Privacy Policy

Last Updated: October 4, 2026

This Privacy Policy explains how CardMatchly ("we," "us," or the "Service") collects, uses, discloses, and protects your personal data when you use our website, our browser extension, and our AI features.

This policy is governed by the Personal Data Protection Act 2012 (PDPA) of Singapore. By using the Service, you consent to the collection and use of your personal data as described herein.

1. Personal Data We Collect

We collect only personal data that is necessary for the purposes described in this policy:

• Identity & Login: We use Kinde for authentication. Access to the AI agent requires a registered account. When you sign up, we receive your email address and name for the purpose of account creation and identity verification.
• Telegram Integration: If you interact with the AI agent via our Telegram bot, your Telegram chat ID is stored in Upstash to link your Telegram account to your CardMatchly account. Messages you send via the bot are transmitted to our Service for processing. Where you elect to share your location via Telegram, your coordinates are transmitted to Google (Places API) to identify the nearby merchant and are cached in Upstash for up to one hour solely to answer your query, after which they are deleted automatically. We do not store your Telegram username or profile information.
• Billing: Payments are processed by Stripe. We do not store your credit card details on our servers; Stripe handles all sensitive financial data solely for the purpose of transaction processing and fraud prevention.
• Usage & AI Interaction Data: We store up to your last 10 exchanges with the AI agent in Upstash to provide conversational context. This data is retained only as long as necessary for that purpose and is accessible solely through your authenticated account. Usage is subject to per-tier prompt limits: free accounts receive a one-time allowance of 5 prompts with no time limit, tracked via a counter stored in Upstash, and individual prompts are capped at 2,000 characters. Aggregated usage data, comprising prompt count, plan tier, and prompt length, together with a limited set of non-content product events (such as sharing a result, overriding a recommendation, or steps in the upgrade process, such as seeing the upgrade prompt, starting checkout, and the plan amount and currency when a subscription starts), website usage analytics (the pages you visit, the referring page, and session activity such as visit duration), and client-side error diagnostics, is processed via PostHog. The text of your prompts is not transmitted to PostHog. If you rate an answer with a thumbs up or down, or flag its cards as wrong, the rating, the merchant concerned, and a short excerpt (up to 200 characters) of CardMatchly's answer are sent to PostHog so we can review answer quality. Usage data and product events are recorded by our servers, linked to your account ID, to operate and improve the Service, and are not affected by your cookie choice. Website usage analytics and client-side error diagnostics are collected in your browser only where you select Allow All (see Section 11).
• Saved Cards: Your saved credit card selections are stored server-side in Upstash, linked to your authenticated account. This allows your saved cards to persist and sync across devices and sessions.
• Spending & Card Tracking: Amounts and merchant notes you log against your saved cards, any recurring payments you set up (card, amount, merchant, and schedule), together with each card's bonus-cap usage, any redemption goal, your statement-cycle day, your category preferences, your time zone (used to work out when your caps reset), your answers about whether you hold a bank account a card's bonus rate depends on, any merchant icons you customize, card recommendations you dismiss, and which bonus-cap alerts you have already seen (so alerts stay cleared across your devices), are stored in Upstash and linked to your account. These figures are self-reported; we do not connect to your bank or access your transaction records.
• Feedback & Category Corrections: If you tell us a merchant is in the wrong category, we store your vote (the merchant and the category you chose) in Upstash, linked to your account, so each user counts only once. Once enough users agree, the correction applies to everyone, but it never shows who voted. If you flag an answer's cards as wrong for a shop, we record the merchant or website, and any broad category you suggest, in our category review queue without linking it to your account (the rating itself is sent to PostHog as described under Usage above). If you use "Send feedback", your message is sent by email from your own email app, and we receive what you choose to include.
• Referrals: Where you share or accept a referral invitation, we store a referral code for your account, the association between the referring and referred accounts, your earned bonus-prompt balance, and a count of successful referrals in Upstash.
• Communications: If you opt in to our newsletter, your name and email address are managed by Kit solely for the purpose of distributing product updates and marketing communications. You may opt out at any time.
• Browser Push Notifications: If you opt in to browser (web push) notifications, we store the push subscription your browser generates, namely a delivery endpoint and the browser-supplied encryption keys, in Upstash, linked to your authenticated account, so we can send you optional alerts such as bonus-cap reminders. The subscription itself contains no card, bank, or account data. Notifications are delivered through your browser's own push service (for example, one operated by Apple, Google, or Mozilla, depending on your browser), and the notification content is encrypted so that only your device can read it. You can turn notifications off at any time in your browser or device settings.
• Browser Extension: If you install our optional browser extension, it collects only the merchant identity and, where shown at checkout, the order total from the cart and checkout pages you visit, in order to recommend a card, and it stores your extension settings locally in your browser. It reuses your existing cardmatchly.com session and does not monitor your general browsing. Section 12 sets out in full what the extension reads, sends, and stores.

