Protellier

1. Introduction

Protellier, LLC (“Protellier,” “we,” “us,” or “our”) operates an advertising platform for local businesses and a loyalty rewards platform for travelers. Travelers earn cashback rewards by visiting and making purchases at participating businesses; businesses use the Platform to reach and attract nearby travelers. This Privacy Policy explains how we collect, use, store, share, and protect personal information from all users of the Platform, including Travelers, Businesses, and Hotels.

By creating an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy. This Privacy Policy is incorporated into and forms part of our Terms of Service.

This Privacy Policy applies to personal information collected through our website and all related services. It does not apply to the independent data practices of participating Businesses, Hotels, or third-party services like Plaid or Stripe, each of which operates under its own privacy policy.

2. Who This Policy Applies To

This Privacy Policy applies to all three categories of Platform users:

• Travelers: individuals who create accounts to earn cashback rewards by visiting and making purchases at participating businesses (linking a financial account through Plaid is a required step so the Platform can detect qualifying purchases);
• Businesses: merchants and vendors who register to run cashback deals on the Platform; and
• Hotels: hospitality businesses that offer the Platform as a guest benefit and earn revenue share on qualifying guest transactions.

Where this Policy describes practices that apply only to a specific user type, we will identify the applicable user type clearly.

3. Information We Collect

3.1 Information You Provide Directly

All Users. When you register for any account type, we collect:

• Full legal name;
• Email address;
• Password (stored in hashed form using Argon2id, we do not store your plaintext password);
• Phone number (if provided for SMS notifications); and
• Account type selection and any preferences set during onboarding.

Travelers. In addition to the above, Travelers provide:

• Financial account information entered during Plaid-assisted account linking (managed by Plaid, we do not receive your bank login credentials); and
• Payout account information (provided to Stripe for reward redemption, we do not store full payment card or bank account numbers).

Businesses. In addition to the general account information above, Businesses provide during onboarding:

• Legal business name;
• Business type and industry category;
• Principal business address;
• Federal Tax Identification Number (EIN) or Social Security Number;
• Business verification documents as requested (which may include articles of incorporation, business license, or utility bill);
• Merchant Matching Profile information (billing descriptor, POS system details, MCC codes); and
• Invoice payment information you provide to Stripe when paying an invoice (processed and stored by Stripe, not by Protellier).

Hotels. In addition to the general account information above, Hotels provide during onboarding:

• Property name and full physical address;
• Geographic coordinates of the property, derived from the address (used to configure geo-based deal display for referred guests);
• Partnership contact name and contact information;
• Federal Tax Identification Number (EIN or SSN);
• Business verification documents as requested (which may include a business license, certificate of formation, or utility bill); and
• Stripe Connect account information for Revenue Share payouts.

3.2 Financial and Transaction Data

Travelers: Plaid Transaction Data. When you link a financial account, we receive transaction data from Plaid Technologies, Inc., including:

• Merchant name and transaction amount for purchases at your linked accounts;
• Transaction date and time;
• Plaid-provided merchant entity IDs and Plaid’s standardized transaction category (e.g., “Food and Drink – Restaurants”), which is not a card network merchant category code (MCC); and
• Partial account information sufficient to identify the linked account (e.g., last four digits of account number, institution name).

We use this transaction data solely to identify qualifying purchases at participating Businesses and to credit cashback Rewards to your account. We do not receive your full bank account numbers, routing numbers, or login credentials through Plaid.

Your use of Plaid is also governed by Plaid’s End User Privacy Policy, available at https://plaid.com/legal/. Protellier does not sell your financial transaction data to third parties and does not use it for advertising or credit assessment purposes.

Businesses: Payment and Invoice Data. For Business users, we process payment information in connection with platform fee invoices. Invoice data includes transaction records used to calculate fees, invoice amounts, and payment confirmations. Payment card and bank account data is processed and stored by Stripe and is not retained in full by Protellier.

Hotels: Revenue Share and Payout Data.For Hotels, we maintain records of Revenue Share credits earned on qualifying guest transactions and payout history. Payout account information is managed through Stripe Connect and is governed by Stripe’s privacy practices.

