1. Information we collect
1.1 Account, connection, and authentication data
When you create an account, connect an email provider, use the app, or use the extension, we may collect identifiers needed to operate the service, such as account ID, hashed or pseudonymous user ID, email provider, connection status, OAuth tokens, permission status, device or installation identifiers, and basic account settings.
1.2 Email receipt data
When you connect an email provider, we use read-only access to identify eligible purchase confirmations and receipt-related messages from supported retailers and brands. Depending on the receipt and retailer, extracted data may include retailer name, sender, subject, order date, purchase date, order ID, order total, product names, quantities, prices, product URLs, SKUs or product IDs when available, and metadata needed for receipt parsing and fraud prevention.
1.3 Browser extension activity
When enabled on supported websites, the extension may detect limited shopping signals needed to operate Oui Impact features, such as page URL or URL pattern, retailer domain, product detail views, add-to-cart events, purchase or checkout signals, timestamps, campaign or referral parameters, enabled settings, impact banner status, side panel interactions, and technical diagnostics.
1.4 Mobile app activity
The mobile app may collect account status, selected causes, challenge participation, impact points, app settings, notification preferences, device type, app version, diagnostics, and interactions needed to provide the Oui Impact experience.
1.5 Website and analytics data
When you visit our websites or landing pages, we may collect standard web analytics and technical data such as IP address, approximate location, browser type, device type, pages visited, referral URLs, timestamps, cookie or local storage identifiers, and interactions with our pages.
1.6 Data we do not intentionally collect
- We do not intentionally collect personal email conversations for the purpose of reading or analyzing private communications.
- We do not use email access to send messages, delete messages, mark messages as read, move messages, or modify your mailbox.
- We do not intentionally collect sensitive categories of personal data, such as precise geolocation, health data, biometric data, or government IDs, unless clearly disclosed and required for a specific future feature.
- We do not knowingly collect personal information from children under 13.
2. Email and OAuth access
Oui Impact may support multiple email providers, including Gmail, Outlook/Microsoft, Yahoo, or other providers we add over time. The exact permissions requested may depend on the provider and the feature you choose to activate.
| What we request | Why we request it | What we do not do |
|---|
| Read-only mailbox access or limited message-read permissions, depending on provider availability. | To find and parse eligible purchase receipts and order confirmations from supported retailers and brands. | We do not send, delete, edit, move, or mark emails as read. |
| OAuth tokens and provider connection metadata. | To keep your email connection active until you disconnect or the token expires. | We do not share OAuth tokens with advertisers, brands, or retailers. |
| Receipt content and receipt metadata relevant to eligible purchases. | To verify purchases, calculate impact points, power challenges, reduce fraud, and improve receipt parsing. | We do not use private email conversations for advertising targeting. |
Some provider permissions may be broader than receipt-only access.When a provider permission allows broader read access, we limit our use to identifying and processing receipt and order-confirmation data needed to provide Oui Impact features.
3. Browser extension and mobile app
3.1 Extension permissions
The browser extension may request permissions needed to run on supported retailer websites, store settings locally, communicate with Oui Impact servers, display the side panel, show opt-in impact banners, capture eligible commerce events, and connect those events with your impact profile.
3.2 Supported website activity
The extension is designed to operate on supported retailer, brand, or partner websites. It may process page context and commerce signals needed to display features, verify activity, attribute points, and measure challenge progress.
3.3 Opt-in impact banners and side panel
If you activate impact banners or side panel features, we may process interactions with those features, such as impressions, clicks, dismissals, toggles, challenge views, creator or cause content views, and settings that control whether the experience is active.
3.4 App permissions
The mobile app may request permissions such as notifications or sign-in permissions only when needed for the app experience. You can manage app permissions through your device settings.
4. How we use information
- Provide and operate Oui Impact, including the website, extension, app, account features, email connections, and dashboards.
- Verify eligible purchase receipts and connect verified activity to impact points, challenges, donation pool logic, rewards, or community milestones.
- Show opt-in impact banners, side panel content, cause updates, brand challenges, creator content, and relevant product or retailer experiences.
- Attribute activity to campaigns, retailers, brands, causes, communities, or referral contexts.
- Prevent fraud, duplicate receipts, abuse, and unauthorized activity.