2. Purposes of Collection and Use

Under the PDPA, we collect, use, and disclose your personal data only for purposes that a reasonable person would consider appropriate in the circumstances. Your data is used strictly to:

• Facilitate secure user authentication and account management via Kinde.
• Process AI agent requests submitted via Telegram and deliver location-aware recommendations where you choose to share your location.
• Identify the spending category of merchants you ask about, using Google Places and, where inconclusive, Tavily.
• Process payments and prevent fraudulent transactions via Stripe.
• Power the AI agent's conversational memory and logic via Upstash.
• Store and sync your saved credit card selections across devices via Upstash.
• Track spending you log against your cards' bonus caps and surface cap-reset reminders and alternative-card suggestions, via Upstash.
• Automatically log recurring payments you have set up on their due dates, via Upstash.
• For Pro members, generate card recommendations from your saved cards, your logged spending, and the spending categories you tell us matter most to you, showing which cards would earn more in the categories where your wallet is weakest.
• Improve merchant categorization for all users using the category corrections and flags users submit.
• Operate our referral program and credit referral bonuses, via Upstash.
• Deliver optional recaps and reviews (for example monthly summaries and longer quarterly or annual reviews), together with bonus-cap alerts, through the Telegram bot.
• Analyse aggregated AI agent usage patterns and product events via PostHog to operate and improve the Service, and, subject to your consent, analyse website usage and diagnose errors in your browser via Google Analytics and PostHog.
• Distribute optional product updates or marketing communications via Kit.
• Deliver optional bonus-cap and reminder alerts to your device through browser (web push) notifications, where you have opted in.
• Generate card recommendations at the point of checkout through our optional browser extension, using the merchant identity and order total read from the relevant checkout page, where you have chosen to install it.
• Register our domain and manage DNS via Cloudflare.
• Host and serve the application securely via Vercel.

We will not use your personal data for any purpose beyond those stated above without first notifying you and, where required, obtaining your consent.

3. AI Data Processing (Google Gemini)

We use the Google Gemini API to power our AI features. To identify the spending category of a merchant, the Service queries the Google Places API and, where that is inconclusive, Tavily. Your prompts are transmitted to Google for processing. A merchant name derived from your query may be transmitted to Google Places and Tavily solely for classification; a photo you send via the Telegram bot is transmitted to Google Gemini to read the merchant name; and coordinates you share via Telegram are transmitted to Google Places to identify the nearby merchant. When using the Telegram bot, your messages pass through Telegram's infrastructure before reaching our Service and Google's API.

• Data Handling: Your prompts are transmitted to Google for processing. As we use the Paid Tier of the Gemini API, Google does not use your data to train its foundational models.
• Storage: Conversation history (up to your last 10 exchanges) is cached in Upstash and is accessible solely through your authenticated account.
• Merchant Classification: When you query a merchant by name, photo, or location, the merchant name or coordinates may be transmitted to Google Places and, as a fallback, Tavily, solely to identify the merchant's spending category. No payment information, card details, or account data is transmitted. AI-generated outputs may still be inaccurate, incomplete, or misinterpreted by the model.
• Overseas Transfer: By using the AI features, your prompts are transferred to Google's servers, which may be located outside Singapore. We have ensured comparable protection through Google's Data Processing Addendum. See Section 5 for more details.
• Public Leaderboard: We may publish a monthly leaderboard of notable card earn rates derived from questions asked across the Service. Entries comprise only a card, a merchant, and an earn rate, and contain no name, account, or other identifier. A merchant is only published once several different users have asked about it; to count them, we keep a list of the account IDs that asked about each merchant for about 45 days, and this list is never published.

