Privacy Policy

Purpose of This Privacy Policy

This Privacy Policy explains how Bumili, SIA ("Bumili", "we", "us", or "our") collects, uses, stores, shares and protects personal data when you use our website, account features, cashback service, referral program, wallet features, payout-related features or contact support.

This Privacy Policy should be read together with our Terms of Service, Cashback Policy, Payment Policy, Referral Program Terms, Cookie Policy and other legal documents available on the Service.

Data Controller

The data controller responsible for your personal data is:

Company name: Bumili, SIA
Registration / VAT number: 40203277106
Address: Rīga, Matīsa iela 61A - 17, LV-1009
Email: [email protected]

What Bumili Does

Bumili provides cashback, affiliate tracking, referral, wallet and payout-related services. We help users access merchant offers through tracking links, record eligible cashback transactions, maintain wallet balances and, where available, request payouts from approved cashback.

Bumili is not the seller of merchant products or services. Purchases are made directly with third-party merchants and may be subject to the merchant's own terms and privacy policy.

Personal Data We Collect

Depending on how you use the Service, we may collect the following categories of personal data:

• Account data: email address, password hash or authentication data, account ID, account status, role, registration date and login-related information.
• Optional contact data: phone number if you choose to provide it or if it is needed for account, security, support or payout-related communication.
• Consent and preference data: acceptance of Terms, privacy choices, cookie choices, marketing preferences and communication preferences.
• Cashback data: tracking links, merchant visits, merchant name, offer information, transaction references, order amount, commission amount, cashback amount, currency, cashback status and cashback history.
• Referral data: referral code, referral link, referral attribution, referrer and referred user relationship, referral reward status and referral reward history.
• Wallet and payout-related data: wallet balances, wallet ledger entries, payout requests, payout method selected, payout status, payout-related notes and records needed to process or review payout requests.
• Payment data: payment status, billing information, transaction identifiers, invoices, payment method metadata and fraud-prevention information processed through payment providers such as Stripe. We do not store full payment card numbers or card security codes.
• Analytics data: page views, events, browser information, device information, approximate location, traffic source and usage statistics collected through analytics providers such as Google Analytics where consent is required.
• Technical data: IP address, browser type, device information, operating system, language settings, approximate technical location, access logs, error logs, security logs and usage events.
• Cookie and tracking data: session identifiers, authentication cookies, referral attribution cookies, cookie consent preferences and related technical identifiers.
• Support data: messages you send to us, screenshots, order confirmations, merchant details, complaint details and other information you provide when contacting support.
• Anti-fraud and security data: information needed to detect duplicate accounts, suspicious activity, abuse, fake referrals, unauthorized access, payout abuse or violations of our policies.

Data We Do Not Intentionally Collect

We do not intentionally collect or store full bank card details, card security codes, online banking credentials, government ID documents, delivery addresses, date of birth, gender, Google login data, Facebook login data or merchant account passwords.

Payment providers, payout providers, analytics providers, security providers, affiliate networks and other third-party services may process certain data under their own terms and privacy notices.

How We Collect Personal Data

We may collect personal data in the following ways:

• when you create an account or log in;
• when you update your account information or preferences;
• when you generate or use a tracking link;
• when a merchant or affiliate network reports a transaction or cashback status;
• when you use referral links, referral codes or referral features;
• when wallet, ledger or payout records are created or updated;
• when you contact support or submit a complaint;
• when cookies, server logs or security systems collect technical information;
• when we receive information from service providers, merchants, affiliate networks or other partners needed to operate the Service.

Why We Use Your Personal Data

We use personal data for the following purposes:

• to create, maintain and secure your account;
• to authenticate users and manage login sessions;
• to generate and manage cashback tracking links;
• to connect tracking identifiers with your account;
• to receive, process and reconcile affiliate events, merchant reports and cashback transactions;
• to calculate pending, approved, rejected, cancelled or paid cashback;
• to maintain wallet balances and wallet ledger records;
• to support payout requests where payout features are available;
• to operate referral links, referral attribution and referral rewards;
• to send account, security, cashback, referral, payout and service notifications;
• to send marketing messages where you have consented or where otherwise permitted by law;
• to provide support and respond to complaints or missing cashback requests;
• to detect, prevent and investigate fraud, abuse, duplicate accounts, unauthorized access, self-referrals, spam and policy violations;
• to maintain service reliability, debug errors and improve technical performance;
• to comply with legal, accounting, tax, regulatory and record-keeping obligations;
• to establish, exercise or defend legal claims.

