Privacy policy

Who handles your information

Convexa Agency LLC d/b/a Arrow ("Arrow", "we", "us") is responsible for the personal information described here. Our address is 539 Beacon Pl, Chula Vista, CA 91910.

This policy covers what Arrow collects when a shopper signs up for a cash-back offer on a page Arrow hosts, sends in a receipt, and is paid a reward. It does not cover what a brand or a retailer does with information you give them directly, on their own site or in their own store.

Who this covers

Arrow runs cash-back offers on behalf of the brands that publish them. This policy covers the personal information Arrow handles when a shopper signs up for an offer on an Arrow page and sends in a receipt.

Arrow is the sender of every text message described here. The messages, how to stop them and what they cost are set out in our text message terms.

What we collect for messaging

The mobile number and email address given at signup, the consent recorded when the signup form's checkbox is ticked (the words shown, the time, and the page), the receipt image sent in, and what the receipt shows about the purchase being claimed.

We use the mobile number to send the text messages the shopper signed up for, and we keep the consent record as evidence that they asked for them.

Mobile numbers and text messages

We do not share, sell, rent, or provide your mobile phone number, your text-message opt-in, or your messaging consent data to third parties or affiliates for marketing or promotional purposes.

We do not sell mobile numbers, and we do not share mobile numbers or the consent to text them with third parties or affiliates for their own marketing or promotional purposes.

A mobile number is used to administer the offer the shopper signed up for: to confirm the signup, to remind them to send a receipt before the deadline, to tell them the receipt was received and reviewed, and to tell them when payment is sent. These texts come from Arrow.

Message frequency varies. A shopper who signs up for one offer and sends a receipt typically receives fewer than 10 messages about it.

Message and data rates may apply.

Reply STOP to any text to stop these texts to that number. Reply HELP for help. Stopping texts never affects a reward already earned.

The only other parties that handle a mobile number are the service providers that deliver the message on our behalf, such as our messaging provider and the mobile carriers, and they may use it only to deliver that message.

Marketing messages

Offer texts are not marketing. Marketing messages are sent to a shopper who ticks the marketing checkbox on the signup form. Ticking it is required to join an offer: the box is never ticked in advance, the shopper ticks it themselves, and the form cannot be submitted without it. It is not a condition of buying anything.

That box names two senders and no others: Arrow and the brand whose offer it is, each in its own name. Both are named on the box before it is ticked, so a shopper who ticks it is choosing to hear from both. Neither is a third party for the purposes of the sentence above: the sentence is a promise not to hand a mobile number to anyone the shopper did not choose, and it is kept. Nobody outside those two is ever given a mobile number, a text-message opt-in, or a marketing consent record for marketing or promotional purposes, and neither of the two may pass what it receives to anyone else.

Arrow sends its own marketing. The brand receives the shopper's email address, mobile number and consent record in its own messaging account, and sends its own marketing from there, in its own name and under its own privacy policy.

Every marketing message says which of the two sent it and how to stop. Reply STOP to a marketing text to stop that sender's marketing texts; use the unsubscribe link in any email to leave that sender's email list. Leaving never affects a reward already earned, and it never affects the offer texts about a signup already made.

What else we collect, and why we keep it

Contact details are stored encrypted, and are matched using per-brand pseudonyms so one brand's shoppers are not visible to another.

We keep this information to decide whether a receipt earns a reward under the published offer terms, to pay an approved reward, and to keep the record of that decision, that payment and that consent that law and our own audits require.

Your choices

Reply STOP to any text to stop texts from that sender to that number. Use the unsubscribe link in any email to leave that sender's email list.

To ask what we hold about you, or to ask us to delete it, write to privacy@arrowsaves.com.

The categories of personal information we collect

Identifiers: your email address, your mobile number, and the name you give us. Where a reward requires it, the identity details our payout provider needs to verify you.

Commercial information: the offer you signed up for, the receipt image you sent, and what that receipt shows about the purchase you are claiming — the retailer, the date, the products and the amount paid.

Internet and device information: your IP address, your browser's user agent, the page you signed up on, and the advertising and tracking tags carried on that page's URL.

Inferences: whether a claim qualifies under the published offer rules, and our assessment of whether a receipt or a claim shows signs of fraud.

We do not ask for and do not want government identification numbers, financial account numbers, precise geolocation, biometric information, or information about your health, race, religion, sexual orientation or political views. Do not send them to us; if a receipt image happens to show something like that, we do not use it.

Where the information comes from

Almost all of it comes from you: what you type into a signup form and the receipt you send.

Some comes from your browser automatically — IP address, user agent, and the tags on the link you arrived from.

Some comes from the brand whose offer it is, or from an advertising platform, when you reach an offer through an ad or a form hosted on the brand's own site.

Some is generated by us: the result of the checks we run on a receipt, and the record of a payment we sent.

Why we use it

To run the offer you signed up for: to confirm the signup, to remind you before the deadline, to tell you what happened to your receipt, and to tell you when payment is sent.

To decide whether a receipt earns a reward under the published rules, and to pay an approved reward.

To detect and prevent fraud, including duplicate and altered receipts, and to protect the platform's security.

To keep the records of that decision, that payment and your consent that the law and our own audits require.

To send Arrow's own marketing messages, under the marketing consent you gave when you joined the offer.

To give the brand whose offer it is your contact details and the record of that consent, so that it can send its own marketing in its own name.

To measure how well an offer performed, in aggregate, and to report that to the brand.

Who we disclose it to

Service providers who act on our instructions and may use it only to do the work: our messaging provider and the mobile carriers that deliver a text, our email provider, our hosting and storage providers, the provider that sends a reward, and the provider that verifies identity before a payout.