4. Data Retention

In accordance with the PDPA's retention limitation obligation, we retain your personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required or permitted by applicable law.

• Account data (name, email) is retained for as long as your account remains active, and deleted within 30 days of a verified account deletion request.
• AI conversation history is a rolling cache of up to your last 10 exchanges and is automatically overwritten as new interactions occur.
• Saved Cards are retained in Upstash for as long as your account is active and deleted within 30 days of a verified account deletion request.
• Logged spending (the individual amounts and merchant notes you record, and the running bonus-cap counters they feed) is not kept indefinitely. It expires automatically on a rolling basis, with no action needed on your part: for a monthly bonus cap, within about three months of your most recent activity in that billing cycle; for a quarterly, yearly, or promotional cap, about 45 days after that cap's period ends (up to about 13 months for a yearly cap). The aggregated monthly totals we derive from it (such as per-category spend and estimated miles, used to power your monthly and year-over-year recaps and card recommendations) are coarse category-level figures, not itemised transactions, and expire automatically after about 15 months. All of it is also deleted within 30 days of a verified account deletion request.
• Card-tracking settings (your redemption goals, statement day, and category and cap selections) are retained while your account is active and deleted within 30 days of a verified account deletion request.
• Recap metrics (coarse monthly figures such as the number of questions you asked and your most-used cards, used to build your monthly, quarterly, and annual reviews) are retained for about 15 months, after which they expire automatically, and are deleted within 30 days of a verified account deletion request.
• Recurring payments (the schedules you set up) are retained until you remove them or they reach the end date you chose, and are deleted within 30 days of a verified account deletion request.
• Category corrections (your vote on a merchant's category) are retained for up to 180 days, or until the correction is reviewed or applied, and are deleted within 30 days of a verified account deletion request. Flags that an answer's cards were wrong for a shop are not linked to your account and expire after about 60 days.
• Seen cap alerts (which bonus-cap alerts you have already viewed) expire automatically after 120 days and are deleted within 30 days of a verified account deletion request.
• Leaderboard asker lists (used only to count how many different users asked about a merchant) expire automatically after about 45 days, and your account ID is removed from them within 30 days of a verified account deletion request.
• Referral data (your code, referral associations, bonus balance, and join count) is retained while your account is active and deleted within 30 days of a verified account deletion request.
• Push notification subscriptions are retained while your account is active and, absent renewal through continued use, expire automatically after 180 days. They are removed as soon as you disable notifications or your browser invalidates the subscription, and are deleted within 30 days of a verified account deletion request.
• Browser extension data comprising the merchant and transaction-amount queries submitted through the extension is processed on the same basis as your other AI interactions (see AI conversation history above) and is not separately retained. Your extension preferences and per-site settings persist in your browser's local storage until you modify them or uninstall the extension, and are not stored on our servers.
• Telegram account links (chat ID to account mapping) are retained for as long as your account is active and deleted within 30 days of a verified account deletion request. Your account deletion also removes all associated Telegram keys from our systems.
• Telegram location data is cached temporarily for up to one hour and deleted automatically after your question is answered or the cache expires, whichever comes first.
• Billing records may be retained by Stripe for longer periods as required by financial regulations; we retain only non-sensitive transaction references.

5. Overseas Transfer of Personal Data

Our service providers are located outside Singapore. Under the PDPA's transfer limitation obligation, we take steps to ensure that your personal data transferred overseas is protected to a standard comparable to the PDPA. We achieve this through:

• Contractual data processing agreements (DPAs) with each sub-processor.
• Using processors who are certified under internationally recognized frameworks (e.g. Google, Stripe, Cloudflare, and Vercel maintain ISO 27001 or SOC 2 certifications).

The countries or regions where your data may be processed include the United States and the European Union, depending on the sub-processor.

