1. Information we collect
1.1 Account, connection, and authentication data
When you create an account, connect a retailer, or use the extension, we may collect identifiers needed to operate the service, such as account ID, hashed or pseudonymous user ID, connection status, permission status, device or installation identifiers, and basic account settings.
1.2 Retailer order data
When you choose to connect a supported retailer account, we process the preceding 12 months of order history made available by that retailer, followed by periodic checks for new eligible purchases. Retailer authorization renews every 12 months until you disconnect. Order data may include order dates, item names, quantities, totals, product identifiers, order IDs, fulfillment or refund status, and metadata needed for eligibility and fraud prevention. We do not give participating brands your retailer password.
1.3 Browser extension activity
When enabled on supported websites, the extension may detect limited shopping signals needed to operate Oui Impact features, such as page URL or URL pattern, retailer domain, product detail views, add-to-cart events, purchase or checkout signals, timestamps, campaign or referral parameters, enabled settings, impact banner status, side panel interactions, and technical diagnostics. If you choose to connect a supported retailer account, the extension also reads your existing order history from that retailer (order dates, items, quantities, and totals for past purchases, not just future ones) so that eligible past purchases can be credited with impact points.
1.4 Website and analytics data
When you visit our websites or landing pages, we may collect standard web analytics and technical data such as IP address, approximate location, browser type, device type, pages visited, referral URLs, timestamps, cookie or local storage identifiers, and interactions with our pages.
1.5 Data we do not intentionally collect
- We do not intentionally collect personal email conversations for the purpose of reading or analyzing private communications.
- We do not use email access to send messages, delete messages, mark messages as read, move messages, or modify your mailbox.
- We do not intentionally collect sensitive categories of personal data, such as precise geolocation, health data, biometric data, or government IDs, unless clearly disclosed and required for a specific future feature.
- We do not knowingly collect personal information from children under 13.
2. Legacy email connections
Email receipt verification is not part of the current consumer sign-up flow. If you previously chose to connect an email provider, that connection remains permission-based and read-only for eligible order-confirmation data until you disconnect it.
| What we request | Why we request it | What we do not do |
|---|
| Read-only mailbox access or limited message-read permissions, depending on provider availability. | To find and parse eligible purchase receipts and order confirmations from supported retailers and brands. | We do not send, delete, edit, move, or mark emails as read. |
| OAuth tokens and provider connection metadata. | To keep your email connection active until you disconnect or the token expires. | We do not share OAuth tokens with advertisers, brands, or retailers. |
| Receipt content and receipt metadata relevant to eligible purchases. | To verify purchases, calculate impact points, power challenges, reduce fraud, and improve receipt parsing. | We do not use private email conversations for advertising targeting. |
Some provider permissions may be broader than receipt-only access.When a provider permission allows broader read access, we limit our use to identifying and processing receipt and order-confirmation data needed to provide Oui Impact features.
3. Browser extension
3.1 Extension permissions
The browser extension may request permissions needed to run on supported retailer websites, store settings locally, communicate with Oui Impact servers, display the side panel, show opt-in impact banners, capture eligible commerce events, and connect those events with your impact profile.
3.2 Supported website activity
The extension is designed to operate on supported retailer, brand, or partner websites. It may process page context and commerce signals needed to display features, verify activity, attribute points, and measure challenge progress.
3.3 Opt-in impact banners and side panel
If you activate impact banners or side panel features, we may process interactions with those features, such as impressions, clicks, dismissals, toggles, challenge views, creator or cause content views, and settings that control whether the experience is active.
4. How we use information
- Provide and operate Oui Impact, including the website, extension, retailer connections, account features, and dashboards.
- Verify eligible retailer orders and connect verified activity to Impact Points, challenges, donation pool logic, rewards, or community milestones.
- Show opt-in impact banners, side panel content, cause updates, brand challenges, creator content, and relevant product or retailer experiences.
- Attribute activity to campaigns, retailers, brands, causes, communities, or referral contexts.
- Prevent fraud, duplicate receipts, abuse, and unauthorized activity.
- Debug, secure, measure, and improve the product.
- Create aggregated, pseudonymized, or de-identified insights for reporting and product improvement.
- Comply with legal obligations and enforce our terms and policies.
5. Sharing and disclosure
5.1 Service providers
We may share information with vendors that help us operate the service, such as hosting providers, cloud infrastructure, analytics, authentication, retailer connector providers, security tools, error monitoring, customer support tools, and data processing vendors. These providers are authorized to process information only as needed to provide services to us.
5.2 Who is responsible when a campaign or partner is involved
Oui Do Good LLC is the controller of personal information when we determine why and how it is processed for Oui Impact accounts, retailer connections, the browser extension, security, fraud prevention, and our own platform operations. When we process personal information only on the documented instructions of a brand, retailer, agency, or other business customer, we may instead act as its processor or service provider for that processing.
A participating brand, retailer, agency, or other recipient becomes responsible for personal information it receives when it determines its own purposes and means of processing. In that situation, it acts as a separate controller or business and is responsible for its own privacy notice, lawful basis, rights-request handling, retention, security, and any further sharing. A campaign-specific notice or agreement may identify the sponsor, data recipient, reward provider, fulfillment owner, and the parties' more specific privacy roles.
5.3 Brands, retailers, charities, and partners
We may share aggregated, pseudonymized, or limited reporting with participating brands, retailers, charities, agencies, or partners. For example, reporting may show challenge progress, verified purchase counts, point totals, campaign performance, retailer-level activity, or donation milestones. We aim to avoid sharing raw email content with brands, retailers, or advertisers.
