Data and Security
At Upside, we keep your data safe so you can feel confident about using our products. We only collect what we need to, and we never sell your data.
What do we collect?
Upside uses data to personalize and improve cash back promotions and verify transactions with participating retailers. We minimize the data we collect and anonymize information wherever we can.
We use your location to match you with nearby offers and transactions you made at participating retailers.
We collect only the first six and last four digits of your debit or credit card for personalization and verification purposes with participating retailers. Our third-party card processing partners collect your full card number (PAN) and help us verify your credit card details.
We use your email address as a unique identifier for your account, as well as to communicate with you about processing activity, status updates, promotions, and support.
Information like the total amount you spend allows us to provide you with cash back offers and personalize your offers in the future.
We work with participating retailers who share price and transaction data with us, which helps us match your claimed offers with your transactions.
Upside only collects information that is required for the program to work. We never sell retailer or consumer data.
Security measures at Upside
We regularly audit our app, conduct employee background checks, and assess third-party partners to ensure the confidentiality, integrity, and availability of our platform.
Upside takes these measures seriously and continuously strives to ensure the highest level of security and protection.
ISO/IEC27001
Certified through the international standard on managing information security. Upside has identified and implemented key controls to ensure confidentiality, integrity, and availability of data and process.
Cryptography
Upside requires all data to be encrypted at rest and in transit using AES-256 and TLS 1.2 minimums.
Access Controls
At Upside, employees and contractors are granted access based on need-to-know and least privilege. Requiring multi-factor authentication. All account activity is logged, monitored and reviewed.
Emergency
Incident response, disaster recovery, and business continuity plans are documented and tested on a regular basis at Upside.
