I don't want to be a thread killer... To me this company seems too ignorant that they don't forsee what sensitive info they are asking for, OR they are planning to make a big business out of peoples inboxes in the background
Weather they get cashback or not, they can make good business with just the info on peoples purchasing behaviour.
Either way play safe with them if you wish to by creating an inbox just for them as the op suggested