Personal Information Management

On January 1, 2020, California’s new privacy law, the California Consumer Privacy Act of 2018 (“CCPA”), became effective. The CCPA provides broad rights to California residents regarding how their data is collected, held, processed, licensed, and sold. Residents of California now have the right, among others, to know what of their personal information is sold or disclosed to third parties, the right to access their personal information that businesses have collected, the right to opt out of the sale of their personal information, and the right to delete of all their personal information (the “right to be forgotten”). Ibotta takes data collection and privacy seriously. As such, in an effort to be transparent about Ibotta’s data collection practices, and despite the fact that the CCPA only applies to California residents, the rights afforded under the CCPA are rights that any Ibotta Saver in any state can choose to exercise. Each of these rights are summarized below and can be exercised with the links provided. Ibotta will respond to your request(s) within forty-five (45) days. Under the CCPA, “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household.

Right to Opt Out

You have the right to direct Ibotta to not sell your personal information to third parties at any time. This is referred to as your “right to opt out.” Pursuant to its Privacy Policy, Ibotta has never sold your personally identifiable information and has no intention to do so in the future; Ibotta only shares information as outlined in its Privacy Policy, and always in an anonymized and/or deidentified manner. If you choose to opt out of the sharing of your anonymized personal information, Ibotta will no longer send your anonymized and/or deidentified information to third parties. You can choose, at any time, to opt back in to the sale of your anonymized and/or deidentified personal information. To opt out of (or opt back in to) the sharing of your anonymized and/or deidentified personal information with third parties, please visit the Preference Center in the Ibotta app (under Account Settings) or on the Ibotta website at https://ibotta.com/account/settings/privacy. Once you exercise your right to opt out, Ibotta will wait at least twelve (12) months before asking you to reauthorize the sale of your anonymized and/or deidentified personal information. Go to account settings

Right to Know

You have the right to receive information about the types of personal information that Ibotta sells or discloses to third parties. Specifically, this right allows you to ask Ibotta (a) what are the categories of personal information that Ibotta collects about me? (b) what are the categories of my personal information that Ibotta sells to third parties? (c) what are the categories of third parties that Ibotta sells this information to? and (d) what are the categories of personal information that are disclosed to third parties for a business purpose? Each of these four questions must be answered by Ibotta when you exercise your right to know. Ibotta will disclose this information to you within 45 days of you exercising your right to know. If you choose to exercise this right, you will receive an email confirming Ibotta’s receipt of your request in addition to the information addressing these questions. Exercise the right to know

Right to Access

You have the right to request access to all the categories of personal information that Ibotta has collected about you, and all the specific pieces of personal information that Ibotta has collected about you through your use of the Ibotta app. When you exercise this right, the information that Ibotta provides to you must be in a portable and readily readable format. Ibotta will disclose this information to you within 45 days of you exercising your right to access. If you choose to exercise this right, you will receive both an email confirming Ibotta’s receipt of your request and a follow-up email with the information addressing these questions. Ibotta must also, whether you exercise your rights or not, disclose to you (a) the categories of personal information collected about you, (b) the purposes for which your personal information is used, and (c) refrain from collecting or using additional categories of personal information about you without proper notice. Exercise the right to access

Right to be Forgotten

You have the right to request that Ibotta delete all the data it has collected about you, subject to certain exceptions for business purposes. You may exercise your right to deletion, also known as the right to be forgotten, twice in any twelve (12) -month period. However, when you do exercise this right, please know that your use experience within the app will look different and any personalization will be lost. Ibotta will not be able to send you targeted offers for items that may be of interest to you and you may not receive personalized recommendations or emails. Also, when you exercise your right to be forgotten, any cash back rewards that are pending approval (if any) in your Ibotta account at the time of deletion will be deleted, and you will lose those pending rewards. In addition, your total lifetime earnings will be reset to the amount of Cash Back rewards in your Ibotta account at the time of deletion. For all intents and purposes, when you exercise the right to be forgotten, you will thereafter be treated as a new Ibotta user; you will, of course, retain in your Ibotta account any cash back rewards you previously earned and are not pending approval, but all other personalization within the app up to that date may be irrevocably lost. Exercise the right to be forgotten

Questions?

Please refer to Ibotta’s Privacy Policy and Terms of Use for further information on Ibotta’s data collection policies.