This Privacy Policy (“Privacy Policy”) explains how Ibotta, Inc. (“Ibotta,” “us,” “our,” and “we”), collects, uses, and shares information when you interact with us. This Privacy Policy applies to all users of Ibotta’s mobile device applications, Ibotta’s website as published at www.ibotta.com , Ibotta’s browser extension, and any other sites or applications that are branded “Ibotta” and link to or reference this Privacy Policy (collectively, the “Services”).
Please read this Privacy Policy carefully. This Privacy Policy replaces and supersedes the last version of this Privacy Policy for all users (including users who registered before January 3, 2023). If you do not agree to the terms in this Privacy Policy, please do not register, subscribe, create an account, or otherwise interact with the Services. By signing up for, using, or continuing to use the Services, you consent to the practices described in this policy.
This Privacy Policy is incorporated into and is subject to the Ibotta Terms of Use. Capitalized terms that are not defined in the Privacy Policy have the meaning given to them in the Terms of Use.
We may ask you to provide information when you register, subscribe, create an account for our Services, link your Ibotta account to a retail loyalty program, contact Ibotta for customer service purposes, or otherwise interact with or use the Services. We may collect certain types of information, including information that can be used to identify you, such as your name, email address, mailing address, phone number, date of birth, geographic location, and mobile device data (as described below), as well as information that does not identify you personally. We may collect the following types of information:
We collect many different types of information from cookies and other technologies. For example, we may collect and record information from the devices you use to access our Services, such as your IP address, operating system type or mobile device model, mobile device identifiers, browser type, domain, and other system settings, as well as the language your system uses and the country and time zone of your device. We may also collect information about the website you were visiting before you came to our Services and the website you visit after you leave our Services.
In many cases, the information we collect using cookies and other tools is used in non-identifiable ways, without any reference to your identity. For example, we use information we collect about users to optimize our Services and understand its traffic and usage patterns. In other cases, we associate the information we collect using cookies and related technologies with information that identifies you. In that case, this Privacy Policy governs how we use that information. Additionally, if you have visited our mobile website or activated one of our mobile-device applications, and if the settings on your location-aware device allow us to receive Location Information, we will collect that automatically. If we associate Location Information with other information that identifies you, this Privacy Policy governs how we would use that information, too.
Please review your web browser’s “Help” file to learn the proper way to modify your cookie settings if you wish to do so. However, please be aware that if you delete, or choose not to accept, cookies from our Services, you may not be able to utilize the features of our Services to their fullest potential.
Finally, please scroll down to the “Your Choices” section below, under the heading “cookies,” for more information about your cookie-related privacy options.
You use Ibotta as your shopping companion, and we and our partners will use the information we collect from and about you in many ways to help you shop and save money. This includes shopping-related services, advertising, and marketing that may be of particular interest to you. Ibotta and our partners use information to:
In addition to the foregoing, we may aggregate or anonymize information in de-identified OR aggregated form and use it for any purpose.
Retailer and Product Manufacturer Partners. We work with various partners so they can provide shopping-related services, promotions, advertising, and marketing to you when you use our Services. To facilitate these activities, we may share information about you with our partners. You may be able to adjust how we share information by changing options within the Services (please see “Your Choices” below). We encourage Ibotta's retailer and product manufacturer partners to adopt and post their privacy policies. When you choose to interact with an Ibotta merchant or business partner, we encourage you to read any privacy policy they may have posted.
Other Third Parties. Ibotta shares information with other third parties. Third parties Ibotta shares information with may engage in Online Behavioral Advertising and the collection of Multi-Site Data as defined by the Digital Advertising Alliance. Please see Sections 4 and 8 for more information about these third parties and the information Ibotta shares with them.
Merger, Sale, or Other Asset Transfers. We may share your information to effect a corporate transaction involving Ibotta, including a merger, acquisition, or otherwise, and to support the sale or transfer of our business assets.
As Required by Law, to Enforce Laws and Similar Disclosures. We may disclose your information, including information that identifies you, to defend ourselves in litigation or a regulatory action; when required or advised to do so by law, such as in response to a subpoena, or similar legal process, including to law enforcement agencies, regulators, and courts in the United States and other countries where we operate; to enforce our rights or protect our property; to protect the rights, property or safety of others, investigate fraud, or respond to a government request; or as needed to support auditing and legal compliance functions.
