Published in English, which is the authoritative version.
1. Who we are
Reward.Farm (“we”, “us”) operates the platform at reward.farm. For the purposes of the GDPR we are the data controller for the personal data described below.
Contact: privacy@reward.farm
2. What we collect, and why
We collect only what the service needs to function. Each item below states the purpose and the legal basis under GDPR Article 6.
| Data | Why we hold it | Legal basis |
|---|---|---|
| Email address, display name | Account identity, transactional email | Contract |
| Country | Payout eligibility, reward targeting | Contract |
| Account balance and ledger entries | Running the marketplace, accounting obligations | Contract, legal obligation |
| Proof files you upload (screenshots, recordings, links, text) | Delivering the work an Architect ordered, and resolving disputes | Contract |
| Social account handles you choose to verify | Proving you own an account, where a reward requires it | Contract |
| Billing address and VAT number, for Architects | Issuing a compliant invoice | Legal obligation |
| IP address at sign-up and on sensitive actions | Fraud prevention and abuse limits | Legitimate interest |
We do not collect special-category data, we do not build advertising profiles, and we do not sell personal data to anyone.
3. Who processes it on our behalf
We use a small number of processors, each bound by a data processing agreement:
- Clerk for authentication and account identity
- Stripe for payments, payouts and invoicing
- Mailgun (EU region) for transactional email
- Cloudflare for hosting, storage of uploaded proof files, and security
Payment card details never reach our systems. They are entered directly on Stripe’s pages and we only ever see the outcome of a payment.
4. Where your data lives
Our database, file storage and email sending are hosted in the European Union. Some processors may access data from outside the EU under Standard Contractual Clauses; details are available on request.
5. How long we keep it
- Account data: while your account exists, then 30 days after deletion.
- Ledger entries and invoices: retained for the period required by accounting and tax law, which is longer than your account, and cannot be deleted on request.
- Proof files: for the life of the reward plus the dispute window, then a further 12 months so a dispute can be reopened, after which they are deleted.
- Server logs: 30 days.
6. Your rights
Under the GDPR you may request access to your data, correction of it, deletion, restriction of processing, portability, and you may object to processing based on legitimate interest. Write to privacy@reward.farm and we will answer within one month.
Two honest limits: we cannot delete ledger entries or issued invoices, because accounting law requires us to keep them, and deleting your account does not undo completed transactions.
You may also lodge a complaint with your national data protection authority. In France that is the CNIL.
7. Cookies
We set only what the site needs to work: a session cookie from Clerk to keep you signed in, and a local preference for your theme and language. We use no advertising or third-party tracking cookies, which is why you are not asked to consent to any.
8. Automated decisions
Reward eligibility is checked automatically against the prerequisites an Architect set (completed rewards, reputation, account age, country, verified social accounts). This is a rules check, not profiling, and the reason for a refusal is always shown to you.
9. Security
Access to the platform is authenticated on every request. Proof files are served only to the people entitled to see them: their author, the Architect who ordered the work, and a moderator handling a dispute.
10. Changes
If we change this policy in a way that affects you, we will say so by email before the change takes effect.