3.3 Device and Usage Data

When you use the Platform, our hosting providers (Vercel, which serves our web application, and Railway, which runs our API and database) collect standard server-side technical data, including:

• IP address and approximate geographic location derived from IP;
• Browser type and operating system reported in request headers;
• Pages requested and timestamps;
• Error logs and performance data; and
• Session identifiers and authentication tokens.

We use a third-party error monitoring service to help us detect, diagnose, and resolve technical issues in the Platform. This service may receive error/crash data associated with your account identifier, but is not used for advertising or behavioral tracking. We do not currently use third-party product analytics or advertising tracking services. If we begin to use any such service in the future, we will update this Privacy Policy before doing so.

3.4 Communications Data

If you contact us for support or submit a dispute, we collect the content of your communications and any information you provide in connection with your inquiry. We retain these records to resolve disputes, improve our services, and comply with legal obligations.

4. How We Use Your Information

We use the personal information we collect for the following purposes:

Platform Operations.

• To create and manage your account;
• To verify your identity and eligibility (KYC/KYB for Business and Hotel users);
• To match Traveler transactions to participating Business deals and credit cashback Rewards;
• To calculate and process platform fees for Businesses;
• To calculate and process Revenue Share payouts to Hotels;
• To process Traveler Reward redemptions; and
• To verify Hotel guest reservations and attribute qualifying transactions to the correct Hotel for Revenue Share purposes.

Communications.

• To send transactional notifications (Reward credits, payout confirmations, invoice delivery, account alerts, password resets); and
• To send service-related communications (Terms of Service updates, Privacy Policy changes, security notices).

Protellier does not currently send marketing communications. If we begin sending marketing communications in the future, we will obtain consent where required by law and provide a clear opt-out mechanism, and we will update this Privacy Policy in advance.

Safety, Security, and Compliance.

• To detect, investigate, and prevent fraudulent transactions, deal abuse, and prohibited conduct;
• To enforce our Terms of Service and applicable User Agreements;
• To comply with applicable laws, regulations, and legal process; and
• To respond to lawful requests from government authorities.

Platform Improvement.

• To analyze server logs to identify and resolve operational issues;
• To conduct internal research using aggregated, non-identifiable data; and
• To generate aggregated and anonymized data for business intelligence purposes.

5. How We Share Your Information

We do not sell your personal information to third parties. We share personal information only in the following circumstances:

5.1 Service Providers and Data Processors

We share personal information with third-party service providers who process data on our behalf to help us operate the Platform. These providers are contractually required to use your data only as directed by us and consistent with this Privacy Policy. Our service providers include:

• Plaid Technologies, Inc.: bank account connectivity and transaction data retrieval for Travelers;
• Stripe, Inc.: payment processing for Business invoice collection and Revenue Share payouts to Hotels and Traveler Reward redemptions;
• Resend (Resend, Inc.): transactional email delivery;
• Twilio Inc.: transactional SMS delivery;
• Vercel Inc.: hosting and delivery of the Platform’s web application; and
• Railway Corp.: cloud hosting and data storage infrastructure for the Platform’s application servers and database.

5.2 Aggregate Data Shared with Businesses

We share aggregated and anonymized deal performance analytics with Business users through the Business portal. This data does not include any personally identifiable information about individual Travelers and cannot reasonably be used to identify any individual.

5.3 Aggregate Data Shared with Hotels

We share aggregated and anonymized guest engagement analytics with Hotels through the Hotel portal. This data does not include individual Traveler financial data or transaction history and cannot reasonably be used to identify any individual guest.

5.4 Legal Requirements and Safety

We may disclose personal information if we believe in good faith that disclosure is necessary to:

• Comply with a law, regulation, subpoena, court order, or other legal process;
• Protect the rights, property, or safety of Protellier, our users, or the public;
• Detect, prevent, or address fraud, security, or technical issues; or
• Enforce our Terms of Service or other agreements.

