Privacy Policy
Last updated: 8 November 2026
This Privacy Policy explains how Ecoverse Digital Ltd (“Ecoverse”, “we”, “us”) collects, uses and protects personal data when you use Redeemz: the website at redeemz.io, the Redeemz mobile app, the Redeemz button shown on partner websites, and related services (together, the “Service”).
1. Who we are
The controller of your personal data is Ecoverse Digital Ltd, a company registered in the Republic of Cyprus. You can contact us about privacy at [email protected].
We process personal data in line with the EU General Data Protection Regulation (GDPR) and the Cyprus law implementing it (Law 125(I)/2018).
2. Data we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Your email address and your password, which we store only as a salted cryptographic hash. | You, when you create an account or sign in with email. |
| Device and session data | A random identifier created by the app on install, the platform (iOS, Android or web), the device model or browser and operating system name, and when the device was last used. | The app and your browser. |
| Subscription data | Your plan, trial start and end dates, and subscription status. When paid plans are available, the payment provider or app store tells us whether a payment succeeded; we never receive your full card details. | You, us, and payment providers or app stores. |
| Redeem data | Which partner site and locked content you unlocked, when, the one-time backup code issued, and whether the site confirmed the unlock. | Your use of the Service and partner sites. |
| Technical data | IP address, request time, browser user agent and similar data in server and security logs. | Your device, automatically. |
| Support messages | Anything you send us by email. | You. |
We do not collect your name, phone number, contacts, precise location or advertising identifiers, and we do not use your camera except to scan a Redeemz QR code in the app. Camera images are processed on your device and are not sent to us.
3. How we use it and why
- To provide the Service: create and secure your account, keep you signed in on the web and in the app, check your plan and daily limits, unlock pages and issue backup codes. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
- To run free trials and subscriptions: grant the free trial once per account and manage paid plans. Legal basis: contract.
- To keep the Service safe: prevent abuse, fraud, brute-force sign-in attempts and misuse of codes, for example by rate-limiting requests per IP address. Legal basis: our legitimate interest in protecting the Service and its users (Art. 6(1)(f)).
- To pay and report to partner sites: tell a site that a member unlocked its page and calculate what we owe it. Legal basis: contract and legitimate interest.
- To support you and answer your messages. Legal basis: contract and legitimate interest.
- To meet legal obligations, such as tax, accounting and responding to lawful requests. Legal basis: legal obligation (Art. 6(1)(c)).
We do not sell your personal data, we do not use it for targeted advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
We may send you emails that are necessary for your account (for example about security or your subscription). If we ever send marketing emails, we will ask for your consent where the law requires it, and you can unsubscribe at any time.
4. What partner sites receive
When you unlock a page, the partner site receives a notification that the page was unlocked, the content identifier the site itself provided, the time, and an anonymous member identifier. That identifier is a one-way hash that is different for every site, so sites cannot see your email, cannot identify you, and cannot link your activity across sites. If you use a backup code on the site, the site sends that code to us to verify it.
Partner sites are independent from us and have their own privacy policies, which apply to what you do on their pages.
5. Service providers
We share personal data only with providers who help us run the Service, under contracts that require them to protect it and use it only on our instructions:
- Hosting: our servers and database are hosted in data centres in the European Union (Germany).
- Cloudflare, Inc.: content delivery, DNS, encryption in transit and protection against attacks. Cloudflare processes technical data such as IP addresses.
- Payment providers and app stores (for example Apple and Google), when paid plans are available, to process payments and subscriptions.
- Professional advisers and authorities, such as accountants, lawyers or regulators, when necessary and permitted by law.
If Ecoverse is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy.
6. International transfers
Our main data storage is in the EU. Some providers, such as Cloudflare, may process data outside the European Economic Area, including in the United States. Where that happens we rely on an adequacy decision (such as the EU-US Data Privacy Framework, where the provider is certified) or on the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed.
7. How long we keep data
- Account and subscription data: for as long as your account exists. When you ask us to delete your account, we delete or anonymise it within 30 days, except data we must keep by law.
- Redeem records: for as long as your account exists, and in anonymised or aggregated form for partner payouts and reporting.
- Server and security logs: normally up to 90 days.
- Billing and accounting records: as long as tax and accounting law requires, usually up to 7 years.
8. Cookies and local storage
The redeemz.io website does not use advertising or analytics cookies. It stores in your browser’s local storage only what it needs to work: your sign-in token, the unlock you started on a partner site, and your light or dark theme choice. The app keeps its sign-in token and device identifier in your device’s secure storage. Cloudflare may set strictly necessary security cookies to protect the site from abuse. Because we only use strictly necessary storage, we don’t show a cookie banner.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy of it;
- correct inaccurate data;
- have your data deleted;
- restrict or object to processing based on our legitimate interests;
- receive your data in a portable format; and
- withdraw any consent you gave, at any time, without affecting earlier processing.
To use these rights, email [email protected] from the address on your account. We will answer within one month, and may need to confirm your identity first. You can also change your password and sign out from your dashboard at any time.
You have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. In Cyprus this is the Commissioner for Personal Data Protection (dataprotection.gov.cy). We’d appreciate the chance to address your concern first.
10. Security
We protect your data with encryption in transit (HTTPS), hashed passwords, access controls, rate limiting and one-time, short-lived unlock codes. No system is completely secure, so please use a strong, unique password. If a personal data breach puts your rights at high risk, we will tell you and the authorities as the law requires.
11. Children
The Service is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes and contact
We may update this Policy from time to time. We will post the new version here with a new “Last updated” date and, for significant changes, tell you by email or in the Service before they take effect.
Questions or requests? Email [email protected].
Ecoverse Digital Ltd, Republic of Cyprus.