Tasted Privacy Policy

Last updated: 15 September 2026

Mysite.ai, Inc. (“Tasted”, “we”, “us”) provides the Tasted mobile application, which pays you cashback for eating at restaurants we partner with (the “Service”). This Privacy Policy explains how we collect, use, and share personal information when you use the Service, and the rights you have over it.

Tasted is a rewards app. It is not a bank, and we never hold or move your money.

Personal information we collect

Personal information you provide to us through the Service includes:

Contact data, such as your mobile phone number. Your phone number is how you sign in — we send a one-time code to it — and it is the only account identifier we require.
Profile data, such as the name or nickname you choose to display, a profile photo if you add one, a short bio, your neighbourhood, and your university if you tell us.
Content you create, such as photos of dishes, notes and ratings about a meal, comments, and the places you save.
Receipt images, when you photograph a receipt to claim cashback. A person on our team may review a receipt to check the restaurant, date, and amount.
Financial account data from a bank account you choose to connect. See Bank account connections and Plaid below, which describes this in detail because it is the most sensitive information we handle.
Communications that we exchange with you, for example when you contact support.

Location

With your permission, the Service uses your device’s location while the app is open, to show restaurants and cashback offers near you. We do not track your location in the background, and we do not build a history of where you have been. You can withdraw this permission at any time in your device settings; the app still works, using a default area.

Automatic data collection

We log basic technical information needed to operate and debug the Service, such as your app version, device model and operating system version, and error reports. We use Sentry for error reporting.

Analytics and advertising

We do not use third-party analytics or advertising SDKs in the Tasted app. There is no advertising identifier collection, no cross-app tracking, and no interest-based advertising. We do not sell your personal information.

Sensitive personal information

Some information described here may be considered sensitive under applicable law, including financial account information. We do not use sensitive personal information to infer characteristics about you, and we process it only as described in this Policy.

Bank account connections and Plaid

Connecting a bank account is entirely optional. You can use Tasted and earn cashback by photographing receipts instead. Connecting an account means you do not have to.

We use Plaid

Tasted uses Plaid Inc. (“Plaid”) to connect to your financial institution and to gather data from it. By connecting an account, you grant Tasted the right, power, and authority to act on your behalf to access and transmit your personal and financial information from your relevant financial institution, and you agree to your personal and financial information being transferred, stored, and processed by Plaid in accordance with Plaid’s End User Privacy Policy.

You never give us your bank login

You sign in to your bank through Plaid, or directly on your bank’s own website or app. Tasted never sees, receives, or stores your bank username or password.

What we receive, and what we store

When you connect an account, we store:

Transactions — the amount, the date, the merchant name and description, whether the charge is pending, and the category. Up to 24 months of history, and new transactions as they occur.
Account details — the name of your financial institution, the account type (for example, checking or credit card), and the last two to four digits of the account number, so you can recognise which account you connected.
Account balances, as last reported by your institution.
Account holder information your institution provides, which may include the name, phone number, email address, and postal address on the account. We use this only to confirm the account belongs to you.

Read-only access

Our access is read-only. Tasted cannot move money, make payments, or transfer funds from a connected account, and the Service contains no capability to do so.

Why we need it

To recognise a purchase at a partner restaurant on your statement and pay the cashback you earned, without you having to photograph a receipt. We do not use connected-account data to make credit decisions, and we do not use it for advertising.

Disconnecting

You can disconnect a bank account at any time in the app, under Settings → Bank. When you do, we instruct Plaid to revoke our access and we delete the transactions, account details, and account holder information we obtained from it. You may also revoke access through your financial institution, or through Plaid Portal.

How we use your personal information

We use personal information for the following purposes:

Providing the Service — creating and maintaining your account, showing restaurants near you, publishing what you post, and operating the app.
Calculating and paying cashback — checking that a claimed visit really happened, by reviewing a receipt you submit or by recognising the purchase in a connected account, and crediting your balance.
Preventing fraud and abuse — detecting duplicate or fabricated claims, so that rewards go to people who actually visited.
Support and communication — responding to you, and sending service-related messages such as the status of a claim.
Improving the Service — understanding which features are used and fixing errors.
Compliance and legal — complying with law, enforcing our terms, and protecting our rights and the rights of others.

