pap! procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| Data retention | All applicable tiers | unknown | “The information can always be stored for a longer period in anonymised form.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ - Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our Terms of Use and/or comply with applicable legal requirements. We may also retain information in anonymised form.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “We will keep your personal information for as long as it is necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than three (3) months past the termination of the user's account or three (3) months after you withdraw consent to access your emails. Accessing your emails is thus necessary to provide the Services..” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “Documentation of your marketing consent is kept for 2 years from the time you have withdrawn your consent to receive direct marketing material.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “Information relating to accounting material is kept for 5 years from the end of the financial year to which the data relate.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “- In connection with a change of ownership or control of all or part of our business (such as a merger, acquisition, reorganization, or bankruptcy).” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “- If we have a good-faith belief that access, use, preservation, or disclosure of such information is reasonably necessary to detect or protect against fraud or security issues.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “- With vendors and service providers that support our core business functions and internal operations, which may include:some text” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “- To support our audit, compliance, and corporate governance functions.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “We shared personal information under the following circumstances;” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “We share personal information in limited circumstances, as described below. In all circumstances, this does not include user-specific email activity from connected inboxes.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “- If required or permitted by applicable law or regulation, including laws and regulations of the United States and other countries, or in the good faith belief that such action is necessary to: (a) comply with a legal obligation or in response to a request from law enforcement or other public authorities wherever Company may do business; (b) protect and defend the rights or property of Company; (c) investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person and illegal activities; or (d) enforce our Terms of Service or otherwise protect against any legal liability.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “- When we contact companies on your behalf to secure your refunds, such companies already have access to your personal data since you initially made a purchase from them. Sharing of your personal data with these companies is necessary in order to fulfill the Services.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “- With third parties that we have partnered with, such as to jointly create and offer a product, service or joint promotion.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ - payment processors, and application services providers.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “Certain distribution options are provided by licensed money transmitters authorized by us to operate in connection with the Services (e.g., PayPal, Inc.) (“Authorized Money Transmitters”) and are subject to additional terms and conditions associated with your account with such Authorized Money Transmitters (the “Payment Provider Terms”). When you elect to distribute Rewards through an Authorized Money Transmitter, you further agree (i) that pap! is acting as your agent with respect to the payment processing, and (ii) that you are bound by the applicable Payment Provider Terms made available by that Authorized Money Transmitter, as such Payment Provider Terms may be modified by the Authorized Money Transmitter from time to time.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “- Payment Data: We may process data you provide that is necessary to process your payment if you make purchases, such as your credit card number. All payment data is stored by Stripe and is not stored on our end. You may find their privacy notice link(s) here: https://stripe.com/privacy.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “In order to enhance our ability to better identify products, offers and services that you may be interested in, we may obtain information about you from other sources, such as affiliate networks, public databases, joint marketing partners, data providers, social media platforms, market research providers as well as from other third parties. This information includes transactions, advertising or promotions engagements, mailing addresses, job titles, email addresses, phone numbers, intent data (or user behavior data), Internet Protocol (IP) addresses, social media profiles, social media URLs and custom profiles.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “- With your consent or at your direction.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “- When we work with partners to send you rewards, they can only interact with anonymized data via pap!’s interface” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “The Services contains advertisements from third parties that are not affiliated with us and which link to other websites, online services or mobile applications. We cannot guarantee the safety and privacy of data you provide to any third parties. Any data collected by third parties is not covered by this privacy notice. We are not responsible for the content or privacy and security practices and policies of any third parties, including other websites, services or applications that may be linked to or from the Services. You should review the policies of such third parties and contact them directly to respond to your questions.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “Your information is limited to Google Cloud Platform services like Firestore, BigQuery, and Firebase Storage. Our server also runs on Google Cloud Platform so no information ever leaves the GCP pipeline from a computing perspective.” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.