Privacy Policy for Cashback

 

This Privacy Policy was last updated on 06 January 2026

 

This Privacy Policy explains how Otterpaw collects, uses, and discloses information about you. Unless otherwise stated, the definitions in the Cashback Service Agreement shall apply.

 

This Privacy Policy is formulated in accordance with Singapore's Personal Data Protection Act 2012 (PDPA). We commit to complying with all applicable PDPA obligations, including notification, consent, purpose limitation, data protection, and individual rights.

 

This Privacy Policy applies to your download, installation, registration, login, browsing, or any other use (collectively, "use") of our Cashback Services ("Service") —whether via our website, desktop browser extension, software applications, mobile applications, or any other device or platform.

 

We adhere to the principle of data minimization: we only collect the personal information strictly required to enable core cashback functionality — such as tracking eligible purchases through our Merchants, validating transactions, and crediting rewards to your account. For example, we may use cookies or similar technologies to recognize your activity on Merchant sites, but only to the extent needed to ensure you receive the Reward Points you've earned.

 

It should be noted that this Privacy Policy does not apply to services provided by Merchants, partners, or other external parties, even if you access them through our Platform. For example, when you make a purchase on a Merchant's website via Platform, any personal information you provide directly to that Merchant is governed by their own Privacy Policy, not ours.

 

By clicking "I have read, understood and agree to this Privacy Policy" or by using our Services, you acknowledge and agree to the practices described in this Privacy Policy.

 

What Personal Data Do We Collect and How We Use It?

 

When you use our Services, we collect certain information about you.

 

This information comes directly from you or your device, such as device information, IP address, country, region, or your interactions with our Merchants. 

 

Depending on which of our Services you interact with, we collect and process the following types of information:

• Sign-in information: When you choose to sign in using your Facebook, Google, Apple or other social media account, we may collect your name, email, profile picture, and other data you authorize those platforms to share. We use this to set up and manage your account, personalize your experience, and communicate with you. You can revoke this access at any time through your social platform settings;
• Usage and transaction data: Information about how you use our platform and interact with our Merchants — for example, the pages you visit, products you view, time spent on sites, clicks, redirects, order reference numbers, and transaction details necessary to verify and credit your cashback;

• Device and technical data: Identifiers and technical information from your device, such as IP address, device type, operating system, browser type, unique device identifiers (e.g., IDFA, AAID), and cookies. With your permission, we may also check whether certain partner apps (e.g., Lazada, Shopee) are installed in some situations to personalize your experience and enable seamless redirection. This helps us ensure compatibility, detect fraud, and optimize performance across devices;
• Location information: With your permission, we may collect precise or approximate location data to show you relevant local offers or tailor services to your region;
• Communications: Records of your interactions with us via customer support, chat, email, or social media channels;
• Information from third parties: We only receive such data permitted by law — for example, to fulfill our contract with you (e.g., verifying a delivery address via a logistics partner), with your consent, or based on our legitimate interest in fraud prevention. We may receive data from trusted partners — such as voucher issuers, logistics providers, or public sources — where they have obtained your consent or are otherwise permitted by law to share it. This may include demographic insights or verification data to enhance Service accuracy and security.

 

We use cookies and similar tracking technologies (such as pixel tags and local storage) to enable the core functionality of our Service. Specifically, when you click through from our platform to a Merchant's website and complete an eligible purchase, these technologies help us recognize that transaction and work with the Merchants to verify and accurately credit your Reward Points.

We only use cookies for the following purposes:

• To record your click-through from our platform to a merchant's site;
• To capture essential transaction parameters (e.g., order ID, timestamp) for cashback matching and fraud prevention;
• To improve platform performance and user experience.

 

Our cookies do not collect the following information:

• Your search engine history;
•  Email content;
•  Browsing activity on websites that are not our Merchants;
•  Any sensitive personal information (e.g., credit card numbers, passwords).

 

The cookies used for transaction tracking are strictly necessary for our Service to function and typically do not require consent under applicable laws. Other cookies (e.g., for analytics or personalization) may require your consent where required by law.

 

If you disable cookies, we will be unable to track your purchases on Merchant sites, which means we cannot credit you with Reward Points. To ensure you can enjoy it, we recommend allowing necessary cookies from our domain.

 

You may manage or delete cookies at any time via your browser settings, but please note this may affect the proper functioning of tracking. If you use our browser extension, its data collection practices align with this cookie policy and adhere to the same principle of data minimization.

