We read your card. Here's exactly what for — and what we do with it after.

The short version

• We read the merchant name, date and amount for transactions on a card you connect. That is what qualifies you to recommend a place, and how we know a referral turned into a visit.
• A business learns that you sent someone, that it was that person's first visit, and what that visit came to. It learns nothing about the rest of your spending.
• The person you send a favor to never sees what it earned you.
• We may sell, license and otherwise distribute data. By default that means aggregated and de-identified insights about spending and referral patterns — never your name, your card, or a record that identifies you. We also reserve the right to sell or share identifiable personal information, and if we ever do, you can opt out and we will honour it. Opt out here.
• We never sell card numbers, credentials, precise location, or anything about anyone under 18.
• You can disconnect your card, export what we hold, or delete the account outright.

This policy covers the Favor app, getfavor.app, and everything we do with data on behalf of members and the businesses listed on Favor. If anything below is unclear, that is a fault worth telling us about: privacy@getfavor.app.

What we collect

Things you give us

• Your name, email address and phone number.
• Who invited you, and who you invite.
• The text you write on a favor, and who you send it to. If you send a favor to somebody by phone number or email, you are giving us their contact details — see people you send favors to.
• Payout details, if you choose to cash out what you have earned, and the tax information the law requires us to collect before we can pay you.
• Anything you write to support.

Things we read from a connected card

• Merchant name, merchant category, date and amount for transactions on that card.
• Nothing else. Not your balance, not your other accounts, and we cannot move money on it.

This connection is what makes Favor different from a review site: it is the reason a recommendation on Favor can only come from somebody who actually went. You can see everything we have read from it in the app, and you can disconnect at any time — which turns off your ability to send favors, because there is then nothing to qualify them.

Card and account credentials are held by our card-linking and payment providers, not by us. We never see or store a full card number.

Things we collect automatically

• Device type, operating system, app version and crash reports.
• Which screens you opened and what you tapped, so we can tell which parts of the app are broken or ignored.
• Approximate location from your IP address, to know which city you are in.
• Cookies and similar technologies on getfavor.app, for sign-in, preferences and basic analytics.

We do not track precise location in the background, and the app does not ask for that permission.

Things we get from other people

• Transaction data from our card-linking provider, as described above.
• Payment and payout status from our payment processors.
• Identity and anti-fraud signals from verification providers, where financial rules require them.
• The fact that somebody put your name forward for an invite.

People you send favors to

When you send somebody a favor, you give us their name and a way to reach them. We use that to deliver the favor and, if they join, to connect the two of you. We do not add them to marketing lists, we do not sell their contact details, and one message is one message — they can ignore it and hear nothing further. Only send a favor to somebody who would expect to hear from you.

What we use it for

• Qualifying a recommendation. Confirming you have actually spent money at a place before you can pass it on.
• Attribution. Matching a first visit to the favor that caused it, so the business is billed correctly and the sender is paid.
• Paying you. Calculating and sending payouts, and meeting the record-keeping and tax-reporting rules that come with moving money.
• Stopping abuse. Spotting self-referrals, reciprocal loops, stolen cards and fake accounts.
• Running and improving the product. Crash reports, screen-level usage, support, and research into what makes a referral work.
• Telling you things. Service messages about your favors and payouts, and — if you have not opted out — occasional email about Favor.
• Commercial insight products. Producing aggregated and de-identified analysis of spending, footfall and referral behaviour, which we may license or sell. See the next section.
• Legal obligations. Tax, anti-money-laundering, sanctions screening, disputes and lawful requests.

Sharing, selling and licensing data

Most privacy policies say "we do not sell your data" and then define selling so narrowly that the sentence means very little. Here is the honest version instead.

Service providers

Companies doing a specific job for us, under contract, with only the minimum they need and no right to use it for anything else:

• The card-linking provider that supplies the transaction feed.
• Payment processors, to send payouts and collect business invoices.
• Cloud hosting, error monitoring, analytics and email or SMS delivery.
• Identity, tax and anti-fraud checks where financial rules require them.

Businesses on Favor

A business sees its own referrals and nothing outside them: that a named member sent a named guest, that the guest was a first visit, and what that visit came to. It cannot see your other favors, your other spending, or anybody's contact details beyond what a member chose to share by turning up.

Aggregated and de-identified data — which we do sell

We build, license and sell analysis derived from what happens on Favor: how categories of business perform, how referrals convert, how spending moves across a neighbourhood or a season. Buyers include the businesses on Favor, prospective businesses, research firms, investors, industry analysts and other commercial partners.

Data in these products is aggregated or de-identified before it leaves us. It does not contain your name, your contact details, your card, your account identifier, or a record that identifies you or your household. We commit to maintaining it in de-identified form, not to attempt to re-identify it, and to bind anyone we give it to by the same two commitments in writing.

Identifiable personal information — which we reserve the right to sell or share

We reserve the right to sell, license, rent, transfer or otherwise disclose personal information that identifies you — and to share it for cross-context behavioural advertising — to third parties including advertising partners, data partners, marketing platforms, analytics companies and other businesses, for their own commercial purposes. Under California, Colorado, Connecticut, Texas, Virginia and similar state laws, that activity is a "sale" or "sharing" of personal information.

Where the law requires an opt-out, you have one, it is free, and it works: Do Not Sell or Share My Personal Information. We also honour the Global Privacy Control and comparable browser or device opt-out signals as an opt-out for that browser or device. Opting out never costs you money, features, or a worse price on Favor.

Where the law requires consent before this kind of disclosure — including under the UK and EU GDPR, and for anyone we know to be under 18 — we will not do it without asking you first.

What we will never sell, license or distribute

• Card numbers, bank credentials, or anything that could be used to charge or access your accounts.
• Precise location.
• Government identifiers, or the documents collected for identity checks.
• Data about anyone we know to be under 18.
• The content of your support conversations with us.
• Anything a card network, our card-linking provider, or our payment processors prohibit us from selling under their rules — those restrictions bind us regardless of what this policy permits.

Legal, safety and corporate

We hand over data if we are legally required to. If that ever happens and we are permitted to tell you, we will. We also disclose data where it is genuinely necessary to prevent fraud, harm, or a breach of our terms.

If Favor is acquired, merges, or sells part of its business, data transfers with it. A buyer inherits the commitments in this policy, and if it intends to use your data materially differently, you will be told before that takes effect.

What other people see

The person you send a favor to

Your name, your note, and the place. Not what you earned, not whether you earned anything, and not where else you have been.

Everyone else

Nothing. There is no public profile, no feed, and no page about you that anybody can find.

How long we keep it

• Your account: while it is open.
• Transaction data read from your card: rolling 24 months, then deleted.
• Favors you have sent: while your account is open, so your history means something.
• Records of payouts: seven years, because financial and tax regulations require it. This is the one thing that survives account deletion.
• Crash and usage logs: 90 days.
• Aggregated and de-identified data: indefinitely. Once it is genuinely de-identified it is no longer about you, and deleting your account does not pull it back out of work already published or licensed.

Your choices and controls

• Do Not Sell or Share My Personal Information. Email privacy@getfavor.app with the subject "Do Not Sell or Share". We action it within 15 business days, we do not charge for it, and we do not ask you to create an account to do it. A one-tap control is coming to the app; until it lands, the email address is the whole of it and it is monitored.
• Global Privacy Control. If your browser or device sends a GPC signal, we treat it as an opt-out for that browser or device without you having to ask.
• Limit the use of sensitive information. Ask us to use your financial information only for the purposes the law permits without your say-so.
• See it. Everything we hold about you is exportable from the app.
• Correct it. Anything wrong, you can change or ask us to change.
• Disconnect. Unlink your card and keep the account.
• Delete it. Remove the account, your card connection and your spend history, keeping only the payout records described above.
• Opt out of email that is not about a favor or a payment.

You can name somebody to make a request on your behalf. We will ask them to prove you authorised it, and we may ask you to confirm directly.

Your rights where you live

California

You have the right to know what we collect and why, to get a copy, to correct it, to delete it, to opt out of sale and sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of that. In the last twelve months we have collected the categories described under What we collect, and disclosed them for the purposes described under Sharing, selling and licensing data. Where we sell or share personal information, the categories involved are identifiers, commercial information, and inferences drawn from them.

Colorado, Connecticut, Texas, Virginia and other US states

You have broadly the same rights: access, correction, deletion, a portable copy, and an opt-out of targeted advertising, sale, and profiling with legal or similarly significant effects. Some states let you appeal if we refuse a request — write to privacy@getfavor.app with "Appeal" in the subject and a person will answer.

UK and EU

Our legal bases are: performing our contract with you (running your account, attributing favors, paying you), legal obligation (tax, anti-money-laundering, record-keeping), legitimate interests (fraud prevention, security, product improvement, aggregated and de-identified analysis), and consent where we ask for it — including before any sale or sharing of identifiable personal information for others' own purposes. You can access, correct, delete, restrict, object, and take your data elsewhere, withdraw consent at any time, and complain to your data protection authority.

Everywhere else

Ask and we will tell you which rights apply to you. In practice we try to give everyone the same controls regardless of where they live.

Where your data goes

Favor is operated from the United States, and data is stored and processed there. If you use Favor from outside the US, your data is transferred to the US and to our providers' locations, under the standard contractual clauses or another lawful transfer mechanism where one is required.

Security

Data is encrypted in transit and at rest. Access is enforced per-account at the database level, so one member's records are not reachable from another's session. Internal access is limited to the people who need it and is logged. No system is perfect; if we ever have a breach that puts you at risk, we will tell you and the relevant regulator within the time the law allows.

Children

Favor is for adults. We do not knowingly collect data from anyone under 18, we do not sell or share data we know to be theirs, and we delete it if we find it.

Changes to this page

If we change something that materially affects what we do with your data — including starting to sell or share a category we did not before — we will email you before it takes effect rather than quietly updating the date at the top.

Asking us about any of this

Write to privacy@getfavor.app and a person will answer. If you think something here does not match what the app actually does, that is the most useful message you could send us.

Last updated 1 September 2026 · Terms of Service