Privacy Policy

Ember and cash-back.ai are operated by ATTOFUN PTE. LTD., a company incorporated in Singapore. We are responsible for your personal data as described in this policy. We handle personal data in line with the Personal Data Protection Act 2012 of Singapore (PDPA) and other laws that apply to us.

• Messaging details: your messaging app user ID, display name, phone number or username (depending on the app), language, and the messages you send to Ember.
• Shopping and cashback data: the links Ember creates for you, when you click them, and the order details merchants and affiliate networks report to us, such as merchant, order ID, order value, commission and status. We do not receive your card or bank details from merchants.
• Rewards and referral data: your balance, welcome bonus, invite link, who invited you and who you invited.
• Payout data: your wallet address, the network you choose, and transaction records. If we need to verify your identity, we may also collect your name, date of birth, nationality, ID document and a selfie, usually through a verification provider.
• Browser extension: limited data needed to check whether cashback is available on the store you are visiting. See Browser extension below for the full details.
• Website: basic technical data such as device, browser, IP address and pages visited. Your light or dark theme choice is stored only in your own browser.

• to reply to you, understand what you're looking for and create cashback links;
• to track purchases and credit cashback, welcome bonuses and referral rewards;
• to process withdrawals and meet anti-money-laundering, sanctions and tax obligations;
• to detect and prevent fraud, duplicate accounts and abuse;
• to send you service messages in the chat, such as cashback confirmations;
• to send you deal alerts and other promotional messages, only if you have opted in;
• to improve Ember, including by reviewing conversations and using de-identified data to make our answers better;
• to comply with the law and protect our rights.

Where the PDPA requires consent, we rely on the consent you give by using Ember, or on other grounds the law allows, such as fulfilling our agreement with you or legitimate interests like fraud prevention.

Some fraud checks are automated. If an automated check affects your rewards or withdrawal, you can ask for a person to review it.

Your messages are processed by AI systems to understand your requests. We use AI and cloud providers that act on our behalf under contracts that restrict them to using your data to provide their services to us. Please do not send Ember sensitive information it does not need, such as passwords or card numbers.

You talk to Ember through WhatsApp, Messenger, Telegram or Viber. We receive only the messages you send to Ember and the profile information the platform shares with businesses and bots (such as your user ID, display name and, on WhatsApp and Viber, your phone number). We cannot see your other chats or contacts.

• WhatsApp and Messenger are provided by Meta Platforms. Messages to Ember are sent through Meta's business messaging platforms, and Meta may process them as a service provider under its own terms and privacy policy.
• Telegram and Viber process messages under their own privacy policies.

We use data received from these platforms only to provide Ember to you. We do not use it for third-party advertising, and we do not sell or share it with data brokers.

We send promotional messages only if you opt in, and we stop when you reply STOP. We follow the Do Not Call provisions of the PDPA and each platform's messaging policies.

The Ember browser extension has a single purpose: to help you earn cashback while you shop online. It handles the following data:

• Current tab address: the web address of the page you are on, used only to check whether it belongs to a store where cashback is available. Where possible this check happens on your device.
• Activation: when you click to activate cashback, the store and time of activation, so your purchase can be tracked to your account.
• Account link and settings: an identifier that links the extension to your Ember account, and your extension settings.

The extension does not collect or store your browsing history, the content of the pages you visit, form entries, passwords, payment details or keystrokes.

Data from the extension is used only to provide its cashback feature. It is never sold, never used for advertising, never used to determine creditworthiness or for lending, and is not transferred to anyone except as needed to provide the feature, to comply with the law, or as part of a merger or acquisition.

The use of information received from the Ember extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. The same rules apply to the extension on Microsoft Edge, Firefox and other browsers. Where a browser store requires it, we ask for your consent before the extension collects any data.

• Merchants and affiliate networks: a click or tracking ID so your purchase can be matched to your account.
• Messaging apps: to deliver messages between you and Ember.
• Service providers: cloud hosting, AI, customer support, identity verification and payout providers, all acting on our instructions.
• People you invited, or who invited you: your referrer may see that you joined and the rewards they earned. They do not see what you bought.
• Authorities and advisers: where required by law, or to protect our rights, users or the public.
• A buyer or successor: if our business is sold or restructured.

We do not sell your personal data, and we do not share it with advertisers.

Payouts in stablecoins such as USDC and USDT are recorded on public blockchains. Your wallet address, the amount and the time of the transfer become publicly visible and permanent. We cannot delete or change information once it is recorded on a blockchain.

Our providers may process data outside Singapore. When we transfer personal data overseas, we take steps to make sure it receives protection comparable to the PDPA, for example through contracts with the recipient.

We keep personal data only as long as needed for the purposes above. Transaction, reward and payout records are kept for as long as required for accounting, tax and anti-money-laundering purposes, which is usually at least five years after the transaction. When we no longer need data, we delete or anonymise it.

We use reasonable technical and organisational safeguards to protect your data, including encryption in transit and access controls. No system is completely secure, so please keep your messaging account and wallet secure too.

Under the PDPA and other applicable laws, you can:

• ask for a copy of your personal data and how it has been used;
• ask us to correct data that is wrong or incomplete;
• withdraw your consent to our use of your data. We may then be unable to keep providing Ember, and we will explain the consequences first;
• stop promotional messages at any time by replying STOP;
• ask us to close your account and delete your data, subject to records we must keep by law.

To make a request, email [email protected]. We will reply within 30 days, or tell you if we need more time. We may need to verify your identity first.

If you are in the European Economic Area or the United Kingdom, you also have the rights to data portability, to restrict or object to processing, and to complain to your local data protection authority. Where those laws apply, we process your data to perform our contract with you, to meet legal obligations, for our legitimate interests (such as fraud prevention), or with your consent.

You can ask us to delete your Ember account and personal data at any time:

• Send the message “delete my data” to Ember on the messaging app you use, or
• email [email protected] from your account, telling us which messaging app you use Ember on.

We will confirm your request, let you withdraw any Confirmed balance of at least US$10 first, then close your account and delete or anonymise your personal data within 30 days. We keep only the records we must keep by law, such as payout and anti-money-laundering records, and information already recorded on a public blockchain cannot be deleted. To remove the browser extension's data, uninstall the extension and include it in your deletion request.

Our website does not use advertising cookies. When you open an Ember link, the merchant and its affiliate network may set their own cookies to track your purchase. Those cookies are governed by their privacy policies.

Ember is only for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has used Ember, please contact us so we can delete their data.

We may update this policy from time to time. We will post the new version on this page with a new date, and tell you through Ember if the changes are significant.

For questions or requests about your personal data, contact our Data Protection Officer at [email protected] (ATTOFUN PTE. LTD., Singapore).