 

We will from time to time ask for your explicit consent before accessing additional features on your device or collecting supplementary information. Whenever we do so, we will clearly explain what data we seek, why it is needed, and how it will be used — and you may choose whether or not to grant permission.

 

How We Use Personal Data?

 

We (and our affiliates) will use the personal information we collect from you solely for the purposes set out in this Privacy Policy. Specifically, we use this information:

 

- To provide and fulfil our Services

We use your personal information to deliver the core functionality of our platform, including:

• Tracking your clicks and eligible purchases on Merchants' websites;
• Verifying transactions with Merchants to determine cashback eligibility;
• Calculating, crediting, and displaying Reward Points in your account;
• Processing withdrawals, redemptions, or transfers of rewards;
• Managing your participation in cashback campaigns, promotions, or loyalty programmes;
• Providing customer support in relation to your transactions, account issues, or reward inquiries;
• At this stage, the service currently supports only non-cash rewards (e.g., closed-loop gift cards) and does not involve cash withdrawals. Should cash withdrawal be introduced in the future, we will update this policy separately and collect financial details only with your explicit consent.

 

- To personalise and enhance your experience

We use your usage patterns, preferences, and transaction history to:

• Recommend relevant cashback offers from Merchants you frequently shop with;
• With your consent, notify you of time-sensitive deals, seasonal promotions, or exclusive member benefits;
• Optimise the layout, content, and performance of our platform across different devices, browsers, and operating systems;
• Improve the accuracy of our tracking and validation systems;
• Conduct user experience research, surveys, and usability testing to refine our Services.

 

- For security, fraud prevention, and platform integrity

We use your data to protect our platform, users, and partners by:

• Detecting, preventing, and investigating fraudulent, abusive, or suspicious activities (e.g., fake transactions or account takeovers);
• Verifying your identity during high-risk actions (e.g., large redemptions or changes to account country settings);
• Enforcing compliance with Cashback Services Agreement and this Privacy Policy;
• Conducting internal audits, risk assessments, and due diligence checks;
• Safeguarding the security and stability of our systems, networks, and data infrastructure.

 

- To comply with legal and regulatory obligations

We may use or disclose your personal information when necessary to:

• Fulfil statutory, regulatory, or governmental reporting requirements;
• Respond to lawful requests from public authorities, including law enforcement, tax, or judicial bodies;
• Defend, establish, or exercise legal claims (e.g., in disputes related to reward eligibility or user conduct);
• Protect the rights, property, or safety of Otterpaw, our users, or the public, including in emergencies involving threats to life, health, or physical safety.
•  

- For analytics, research, and Service development

We analyse anonymised or aggregated data (where re-identification is not reasonably possible) to:

• Understand user behaviour, platform performance, and cashback redemption trends;
• Develop new features, improve existing ones (e.g., browser extension accuracy) and enhance overall Service quality;
• Conduct demographic and behavioural research to better serve diverse user groups;
• Train machine learning models to improve fraud detection or personalisation algorithms — always ensuring that such processing does not result in decisions that produce legal or similarly significant effects without human oversight.

 

Where such analysis involves personal data that could identify you, it is conducted only where necessary for our legitimate business purposes and does not override your rights under the PDPA.

 

- With your consent or as otherwise permitted by law

We may use your personal information for additional purposes not listed above only if:

• You have given explicit consent (e.g., for a new feature requiring camera access); or
• Such use is permitted or required under applicable data protection laws (e.g., for archiving in the public interest, scientific research, or statistical purposes).

 

How We Share Your Personal Data?

 