Legal Bases for Processing

We process personal data only where we have a legal basis to do so. Depending on the purpose, we may rely on the following legal bases:

Cashback, Tracking Links and Affiliate Data

When you generate or use a tracking link, we may create a technical identifier, such as a subId or similar reference, to connect merchant or affiliate network reports with your Bumili account.

This identifier is used for cashback attribution, transaction reconciliation, fraud prevention, support and wallet updates. Where possible, we use opaque technical identifiers instead of directly including your name, email address or phone number in tracking links.

Merchants, affiliate networks or tracking partners may receive or return technical information such as tracking identifier, click time, merchant reference, order amount, commission amount, currency, transaction status and transaction reference.

Analytics and Performance Monitoring

We may use analytics and performance tools, including Google Analytics 4, to understand how visitors use the Service, improve user experience, measure traffic and improve functionality.

Analytics providers may process information such as page views, events, browser information, device information, approximate geographic location, traffic source and technical identifiers.

We do not intentionally send email addresses, user IDs, order IDs, referral codes, sub IDs, wallet data, payout data or other sensitive account information to Google Analytics.

Where required by law, analytics technologies are used only after obtaining your consent.

Meta Pixel and Marketing Measurement

Where you give marketing-cookie consent, we may use Meta Pixel (Facebook Pixel) to measure advertising performance and understand non-sensitive cashback shopping activity on Bumili.

Meta Pixel may process limited event information such as page path, language or locale, merchant ID, merchant name, merchant category, cashback percentage where available, page views, merchant page views, search use, registration completion, cashback link clicks and strong cashback intent.

We do not intentionally send email addresses, phone numbers, names, wallet details, payout details, raw user identifiers, order IDs, referral codes, sub IDs or other sensitive account information to Meta Pixel.

Meta Pixel is not loaded before marketing-cookie consent. If you reject or withdraw marketing consent, Bumili does not initialize Meta Pixel and stops firing Meta Pixel events where technically possible.

Cloudflare and Service Security

We use Cloudflare and similar infrastructure providers to improve website performance, security, reliability and protection against abuse, fraud and malicious traffic.

These providers may process technical information such as IP address, browser information, request metadata, region or country information, security events and traffic logs.

This processing is necessary to protect the Service and is based on our legitimate interests in maintaining security, stability and availability.

Stripe and Payment Processing

Where payment functionality is available, payments may be processed by Stripe or other payment service providers.

Payment providers may process personal data such as name, email address, billing information, payment method information, transaction amount, currency, payment status and fraud-prevention information.

Bumili does not store full payment card numbers or card security codes on its own systems.

Cookies and Similar Technologies

We use cookies and similar technologies for login sessions, account security, referral attribution, cookie consent preferences and core Service functionality.

We may use analytics cookies, including Google Analytics cookies, where consent is provided. For users in the European Economic Area and other regions where consent is required, analytics storage is denied by default until a user chooses to accept analytics cookies.

We may use marketing cookies and similar technologies, including Meta Pixel, only where marketing-cookie consent is provided. For users in the European Economic Area and other regions where consent is required, Meta Pixel is not loaded until the user accepts marketing cookies.

We may also use cookies or similar technologies required by payment providers, security providers and infrastructure providers to provide their services.

More information is available in our Cookie Policy.

Marketing Communications

If you give consent, we may send you marketing communications about cashback offers, merchant offers, referral updates, promotions, service news or similar information.

You can withdraw your marketing consent or unsubscribe from marketing communications at any time. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

Even if you unsubscribe from marketing, we may still send necessary service messages, such as account, security, cashback, payout, legal or support-related notifications.

Who We May Share Data With

We may share personal data where necessary with:

• Merchants and affiliate networks: to track transactions, confirm cashback eligibility, reconcile commissions and investigate missing cashback.
• Hosting, infrastructure and database providers: to operate and secure the Service.
• Cloudflare: for security, content delivery, performance optimization and abuse prevention.
• Google Analytics: for website analytics and usage measurement where applicable.
• Meta Pixel / Facebook Pixel: for marketing measurement and advertising performance measurement where marketing-cookie consent is provided.
• Stripe and payment providers: to process payments, billing, refunds and fraud-prevention checks.
• Email or communication providers: to send account, security, support, marketing or service messages.
• Payment or payout providers: if payout functionality is available and a provider is used to process payout-related information.
• Analytics or performance providers: if such tools are introduced and where consent is obtained when required.
• Fraud prevention, security and technical providers: to detect abuse, protect accounts and maintain service security.
• Professional advisers: such as legal, accounting, tax or compliance advisers.
• Authorities or courts: where required by law or necessary to protect our rights, users, partners or the Service.
• Business transfer recipients: if we are involved in a merger, acquisition, restructuring, sale of assets or similar transaction.

