2XPoints Privacy Policy

Last Updated: November 25, 2025

2XPoints (“2XPoints,” “we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use the 2XPoints website, mobile app, card-linking services, and rewards platform (“Services”).

By accessing or using the Services, you consent to this Privacy Policy.
If you do not agree, please discontinue use of the Services.

1. Information We Collect

We collect personal, technical, and transaction-based information to operate the 2XPoints rewards program and card-linked offers.

1.1 Personal Information You Provide

Examples include:

• Name
• Email address
• Mobile phone number
• Account login credentials
• Profile settings
• Customer support messages
• Preferences and communications settings

1.2 Technical & Device Information

We automatically collect:

• IP address
• Device information
• Browser type and version
• Cookies and tracking technologies
• App usage data
• Page views, clicks, scroll activity
• Session duration
• Referring/exit pages

This data helps us operate, secure, and improve the Services.

1.3 Cookies & Tracking Technologies

We use cookies, web beacons, pixels, and similar technologies for:

• Website functionality
• Analytics and performance
• Fraud detection
• Personalized content
• Offer relevance
• Improving the user experience

You can disable cookies in your browser settings, but some features may not function properly.

1.4 Transaction Data (Card-Linking Program)

When you link an eligible Visa or Mastercard credit card, you authorize the card network to securely share tokenized transaction data with 2XPoints so we can provide card-linked rewards.

We may receive:

• Date and time of purchase
• Transaction amount
• Merchant name
• Merchant category code
• Location information (when permitted)
• Tokenized card identifier

2XPoints never receives your full card number, CVV, or expiration date.

All card linking is handled through secure, PCI-compliant payment networks.

1.5 Tokenization

When your card is enrolled, Visa/Mastercard generate a secure token representing your card.
2XPoints only receives and uses this token—never the actual card number.

1.6 Anonymous & Aggregated Data

We generate anonymized and aggregated data for analytics, reporting, and program optimization.
This data cannot identify you.

2. How We Use Your Information

We use your information to:

• Operate the 2XPoints rewards program
• Identify eligible transactions
• Issue points and bonuses
• Deliver card-linked offers
• Provide location-based or personalized offers
• Process redemptions
• Improve performance, analytics, and reporting
• Detect fraud or misuse
• Communicate through email, SMS, and push notifications
• Provide account support and updates
• Comply with legal obligations

We do not sell personal information.

3. How We Use Transaction Data

We use card-linked transaction data solely to:

• Calculate points, bonuses, and rewards
• Power card-linked offer eligibility
• Provide offer recommendations
• Deliver location-based promotions
• Prevent fraud
• Create anonymized merchant performance analytics
• Validate qualifying purchases
• Improve program accuracy and user experience

Transaction data is not used outside of operating the card-linked rewards program.

4. Consent for Email, SMS, Push Notifications & Geolocation

By using the Services, you consent to:

4.1 Email Communications

We may send:

• Account notifications
• Reward postings
• Offer announcements
• Security messages
• Required legal notices

You may unsubscribe from marketing emails at any time.

4.2 SMS/Text Messages

If you opt in or provide a mobile number, you consent to receive:

• Reward alerts
• Offer reminders
• OTP/security codes
• Important account updates

Reply STOP to opt out.

4.3 Push Notifications

If enabled on your device, we may send:

• Real-time reward alerts
• Personalized offers
• Nearby merchant notifications

4.4 Geolocation

If you enable location services, we may use location data to:

• Show nearby participating merchants
• Provide personalized or timely offers
• Enhance fraud detection
• Improve app functionality

You may disable location access at any time through device settings.

5. Sharing of Information

We may share your information with:

5.1 Service Providers

Including cloud hosting, analytics providers, customer support tools, and communications partners.
They are contractually required to:

• Protect your data
• Use it only for authorized purposes
• Maintain confidentiality

5.2 Card Networks (Visa & Mastercard)

For the purpose of:

• Verifying eligible transactions
• Issuing rewards
• Supporting card-linked functionality

Only tokenized card identifiers and necessary transaction data are exchanged.

5.3 Merchants & Brands

We may share anonymous, aggregated performance reports such as:

• Offer redemption rates
• Traffic and engagement data
• Volume of purchases

We do not share your identity with merchants unless you explicitly authorize it.

5.4 Legal Requirements

We may disclose information if required to:

• Respond to legal requests
• Prevent fraud or illegal activity
• Protect the rights and security of 2XPoints or users

5.5 Business Transfers

If 2XPoints is acquired, merged, or restructured, your information may transfer to the acquiring company under the same privacy protections.

6. Data Retention

We retain your information only as long as necessary to:

• Operate the rewards program
• Maintain accuracy of transaction and reward history
• Prevent fraud
• Comply with legal, regulatory, and tax obligations

When no longer needed, your information is securely deleted or anonymized.

7. Security

We use industry-standard measures including:

• Encryption
• Tokenization
• Access controls
• Firewall protection
• Secure hosting
• Continuous monitoring

However, no system is 100% secure.
You are responsible for keeping your login credentials safe.

8. Your Privacy Rights

Depending on your jurisdiction, you may have the right to:

• Access your personal information
• Correct outdated or inaccurate information
• Request deletion of your data
• Revoke card-linking permissions
• Opt out of marketing communications
• Limit use of sensitive personal information
• Request a copy of your collected data

Submit requests to privacy@2xpoints.com.

9. Children’s Privacy

2XPoints does not knowingly collect information from anyone under 18 years of age.
If you believe a minor has submitted information, contact us immediately.

10. International Transfers

Your data may be stored and processed in the United States or other jurisdictions.
We maintain appropriate safeguards for all international transfers.

11. California Consumer Privacy Rights (CCPA & CPRA)

This applies to California residents.

11.1 Your California Rights

You may request:

• The categories of personal information we collect
• The sources of that information
• How we use the information
• Whether we share or disclose it
• Copies of your personal information
• Corrections of inaccurate data
• Deletion of your data
• To opt out of “sharing” for cross-context behavioral advertising
• To limit use of sensitive personal information

We do not sell personal information.

We do not collect sensitive categories such as SSNs, driver’s licenses, biometric identifiers, or complete financial account numbers.

11.2 Submitting a California Privacy Request

Email: privacy@2xpoints.com
We may require identity verification.

11.3 Non-Discrimination

We will not:

• Deny service
• Charge different prices
• Provide lesser functionality

However, some program features may not work if you disable card-linking or revoke essential permissions.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically.
If changes occur, we will update the “Last Updated” date and, where required, notify users.

13. Contact Us

For privacy-related questions or requests:

2XPoints Privacy Team
Email: privacy@2xpoints.com
Website: www.2xpoints.com