Scope and responsible organizations
Trinity Payment Solutions operates the Rebate Cards website and platform. This notice covers data handled through the public website, business accounts, Shopify connection, program configuration and related support.
A merchant, verification provider, card issuer, payment network, card program provider or other service provider may be independently responsible for particular processing. The applicable merchant terms, card terms and provider privacy notices explain those responsibilities when they apply.
Data we may receive
We seek to collect and retain only the information reasonably needed to operate the website, verify eligible businesses and people, connect approved commerce data, administer rebate programs and support virtual card activity.
- Account and contact data, including name, business email, telephone number, authentication records, consent records, company details, role, correspondence and support history.
- Shopify store data, including store identifiers, domain, storefront details, currency, connection status and the permissions granted by an authorized merchant user.
- Program-relevant Shopify data, which may include customer identifiers and contact details, orders, line items, prices, discounts, taxes, fulfillment status, cancellations, returns and refunds when needed to determine eligibility and maintain an accurate program ledger.
- Verification data received from or associated with iComply, such as entity and session identifiers, verification status, decision information, verified business or identity fields, ownership and control information, and supporting-document metadata.
- Program and card records, including eligibility rules, funding parameters, rebate calculations, order references, approved value, virtual card identifiers, status, limits, adjustments, reversals and reconciliation records. We do not ask you to submit full card numbers through the public contact form.
- Technical and security data, including IP address, browser and device information, requested URL, request time, response status, request identifiers and signals used to protect accounts, connections and webhook endpoints.
How we use data
We use personal data to provide and secure the requested service, respond to business inquiries, evaluate program readiness, satisfy applicable obligations and maintain reliable records. Where law requires a legal basis, the basis may include steps requested before a contract, performance of a contract, compliance with legal obligations, legitimate interests in operating and protecting the service, or consent where required.
- Create and authenticate a business account and associate it with an authorized Shopify store.
- Coordinate business and identity verification through iComply and record the resulting status. iComply provides the verification flow and is not the issuer of a virtual card.
- Enable approved self-service features in stages after registration, required verification, program review and any provider approval.
- Receive Shopify order, customer, fulfillment and refund events, apply the merchant's approved program rules, calculate rebate value and keep related records aligned.
- Coordinate approved virtual card issuance, limits, adjustments and reconciliation with the responsible card service providers.
- Prevent misuse, verify webhook authenticity, investigate security events, meet recordkeeping requirements and respond to lawful requests.
Shopify and other commerce platforms
Shopify is the native account and store connection described on this website. A merchant authorizes the applicable access and remains responsible for ensuring that its use of Shopify data and its customer notices are lawful and accurate.
Connections for WooCommerce, Adobe Commerce, BigCommerce, Wix, Squarespace, PrestaShop, OpenCart, marketplaces, or custom and headless commerce are not automatically available. If a connection is approved after separate technical and program review, the data categories and responsibilities are documented before activation.
Service providers and disclosures
We may disclose personal data only where reasonably necessary to operate the service, complete requested verification, administer an approved program, support virtual card activity, obtain professional services, protect rights and security, comply with law or complete a legitimate corporate transaction.
Recipients may include authorized merchant and platform personnel, Shopify, iComply, hosting and security providers, communications providers, professional advisers, and the card issuer, payment network, program provider or processor responsible for an approved card arrangement. Each provider's role and terms may differ by program and jurisdiction.
A provider may process data in another country. Where transfer restrictions apply, the organization responsible for the transfer must use a lawful transfer mechanism and appropriate safeguards.
Retention and security
We retain information only for as long as reasonably necessary for the purposes described here, including account and program administration, reconciliation, dispute handling, security, legal compliance and the protection of legitimate interests. Different records may have different retention periods because merchant, verification and card program obligations are not identical.
We use proportionate administrative and technical safeguards, including access controls and protections for authenticated requests and webhooks. No internet service can guarantee absolute security. Do not send passwords, full card numbers, security keys or unnecessary sensitive data through the public contact form or ordinary email.
Your choices and rights
Depending on the law that applies, you may have rights to request access, correction, deletion, restriction or portability, to object to particular processing, or to withdraw consent without affecting earlier lawful processing. Conditions, exceptions and identity-verification requirements may apply.
A request concerning data controlled by a merchant, iComply, Shopify or a card service provider may need to be handled by that organization. We will direct the request when the responsible organization can be identified.
Contact and updates
Email hello@rebatecardsx.com with a privacy question or request relating to this website or platform. You may also have the right to complain to the data protection authority responsible for your circumstances.
We may update this notice when our services, providers or legal obligations change. The effective date identifies the current published version.