5.4 Advertising and measurement partners
Where applicable, we may transmit limited event-level data needed for measurement, attribution, campaign optimization, or fraud prevention. We strive to limit shared data to what is necessary and to use hashing, pseudonymization, aggregation, or other privacy-preserving methods where appropriate.
5.5 Legal and safety
We may disclose information if required by law, legal process, or a good-faith belief that disclosure is necessary to protect rights, safety, security, users, the public, or our services.
5.6 Business transfers
If we are involved in a merger, acquisition, financing, restructuring, or sale of assets, information may be transferred as part of that transaction, subject to appropriate protections.
6. Google API Services disclosure
If you connect a Google account, Oui Impact’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We use Google user data only to provide or improve user-facing Oui Impact features, including receipt verification, purchase validation, impact points, and challenge participation.
- We do not use Google user data for serving personalized ads.
- We do not sell Google user data.
- We do not allow humans to read Google user data unless you give us explicit permission for support, it is necessary for security or abuse investigation, or we are required to do so by law.
- We do not transfer Google user data to advertisers, data brokers, or information resellers.
For any optional Google email access, we limit our use to locating and processing eligible receipt and order-confirmation data needed for Oui Impact features.
Chrome Web Store User Data Limited Use
Oui Impact's use and transfer of information received through Chrome extension APIs and from websites accessed by the extension will comply with the Chrome Web Store User Data Policy, including its Limited Use requirements.
- We use extension user data only to provide or improve the extension's disclosed shopping-for-impact features and related security, fraud-prevention, reliability, and support functions.
- We do not sell extension user data or use or transfer it for personalized or retargeted advertising, audience building, creditworthiness, or lending.
- We do not transfer extension user data to advertising platforms, data brokers, or information resellers.
- We do not permit humans to read extension user data except with the user's specific consent for support, when necessary for security or abuse investigation, when required by law, or when the data has been aggregated and de-identified for lawful internal operations.
7. Storage, retention, and security
7.1 Where data is stored
Data may be stored locally on your device, in browser extension storage, and on our servers or vendor infrastructure. Connection tokens and sensitive credentials are intended to be stored securely and access-controlled.
7.2 Retention
We retain personal information only as long as needed for the purposes described in this policy, unless a longer retention period is required or permitted by law. We may retain aggregated, de-identified, or fraud-prevention records for longer where appropriate.
7.3 Security
We use commercially reasonable administrative, technical, and organizational safeguards designed to protect information. However, no method of transmission or storage is 100% secure.
8. Your choices and controls
- Retailer authorization renews every 12 months until you disconnect. You can stop renewal and future retailer access at any time through Oui Impact connection controls or the Privacy Request form.
- If you previously authorized an email connection, you can withdraw it through your provider permissions or the Privacy Request form.
- You can remove the browser extension through your browser’s extension manager.
- You can disable or manage extension features such as impact banners or side panel settings where available.
- You can control cookies and local storage through your browser settings.
- You can use our Privacy Request form to request access, correction, deletion, retail or email connection withdrawal, tracking opt-out, or other privacy rights available to you.
9. Privacy rights
9.1 EEA, UK, and Switzerland
If you are located in the EEA, UK, or Switzerland, you may have rights to access, correct, delete, restrict, object to processing, or request portability of your personal data. You may also have the right to withdraw consent where processing is based on consent.
We process account and service data as needed to provide the service and perform our agreement with you; optional retailer connections, shopping-companion activity, impact banners, and new-tab preferences based on your choices and consent where required; security, fraud prevention, service reliability, and limited product measurement based on our legitimate interests where those interests are not overridden by your rights; and records needed to comply with legal obligations.
Account and authentication data are required to provide account-based features. Retailer connections, the shopping companion, impact banners, and the Oui Impact new-tab experience are controlled through extension settings. Impact banners and the Oui Impact new-tab experience are disabled by default. The installed extension still declares Chrome's New Tab override, so installation changes Chrome's New Tab handler even while the Oui Impact new-tab experience is disabled.
Information may be processed in the United States and other countries where we or our service providers operate. Where required, we use an approved transfer mechanism and appropriate safeguards, such as adequacy decisions or standard contractual clauses. You may contact us to ask about the safeguard that applies to a transfer.
Oui Impact does not use extension data to make decisions based solely on automated processing that produce legal or similarly significant effects.
You may lodge a complaint with the data-protection or supervisory authority where you live, work, or believe an infringement occurred. You may contact us first, but doing so is not required before contacting an authority.
9.2 United States, including California
Depending on your state of residence, you may have rights to know, access, correct, delete, or obtain a copy of personal information, and to opt out of certain sharing or targeted advertising where applicable.
We do not sell personal information in the traditional sense. If a privacy law defines certain measurement or advertising activities as a “sale” or “sharing,” we will provide required notices and choices where applicable.
You can submit these requests through the Privacy Request form. We verify requests before destructive changes so accounts, rewards, impact points, and donation pool records are not accidentally affected.
10. Children’s privacy
Oui Impact is not intended for children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, please contact us and we will take appropriate steps.
11. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and update the “Last updated” date. If changes are material, we may provide additional notice where required.
12. Contact us
If you have questions, requests, or concerns about this Privacy Policy or our privacy practices, contact us:
