Privacy Policy

PointsExplained ("we," "us," or "our") operates the website pointsexplained.com and its country editions. It is an independent credit card comparison site, operated from Canada.

The site publishes editions for 7 countries: Canada, the United States, the United Kingdom, Australia, Brazil, India, and Portugal. This policy applies to every visitor, wherever you are.

For privacy questions, email privacy@pointsexplained.com.

Information you choose to give us

• Email address — only if you subscribe through a newsletter form (in the site footer, the pop-up on guide and news pages, or the referral page). We store the address with a country code, a subscription status, and the dates you subscribed and, if you do, unsubscribed.
• Quiz answers — your spending, goal, credit range and preferences. Your quiz answers are sent to our server to compute your ranking and are not stored in our database. Your browser keeps a copy for the session (see Section 5), and the results page puts them, encoded, in its web address so a result can be reloaded or shared. Anyone you share that link with can see those answers.
• Emails you send us — if you write to one of our addresses, we have your email address and your message.

Information collected automatically

• Approximate country — our host, Vercel, tells our server which country a request comes from, worked out from your IP address. We use it only to choose a country edition, and remember that edition in the pe-country cookie.
• IP address — the quiz and newsletter forms count requests per IP address to stop abuse. The count lives only in the memory of the server that handled the request and is never written to disk or to our database.
• Request logs — like any web host, Vercel records each request (IP address, page, time, browser type) to run and secure the service.

We run no analytics or advertising tools. There is no analytics service, tag manager, advertising pixel or social media tracker on this site.

Information we do NOT collect

• Credit card numbers or financial account details
• Your income, credit score, or credit application
• Government-issued identification
• Precise geolocation (GPS coordinates)
• Social media login information
• Biometric data

We do not sell your personal information, share it for advertising, or use it for automated decisions that have legal or similarly significant effects on you. The quiz ranking is computed automatically, but it is a list of cards to read, not a decision about you.

These are the outside services the site uses, and what each one receives:

When you follow a link to a card issuer's website, you leave PointsExplained and that site's own privacy policy applies. We have no affiliate partnerships, and issuers send us no information about you or any application you make.

The site sets one cookie and keeps a few small items in your browser's storage. None of them is used for analytics or advertising.

Signing in to the private admin area (site operators only) sets Supabase sign-in cookies whose names begin with “sb-”. No reader is ever asked to sign in, so readers never receive them.

For full details, see our Cookie Policy.

Depending on where you live, you have specific rights regarding your personal data. The table below summarizes which rights apply in each jurisdiction:

To exercise any of these rights, email privacy@pointsexplained.com with "Privacy Request" in the subject line. We will respond within the time your applicable law requires (for example, one month under the GDPR, or 45 days under the CCPA).

If you are located in the United Kingdom or the European Union (including Portugal), the UK GDPR, EU GDPR, and ePrivacy Directive apply to your use of PointsExplained.

Legal basis for processing

• Consent (Article 6(1)(a)): newsletter subscription.
• Legitimate interests (Article 6(1)(f)): choosing your country edition, preventing abuse, and the request logs needed to run and secure the site.
• Performance of a contract (Article 6(1)(b)): computing the quiz ranking you ask for.

The one cookie the site sets (pe-country) only remembers the country edition you are reading.

Privacy contact

Requests and questions go to privacy@pointsexplained.com.

Supervisory authorities

• UK: Information Commissioner's Office (ICO) — ico.org.uk
• Portugal: Comissão Nacional de Proteção de Dados (CNPD) — cnpd.pt

Transfers outside the UK and EEA

Some of the providers in Section 4 process data outside the UK and EEA, including in the United States. Each provider's own privacy terms, linked in Section 4, describe the safeguards it applies to those transfers.

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies at the federal level. Provincial privacy laws may also apply:

• Quebec: Act respecting the protection of personal information in the private sector (Law 25), which requires express consent for data collection and a privacy-by-default approach.
• Alberta: Personal Information Protection Act (PIPA Alberta).
• British Columbia: Personal Information Protection Act (PIPA BC).

How the PIPEDA principles apply here

• Identifying purposes and consent: each newsletter form says what it does before you submit an address, and you can unsubscribe or ask for deletion at any time.
• Limiting collection: the site collects only what Section 2 lists.
• Individual access: you can ask what we hold about you and have it corrected or deleted.
• Challenging compliance: contact privacy@pointsexplained.com, or file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.

Quebec Law 25

The site sets no non-essential cookies. Its cookie banner uses an opt-in model for every Canadian visitor, the stricter standard Quebec requires.

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) applies. Other state privacy laws (Virginia CDPA, Colorado CPA, Connecticut CTDPA, etc.) may also apply.

Categories of personal information collected

• Identifiers: email address (only if you subscribe); IP address (handled by our host and held briefly by the rate limiter, not stored in our database).
• Internet or electronic network activity: the request logs our host keeps.

Do Not Sell or Share My Personal Information

PointsExplained does not sell or share your personal information. The site runs no analytics or advertising tools, so nothing is shared for cross-context behavioral advertising.

Exercising your rights

California residents can exercise their right to know, delete, correct, or opt out by emailing privacy@pointsexplained.com. We will verify your identity before processing requests. You will not be discriminated against for exercising your rights.

If you are in Brazil, the Lei Geral de Proteção de Dados (LGPD) applies. Under the LGPD, you have the right to:

• Confirm the existence of processing of your personal data
• Access your data
• Correct incomplete, inaccurate, or out-of-date data
• Anonymize, block, or delete unnecessary or excessive data
• Request portability of your data to another service provider
• Delete personal data processed with your consent
• Obtain information about entities with which your data has been shared
• Revoke consent at any time

Legal basis for processing: consent for the newsletter, and legitimate interest for choosing your country edition and keeping the site secure.

Contact: requests under the LGPD go to privacy@pointsexplained.com.

Supervisory authority: Autoridade Nacional de Proteção de Dados (ANPD) — gov.br/anpd.

If you are in India, the Digital Personal Data Protection Act 2023 (DPDP Act) applies. Under the DPDP Act:

• We process your email address only with your consent, and you may withdraw consent at any time.
• You have the right to access a summary of your personal data and processing activities.
• You have the right to correction and erasure of your personal data.
• You have the right to nominate another person to exercise your rights in the event of your death or incapacity.
• You can file complaints with the Data Protection Board of India.

Data Fiduciary: PointsExplained is the Data Fiduciary for the data described here. Contact privacy@pointsexplained.com for all data protection requests.

If you are in Australia, the Privacy Act 1988 and the Australian Privacy Principles (APPs) apply to how we handle your personal information.

• We collect only what Section 2 lists, and say what each newsletter form does before you submit it (APPs 3 and 5).
• The only email the site sends to a subscriber is a one-off welcome message, and your address is used for nothing else (APP 7).
• You can access your personal information and request correction (APPs 12 and 13).

Cross-border disclosure: the providers in Section 4 process data outside Australia, including in the United States.

Complaints: write to privacy@pointsexplained.com. If you are unsatisfied with our response, you can escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

PointsExplained is operated from Canada. The providers in Section 4 process data in countries that may not be your own, mainly the United States. Each provider's privacy terms, linked in Section 4, describe how it protects data it transfers.

PointsExplained is not directed at children under 16 (or under 13 in the US, per COPPA). We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact privacy@pointsexplained.com and we will delete it.

When what the site collects changes, this page changes with it, and the "Last updated" date at the top changes too. Where the law requires it (for example the GDPR or Quebec Law 25), we will ask for fresh consent before processing data in a new way.

For any privacy-related questions or requests: