Personal Information Management

The California Consumer Privacy Act went into effect on January 1, 2023 (the “CPRA”). It amends the California Consumer Privacy Act of 2018 (together with the CPRA, the “CCPA”). The CCPA as amended provides rights to California residents regarding how their data are collected, held, processed, licensed, and sold. Residents of California now have the right to know what of their personal information is sold or disclosed to third parties, the right to access and correct their personal information that businesses have collected, the right to opt out of the sale or sharing of their personal information, the right to limit how businesses use their sensitive personal information, and the right to delete their personal information. These rights are described in detail in Ibotta’s Privacy Policy (which you can find at https://legal.ibotta.com) and can be exercised as set forth below. While the CCPA only covers California residents, Ibotta has given all users the ability to manage their personal information utilizing the same personal information management tools described below. Ibotta will respond to a user’s request(s) within forty-five (45) days or provide an explanation of why more time is needed.

Opting Out of the Sale or Sharing of Personal Information

To opt out of (or opt back in to) the sale or sharing of your personal information with third parties, please visit the Preference Center in the Ibotta app (under Account Settings) or the Ibotta website at the link below. Selecting this option will limit how Ibotta shares your information with third parties who perform services on Ibotta’s behalf and may affect your experience using the Ibotta app and website. You can choose, at any time, to opt back into the sale or sharing of your personal information. Once you exercise your right to opt out, Ibotta will wait at least twelve (12) months before asking you to reauthorize the sale or sharing of your personal information. Go to account settings

Requesting Description of Your Personal Information Ibotta Has Collected (“Right to Access” under the CCPA)

Upon request, Ibotta will tell you the categories of Personal Information that Ibotta has collected about you, the sources from which it has collected that information, and the business purposes for which that information was collected in a portable and readily readable format. If you make this request, you will receive both an email confirming Ibotta’s receipt of your request and a follow-up email with the information addressing these questions. Request description of Personal Information requested

Requesting Description of Your Personal Information that Ibotta Has Shared or Sold (“Right to Know” under the CCPA)

Upon request, Ibotta will tell you the categories of Personal Information that Ibotta has collected about you, the sources from which it has collected that information, and the business purposes for which that information was collected in a portable and readily readable format. If you make this request, you will receive both an email confirming Ibotta’s receipt of your request and a follow-up email with the information addressing these questions. Request description of Personal Information collected

Requesting Description of Your Personal Information that Ibotta Has Shared or Sold (“Right to Know” under the CCPA)

Upon request, Ibotta will tell you about your Personal Information that Ibotta has sold to, shared with, or disclosed to third parties during the past 12 months. Specifically, you may request that Ibotta tell you: (a) the categories of Personal Information that Ibotta has collected about you; (b) the categories of your Personal Information that Ibotta has sold to or shared with third parties; (c) the categories of third parties that Ibotta sold your Personal Information to or shared your Personal Information with; (d) the categories of your Personal Information that Ibotta disclosed to third parties for a business purpose; and (e) the categories of third parties to whom Ibotta disclosed your Personal Information. If you make this request, you will receive an email or emails confirming Ibotta’s receipt of your request in addition to the information addressing these questions. Request description of Personal Information sold or shared

Correcting Your Personal Information

You may request that Ibotta correct inaccurate Personal Information about you, taking into account the nature of the Personal Information and the purposes for which the Personal Information is kept. You may update or correct your Personal Information at any time by visiting your profile’s account setting page. If you have other questions or requests, or if you would like to access or request a correction to any other information that we may have about you, please contact us at privacy@ibotta.com. Please note that while your changes are reflected promptly in our active user databases, we may retain all information you submit for as long as needed to fulfill a legitimate business need or as required by law, including for transaction backup and archiving, prevention of fraud and abuse, compliance with legal obligations, dispute resolution, enforcing our agreements, and analytics.

Deleting Personal Information

You may request that Ibotta delete all the data it has collected about you, subject to certain exceptions for business purposes. You may request deletion up to twice in any twelve (12)-month period. However, when you request deletion, please know that your use experience within the app will look different and any personalization will be lost. Ibotta will not be able to send you targeted offers for items that may be of interest to you and you may not receive personalized recommendations or emails. Also, when you request deletion, any cash back rewards that are pending approval (if any) in your Ibotta account at the time of deletion will be deleted, and you will lose those pending rewards. In addition, your total lifetime earnings will be reset to the amount of Cash Back rewards in your Ibotta account at the time of deletion. For all intents and purposes, after your information is deleted, you will be treated as a new Ibotta user; you will retain in your Ibotta account any cash back rewards you previously earned and are not pending approval, but all other personalization within the app up to that date may be irrevocably lost. Request deletion

Limiting the Use of your Sensitive Personal Information

You may request that Ibotta limit the use of your Sensitive Personal Information to only what is necessary to provide you with Ibotta’s services. You will be able to continue using the Ibotta app and website; however, when you make this request, please know that your use experience within the app may be affected. To limit Ibotta’s use of your sensitive personal information, please visit the Preference Center in the Ibotta app (under Account Settings) or on the Ibotta website at the link below. Go to account settings

Questions

Please refer to Ibotta’s Privacy Policy and Terms of Use for further information on Ibotta’s data collection policies.