This Privacy Notice explains how Sell Traces, Inc. ("Rebates," "we," "our," or
"us") collects, uses, discloses, and protects personal information when you use
Rebates or Sell Traces. Rebates includes our websites, account dashboard,
command-line tools, integrations, sponsored content, referrals, earnings and
payout features, APIs, documentation, and support services. Sell Traces is our
service for licensing AI agent traces that you choose to upload, including the
selltraces command-line tool and the trace library, data controls, and payout
features in your dashboard. Together, these are the "Service."
The short version
We collect information needed to run the Service, secure accounts, show and
measure sponsors, credit earnings, make payments, prevent abuse, and improve
the product.
Features and integrations may process information from your device or tools,
including project information and content you submit or make available. What
is processed depends on the feature and your settings.
If you choose to upload traces to Sell Traces, we store them, scrub them, and
license scrubbed copies to AI developers and researchers, who use them to
train, evaluate, and research AI systems. You earn a share of each sale.
Rebates does not upload traces for sale.
We share information with service providers and business partners when needed
to operate the Service, deliver sponsorships, license traces you uploaded,
process payments, comply with law, or complete a business transaction.
Privacy controls reduce collection or sharing in specific situations, but
turning off one feature does not erase records we must keep for security,
accounting, fraud prevention, payments, or legal compliance, and it does not
recall trace copies already delivered to buyers.
You can ask questions or exercise applicable privacy rights by emailing
privacy@rebates.ai.
Information we collect
Information you provide
We collect information you give us, such as your email address, profile details,
account preferences, payout information, referral activity, support messages,
feedback, and any content or files you choose to submit, including traces you
upload to Sell Traces.
Information from your device and use of the Service
We collect device and network information, identifiers, authentication and
session data, IP address, user agent, timestamps, pages and features used,
commands or requests made, sponsor views and clicks, earnings activity, error
and diagnostic data, and similar logs.
Our local tools may create settings, credentials, device identifiers, caches,
backups, local indexes, and integration files on your device. Local information
stays on your device unless a feature sends it to the Service, you submit it, or
another tool or service you use transmits it.
Information processed by features and integrations
Depending on the feature and your settings, the Service may read or process
project metadata, package or workspace information, prompts, model responses,
transcripts, files, or other content made available through an enabled
integration. Processing may happen locally, on our systems, or through a
service provider.
We may apply redaction, filtering, minimization, or other safeguards before or
after transmission. These safeguards reduce risk but do not guarantee that all
sensitive information will be removed. Do not enable a feature for content you
are not allowed to share or process.
Information from other sources
We may receive information from authentication providers, payment and payout
providers, advertisers, analytics and security providers, connected services,
public sources, and other partners. Their handling of your information is also
governed by their own privacy policies.
Sell Traces
This section applies only if you use Sell Traces. The
Sell Traces Contributor Terms set out the license you give
us for traces you upload.
What the tool reads on your computer
The selltraces tool reads the transcripts that supported AI coding tools, such
as Claude Code, Codex, Cursor, Gemini CLI, and OpenCode, keep on your computer.
It builds a local index, a record of what has been uploaded, and your upload
settings on your computer, and it redacts traces there before anything leaves
your computer. It uploads only the traces in a plan you approve. The tool may
also send diagnostics, such as counts and transcript format names, that do not
include transcript content. You can turn diagnostics off by setting
DO_NOT_TRACK=1.
What is uploaded
When you approve an upload, we receive the approved traces after local
redaction. A trace can include your prompts, the AI's responses, tool calls and
results, commands, code and file contents that appeared in the session,
timestamps, model and tool names, token counts, and session details such as the
working directory, repository, branch, commit, operating system, and shell. We
also receive your account and device identifiers and details about the upload.
Traces can contain personal information about you or other people, such as names
or contact details that appear in code, comments, or conversations.
Redaction and scrubbing
After local redaction, we scrub each trace again on our servers. Scrubbing looks
for secrets, access tokens, email addresses, phone numbers, IP addresses, street
addresses, and home directory paths. We reject traces in which we detect a
government identification number, a payment card number, or a health or medical
record identifier, and we do not offer them for sale. Redaction and scrubbing
are automated and imperfect: they can miss sensitive information. Review what
you upload and use the exclusion controls.
Storage and retention
We store traces in our databases and cloud storage. For each upload, we keep the
data as we received it, before server-side scrubbing, so we can process it,
re-scrub it when our scrubbing improves, investigate security or fraud issues,
resolve disputes, and show what was delivered. We deliver scrubbed versions to
buyers, not these stored upload copies. We keep traces while your account is
active or until you ask us to delete them. We keep records of sales, payouts, and
the Contributor Terms versions you accepted for as long as we need them for
accounting, tax, fraud prevention, and legal purposes.
Licensing to AI developers
We use uploaded traces to review, score, price, and package them into datasets,
and we license or sell scrubbed traces and datasets to AI developers, research
organizations, and other buyers for training, evaluating, benchmarking, and
researching AI systems. Buyers agree to license terms that prohibit trying to
re-identify people in the traces and redistributing or reselling the traces we
deliver. Some privacy laws treat this kind of licensing as a "sale" of personal
information. It happens only for traces you choose to upload and do not exclude.
Your Sell Traces choices
Before upload: approve sources and projects, keep projects private, block
terms, and review the upload plan and redaction preview.
Before a sale: exclude traces or whole projects from sale in your
dashboard. Excluded traces are not offered in new sales.
After a sale: sold traces are locked in the product. You can ask us to stop
offering a sold trace in future sales.
Deletion: ask us to delete your traces, or delete your account. We stop
offering deleted traces for sale and delete them from active systems within a
reasonable time, except for the records described above.
