Privacy policy

This is a translation. The Finnish version applies if the two differ.

Last updated: 26 August 2026

1. Who are we?

Rahatakaisin is a cashback service that gives you money back when you shop with our partner stores. The service is operated by Monsen AS (Norwegian company registration number 931 063 499), Inger Bang Lunds vei 5, 5059 Bergen, Norway. Monsen AS is the data controller for the processing of personal data described in this policy. Norway belongs to the European Economic Area (EEA), and the EU General Data Protection Regulation (GDPR) is in force there in the same way as in the European Union. Contact: tuki@rahatakaisin.fi.

2. What data do we collect?

We process the following personal data:

• Account information: name and email address. If you log in with a Google account, we receive the name and the email address from there. We do not ask for your personal identity code.
• Purchase data: information about the purchases you make through our affiliate links: the store, the amount and the time.
• Technical information: IP address, browser, device and operating system, so that the service works and so that we are able to prevent misuse.
• Cookies: we use cookies that are necessary for login and for affiliate link tracking, including a device identifier (the “sb_did” cookie, valid for 180 days).
• Click and account events: when you go through a link to a partner store, we record the time, the partner, the IP address, browser information and the device identifier. The same happens when you register and when you log in. The purpose is to connect purchases to the right account, including cases where you bought before you registered, so that you receive the cashback that belongs to you, as well as to prevent misuse. We keep this data for no longer than 180 days and process it on the basis of legitimate interest (GDPR art. 6(1)(f)).
• Order confirmations in connection with a cashback claim: when you submit a cashback claim, you upload the order confirmation from the store (PDF or image). We use it solely to check your claim, and we delete it automatically no later than 90 days after the claim has been settled.

A payout is made through a Revolut payment link that you complete yourself. We therefore neither collect nor store your account number.

3. Why do we process this data?

• To provide the cashback service and to register your purchases.
• To create and administer your user account.
• To pay out the money you have earned.
• To improve the service and the user experience.
• To meet statutory obligations (accounting and taxation).

4. Legal basis

We process personal data on the following bases: the agreement entered into with you (GDPR art. 6(1)(b)), legitimate interest (GDPR art. 6(1)(f)), consent where consent is required (GDPR art. 6(1)(a)), as well as a statutory obligation where accounting and tax rules require it (GDPR art. 6(1)(c)).

5. Who do we share data with?

• Affiliate networks: Adtraction, Addrevenue, Tradedoubler and others, so that purchases may be registered and confirmed.
• Google: if you choose to log in with Google. The login is handled by Google Ireland Limited, which passes your name and email address on to us. Google is an independent data controller for its own part.
• Payment service provider: Revolut, for paying out the money you have earned.
• Technical service providers: operation, server capacity and email (see section 8).

We never sell your personal data to third parties.

6. Storage and deletion

We keep personal data for as long as you have an active account. If you delete your account, we delete your data within 30 days, apart from data that we are required by law to keep (a maximum of 5 years under the Norwegian Accounting Act, which Monsen AS is obliged to comply with). Click and account events containing IP address and device identifier are deleted automatically after 180 days.

7. Your rights

You have the right to:

• Check what data we hold about you.
• Have incorrect data rectified.
• Have your data erased.
• Transfer your data from one system to another, that is, to take your data with you.
• Object to processing that is based on legitimate interest.
• Withdraw a consent you have given at any time.
• Lodge a complaint with the Office of the Data Protection Ombudsman, which is the Finnish supervisory authority.

8. Where data is processed, and our data processors

Data is processed mainly in Norway as well as in the European Union and the EEA. The exceptions, which mean a transfer of data to a third country, are listed below. Norway is a party to the EEA Agreement and the GDPR is in force there, so a transfer of data to Norway is not a transfer to a third country. We use the following data processors:

• Hostinger: operation of the platform and server capacity (EU/Lithuania)
• Resend: transactional email. Resend is located in the United States, so the email address and the content of the message are transferred there. The transfer is based on the EU-US Data Privacy Framework, and in addition on the European Commission's standard contractual clauses (SCC) as well as supplementary safeguards.
• Revolut: payouts (EU)
• Google Ireland Limited: Google login (EU). Google may in turn transfer data to the United States on the basis of the Data Privacy Framework.

Rahatakaisin for businesses, that is the subscription under which a store sends us the purchase transactions of its customers and we act as data processor, is not yet available in Finland. When it launches, we will conclude a data processing agreement as part of the terms of use.

9. Analytics, marketing and tracking

9.1 Statistics (without cookies)

We measure traffic and use of the service with Plausible Analytics. Plausible does not collect personal data, uses no cookies and does not identify you. No data is transferred outside the EEA.

9.2 Ad tracking (only with your consent)

If you give your consent in our cookie banner, we may activate ad tracking from the following platforms: Meta (Facebook/Instagram), Google Ads, TikTok, Snapchat, Microsoft/Bing, Pinterest, X and Reddit. It allows us to measure and target advertising. The legal basis is consent (GDPR art. 6(1)(a)). These platforms may transfer data to the United States on the basis of the EU-US Data Privacy Framework or the European Commission's standard contractual clauses (SCC). You may change or withdraw your consent at any time by clicking “Cookies” at the bottom of the page. Without consent, none of these are loaded.

See our cookie page for a full overview of cookies and tracking.

9.3 Affiliate link attribution (necessary)

So that we are able to register cashback and credit it to your account, we use affiliate link tracking: when you go through to a partner store via Rahatakaisin, a first-party subId (a pseudonymous identifier) is stored with us and with the affiliate network in question (see section 5). This is necessary for the service to work, and it is processed on the basis of the agreement entered into with you (GDPR art. 6(1)(b)). No third-party advertising cookies are set at this step.

10. Contact us

Questions about privacy? Write to us at tuki@rahatakaisin.fi