Analytics. We use third-party services (such as Google Analytics, AppsFlyer, Heap and Singular) to help us understand how visitors interact with our Services and to help improve our user experience. Google provides additional privacy options regarding cookie use described at www.google.com/policies/privacy/partners/; AppsFlyer’s privacy options are provided at https://www.appsflyer.com/legal/cookie-policy/; Heap's privacy options are provided at https://heap.io/privacy; and Singular’s privacy options are described at https://www.singular.net/privacy-policy/. We use other third-party services, such as The Trade Desk, to assist with targeted advertising. The Trade Desk provides additional privacy options described at https://www.thetradedesk.com/us/privacy.
Aggregated and De-Identified Data. Ibotta may also disclose information about you that does not identify you personally. For example, we may provide our merchants, business partners, or other third parties with reports that contain aggregated data, statistical data, and/or anonymized data.
Consent. We may also share your information with your consent.
We think that you benefit from a more personalized experience when we and our partners know more about you and the kinds of offers you like. However, you can limit the information you provide to Ibotta or that Ibotta provides to others, and you can limit the communications that Ibotta sends to you. For further information about your specific rights to any personal information that Ibotta collects about you, please refer to Section 8 – Privacy Notice Regarding “Personal Information.”
Email. You can manage your email preferences by logging into Ibotta's mobile application or website and going to the Notifications section under Settings. You may also manage your email preferences by clicking "unsubscribe" on any email communication we send you. You may choose to subscribe to some types of messages and may choose to unsubscribe from others.
Cookies. You may manage how your browser handles cookies and related technologies by adjusting its privacy and security settings. Please note that if you disable cookies, you may be unable to access some customized features of our Services. You can opt-out of being targeted by certain third-party advertising companies online at https://thenai.org/opt-out/ and http://www.aboutads.info/choices/.
Mobile. Some of the features of the Services may enable Ibotta to access and collect information about your current or past location in order to personalize the Services for you and provide other features of the Services ("Location-based Features"). In order to use Location-based Features, you must give Ibotta permission to use your geo-location through your device. Ibotta may access your geo-location using a variety of means, including GPS, IP address, or cell tower location. You may opt-out of using Location-based Features by going to Settings and turning off the “Nearby Offer Alerts” feature. Alternatively, you may adjust the settings on your mobile device to prevent the sharing of precise Location-based Information. You may also manage how your mobile device or mobile browser handles cookies and related technologies by adjusting your mobile device privacy and security settings. If you choose not to allow Ibotta to use your location information or disable Ibotta's Location-based Features on your device under settings, you will not be able to utilize certain features of the Service.
Connecting through Social Networks or Other Third Parties. You may be able to manage what social networks or other third parties share with Ibotta. Please refer to the privacy settings of the applicable third-party platform or application to determine how you may adjust permissions and manage the interactivity between Ibotta and your third-party account.
Web Push Notifications. At any time, you may opt into or out of web push notifications via the Options button or tab on your browser’s address bar.
Ibotta’s SMS Programs. By providing us with your mobile telephone number, you consent to receive SMS text messages at that number as requested for account verification, authentication, and other purposes related to the Services. You may also receive an SMS from Ibotta if you are invited by another user to join Ibotta. You can stop receiving SMS messages at any time by texting "STOP" to 68316. After you send the SMS message "STOP" to us, we will send you an SMS message to confirm that you have been unsubscribed. After this, you will no longer receive SMS messages from us. For more information, please visit our SMS Terms and Conditions.
Opt Out from Cross-App and Cross-Site Interest-Based Advertising. Some of our advertising partners are members of the Networking Advertising Initiative or the Digital Advertising Alliance. Please visit these organizations’ opt-out pages to learn about how you may opt out of receiving web-based personalized ads from member companies. You can access any settings offered by your mobile operating system to limit ad tracking or install the DAA’s AppChoices app to learn more about how you may opt out of receiving personalized ads in mobile apps.