What cannot be recalled: we cannot recall copies already delivered to
buyers, or undo models, evaluations, or research results built with them.
If you believe your personal information appears in a trace someone else
uploaded, email privacy@rebates.ai. We will review the request and can remove
the trace from future sales.
How we use information
We use information to:
provide, personalize, maintain, and improve the Service;
authenticate users, secure accounts and devices, and troubleshoot problems;
select, deliver, measure, and report sponsored content;
process, scrub, review, price, and license traces you upload to Sell Traces;
calculate, review, credit, withhold, reverse, and pay earnings, revenue share,
or referrals;
detect and investigate fraud, invalid traffic, abuse, and security incidents;
communicate about accounts, support, payments, product updates, and legal
changes;
analyze performance, reliability, adoption, and business operations;
enforce our agreements and protect users, partners, and the public; and
comply with legal, tax, accounting, sanctions, and regulatory obligations.
We may create aggregated, de-identified, or statistical information and use or
disclose it for lawful purposes. We do not attempt to re-identify information
that we treat as de-identified unless permitted by law for testing or security.
How we disclose information
We may disclose information to:
service providers that support hosting, storage, authentication, email,
analytics, security, support, payments, legal, and other operations;
advertisers and advertising partners to select and deliver sponsors,
measure performance, attribute activity, prevent fraud, and fund earnings;
trace buyers, meaning AI developers, research organizations, and other
buyers that license scrubbed traces you uploaded to Sell Traces;
payment, tax, and financial providers to verify eligibility, process and
reconcile payments, and meet compliance obligations;
connected services when you enable or direct an integration;
professional advisers and authorities when reasonably necessary to comply
with law, respond to legal process, enforce agreements, or protect rights and
safety; and
transaction participants in connection with financing, diligence, a
merger, acquisition, reorganization, bankruptcy, or sale of assets.
We may also disclose information with your direction or consent, or in an
aggregated or de-identified form that is not personal information under
applicable law.
Sponsorships and advertising
Rebates is funded in part by sponsored content. Sponsor selection and
measurement may use account, device, network, activity, and contextual
information. If a contextual feature is enabled, information made available to
that feature may be transformed and shared for sponsor selection, measurement,
reporting, fraud prevention, and related operations.
Sponsor attribution is off by default and is separate from contextual sponsor
prompts. Enabling one control does not enable the other. If you enable sponsor
attribution, the Rebate CLI may run Gravity's terminal pixel and send Gravity
visitor, session, click, and ad identifiers, together with terminal, device,
session, and related technical metadata that the pixel collects. Rebates may
also send a one-way SHA-256 hash of your normalized, verified account email.
Your raw email address is never sent to Gravity. The hash is pseudonymous and
matchable, not anonymous. Although it does not display the raw email on its own,
it could be guessed by testing candidate email addresses, and a party that
already knows an address can compute the same hash and match it.
We use these attribution signals to select and measure sponsors, prevent fraud,
and audit sponsor delivery and measurement. Enabling attribution does not
guarantee higher sponsor rates, earnings, or payouts. You can revoke attribution
consent at any time with rebate sponsor attribution disable; revocation stops future
consented provider identifiers and email hashes but does not undo prior lawful
processing or erase audit, fraud, accounting, or legal records we must retain.
Some laws define "sale," "sharing," or "targeted advertising" broadly enough
to cover certain advertising disclosures. Where applicable, you may have the
right to opt out. Email privacy@rebates.ai to make a request. Product controls
may also let you disable particular forms of contextual processing or local
integration.
Legal bases
Where a legal basis is required, we process information as necessary to perform
our contract with you, including licensing traces you upload under the Sell
Traces Contributor Terms and paying your share of sales, with your consent, to
comply with legal obligations, and for legitimate interests such as operating
and securing the Service, preventing fraud, serving and measuring sponsors,
improving the product, and protecting our rights. You may withdraw consent where
processing depends on consent, but withdrawal does not affect earlier
processing.
Retention
We keep information for as long as reasonably needed for the purposes described
in this Notice. Retention depends on the type of information, the feature, and
our legal and operational needs. For example, account and service data may be
kept while an account is active; uploaded traces are kept as described in the
Sell Traces section; and sponsor, earnings, sales, payment, tax, fraud, and
security records may be kept longer for reporting, dispute, audit, and legal
purposes.
When information is no longer needed, we may delete it, de-identify it, or
retain a limited record where necessary to document a request or legal action.
Local files remain on your device until you or your system removes them.
Your choices and rights
Depending on your location and the features you use, you may be able to manage
integration settings, contextual processing, trace exclusions, cookies,
communications, local files, and account deletion. You may also have rights to
access, correct, delete, or receive a copy of personal information; object to or
restrict processing; withdraw consent; opt out of certain advertising
disclosures, sales, or profiling; appeal a decision; or complain to a regulator.
To make a request, email privacy@rebates.ai from the address associated with
your account and describe the request. We may verify your identity and may deny
or limit a request where permitted by law, including to protect another person,
preserve security or fraud records, or meet legal and financial obligations. We
will not discriminate against you for exercising an applicable privacy right.
Security and international transfers
We use administrative, technical, and organizational safeguards designed to
protect information. No system, transmission, redaction process, or storage
method is completely secure.
We are based in the United States and may process information in other countries
where we or our providers operate. Where required, we use recognized safeguards
for international transfers.
Children
The Service is not intended for anyone under 18. If you believe a minor has
provided personal information, contact privacy@rebates.ai.
Changes and previous versions
We may update this Notice as the Service, our practices, or the law changes. We
will publish each version with its effective date and provide additional notice
when required. A new version applies from its stated effective date; earlier
versions remain archived.
Contact
Email privacy questions and requests to privacy@rebates.ai.