Exxon Mobil Rewards+

"Categories of Third Parties to Whom Personal Information was Sold or Disclosed: Advertising networks, online marketing companies, agencies, credit card processing vendors, third party payment provider, platform and IT Service Providers, suppliers."

Personal identifiers including name, address, email, and online identifiers are disclosed to a broad range of third parties including advertising networks and online marketing companies.

"ExxonMobil may share with third parties EM Rewards+ member Personal Information collected in the context of navigation of EM Rewards+ websites via Cookie for the purpose of cross-context behavioral advertising. You may opt-out of this sharing by following the cookie-banner instructions."

ExxonMobil tracks user behavior across websites and shares this data with third parties for cross-context behavioral advertising, building interest profiles from browsing behavior over time and across different sites.

"Geolocation data: Geographical location of a person obtained by GPS or similar technology from mobile devices (only if the consumer opts-in to EMR+ App and this functionality on the mobile device). ... the location of your mobile device or EM Rewards+ transactions."

The app collects precise GPS geolocation data from mobile devices. While opt-in is required, location data is collected and shared with platform and IT service providers.

"We may collect information about the operating system or the browser version and the type of device you use to open electronic communications from us; DeviceID, crash logs, app interaction to maintain the quality and safety of our website and application; the IP Address and information related to that IP Address; browsing history on our websites or apps."

The app collects device IDs, operating system details, browser version, crash logs, IP addresses, and detailed browsing history — going beyond what a fuel rewards program would require for core functionality.

"We may change this Privacy Statement from time to time, so we recommend that you check the current version available on a regular basis. If we make changes to this statement, we will update the "Effective Date" at the top of this page so that you know changes have been made."

ExxonMobil can change the privacy statement at any time with no direct notice to users — they simply update the effective date and expect users to check regularly.

"We will keep your Personal Information only as long as required to deliver our products and services, unless we are required by law or regulation or for litigation or regulatory reasons to keep it."

No specific retention timeline is provided. The policy uses vague language ('as long as required') with broad exceptions for legal, regulatory, or litigation reasons that could justify indefinite retention.

"Deletion of your Personal Information (note that deletion of Personal Information processed with respect to administration of EM Rewards+ membership may require withdrawal of membership and potential loss of program benefits). If you request to delete your account or any personal information, which is required to create an account, such as Name, Email address, Loyalty membership ID, phone number, please note that we will cancel your account and delete your personal information."

Requesting deletion of personal information forces loss of membership and all accumulated rewards points, creating a disincentive to exercise privacy rights despite ExxonMobil claiming not to discriminate against users who exercise their rights.