We use and upgrade certain physical, managerial, and technical safeguards that are designed to improve the integrity and security of your information. However, it is impossible to completely eliminate the chance of data breaches by hackers using illegal techniques.
We do not knowingly collect, maintain, or use information from children under 13 years of age (our Terms of Use require that users be at least 18 years old), and no part of the Services are directed to children. If you learn that a child has provided us with their information in violation of this Privacy Policy, please alert us to the concern at [email protected].
The Services are hosted in the United States and Puerto Rico and are intended only for users located within the United States and Puerto Rico. Ibotta’s Terms of Use restrict use of the Services to the United States and Puerto Rico. If you violate the Terms of Use and use the Services from the European Union or other regions of the world with laws governing data collection and use that may differ from U.S. law, then please note that you are transferring your information outside of those regions to the United States for storage and processing, and by providing your information on the Services you consent to that transfer, storage, and processing.
On January 1, 2020, the California Consumer Privacy Act of 2018 (“CCPA”), became effective. On January 1, 2023, amendments to the CCPA contained in the California Privacy Rights Act of 2020 became effective. The CCPA provides rights to California residents regarding how their data is collected, held, processed, licensed and sold. This data includes California residents’ “Personal Information,” which the CCPA defines as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Subject to certain restrictions, residents of California have the right, among others, to know what of their Personal Information is sold or disclosed to third parties, the right to access their Personal Information that businesses have collected, the right to opt out of the sale or sharing of their Personal Information, the right to limit the use and disclosure of their “Sensitive Personal Information,” the right to correct inaccurate Personal Information, and the right to delete their Personal Information. This Section 8 addresses these rights and requirements. The CCPA only covers California residents and does not extend legal rights to residents of other States.
Users can exercise the rights afforded by the CCPA at https://home.ibotta.com/personal-information-management/. Ibotta will respond to your request(s) within the timeframe required by applicable law.
As of January 1, 2023, the CCPA imposes various duties on companies that collect Personal Information from California residents. They include:
The CCPA defines “Sensitive Personal Information” as a subset of Personal Information. Personal Information is Sensitive Personal Information if it reveals: (a) a consumer’s social security, driver’s license, state identification card, or passport number; (b) a consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (c) a consumer’s precise geolocation; (d) a consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership; (e) the contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication; (f) a consumer’s genetic data. Sensitive Personal Information also includes: (g) the processing of biometric information for the purpose of uniquely identifying a consumer; (h) Personal Information collected and analyzed concerning a consumer’s health; and (i) Personal Information collected and analyzed concerning a consumer’s sex life or sexual orientation.
To exercise any of the rights under the CCPA, please submit a verifiable request to us by visiting https://home.ibotta.com/personal-information-management/. You can select the appropriate link for the right you want to exercise, then log in to your Ibotta account using the username and password that you use to log in to the Ibotta app. Once you are logged in, you can submit a secure request to exercise any of the rights under the CCPA. Only you, or a person authorized to submit a verifiable request on your behalf pursuant to the law of the State in which you live, may make a verifiable request related to your Personal Information.
Ibotta takes data collection and privacy seriously. As such, in an effort to be transparent about Ibotta’s data collection practices, and despite the fact that the CCPA only applies to California residents, all Ibotta users may similarly manage their Personal Information using Ibotta’s personal information management tools. However, this Privacy Policy is not intended to, and does not, give users greater legal rights than are otherwise provided by the laws of each user’s State of residence.
You may choose to opt out of Ibotta selling or sharing your Personal Information to third parties at any time. If you choose to opt out of the selling of your Personal Information, Ibotta will no longer sell your Personal Information to third parties. If you choose to opt out of the sharing of your Personal Information with third parties, Ibotta will no longer share your Personal Information with third parties. You can choose, at any time, to opt back into the sale or sharing (or both) of your Personal Information. To opt out of (or to opt back in to) the selling or sharing of your Personal Information with third parties, please visit the Preference Center in the Ibotta app (under Account Settings) or on the Ibotta website at https://ibotta.com/account/settings/privacy. Once you exercise your right to opt out, we will wait at least twelve (12) months before asking you to reauthorize the sale or sharing of your Personal Information.
You may request access to of the Personal Information that Ibotta has collected about you through your use of the Ibotta Services during the past 12 months. If you choose to request such access, you will receive both an email confirming Ibotta’s receipt of your request, and a follow-up email with the information addressing these questions. Specifically, you may ask Ibotta to tell you: (a) the categories of Personal Information Ibotta has collected about you; (b) the categories of sources from which the Personal Information was collected; (c) the business or commercial purposes for which Ibotta has collected, sold, or shared your Personal Information; (d) the categories of third parties to whom Ibotta has disclosed your Personal Information; and the specific pieces of your Personal Information Ibotta has collected. If you request such access, Ibotta will provide you the information by email in a portable and readily readable format. To request access, please visit the Personal Information management webpage at https://home.ibotta.com/personal-information-management/.
Upon request, Ibotta will tell you about the types of Personal Information that Ibotta has sold to, shared with, or disclosed to third parties during the past 12 months. Specifically, you may request that Ibotta tell you: (a) the categories of Personal Information that Ibotta has collected about you; (b) the categories of your Personal Information that Ibotta has sold to or shared with third parties; (c) the categories of third parties that Ibotta sold your Personal Information to or shared your Personal Information with; (d) the categories of your Personal Information that Ibotta disclosed to third parties for a business purpose; and (e) the categories of third parties to whom Ibotta disclosed your Personal Information. If you request the above information from Ibotta, you will receive both an email confirming Ibotta’s receipt of your request, and a follow-up email with the information addressing these questions. To request this information from Ibotta, please visit the Personal Information Management webpage at https://home.ibotta.com/personal-information-management/.
You may request that Ibotta delete all the Personal Information it has collected from you in the past, subject to certain limited exceptions set forth below. If you request deletion, please know that your user experience within the app will look different and any personalization will be lost. Ibotta will not be able to send you targeted offers for items that may be of interest to you and you may not receive personalized recommendations or emails. Even if you request deletion, Ibotta will retain your account login information so that you may continue to use your account after exercising your right to delete. If you continue to use your account after submitting a request to delete, Ibotta will again begin collecting purchase history and other information and using it in accordance with this privacy policy.
Also, if you request deletion, any cash back rewards that are pending approval in your Ibotta account at the time of deletion will be deleted, and you will lose those pending rewards. In addition, your total lifetime earnings will be reset to the amount of Cash Back rewards in your Ibotta account at the time of deletion. For all intents and purposes, when you request deletion, you will thereafter be treated as a new Ibotta user. You will retain any Cash Back rewards you previously earned and are not pending approval, but all other personalization within the app up to that date may be irrevocably lost. To request deletion, please visit the Personal Information Management webpage at https://home.ibotta.com/personal-information-management/.
We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:
You may request that Ibotta correct inaccurate Personal Information about you, taking into account the nature of the Personal Information and the purposes for which the Personal Information is kept. You may update or correct your Personal Information at any time by visiting your profile’s account setting page. If you have other questions or requests, or if you would like to access or request a correction to any other information that we may have about you, please contact us at [email protected].
Please note that while your changes are reflected promptly in our active user databases, we may retain all information you submit for as long as needed to fulfill a legitimate business need or as required by law, including for transaction backup and archiving, prevention of fraud and abuse, compliance with legal obligations, dispute resolution, enforcing our agreements, and analytics.
If you exercise any of the rights under the CCPA, Ibotta will not discriminate against you for doing so. Ibotta will not: (a) deny you the ability to use the Services; (b) charge you a different price or rate for the Services, including through the use of discounts or other benefits or imposing penalties; (c) provide you a different level or quality of the Services, unless your exercise of rights degrades Ibotta’s ability to deliver the same level or quality of the Services; or (d) suggest to you that you will receive a different price or rate for the Services or a different level or quality of the Services, except where your exercise of rights degrades Ibotta’s ability to deliver the same level or quality of the Services. For instance, Ibotta uses Personal Information to provide its users with unique or differentiated cash back offers or bonuses. If you request deletion of your Personal Information, opt out of sharing of your Personal Information, or request limiting use of your Sensitive Personal Information, that will degrade Ibotta’s ability to provide you with unique or differentiated cash back offers or bonuses.
