At Arrafund, we respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and protect your data when you use our platform in compliance with relevant regulations such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
We collect personal information in various ways to provide and enhance our services.
Your information enables us to operate and enhance our platform, personalize user experiences, and communicate with you.
We respect your privacy and do not sell or share your information with unaffiliated third parties except in specific circumstances.
We do not sell Google user data, use it for advertising, or use it to determine creditworthiness. We limit access by people to a specific receipt when you have authorized review and review is needed to verify a reward, investigate fraud or abuse, comply with law, or resolve a support request. Service providers may process data only to operate the connected-receipt feature for you. This includes automated extraction providers that identify receipt fields. Arrafund does not use Gmail data to train generalized AI models.
Arrafund's use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.
We do not sell Plaid-derived data. Plaid processes information needed to connect the accounts you select, and our hosting and infrastructure providers process encrypted data only as needed to operate Arrafund. We do not disclose your private merchant or transaction details to the friend receiving a reward. You may choose to publish an eligible purchase event separately from your dashboard.
Depending on your location, you may have rights regarding your personal information, such as:
To exercise these rights, please contact us at privacy@arrafund.com. Instructions specific to connected Google data are available on our Google User Data and Deletion page. Instructions for disconnecting Plaid and requesting deletion of Plaid-derived data are available on our Plaid Data and Deletion page.
We implement industry-standard security measures, such as encryption, access controls, and regular audits, to protect your data. However, no method of internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security.
Google OAuth access and refresh tokens are encrypted at rest. Gmail data is transmitted over HTTPS. We store receipt evidence and extracted purchase details only as needed to operate, review, and account for receipt rewards.
Plaid access tokens, Item and account identifiers, institution names, account names, and merchant and transaction descriptions are encrypted at rest. Data is transmitted over HTTPS, and access is limited to authorized systems and personnel.
We retain your data as long as necessary to provide services, comply with legal obligations, resolve disputes, and enforce our agreements. When no longer needed, we securely delete or anonymize your data.
Disconnecting Gmail revokes the Google authorization, deletes the OAuth credentials held by Arrafund, and stops future inbox access. Receipt and reward records already created may be retained while needed for reward review, fraud prevention, accounting, disputes, or legal obligations. You may request deletion of Gmail-derived data using the instructions linked above; we delete or anonymize eligible records after verifying the request.
Direct Plaid connection, account, and transaction records are retained only while the connection remains active. Disconnecting an institution, revoking permission, or closing your account causes Arrafund to revoke access where applicable and delete those direct records. Plaid-derived receipt-review records are deleted, and merchant, account, and Plaid identifiers are removed from any minimal reward ledger entry that must be retained to complete a reward or meet fraud-prevention, dispute, tax, or accounting obligations. Those minimal records are reviewed for disposal after seven years. Verified Plaid-data deletion requests are completed within 30 days unless a documented legal exception applies.
Arrafund is not intended for users under 13 years old. We do not knowingly collect personal information from children under 13 without parental consent. If we discover any information collected from a child under 13, we will promptly delete it.
Our services are based in the United States. By using Arrafund, you consent to the transfer, storage, and processing of your information in the United States or other countries. We ensure that such transfers comply with applicable laws and regulations.
We may update this Privacy Policy to reflect changes in our practices or applicable regulations. Any changes will be posted here, and if significant, we will notify you through appropriate channels. Your continued use of Arrafund constitutes acceptance of any changes.
If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us at privacy@arrafund.com.
Last updated: August 25, 2026