We do not sell your personal data.

International Transfers

Some service providers, merchants, affiliate networks or technical partners may be located outside Latvia, the European Union or the European Economic Area.

Where personal data is transferred outside the European Economic Area, we will use appropriate safeguards where required, such as adequacy decisions, standard contractual clauses or other legally recognized transfer mechanisms.

How Long We Keep Personal Data

We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

How We Protect Personal Data

We use appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration or disclosure.

These measures may include access controls, password hashing, authentication controls, logging, database security, network security, backup procedures, restricted administrative access and monitoring for suspicious activity.

No internet-based service can be guaranteed to be completely secure. You are responsible for keeping your login credentials confidential and notifying us if you believe your account has been compromised.

Your Rights

Depending on applicable law, you may have the following rights regarding your personal data:

• Right of access: to request confirmation whether we process your personal data and receive a copy of your data.
• Right to rectification: to request correction of inaccurate or incomplete personal data.
• Right to erasure: to request deletion of your personal data where applicable.
• Right to restriction: to request restriction of processing in certain circumstances.
• Right to object: to object to processing based on legitimate interests or direct marketing.
• Right to data portability: to receive certain data in a structured, commonly used and machine-readable format where applicable.
• Right to withdraw consent: to withdraw consent where processing is based on consent.
• Right to lodge a complaint: to complain to a competent data protection authority.

Some rights may be limited where we need to keep certain data for legal obligations, accounting, fraud prevention, dispute resolution, security, cashback reconciliation, payout records or legal claims.

How to Exercise Your Rights

To exercise your rights or ask questions about personal data, contact us at [email protected].

We may need to verify your identity before responding to your request. We aim to respond within the period required by applicable law.

Account Deletion

You may delete your account yourself by going to your account settings, scrolling to the bottom, and clicking the "Delete User" button followed by confirming your choice.

Requests for account deletion sent via email are not processed due to the risk of fraud.

Once a deletion request is made, your account will be subject to a review period of 30 days, during which time you have the option to cancel the deletion.

If you wish to expedite the deletion process, please contact support at [email protected] and submit a ticket requesting to speed up the account deletion.

Account deletion may remove or deactivate your access to the account, but certain records may be retained where required or permitted by law.

For example, we may retain cashback records, wallet ledger entries, payout records, referral records, consent records, security logs, or support records where necessary for accounting, legal compliance, fraud prevention, dispute resolution, or legitimate business purposes.

Children

The Service is intended for users who are at least 18 years old. We do not knowingly allow children to create accounts or use cashback, referral or payout features.

If we become aware that a person under 18 has created an account, we may close the account and delete or restrict related data where appropriate, unless retention is required for legal, security or fraud prevention reasons.

Third-Party Websites

The Service may contain links to third-party merchant websites, affiliate networks, payment providers or other services. We are not responsible for the privacy practices, content, security or policies of third-party websites or services.

When you visit a merchant website or use a third-party service, their own privacy policy and terms may apply.

Automated Decisions

We may use automated or semi-automated systems to support fraud detection, tracking, cashback status updates, referral checks, payout review, account security and technical monitoring.

Important decisions, such as account restrictions, payout rejection or fraud-related action, may also involve manual review where appropriate.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including when we add new features, payout providers, analytics tools, affiliate partners, cookies, legal requirements or business processes.

The updated version will be posted on the Service with a new "Last updated" date. If changes are material, we may provide additional notice where reasonable or required by law.

Contact Us

If you have questions about this Privacy Policy or how we process personal data, contact us at:

Bumili, SIA
Rīga, Matīsa iela 61A - 17, LV-1009
Email: [email protected]

Supervisory Authority

If you believe that your personal data rights have been violated, you may have the right to lodge a complaint with the competent data protection authority. In Latvia, this is the Data State Inspectorate.

We encourage you to contact us first so we can try to resolve your concern directly.