We share personal information with:

Service providers who process information on our behalf and only on our instructions. These include Plaid (bank connections), Supabase (database and file storage), Vercel (hosting), Google Places (restaurant information), Telnyx (sending your sign-in code), and Sentry (error reporting).
Partner restaurants, in aggregate. A partner is told how many visits and how much spending a campaign produced. We do not give a partner your name, phone number, email address, or your transactions.
Other users, where you choose to publish. Content you post — a dish photo, a note, a comment — is visible to other users alongside your display name and profile photo. Your phone number, connected accounts, and transactions are never visible to other users.
Professional advisors, such as lawyers and accountants, where needed.
Authorities and others, where we believe disclosure is required by law or necessary to protect the rights, safety, or property of any person.
In a business transaction, such as a merger, financing, or sale of assets, in which case this Policy will continue to apply to the transferred information unless you are told otherwise.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

Your privacy rights and choices

Access or update your information. You can review and change your profile in the app, under Settings.

Disconnect a bank account. In the app, under Settings → Bank. We delete the data obtained from that account.

Delete your account. Email support@jointasted.com and we will delete your account and personal information, subject to the retention limits described below.

Depending on where you live, applicable law may give you the right to:

Access a copy of the personal information we hold about you.
Delete personal information we collected from you.
Correct inaccurate personal information.
Opt out of any “sale” or “sharing” of personal information. As stated above, we do not sell or share personal information for advertising, so there is nothing to opt out of.

To exercise these rights, email support@jointasted.com or write to us at the address in How to contact us. We may need to verify your identity before acting, for example by confirming the request from the phone number or email address on your account. These rights are not absolute, and we may decline a request where the law permits — for example, information subject to the Gramm-Leach-Bliley Act may be exempt from certain requests.

Notification and marketing messages. You can turn off push notifications in your device settings. If you receive text messages from us, reply STOP to stop receiving further marketing texts. You may continue to receive service-related messages, such as your sign-in code.

How long we keep your information

We keep personal information for as long as needed to provide the Service and for the purposes described in this Policy. In particular:

Connected-account data is deleted when you disconnect the account or delete your account.
Receipt images are kept while a claim is reviewed and for a limited period afterwards, as a record of a payment we made.
Records of cashback paid are retained where we are required to keep financial records.

Security

We use reasonable organisational and technical measures designed to protect personal information, including encryption in transit, access controls, and keeping credentials for connected accounts server-side, never in the app. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children

The Service is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

Other sites and services

The Service may link to websites and services we do not operate, including your financial institution and Plaid. This Policy does not apply to them, and we are not responsible for their practices.

Changes to this Privacy Policy

We may update this Policy. When we do, we will change the “Last updated” date above, and for material changes we will provide additional notice, such as in the app or by email.

How to contact us

Mysite.ai, Inc.
3500 S DuPont Highway
Dover, DE 19901
United States

Email: support@jointasted.com

California privacy notice

This section provides additional information for California residents under the California Consumer Privacy Act (“CCPA”).

In the past 12 months, we have collected the categories of personal information described in Personal information we collect, namely identifiers (such as your phone number), commercial information (such as transactions and claims), financial information from connected accounts, internet or network activity, geolocation data, audio/visual information (photos you submit), and inferences we draw to operate the Service. We collect it from you, from your financial institution via Plaid, and automatically from your device. We use and disclose it for the purposes set out in How we use your personal information and How we share your personal information.

We have not sold personal information, and we have not shared personal information for cross-context behavioural advertising, in the past 12 months. We do not have actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

California residents may exercise the rights described in Your privacy rights and choices, and may designate an authorised agent to make a request on their behalf. We will not discriminate against you for exercising a privacy right.

Note that much of the information we handle is subject to the Gramm-Leach-Bliley Act, and information subject to that Act is exempt from CCPA rights requests. We may therefore decline all or part of a request that relates to exempt information.