Datenschutzerklärung

Wynnest is a cashback service operated by Wynnest, a company established in Hong Kong SAR. When you use wynnest.com we decide how and why your personal data is processed, which makes us the data controller for that processing.

For anything in this policy, write to support@wynnest.com.

Only what the service needs to work and to pay you:

• Account details — your email address, the currency you chose, your language, and a password we never store in readable form (it is hashed with Argon2id, a one-way function; we cannot recover it, and neither can anyone who steals the database).
• Shopping activity — which store you clicked through to, when, the cashback rate you were promised at that moment, and the orders retailers report back to us. This is the record of what we owe you, so we cannot operate without it.
• Technical data — a first-party cookie holding a random visitor identifier, your browser’s user agent, and your approximate country. We do not store your IP address: it is passed through a keyed hash on arrival and only the hash is kept, which lets us spot one person opening fifty accounts without letting us — or an attacker — reconstruct where you connected from.
• Payout details — the PayPal address or bank account you ask us to send money to. These are encrypted (AES-256-GCM) and only an obscured hint such as j***@gmail.com is shown back in the interface.
• Support messages — what you send us, so we can answer it.

We do not ask for your name, date of birth, address or any identity document to open an account. If a specific payout method or an anti-fraud check ever requires more, we will ask for it at that point and explain why.

• To perform our contract with you — creating your account, tracking your purchases, calculating cashback and paying it out. Without this data there is no service.
• Our legitimate interests — preventing fraud and self-referral abuse, securing accounts, reconciling what affiliate networks report against what we paid, and improving the site. We have weighed these against your interests and use the least identifying data that works, which is why IP addresses are hashed.
• Your consent — marketing email, which you can withdraw at any time from any message we send. Withdrawing it never affects your balance or your ability to withdraw money.
• Legal obligation — accounting and tax records relating to payments we have made.

This is the part of a cashback site people most want explained, so here it is in full. When you click a store on Wynnest we generate a random identifier for that click, store it against your account on our side, and hand only that identifier to the affiliate network as we forward you to the retailer.

The network and the retailer therefore receive a meaningless string — not your email address, not your name, not your Wynnest account. When your order is confirmed they report it back quoting that same identifier, and we match it to you. The retailer knows it made a sale through Wynnest; it does not learn that the buyer holds a Wynnest account, and we do not sell or rent your data to them or to anyone else.

Once you land on the retailer’s own site you are on their property and their privacy policy applies to everything you do there, including the cookies they and their affiliate network set. We have no control over, and no visibility into, what you browse or buy beyond the order totals reported back to us for commission.

We use first-party cookies only, and only for things the site cannot do without:

• A session cookie so you stay signed in. It holds a random token; the database stores only a hash of it.
• A visitor cookie holding a random identifier, so that if you click a store before signing up and register afterwards, the cashback you already earned still finds your account.

We do not run third-party advertising or analytics cookies on wynnest.com.

We share the minimum necessary, and never for anyone else’s marketing:

• Affiliate networks — the anonymous click identifier described above.
• Payment providers — the destination and amount needed to send your withdrawal.
• Infrastructure and email providers — who host the service and deliver messages such as your verification code, under contracts that permit them to act only on our instructions.
• Authorities — where we are legally required to, or to establish or defend legal claims.

We operate from Hong Kong SAR and serve members in the United States and Europe, so your data is transferred outside your own country as a matter of course. Where we move personal data out of the European Economic Area or the United Kingdom we rely on the European Commission’s Standard Contractual Clauses, together with the technical measures described in this policy — encryption in transit, encrypted payout details, and hashed identifiers rather than raw ones.

• Account and transaction records: for as long as your account is open, and afterwards for as long as tax and accounting law requires us to keep records of payments made to you.
• Click records: until the retailer’s reporting window has closed and the order can no longer be disputed, after which they are only aggregate figures.
• Support messages: two years.
• Closed accounts: deleted or irreversibly anonymised once no open balance, payment or dispute remains.

If you are in the European Economic Area or the United Kingdom, the GDPR gives you the right to access your data, correct it, have it erased, restrict or object to how we use it, receive it in a portable form, and withdraw any consent you gave. If you are a California resident, you have the right to know what we collect, to request deletion, and not to be discriminated against for exercising those rights — and we note plainly that we do not sell or share personal information as those terms are defined by the CCPA.

Write to support@wynnest.com and we will respond within one month. You can also complain to your local data protection authority, though we would rather you gave us the chance to put it right first.

One honest limit: we cannot erase the record of a payment we have already made to you, because we are required to keep it. Everything else can go.

Passwords are hashed with Argon2id, session tokens are stored only as hashes, payout destinations are encrypted with AES-256-GCM, and IP addresses are reduced to keyed hashes before they are written down. No service can promise perfect security, but a breach of our database should not hand anybody your password, your session, or your bank details.

Wynnest is not for people under 18. We do not knowingly collect data from children, and we delete any account we discover belongs to one.

If we change how we handle your data in a way that matters, we will email you before it takes effect rather than quietly updating the date at the top of this page. See also our Nutzungsbedingungen.