5.5 Business Transfers

If Protellier is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of its assets, personal information may be transferred as part of that transaction. We will provide notice to affected users if a transfer results in a material change to how their data is processed.

5.6 With Your Consent

We may share your personal information with third parties in other circumstances with your explicit consent.

6. Third-Party Services and Integrations

6.1 Plaid

The Platform uses Plaid Technologies, Inc. to connect Traveler financial accounts. When you link a financial account, you are interacting directly with Plaid’s secure interface. Plaid collects, processes, and stores your financial account credentials and transaction history under its own End User Privacy Policy. Protellier does not receive or store your bank login credentials. To revoke Plaid’s access to your accounts, you may do so through the Platform’s account settings or directly at https://my.plaid.com. Revoking Plaid access will stop new transaction data from being shared with Protellier and will prevent future cashback Reward credits.

Authorization to Plaid.By using our services, you grant Protellier and Plaid Inc. (“Plaid”) the right, power, and authority to act on your behalf to access and transmit your personal and financial information from the relevant financial institution. You agree to your personal and financial information being transferred, stored, and processed by Plaid in accordance with the Plaid End User Privacy Policy.

6.2 Stripe

The Platform uses Stripe, Inc. for payment processing and payout disbursement. For Business users, Stripe processes invoice payments. For Traveler Reward redemptions and Hotel Revenue Share payouts, Stripe manages payout disbursement through Stripe Connect. Stripe’s collection and use of your financial and identity information is governed by Stripe’s Privacy Policy, available at https://stripe.com/privacy. Protellier does not store full payment card numbers or full bank account numbers.

6.3 Email and SMS Delivery

We use Resend for transactional email delivery and Twilio for transactional SMS delivery. Your email address and phone number are shared with these providers solely for the purpose of delivering communications you have requested or are required to receive in connection with your account (e.g., verification messages, security notices, transaction confirmations).

6.4 Cloud Infrastructure

The Platform’s web application is served through Vercel Inc., and all Platform data is stored and processed on servers managed by Railway Corp. Both providers operate under contractual data security and confidentiality obligations. Data is stored in the United States.

6.5 SMS / Text Messaging Program

When you provide your phone number and opt in to receive text messages from Protellier, we may send transactional SMS notifications through our SMS service provider, Twilio Inc. Protellier sends transactional SMS only, we do not send marketing or promotional text messages.

Message Types. The SMS program is currently available to Traveler accounts only. If you opt in, you may receive:

• An opt-in confirmation message when you enable SMS notifications;
• Cashback earned alerts; and
• Payout status updates.

Protellier does not currently use SMS for account verification or multi-factor authentication, and Business and Hotel accounts do not currently receive SMS messages. If the SMS program is expanded, we will update this Privacy Policy and the Terms of Service before doing so.

Message Frequency. Frequency varies based on your account activity, typically no more than 10 messages per month for an active account. Some account types may receive additional messages during periods of high transaction volume.

Costs. Message and data rates may apply. These charges are determined by your wireless carrier, not by Protellier.

Carrier Liability. Carriers are not liable for delayed or undelivered messages.

Opt-In. You opt in to SMS by enabling SMS notifications in your account settings and providing your phone number. Your consent to receive SMS is collected separately from your consent to other forms of communication.

Opt-Out. You may opt out of SMS at any time by replying STOP to any message you receive. You may also disable SMS notifications in your account settings. Opting out of SMS does not affect your account standing or your other communication channels (email, in-app notifications).

Help. For help with SMS messages, reply HELP to any message you receive, or contact us at support@protellier.com.

No Sharing of Mobile Information. Mobile information (including phone numbers and SMS opt-in consent records) will not be shared with third parties or affiliates for marketing or promotional purposes. The data sharing described in Section 5 specifically excludes text messaging originator opt-in data and consent, that information is shared only with Twilio Inc. for the sole purpose of delivering the SMS messages you have requested.

6.6 GLBA / Regulation P Notice (Traveler Financial Information)

Because Travelers link financial accounts and we receive nonpublic personal information (“NPI”) about them, we provide the following notice consistent with the Gramm-Leach-Bliley Act (GLBA) and Regulation P. This notice applies to Travelers; it summarizes practices described in more detail elsewhere in this Policy.

• NPI we collect. Identifying information you provide (name, email, phone); and, through Plaid, financial-account information about your linked accounts: transaction merchant, amount, date, merchant category, partial account number, and institution name (see Sections 3.1 and 3.2). We do not receive your bank login credentials or full account/routing numbers.
• NPI we disclose, and to whom.We disclose NPI only to service providers who process it on our behalf to operate the Platform (Plaid for connectivity and transaction retrieval, Stripe for payouts, Resend and Twilio for notifications you have requested, and Vercel and Railway for hosting), and as required to comply with law or protect against fraud (see Sections 5.1 and 5.4). We do not disclose NPI to any non-affiliated third party for that party’s own marketing.
• Affiliates and non-affiliates. Protellier, LLC has no corporate affiliates, so we do not share NPI with affiliates. We do not share NPI with non-affiliates for joint marketing.
• We do not sell your NPI, and we do not use it for advertising or credit assessment.
• Your right to limit sharing. Because we do not share NPI with non-affiliates for marketing, there is no marketing-related sharing for you to opt out of. You may stop ongoing collection at any time by disconnecting Plaid or closing your account (see Sections 6.1 and 8), and you may exercise the rights described in Section 10.
• How we protect NPI. We use TLS in transit, AES-256-GCM encryption of Plaid access tokens at rest, Argon2id password hashing, least-privilege access controls with MFA on administrative accounts, and webhook signature verification (see Section 9).

7. Cookies and Tracking Technologies

We use cookies, browser storage, and similar technologies only as necessary to operate the Platform. The categories we use are:

• Strictly necessary: required for Platform functionality such as authentication, session management, and security; and
• Preferences: used to remember your settings (e.g., timezone, account type).

We do not currently use advertising, behavioral, or third-party analytics cookies or tracking technologies. You can control cookie settings through your browser’s settings; disabling strictly necessary cookies will prevent you from signing in. We do not currently respond to “Do Not Track” signals from browsers; if our practices change and we deploy advertising or behavioral tracking, we will update this policy and honor applicable opt-out signals (including the Global Privacy Control) where required by law.

8. Data Retention and Deletion

8.1 Retention During Account Lifecycle

We retain your personal information for as long as your account is active. After account closure, we retain personal information for the following periods, consistent with our Data Retention and Deletion Policy:

Longer retention periods may apply where required by applicable law or necessary to resolve a dispute or enforce our agreements. Where a transaction also underlies a participating hotel's or business's own financial or tax records (for example, a hotel's revenue-share entitlement or a business's invoice), we remove your personal association with that transaction rather than deleting the underlying record outright, so that the other party's own recordkeeping obligations are not disrupted by your account's retention schedule.

8.2 Plaid Transaction Data

Plaid access tokens are deleted immediately upon disconnection of a linked account or account closure. Transaction data already received prior to disconnection is retained per the schedule in Section 8.1. No new transaction data is collected after disconnection.

8.3 Deletion Requests

You may request deletion of your personal information by submitting a request to support@protellier.com. We will process deletion requests within 45 days of receipt, subject to extension where permitted by applicable law. We may retain certain information after a deletion request where retention is required by law, necessary to complete a transaction, or necessary to protect against fraud.

Please note that deleting your account data will result in forfeiture of any pending Rewards or Revenue Share that has not been redeemed or paid out, except to the extent applicable law (including state unclaimed property law, see the Traveler User Agreement) requires otherwise. We recommend redeeming any eligible balance before submitting a deletion request.

8.4 Anonymization

In some cases, rather than deleting your personal information, we may de-identify or anonymize it such that it can no longer be reasonably associated with you. De-identified data may be retained indefinitely for analytics and research purposes.