- Debug, secure, measure, and improve the product.
- Create aggregated, pseudonymized, or de-identified insights for reporting and product improvement.
- Comply with legal obligations and enforce our terms and policies.
5. Sharing and disclosure
5.1 Service providers
We may share information with vendors that help us operate the service, such as hosting providers, cloud infrastructure, analytics, authentication, email API providers, security tools, error monitoring, customer support tools, and data processing vendors. These providers are authorized to process information only as needed to provide services to us.
5.2 Brands, retailers, charities, and partners
We may share aggregated, pseudonymized, or limited reporting with participating brands, retailers, charities, agencies, or partners. For example, reporting may show challenge progress, verified purchase counts, point totals, campaign performance, retailer-level activity, or donation milestones. We aim to avoid sharing raw email content with brands, retailers, or advertisers.
5.3 Advertising and measurement partners
Where applicable, we may transmit limited event-level data needed for measurement, attribution, campaign optimization, or fraud prevention. We strive to limit shared data to what is necessary and to use hashing, pseudonymization, aggregation, or other privacy-preserving methods where appropriate.
5.4 Legal and safety
We may disclose information if required by law, legal process, or a good-faith belief that disclosure is necessary to protect rights, safety, security, users, the public, or our services.
5.5 Business transfers
If we are involved in a merger, acquisition, financing, restructuring, or sale of assets, information may be transferred as part of that transaction, subject to appropriate protections.
6. Google API Services disclosure
If you connect a Google account, Oui Impact’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We use Google user data only to provide or improve user-facing Oui Impact features, including receipt verification, purchase validation, impact points, and challenge participation.
- We do not use Google user data for serving personalized ads.
- We do not sell Google user data.
- We do not allow humans to read Google user data unless you give us explicit permission for support, it is necessary for security or abuse investigation, or we are required to do so by law.
- We do not transfer Google user data to advertisers, data brokers, or information resellers.
For Gmail or other Google email access, we limit our use to locating and processing eligible receipt and order-confirmation data needed for Oui Impact features.
7. Storage, retention, and security
7.1 Where data is stored
Data may be stored locally on your device, in browser extension storage, in app storage, and on our servers or vendor infrastructure. OAuth tokens and sensitive credentials are intended to be stored securely and access-controlled.
7.2 Retention
We retain personal information only as long as needed for the purposes described in this policy, unless a longer retention period is required or permitted by law. We may retain aggregated, de-identified, or fraud-prevention records for longer where appropriate.
7.3 Security
We use commercially reasonable administrative, technical, and organizational safeguards designed to protect information. However, no method of transmission or storage is 100% secure.
8. Your choices and controls
- You can disconnect email access through Oui Impact account settings where available, or through your email provider account permissions.
- You can remove the browser extension through your browser’s extension manager.
- You can disable or manage extension features such as impact banners or side panel settings where available.
- You can delete the mobile app or manage app permissions through your device settings.
- You can control cookies and local storage through your browser settings.
- You can use our Privacy Request form to request access, correction, deletion, email disconnect, tracking opt-out, or other privacy rights available to you.
9. Privacy rights
9.1 EEA, UK, and Switzerland
If you are located in the EEA, UK, or Switzerland, you may have rights to access, correct, delete, restrict, object to processing, or request portability of your personal data. You may also have the right to withdraw consent where processing is based on consent.
Legal bases may include providing the service, legitimate interests, consent where required, compliance with legal obligations, and protection against fraud or abuse.
9.2 United States, including California
Depending on your state of residence, you may have rights to know, access, correct, delete, or obtain a copy of personal information, and to opt out of certain sharing or targeted advertising where applicable.
We do not sell personal information in the traditional sense. If a privacy law defines certain measurement or advertising activities as a “sale” or “sharing,” we will provide required notices and choices where applicable.
You can submit these requests through the Privacy Request form. We verify requests before destructive changes so accounts, rewards, impact points, and donation pool records are not accidentally affected.
10. Children’s privacy
Oui Impact is not intended for children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, please contact us and we will take appropriate steps.
11. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and update the “Last updated” date. If changes are material, we may provide additional notice where required.
12. Contact us
If you have questions, requests, or concerns about this Privacy Policy or our privacy practices, contact us:
