Privacy Policy

1. Scope

This policy covers the Treasure Pays platform: the Publisher Command Center, the staff Console, the partner API, and the Bridge offerwall your users are shown. It does not cover your own properties, or the survey a respondent is redirected into once a provider takes over.

2. What we collect

• Publisher account data — name, work email, organisation, role, and the audit trail of actions taken in the command centre.
• Respondent identifiers — the identifier you send us is stored as a pseudonymous mapping. We do not ask you for your users' names, email addresses, or postal addresses.
• Profile attributes — the demographic answers a respondent gives so they can be matched to suitable surveys.
• Technical and integrity signals — IP address, user agent, device and network reputation signals, timing, and session history, collected to detect fraud and protect payout integrity.
• Transaction records — sessions, offers, conversions, reversals, ledger entries, statements and payouts.

3. Why we use it

To operate the service and route respondents to suitable surveys; to calculate rewards and settle statements accurately; to detect and prevent fraud and abuse; to meet our legal, tax and accounting obligations; and to support you when something goes wrong.

4. Legal bases

Where data protection law requires a basis, we rely on performance of a contract (operating your account and paying you), legitimate interests (fraud prevention, service integrity and security), and legal obligation (financial record keeping). Where consent is required for a respondent to take part, it is collected by you or by the provider before the survey begins.

5. Sharing

We share the minimum needed with survey providers to request and validate an offer, and with sub-processors that host, monitor, or support the platform. We do not sell personal data and we do not share it for cross-context behavioural advertising. Data may be disclosed where we are legally required to do so.

6. Retention

Transaction and ledger records are retained for as long as financial and audit obligations require. Integrity signals are retained for the period needed to investigate fraud patterns. Account data is retained for the life of the account and a limited period afterwards.

7. Rights

Respondents should raise access, correction and deletion requests with the publisher whose property they used — you are the controller of that relationship, and we will support you in responding within the timeframes the law allows. Publisher users can exercise their own rights directly with us.

8. Security

Access is role scoped and multi-factor authentication is required for staff. Secrets are encrypted at rest, API traffic is signed and replay protected, and administrative actions are recorded in an append-only audit log.

9. International transfers

The platform and its providers operate across regions. Where personal data moves between jurisdictions we rely on the transfer mechanisms recognised in the exporting region.

10. Contact

Privacy questions and requests: privacy@treasurepays.com.