Legal

Privacy Policy

Effective date: June 1, 2026 · Last updated: June 1, 2026

The short version: Your credit card statements are processed in your browser session only and never stored on our servers. We collect only what's necessary to deliver your strategy report. We don't sell your data. Ever.

1. Who We Are

RewardGap ("we," "us," or "our") operates rewardgap.com, a business credit card rewards optimization service. We analyze your credit card statements to identify opportunities to earn more rewards on your existing business spend.

For questions about this policy, contact us at support@rewardgap.com.

2. Information We Collect

Information you provide directly:

Contact information: Your name, business name, and email address, collected at the start of your analysis session.
Payment information: Your credit card details for the $497 service fee. Card data is collected and processed exclusively by Stripe and never transmitted to or stored on RewardGap servers.
Credit card statements: PDF files you upload for analysis. See Section 3 for how these are handled.

Information collected automatically:

Standard server logs (IP address, browser type, pages visited) collected by Vercel, our hosting provider.
No tracking cookies, advertising pixels, or behavioral analytics are used.

3. How We Handle Your Statements

Your PDF statements are never stored on our servers. They are read in your browser, converted to a format our AI can process, analyzed, and discarded. No statement file is written to any database, file system, or long-term storage.

Specifically:

Statement files are processed using your browser's FileReader API — the conversion happens on your device.
The processed content is sent to our AI analysis service (Anthropic Claude) over an encrypted HTTPS connection for analysis.
After analysis, the content is not retained by RewardGap. Anthropic's data handling policies govern how they process API requests.
We extract spend category totals only. Individual transaction details are used for analysis but not recorded.

4. How We Use Your Information

To perform the credit card rewards analysis you requested.
To process your payment via Stripe.
To deliver your strategy report by email.
To store your strategy report temporarily (72 hours) in case of email delivery issues.
To respond to support inquiries.

We do not use your information for advertising, profiling, or sale to third parties.

5. Report Storage

Your strategy report is stored in encrypted form for 72 hours after delivery. This allows us to resend the report if your email bounced or you need it re-delivered to a corrected address. After 72 hours, the report is automatically and permanently deleted. No manual deletion is required — expiry is enforced at the infrastructure level.

6. Third-Party Services

We use the following third-party services to operate RewardGap:

Stripe — Payment processing. Your card details are handled entirely within Stripe's PCI-compliant environment. Stripe Privacy Policy
Anthropic — AI analysis of your statement data. Anthropic Privacy Policy
Postmark — Email delivery of your strategy report. Postmark Privacy Policy
Vercel — Website hosting and infrastructure. Vercel Privacy Policy
Upstash — Temporary encrypted report storage. Upstash Privacy Policy

7. Data Retention

Strategy reports: 72 hours, then automatically deleted.
Payment records: Retained by Stripe per their policies and legal requirements.
Email records: Retained by Postmark per their policies.
Server logs: Retained by Vercel per their standard log retention policies.
Statement files: Not retained. Processed in-session only.

8. Your Rights

Depending on your location, you may have rights regarding your personal data including the right to access, correct, or delete information we hold about you. Since we retain minimal data and most of it expires automatically within 72 hours, most requests can be addressed immediately.

To exercise any data rights or ask questions, email support@rewardgap.com.

9. Security

All data transmitted between your browser and RewardGap is encrypted via HTTPS (TLS). Payment data is handled within Stripe's PCI DSS compliant environment. Stored reports use encrypted storage with automatic expiry. We follow security best practices appropriate for a service of this nature.

10. Children's Privacy

RewardGap is a business service intended for adult business owners. We do not knowingly collect information from anyone under 18 years of age.

11. Changes to This Policy

We may update this policy as the service evolves. Material changes will be noted with an updated effective date. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Contact

Questions about this privacy policy or your data:

support@rewardgap.com
RewardGap
rewardgap.com