6. Third-Party Processors

We disclose personal data to the following infrastructure providers solely to facilitate our Service. Each processor is bound by contractual obligations to protect your data:

• Cloudflare: Domain registration and DNS management. Cloudflare does not proxy visitor traffic to the Service.
• Vercel: Application hosting and serving.
• GitHub: Source code management (no user personal data stored).
• Kinde: User identity and authentication management.
• Stripe: Financial transaction processing.
• Upstash: AI conversation caching and saved card storage, linked to your authenticated account.
• Google: AI processing (Gemini API), merchant and location lookup (Places API), and photo-based merchant recognition (Gemini).
• Google Analytics: Website usage analytics, loaded only where you have consented to analytics cookies.
• Google Ads: Advertising measurement and conversion tracking, loaded only where you have consented to Allow All.
• Tavily: Fallback merchant-classification service used where Google Places is inconclusive. Only merchant names are transmitted; no account or payment data is shared.
• Telegram: Messaging platform used to deliver AI agent access via bot interface. Messages sent via Telegram are transmitted to Telegram's servers before reaching our Service. Telegram's own Privacy Policy applies to data processed on their platform.
• PostHog: Product-usage analytics, website usage analytics, and client-side error diagnostics.
• Kit: Optional email marketing and communications.
• Browser Push Services (for example, Apple Push Notification service, Google FCM, and Mozilla autopush): Deliver web push notifications you have opted into. They relay only your browser's push endpoint and the encrypted notification payload; they cannot read its content and receive no account or card data.

7. Your Rights Under the PDPA

Under the Personal Data Protection Act 2012 (Singapore), you have the right to:

• Access your personal data: Request a copy of the personal data we hold about you.
• Correct your personal data: Request that we correct any inaccurate or incomplete personal data we hold about you.
• Withdraw consent: Withdraw consent for collection, use, or disclosure of your personal data at any time, subject to legal and contractual restrictions. Note that withdrawal may affect our ability to provide the Service to you.
• Data portability: Where technically feasible, request that we transmit your personal data to another organization in a commonly used machine-readable format (applicable under PDPA Amendment 2021).

To exercise any of the above rights, email our Data Protection Officer at hello@cardmatchly.com. We will acknowledge your request within 5 business days and respond substantively within 30 calendar days in accordance with the PDPA.

8. Rights of International Users

In addition to your rights under the PDPA (Section 7), users in certain jurisdictions have additional rights under their local laws. We honor these rights for all eligible users regardless of where our business is based.

Canada (PIPEDA & Quebec Law 25)

If you are located in Canada, your personal data is handled in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25). You have the right to:

• Access and correct personal data we hold about you.
• Withdraw consent at any time, subject to legal or contractual restrictions.
• Quebec users: Request deletion of your personal data and request that we cease disseminating it, in accordance with Law 25.
• Lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca, or with the Quebec Commission d'accès à l'information (CAI) for Quebec-specific matters.

United States (CCPA, California)

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA). Note that these rights typically apply to businesses above certain revenue or data-volume thresholds; as a small operator, we may not currently meet those thresholds. However, we extend these rights to California users as a matter of good practice:

• Right to know: Request disclosure of the categories and specific pieces of personal data we have collected about you.
• Right to delete: Request deletion of personal data we have collected, subject to certain exceptions.
• Right to opt out of sale: We do not sell or share your personal data with third parties for their own marketing purposes.
• Right to non-discrimination: We will not discriminate against you for exercising any of these rights.

Residents of other US states with active privacy laws (Virginia, Colorado, Connecticut, Texas, etc.) may have similar rights. We will endeavor to honor equivalent requests on a good-faith basis.

9. Data Protection Officer

In accordance with the PDPA, CardMatchly has designated a Data Protection Officer (DPO) responsible for ensuring compliance with our data protection obligations. You may contact our DPO for any queries or concerns regarding the handling of your personal data:

• Email: hello@cardmatchly.com
• Subject line: "PDPA Data Protection Query"

If you are not satisfied with our response, you may contact the Personal Data Protection Commission (PDPC) of Singapore at www.pdpc.gov.sg.

