDPR), you have the right to:

access the personal data we hold about you,
correct inaccurate data,
delete your data (“right to erasure”),
export your data in a portable format,
object to or restrict certain processing,
withdraw consent where processing relies on consent.

You can view and edit most of your data in your account at any time. To request an export or deletion, contact [SUPPORT EMAIL]. We may need to verify your identity first. Note that some data must be retained for legal, administrative, or security purposes and cannot be erased on request.

If you’re in the UK/EU and believe we’ve mishandled your data, you may complain to your data protection authority (in the UK, the Information Commissioner’s Office, ico.org.uk).

Where your data is sent

If you request a password reset, your IP address may be included in the reset email for security.
Form submissions may be checked by an automated spam-detection service (reCAPTCHA).
Your data may be processed by the third-party providers listed above, some of which may operate outside your country; where required, we rely on appropriate safeguards for such transfers.

Children

abitback is not intended for children under [16 / the applicable age in your jurisdiction], and we do not knowingly collect their personal data.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above and, where appropriate, communicated to you.

Contact

admin@abitback.com