Privacy Policy

ImReward ("we," "our," or "us") is a software service operated from Malaysia. We provide interactive marketing campaign tools to merchants worldwide, including spin wheels, scratch cards, prize boxes, and similar games (the "Service").

This Privacy Policy explains how we collect, use, share, and protect personal information when you use imreward.com, the merchant portal, campaign player pages, and related apps (including Shopify).

By using the Service, you agree to this Policy. If you do not agree, do not use the Service.

Who this Policy covers

• Merchants (store owners and their team members) who create an ImReward account.
• Shoppers / players who take part in a merchant's campaign. For shopper data collected inside a campaign, the merchant is typically the data controller (or equivalent) and ImReward acts as a processor on the merchant's instructions. For merchant account, billing, and site usage data, ImReward is the controller.

1. Information we collect

1.1 Merchant account data. Name, username, email, password (hashed), company name, website, timezone, plan, and support messages.

1.2 Billing data. Subscription plan, payment status, and invoice history. Card and wallet details are collected by our payment providers (Stripe and PayPal). We do not store full card numbers.

1.3 Shopper / campaign data. Data the merchant chooses to collect in a campaign, which may include name, email, phone, locale, prize results, and other form fields the merchant configures.

1.4 Usage and device data. IP address, browser type, device, pages viewed, referring URL, timestamps, and similar technical logs needed to run and secure the Service.

1.5 Cookies and similar technologies. See our Cookie Policy. We use essential cookies for sign-in, security (including Cloudflare Turnstile), and payments. Optional cookies may be used for analytics or ads if enabled.

1.6 Integrations. If you connect Shopify, Google, or another integration, we receive the account and store data that integration shares so the Service can work (for example catalog, shop domain, or login identity).

We do not knowingly collect personal information from children under 18.

2. How we use information

• Provide, host, and improve the Service
• Create and manage campaigns, prizes, tokens, and reports
• Process subscriptions and prevent fraud
• Communicate about the account, billing, security, and product updates
• Comply with law, enforce our Terms, and protect users and the Service
• Understand usage in aggregate so we can fix issues and plan features

We do not sell personal information.

3. Legal bases (EEA, UK, and similar laws)

Where GDPR, UK GDPR, or similar laws apply, we process personal data on one or more of these bases: contract (to provide the Service you requested), legitimate interests (to secure and improve the Service, in a way that does not override your rights), consent (where we ask for it, including some cookies), and legal obligation.

Where Malaysia's Personal Data Protection Act (PDPA) applies, we process personal data for the purposes described in this Policy and in line with that Act.

Where CCPA/CPRA or other US state laws apply, we process personal information as described here. We do not sell or "share" personal information for cross-context behavioral advertising in the sense of those laws, unless we say so and provide a choice.

4. How we share information

We share personal information only as needed:

• Stripe — card and subscription billing
• PayPal — PayPal and guest-card checkout
• Cloudflare — DNS, security, and bot protection (including Turnstile)
• Google — optional Google sign-in and Workspace email for support
• Shopify — if you install or connect the Shopify app
• Hosting and email providers we use to run the Service
• Authorities if required by law
• A buyer of the business, if we sell or merge, with notice where required

Those providers may process data in Malaysia, the United States, the EEA, or other countries. We take reasonable steps so transfers are lawful (for example contractual clauses and provider terms).

Merchants may export or see shopper data they collected. Merchants are responsible for how they use that data.

5. International customers and transfers

ImReward is available to businesses worldwide. Using the Service means your information may be processed in Malaysia and in other countries where we or our providers operate. Those countries may not have the same data-protection laws as your home country. We still apply this Policy and the safeguards described above.

If you are a merchant, you are responsible for telling your shoppers how their data is used in your campaigns and for collecting any consent your local law requires.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to certain processing, to withdraw consent, and to lodge a complaint with a supervisory authority (including, where relevant, a Malaysian, EEA, UK, or US state authority).

Shoppers should contact the merchant that ran the campaign first. We will help merchants honour valid requests.

To exercise rights we control (your merchant account), email [email protected]. We may need to verify your identity. We will not discriminate against you for exercising privacy rights.

7. Retention

We keep account and billing records for as long as the account is active and as long as needed for tax, dispute, and legal purposes. Campaign and shopper records are kept while the merchant account needs them, then deleted or anonymised when no longer required, subject to backups and legal holds.

8. Security

We use technical and organisational measures appropriate to a hosted SaaS product (access controls, HTTPS, hashed passwords, and provider security). No method of transmission or storage is completely secure.

9. Children's privacy

The Service is for businesses and people 18 or older. If you believe we have collected data from a child, contact [email protected] and we will delete it where required.

10. Changes

We may update this Policy. The new version will be posted on this page with a new "Last updated" date. Material changes may also be emailed to the account address.

11. Contact

Privacy and support: [email protected]
Also accepted: [email protected], [email protected], [email protected]
Operator: the operator of the ImReward service, based in Malaysia

Do not send passwords or full payment card numbers to these inboxes.