Ibotta may also offer you certain financial incentives in exchange for your Personal Information that can result in different prices, rates, or quality levels. Such financial incentives will reasonably relate to your Personal Information’s value and contain written terms that describe the program’s material terms. We will ask for your consent to participate in such financial incentive programs, which you may revoke at any time.
California’s “Shine the Light” law (CA Civil Code Section § 1798.83) permits users of our website who are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please send us an electronic message through our website or write us at our address listed on our webpage.
The CCPA requires companies like Ibotta to tell consumers about what categories of Personal Information they have collected from users during the previous 12 months, the categories of sources from which the information is collected, the business or commercial purpose for collecting, selling, or sharing the information, and the categories of third parties to whom the business discloses the information. We have included this information below:
Categories collected: identifiers (name, address, phone number, birth date, email address, IP address, loyalty account information, social media user information); commercial information (shopping & purchase history and information, payment mechanism (EBT usage)); internet or other electronic network activity information (browsing & search history, device ID, mobile advertising ID); geolocation data; inferences drawn from other Personal Information collected by Ibotta to create a profile about the consumer (demographics, shopping preferences); and certain sensitive personal information (precise geolocation data where users opt in and allow Ibotta to access the data from their device, inferred race and ethnicity, and purchases that may be related to a user’s sex life if the receipt or transaction information includes such purchases).
Categories of sources collected from: the Services; your communications with us (such as through the Services, email, and SMS); third parties that perform services on our behalf, and retailers and retailer accounts that you have linked to your Ibotta account.
Business or commercial purposes for collecting, selling, or sharing: providing personalized offers; communicating with users; creating data sets and audiences; auditing related to counting impressions to unique visitors; verifying positioning and quality of ad impressions; helping to ensure security and integrity; debugging to identify and repair errors that impair existing functionality; short-term transient use such as non-personalized advertising shown as part of a user’s current interaction with the business, performing services on behalf of Ibotta (including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions and redemptions, verifying customer information, processing payments, providing analytic services); providing advertising and marketing services; undertaking internal research for technological development and demonstration; undertaking activities to verify or maintain the quality or safety of the Services; improving, upgrading or enhancing the Services; marketing and selling the Services.
Categories of third parties to whom Ibotta discloses Personal Information: product manufacturers (i.e., brands), retailers, advertising and media agencies, financial institutions, data and media platforms, third parties who perform services on Ibotta’s behalf, and as necessary to comply with legal and regulatory requests.
The CCPA also requires companies like Ibotta to tell consumers about what categories of Personal Information they have sold to or shared with third parties and what categories of Personal Information they disclosed to third parties for a business purpose during the preceding 12 months.
Categories sold or shared: identifiers (name where a user elects to link a bank account for ACH deposit, email address, retailer loyalty account); commercial information (shopping & purchase history); internet or other electronic network activity information (device ID, mobile advertising ID); geolocation data; inferences drawn from other Personal Information collected by Ibotta to create a profile about the consumer (demographics, shopping preferences); and certain sensitive personal information (precise geolocation data where users opt in and allow Ibotta to access the data from their device, purchases that may be related to a user’s sex life if the user's receipt or transaction information includes such purchases).
Categories disclosed to third parties for a business purpose: identifiers; commercial information; internet or other electronic network activity information; geolocation data; and inferences drawn from other Personal Information collected by Ibotta to create a profile about the consumer. Under the CCPA, “sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s Personal Information by the business to another business or a third party for monetary or other valuable consideration.
“Share,” “sharing,” or “share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s Personal Information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
We will post and alert you to any adjustments to the Privacy Policy on this page, and the revised version will be effective as described in our Terms of Use.
Please contact us with any questions or comments about this Privacy Policy, your information, our use and disclosure practices, or your consent choices by e-mail at [email protected], or our USPS mailing address:
Ibotta, Inc.
1801 California St., Suite 400
Denver, Colorado 80202
Attn: Legal Department