Privacy policy

Effective 24 August 2026

1. Scope

This policy explains how Rebatable.AI Inc. (“Rebatable”, “we”) handles personal information on rebatable.ai and in the Rebatable platform. We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and other privacy laws where they apply to you.

2. What we collect

On the website:

Demo requests. What you enter in the form: first and last name, work email, company, your role, ERP system, annual purchase volume band, rebate program count band, and anything you write in the optional context box.
Scheduling. Booking a time happens through Calendly, which collects the details you give it under its own privacy notice.
Technical basics. Standard server logs — IP address, request time, user agent — used for security and rate limiting. The marketing site sets no advertising trackers and runs no third-party analytics.

In the platform:

Account information — name, work email, and sign-in records, handled through our authentication provider.
Customer business data— rebate terms, vendor statements, ERP transactions, and files your organization loads into the platform. This is your organization’s data, processed to provide the service; incidental personal information inside it (for example a buyer’s name on a transaction) is handled under this policy and our agreement with your organization.

3. Cookies and local storage

The marketing site sets no advertising cookies, does no cross-site tracking, and runs no third-party analytics. The platform uses only what is needed to work:

Sign-in and session. Our authentication provider sets cookies strictly to keep you signed in and to protect your session, and the platform uses functional cookies such as remembering which organization workspace you selected. Blocking them prevents sign-in.
Preferences.Settings such as your theme and workspace layout are kept in your browser’s local storage; a few, like saved table layouts, are stored with your account so they follow you between devices.

Scheduling on the demo page is provided by Calendly, which operates under its own privacy notice. If we ever introduce analytics or advertising technologies, we will update this policy first and, where the law requires it, ask for your consent before they run.

4. How we use it

to respond to your demo request and hold the meeting you book;
to provide, secure, and improve the services;
to power AI features — extraction, forecasting, suggestions — when your organization uses them;
to meet legal obligations.

We do not sell personal information, and we do not send marketing email lists — email from us is a direct response to something you asked for, consistent with Canada’s anti-spam legislation (CASL).

5. Who processes it for us

Service providers process data on our behalf, under contracts, for the purposes above: website hosting and serverless infrastructure (Netlify), authentication (Stack Auth), transactional email (Resend), demo scheduling (Calendly), AI processing (OpenAI, for platform AI features), and Microsoft services where your organization connects them. Some providers process data in the United States; where information leaves Canada we use contractual safeguards, and it remains subject to the laws of those jurisdictions.

6. Retention

Demo-request information is kept while it is useful for the sales conversation and then deleted on request or when no longer needed. Platform data is retained per our agreement with your organization, and made available for export on termination.

7. Your rights

You may ask to access or correct your personal information, withdraw consent (which may limit what we can provide), or ask us to delete demo-request information — write to julian@rebatable.ai. You may also complain to the Office of the Privacy Commissioner of Canada.

8. Security

Data is encrypted in transit; access follows least privilege; a public form that reaches us by email is validated and rate limited. No system is perfectly secure, and we will notify affected parties of a breach as the law requires.

9. Children

The services are business tools and are not directed at anyone under 18.

10. Changes

When this policy changes, the effective date above changes with it, and material changes will be flagged on this page. See also the terms of service.

11. Contact

Privacy questions: julian@rebatable.ai.

2. What we collect

On the website:

Demo requests. What you enter in the form: first and last name, work email, company, your role, ERP system, annual purchase volume band, rebate program count band, and anything you write in the optional context box.

Scheduling. Booking a time happens through Calendly, which collects the details you give it under its own privacy notice.

Technical basics. Standard server logs — IP address, request time, user agent — used for security and rate limiting. The marketing site sets no advertising trackers and runs no third-party analytics.

In the platform:

Account information — name, work email, and sign-in records, handled through our authentication provider.

Customer business data— rebate terms, vendor statements, ERP transactions, and files your organization loads into the platform. This is your organization’s data, processed to provide the service; incidental personal information inside it (for example a buyer’s name on a transaction) is handled under this policy and our agreement with your organization.

3. Cookies and local storage

The marketing site sets no advertising cookies, does no cross-site tracking, and runs no third-party analytics. The platform uses only what is needed to work:

Sign-in and session. Our authentication provider sets cookies strictly to keep you signed in and to protect your session, and the platform uses functional cookies such as remembering which organization workspace you selected. Blocking them prevents sign-in.

Preferences.Settings such as your theme and workspace layout are kept in your browser’s local storage; a few, like saved table layouts, are stored with your account so they follow you between devices.

4. How we use it

to respond to your demo request and hold the meeting you book;

to provide, secure, and improve the services;

to power AI features — extraction, forecasting, suggestions — when your organization uses them;

to meet legal obligations.

5. Who processes it for us