The brand whose offer it is receives the outcome of your claim and the aggregate performance of its offer.

It also receives your email address and mobile number, and the record of your permission, when you tick the marketing box on the signup form — the box that names it and Arrow together, before you tick it, and that is required to join the offer. They are delivered to the brand's own email and text marketing account, and the brand sends its own marketing from there under its own privacy policy. It receives them only so that it can send you what you asked it for, it may not pass them to anyone else, and you can leave its list at any time without affecting a reward you have earned. Where a shopper ticked an earlier version of that box, the permission recorded then is what still governs their contact details.

Meta, when a brand measures its offer with Meta advertising. Arrow sends Meta the offer page visit, signup, retailer click, receipt-submitted, paid-reward and purchase events for that brand, and the Meta Pixel on the offer page sends page activity to Meta directly. So that Meta can match the events to its users, they carry hashed contact details (email address, mobile number and name), advertising cookie identifiers, your IP address and your browser's user agent. A purchase event also carries the amount and date of the approved purchase. Receipt images, the products on a receipt, payment details and secure account links are not sent. Meta uses this to measure and improve the brand's advertising, and may use it for its own purposes under its own terms. See "Your privacy rights" for how to opt out.

Anyone we are legally required to disclose to, and anyone acquiring the business — see the two sections below.

We do not sell personal information for money. Advertising measurement is separate from permission to receive marketing messages: opting out of one does not change the other.

Notice of financial incentive

An Arrow offer is a financial incentive under California law: a shopper receives cash back on a qualifying purchase, or a discount code, in exchange for signing up with their email address and mobile number and joining the marketing of the brand whose offer it is and of Arrow. Each offer's terms state its reward.

The personal information involved is the email address and mobile number given at signup, the consent recorded then, and, for a cash-back offer, the receipt sent in.

You opt in by ticking the consent boxes on the offer's signup form. You can withdraw at any time: reply STOP to a text or use the unsubscribe link in an email, from either sender. Withdrawing never affects a reward already earned or a code already issued.

Arrow estimates the value of that personal information at approximately the value of the offer's reward or discount. The method is the cost of providing the offer: the brand pays that amount to reach a shopper who has signed up, so it is our good-faith estimate of what the information is worth to the brand and to Arrow.

Legal obligations and safety

We may disclose personal information where we reasonably believe the law requires it, in response to lawful process, or to establish or defend a legal claim; and where we reasonably believe it is necessary to investigate fraud, enforce our terms, or protect the rights or safety of any person.

If Arrow is acquired, merged, or sells the part of the business that runs these offers, personal information may transfer with it. It stays subject to a policy no less protective than this one, and we will say so before it happens.

Information that is not about a person

We aggregate and de-identify information — how many people signed up for an offer, how many receipts qualified, how quickly. We may use and disclose that without restriction, and we do not attempt to re-identify it.

How we protect it

Email addresses and mobile numbers are stored encrypted, and are matched using per-brand pseudonyms, so one brand's shoppers are not visible to another and a stolen database row is not a contact detail.

Access is limited to the people who need it to run an offer or investigate a problem, and what they do is logged.

No system is perfectly secure, and we cannot promise that one is. Tell us at the address below if you think something has gone wrong.

How long we keep it

A receipt image and the claim decision it supports are kept for as long as we need to answer a question about that decision, and to satisfy the record-keeping our audits and the law require.

A consent record is kept for as long as the consent is live and for as long afterwards as we may need to evidence it.

Contact details are kept while you are on a list you asked to be on, and afterwards only in the suppression record that stops us contacting you again.

When a retention period ends we delete the information or de-identify it.

Children

Arrow is for adults. The platform is not directed at children, we do not knowingly collect personal information from anyone under 18, and anyone signing up for an offer must be 18 or older. If you believe a child has given us information, write to us at the address below and we will delete it.

Your privacy rights

Depending on where you live, you may have the right to know what personal information we hold about you and where it came from, to get a copy of it, to correct it, to have it deleted, and not to be treated differently for exercising any of those rights. Residents of California, and of the other states with comprehensive privacy laws, generally have these rights.

Sending advertising events to Meta, described above, may be "sharing" personal information for cross-context behavioral advertising under California law. In the past 12 months the categories shared this way were identifiers (hashed contact details, advertising cookie identifiers and IP address), internet and device information (page activity and browser user agent) and commercial information (signups and approved purchase amounts). We do not sell or share the personal information of anyone we know to be under 16.

You have the right to opt out of that sharing, and opting out never affects an offer or a reward. Arrow treats a Global Privacy Control signal from your browser as a request to opt out: with it turned on, the offer page does not load the Meta Pixel and nothing from your signup is sent to Meta. You can also write to privacy@arrowsaves.com from the email address you signed up with, and we will stop sending your information to Meta.

You can leave any marketing list at any time.

To make a request, write to privacy@arrowsaves.com from the email address you signed up with, or tell us enough for us to find you. We will verify that the request is yours before acting on it, and we will answer within the time the applicable law allows. You may use an authorised agent, and we may ask them for proof of that authority.

If we cannot honour a request in full — usually because we are required to keep the record of a decision or a payment — we will tell you which part we kept and why.

How to stop messages, and what stopping does and does not affect, is set out in our text message terms.

Changes to this policy

We may update this policy. When we do, we change the date at the top of this page, and where the change is material we will give notice before it takes effect.

How to reach us about privacy

Write to privacy@arrowsaves.com, or to us at 539 Beacon Pl, Chula Vista, CA 91910.