10. Security Practices

We implement industry-standard security measures to protect your personal data, including SSL/TLS encryption for all data in transit, secure environment variables for all third-party API credentials, and access controls limiting data access to authorised personnel only. We do not store sensitive payment information on our own infrastructure.

11. Cookies and Session Storage

We use a limited set of cookies and on-device storage. On your first visit, a consent banner allows you to choose between Essential Only and Allow All; you may revise this choice at any time via Privacy Preferences in the profile menu.

• Session Cookies (Kinde & Stripe): Maintain your authenticated session and facilitate payment processing.
• Analytics Cookies (Google Analytics & PostHog): Measure site usage and diagnose errors. These are set only where you select Allow All, and never where you select Essential Only. Your cookie choice does not affect the server-side usage events described in Section 1.
• Advertising Cookies (Google Ads): Measure the effectiveness of our advertising. Like analytics cookies, these are set only where you select Allow All, and never where you select Essential Only.

We additionally use a small amount of browser local storage for on-device conveniences, namely your consent choice, your light or dark theme preference, and the last few merchants you have asked about (used solely to personalize prompt suggestions on your device). This information remains on your device. Your account data and saved cards are never held in local storage; they are stored server-side in Upstash and linked to your authenticated account.

12. Browser Extension

We offer an optional CardMatchly browser extension for Chrome and other Chromium-based browsers (such as Edge, Brave, Arc, and Opera). It brings your best-card recommendation onto the page you are shopping on, so you do not have to open cardmatchly.com in a separate tab. Installing and using it is entirely optional, and it is designed to collect no more than the web app already does.

• Sign-in reuse (no separate login): The extension does not create its own account or ask for your password. It reuses your existing cardmatchly.com session: when it contacts our Service on your behalf, your normal sign-in cookie is included, exactly as if you had opened cardmatchly.com yourself. We do not issue, store, or handle any separate access token.
• What it reads from a page: To recognize the shop you are on, the extension reads the web address (URL) and title of your current tab and derives a merchant name from it (for example, "Amazon" from amazon.sg). To decide whether a page is a cart or checkout page, it checks whether typical payment fields are present. It checks only for the presence of such fields; it does not read, collect, or transmit anything you type into them, including card numbers, security codes, passwords, or any other form input. It does not read the general content of the pages you visit, and it never runs on cardmatchly.com pages themselves.
• What is sent to our Service: When you view a recommendation, the extension sends the derived merchant name, the domain of the shop’s website (for example “amazon.sg”), the shop’s own publicly-declared name and business type where the page provides them in its metadata (for example a site name of “Shaw Theatres” or a type of “MovieTheater”), and your device’s time zone (used only to look up an in-person merchant in your own market), so the shop is identified accurately and looked up in the right country. Where it is shown at checkout, it also sends the order total and currency it reads from the page. This is the same information as if you had typed that shop and amount into the web app, and it is processed as described elsewhere in this policy (Sections 2 and 3), including merchant classification. The website domain and metadata are sent only for the shop detected on the page you are viewing, never for a shop you type in yourself. We do not send the page title, the page’s body content, anything you type into a form, or your browsing history. A question asked through the extension counts toward the same prompt allowance and appears in the same conversation history as the web app.
• On-device storage: The extension stores a small amount of data locally in your browser using the browser's extension storage: your extension settings (whether the on-page card is shown, and whether it reveals automatically), a short-lived cache of recent answers so a repeat visit does not use another question, and per-site preferences such as where you positioned the card or whether you dismissed it. This information stays on your device, is not transmitted to us, and is removed when you uninstall the extension or clear your browser's data for it.
• Permissions: The extension requests access to cardmatchly.com (so it can reach our Service with your session), access to your current tab when you interact with the extension, and local storage for the settings and cache above. It does not request broad permission to read or change data on the other websites you visit beyond the checkout detection described here.
• Removal: You can remove the extension at any time from your browser's extensions page, which also deletes its on-device storage. Any data held server-side under your account continues to be governed by the rest of this policy and can be deleted as described in Sections 4 and 7.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last Updated" date. Your continued use of the Service after such changes constitutes your acknowledgment of the updated policy.