9. Data Security

We implement commercially reasonable technical and organizational security measures to protect your personal information against unauthorized access, disclosure, alteration, and destruction. Our security practices include:

• Encryption of data in transit using TLS;
• Encryption of Plaid access tokens at rest using AES-256-GCM;
• Argon2id hashing of user passwords;
• Access controls limiting access to personal information on a least-privilege basis, with multi-factor authentication required on all administrative accounts;
• Cryptographic verification of inbound webhook signatures from Plaid and Stripe;
• Logging and monitoring of authentication and administrative events; and
• Documented incident response procedures.

Administrative and Support Access. Authorized Protellier personnel may, in limited circumstances, access your account information (including transaction history and, for Business and Hotel users, identity verification documents) to provide customer support, investigate suspected fraud or policy violations, or respond to your requests. Access of this kind requires a documented reason, is subject to multi-factor authentication and rate limiting, and is logged in our audit trail. Personnel accessing your account in this manner cannot make changes on your behalf using this access.

These practices are described in detail in our Information Security Policy and Access Controls Policy.

No method of electronic transmission or storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately at support@protellier.com.

10. Your Privacy Rights

Depending on your state of residence, you may have certain rights with respect to your personal information. These rights may include:

• Right to Access: the right to request a copy of the personal information we hold about you;
• Right to Correction: the right to request correction of inaccurate or incomplete personal information;
• Right to Deletion: the right to request deletion of your personal information, subject to applicable exceptions;
• Right to Data Portability: the right to receive a copy of your personal information in a structured, machine-readable format;
• Right to Opt-Out of Sale or Sharing: the right to opt out of the “sale” or “sharing” of your personal information for targeted advertising purposes (note: Protellier does not sell personal information); and
• Right to Non-Discrimination: the right not to receive discriminatory treatment for exercising your privacy rights.

Texas residents have specific rights under the Texas Data Privacy and Security Act (TDPSA). Residents of California, Colorado, Connecticut, Virginia, and other states with comprehensive privacy laws may have additional rights under those laws.

To exercise any of your privacy rights, submit a request to support@protellier.comwith the subject line “Privacy Rights Request.” We will verify your identity before processing your request and will respond within the timeframe required by applicable law (generally 45 days, with a possible 45-day extension).

11. Children’s Privacy (COPPA)

The Platform is intended solely for users who are 18 years of age or older. We do not knowingly collect personal information from children under the age of 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will take prompt steps to delete that information.

If you believe that a child under 13 has provided personal information to us, please contact us immediately at support@protellier.com.

Because the Platform requires users to link financial accounts, a feature that is inherently unsuitable for minors, we do not offer any features or services directed at or designed for users under 18. Users between the ages of 13 and 17 are not eligible to use the Platform.

12. Do Not Sell or Share My Personal Information

Protellier does not sell your personal information to third parties, and we do not share your personal information with third parties for cross-context behavioral advertising purposes. We share personal information with service providers only as described in Section 5.1 of this Privacy Policy and only for the purposes of operating the Platform.

If our practices change and we begin sharing personal information in ways that constitute a “sale” or “sharing” under applicable state law, we will update this Privacy Policy and provide you with the ability to opt out before any such sharing begins.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated Privacy Policy on the Platform and updating the “Last Updated” date at the top of this document. For significant changes affecting how we process sensitive financial data, we will also send you an email notification.

Your continued use of the Platform after the effective date of any updated Privacy Policy constitutes your acceptance of the updated policy. If you do not agree with the updated policy, you must stop using the Platform and close your account.

14. Dispute Resolution

Any dispute arising out of or relating to this Privacy Policy or our privacy practices is subject to the dispute resolution provisions of the Protellier Terms of Service, as in effect at the time the dispute arises.

To submit a privacy-related dispute or complaint, please first contact us at support@protellier.com with a written description of your concern. We will make reasonable efforts to resolve your privacy concern informally before either party initiates formal dispute proceedings.

15. Contact Us

For questions, concerns, or requests related to this Privacy Policy or your personal information, please contact us at:

For general inquiries not governed by Sections 8.3 or 10 above, we will respond within 30 days of receipt.