Privacy policy

If you create an account

• Your name and email address.
• Your password, stored only as a one-way bcrypt hash — nobody here can read it.
• If you sign in with Google instead: the name, email address and profile picture Google shares with us.
• Your plan, your role, when you joined and when you last signed in.
• Sign-in and verification codes we email you, stored as hashes and expiring after use.

What you save or choose

• Saved deals, deal ratings and in-site notifications.
• Your email preferences. Marketing email is off unless you turn it on.

If you pay for membership

• The plan, period, amount and currency; the bKash transaction ID and sending number you type in; and the status and notes from the staff member who checked the payment. You pay inside bKash — we never see your bKash PIN or balance.

When you use the site

• Page views: the page and the website that sent you there. No IP address, browser details or visitor ID.
• Offer activity: which offer was viewed, copied or opened, and on which page — with your account attached only if you were signed in, so your dashboard can show it.
• Tool limits: for the few tools with a daily limit, a count against your account, or against a random ID in a cookie if you are not signed in, plus a one-way hash of your IP address so the limit cannot be dodged by clearing cookies.
• Sign-in protection: a salted hash of your IP address, held briefly in memory to slow down password guessing.
• Our web server’s access log: IP address, requested address, time and browser type, kept for 14 days for security and fixing faults.

If you report a problem with an offer: which offer, the reason you chose, the page you were on, and your note and email address only if you give them.

If you email us, we keep the message and your address to reply.

Staff accounts: actions in the admin console are logged with the staff member’s email and IP address.

• To run your account and membership — because you asked us to (contract).
• To send email — account and payment messages always; deal digests and marketing only if you opted in (consent), with an unsubscribe link in every one.
• To keep the site secure and working — rate limits, access logs and the staff audit log (legitimate interests).
• To understand which offers and pages are useful — our own counts and Google Analytics (legitimate interests, or consent where the law requires it).
• To show ads — Google AdSense (consent where the law requires it).
• To meet legal obligations, such as keeping payment records.

We use a few cookies of our own and Google uses others. Every one is listed, with how long it lasts, in the cookie policy, which also explains how to change your choice.

We do not sell personal information or share it for others’ marketing. These services receive some of it to do their part:

• Google Analytics — visit statistics. Google’s privacy policy; opt out.
• Google AdSense — ads. How Google uses cookies in advertising and how Google uses data from sites like ours.
• Google sign-in — only if you choose to sign in with Google.
• Resend — delivers our emails. Resend’s privacy policy.
• bKash — membership payments happen in bKash, under bKash’s own terms.
• Merchants and affiliate networks — when you follow a link to them, they see that you came from KuponGuru. What you do on their site is covered by their privacy policy, not this one.

We may also disclose information when the law requires it, or to protect people or the site from fraud or abuse.

• Account information, saved items, preferences and payment records: while your account exists.
• Sign-in and verification codes: until used or expired.
• Web server access logs: 14 days.
• Page-view and offer-activity counts: kept as site statistics. They hold no IP address, and deleting your account removes your account from any offer activity it was attached to.

• Change your email preferences in your dashboard, and unsubscribe from any email with the link inside it.
• Ask us to delete your account — email info@kuponguru.com from the address you signed up with. Deleting it removes your profile, sign-in details, saved deals, ratings, notifications, preferences, subscriptions and payment records; offer activity you took part in is kept without your account attached.
• Ask us for a copy of your information, to correct it, or to stop using it for a purpose, at the same address. We may need to confirm the request comes from you, and we reply within 30 days.
• Withdraw consent to cookies at any time from the cookie policy.
• If you are unhappy with how we handled your information, you can complain to the data protection authority where you live.

The site is served only over HTTPS. Passwords are hashed, sign-in attempts are rate limited, and the admin console is limited to staff, with every change logged. No system is perfectly secure, so if you think your account has been misused, tell us straight away.

Google and Resend may process information in countries other than yours, under their own safeguards described in their policies.

KuponGuru is not meant for children under 13, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will delete it.

When this policy changes, the date at the top changes with it. If a change affects how we use information you already gave us, we will tell account holders by email before it applies.