• With our affiliates, solely for the purposes set out in this Privacy Policy. We will only share necessary personal information, and if any affiliate intends to use such data for a new purpose, it will seek your separate consent.
• With your explicit and separate consent, including where you have opted in to specific features (e.g., cash-out via bank transfer) or marketing communications. You may withdraw such consent at any time without affecting your access to core Services.
• With third-party partners and service providers who assist us in delivering the services you request, such as: (i) Merchants, to fulfil your eligible purchases and credit Reward Points; (ii) Redemption partners (e.g., Grab, PayPal), to issue digital vouchers upon your redemption request; (iii) Technology, logistics, customer support, or analytics vendors, to operate and optimise our platform. In all cases, sharing is limited to what is necessary, specific, and directly related to the service provided, and partners are contractually prohibited from using your data for any unrelated purpose, including safeguards for any cross-border data transfers.
• In anonymised or aggregated form, where your identity cannot be reasonably re-identified (e.g., statistical reports on user demographics or redemption trends).
• As required by law including: (i) Compliance with legal, regulatory, judicial, or administrative obligations; (ii) Enforcement of Cashback Service Agreement or other agreements with you; (iii)Protection of the rights, property, safety of Otterpaw, our users, employees, or the public (e.g., preventing fraud, illegal activities, or threats to life/health).
• In connection with a corporate transaction, such as a merger, acquisition, or sale of assets. In such cases, we will either:(i) require the acquirer to continue complying with this Privacy Policy; or (ii) obtain your prior consent for any new use of your personal data.

 

We do not sell, rent, or commercially trade your personal information. All third parties receiving your data are bound by confidentiality obligations and, where applicable, data processing agreements that reflect PDPA standards.

 

How We Protect Your Personal Data?

 

We take the security of your personal data seriously and have implemented a combination of technical, organizational, and administrative measures designed to protect it against unauthorized access, use, disclosure, alteration, or loss. These measures include:

• Secure data transmission: We use appropriate encryption protocols to protect personal data transmitted between your device and our systems, particularly on pages where you submit sensitive information.
• Protected data storage: Your personal data is stored on servers protected by reasonable technical safeguards, including firewalls, intrusion detection systems, and access controls.
• Strict access controls: Access to your personal data is limited to authorized personnel (including employees, contractors, and partners) who require such access to perform their duties in delivering our Services. All such individuals are bound by confidentiality obligations, and access is granted on a need-to-know basis.
• Security monitoring and auditing: We maintain ongoing monitoring, logging, and periodic audits of our systems to detect and respond to potential security incidents promptly.
• Data minimization and retention: We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, comply with legal obligations, or resolve disputes. Once no longer needed, data is deleted or anonymized.
• Employee training and awareness: Our staff undergo regular training on data protection, privacy best practices, and incident response procedures to reinforce a culture of security.
• Incident response preparedness: We have established a dedicated data breach response plan. In the event of a confirmed personal data breach that poses a risk of harm, we will: (i) contain and investigate the incident; (ii) assess the nature and impact; (iii) notify affected individuals and relevant authorities where required by applicable law; and (iv) implement corrective and preventive measures.
• Your responsibilities: While we implement robust safeguards, you also play a role in protecting your account. Please: (i) keep your third-party account credentials secure; (ii) log out of your account when using shared or public devices; (iii) avoid sharing your account details with others; and (iv) notify us immediately if you suspect unauthorized access.

 

Please note: No electronic transmission or storage system is 100% secure. Although we use commercially reasonable measures, we cannot guarantee absolute security. Should a security incident occur, we will act in accordance with our legal obligations under the PDPA and other applicable laws.

 

How Long We Keep Your Personal Data?

 

We keep your personal data for as long as necessary to provide and improve the Service, to comply with legal obligations, and to resolve disputes. When we no longer need your personal data, we will delete it or anonymize it in accordance with applicable laws and regulations.

 

What Are Your Rights and Choices?

 

You have the following rights and choices regarding your personal data:

•     Access and correction: You can access and update your personal data on the Services. You can also request a copy of your personal data that we hold via email.

•     Deletion and withdrawal of consent: You can delete your account and personal data on the Services. You can also withdraw your consent to our processing of your personal data at any time. However, please note that deleting your account or withdrawing your consent may affect your ability to use the Services, and that we may still retain some of your personal data as required or permitted by law.

•     Complaint: You can lodge a complaint with the relevant data protection authority in your country if you are not satisfied with how we handle your personal data.

 

How We Update This Privacy Policy?

 

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, laws, or regulations. We will notify you of any material changes by posting the updated Privacy Policy on the app or by sending you an email or a push notification. Your continued use of the Services after the effective date of the updated Privacy Policy constitutes your acceptance of the changes. We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and share your personal data.

 

How to Contact Us?

 

If you have any questions, comments, or requests regarding this Privacy Policy or our processing of your personal data or your rights, please contact us at:

 

Otterpaw Studio Pte. Ltd

Email: privacy@otterpawstudio.com

 

 

This Privacy Policy is governed by and construed in accordance with the laws of the Republic of Singapore.