Privacy Policy

1. Who we are

Rewards Fuel LLC ("RFWIN", "we", "us") provides the RFWIN draw tool at rfwin.uk. We are incorporated in Saint Kitts and Nevis. Privacy questions: info@rewardsfuel.com.

2. Scope

This policy applies to rfwin.uk and its API. By using RFWIN you acknowledge this policy and our Terms. If you do not agree, do not use the Service.

3. What data RFWIN stores

RFWIN is designed to minimise personal data storage. Here is exactly what we store per draw:

Data element	What it is	Visibility
Draw ID	Random slug (e.g. dusty-iguana-7c41f8)	Public
Draw title	Text you provide (optional)	Public
Email hash	SHA-256 of lowercased email — one-way, irreversible	Public
Masked identifier	e.g. s••••j@g•••l.com — first + last chars only	Public
Ticket count	Weighting value for weighted draws	Public
Server seed	Cryptographic random value (64 hex chars)	Public after draw
drand value	Public randomness beacon output	Public
Win hash	Derived hash proving winner selection	Public
Timestamps	Draw creation and execution times	Public

We do not store raw email addresses or full names. Original identifiers are hashed and masked at submission and are not retained in recoverable form.

We also collect standard technical data — IP addresses, browser type, and request logs — for security and abuse prevention. These are not published.

4. The permanent public ledger

All draw records are stored permanently in the RFWIN verification ledger. This is fundamental to the service's cryptographic verifiability. Records cannot be deleted after submission. Draw organisers are responsible for ensuring they have a lawful basis to submit any data about entrants and for complying with all applicable privacy laws (GDPR, CCPA, etc.) before using the Service.

5. How we use information

To operate the draw engine and return verifiable results.
To serve the public verification ledger at /d/:id.
To detect abuse and enforce our Terms.
To respond to support requests.
Aggregated, non-identifiable usage data may be used to improve the Service.

We do not sell personal data. We do not use draw entrant data for advertising.

6. How data is shared

Public ledger. All draw data (as described in section 3) is publicly accessible via the RFWIN website and API.
Service providers. We use third-party infrastructure providers for hosting and our distributed database. Their privacy practices govern their data handling.
Legal and safety. We may disclose information if we believe it necessary to protect rights, property, or safety, or to respond to lawful process — in our sole discretion.
Business transfers. Data may transfer in a merger, acquisition, or asset sale.

7. Data disclaimer — no liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW: THE SERVICE AND ALL DATA HANDLING ARE PROVIDED "AS IS" WITHOUT WARRANTIES OF ANY KIND. WE DO NOT WARRANT THAT DATA WILL BE SECURE, ERROR-FREE, OR FREE FROM UNAUTHORIZED ACCESS, LOSS, OR ALTERATION. WE ARE NOT LIABLE FOR ANY DATA BREACH, LEAK, THEFT, CORRUPTION, DELETION, OR MISUSE — WHETHER CAUSED BY US, YOU, A DRAW ORGANISER, A CONTESTANT, A THIRD PARTY, OR FORCE MAJEURE. DRAW ORGANISERS ARE SOLELY RESPONSIBLE FOR THEIR DRAWS AND FOR ENTRANT DATA COMPLIANCE. YOUR SOLE REMEDY FOR DISSATISFACTION WITH OUR DATA PRACTICES IS TO STOP USING THE SERVICE.

8. Security

RFWIN uses HTTPS, edge security infrastructure, and cryptographic hashing to protect data in transit and at rest. However, we make no representation that any measure is adequate for your purposes or any regulatory regime. You use the Service at your own risk.

9. Cookies and local storage

rfwin.uk uses browser localStorage to remember your theme preference (rfwin-theme) only. No cross-site tracking cookies are set. We do not use advertising cookies.

10. International transfers

Data is processed and stored on a globally distributed edge network, including servers in the United States and European Union. By using RFWIN you consent to such transfers. We do not offer additional safeguards beyond standard infrastructure data processing agreements unless required by mandatory law.

11. Regulatory notices

Laws such as GDPR, CCPA/CPRA, COPPA, and similar regimes may apply to draw organisers. We make no representation that RFWIN satisfies any specific law. Draw organisers are responsible for their own compliance when collecting entrant data for use with this Service. We do not knowingly target or collect data from children under 13.

12. Retention

Draw records on the public ledger are retained permanently by design. Technical logs may be retained for up to 30 days for security purposes. We may retain account data as long as your account is active and for a reasonable period after closure for legal defence purposes.

13. Your rights

Because raw personal data (email addresses, full names) is not stored in recoverable form, many data subject access requests cannot be fulfilled — there is nothing to return or delete at the individual level. If you believe data about you is stored, contact us and we will investigate.

If applicable law grants you rights we are required to honour, contact us at info@rewardsfuel.com. We will respond as required by mandatory law and consistent with our Terms.

14. Changes

We may change this policy at any time by posting an updated version at rfwin.uk/privacy.html. Continued use after changes constitutes acceptance.

15. Contact

Rewards Fuel LLC · Saint Kitts and Nevis
info@rewardsfuel.com