Privacy policy

If you create an account

• Your name and email address.
• Your password, stored only as a one-way bcrypt hash, nobody here can read it.
• If you sign in with Google instead: the name, email address and profile picture Google shares with us.
• Your plan, your role, when you joined and when you last signed in.
• Sign-in and verification codes we email you, stored as hashes and expiring after use.

What you save or choose

• Saved deals, deal ratings and in-site notifications.
• Your email preferences. Marketing email is off unless you turn it on.

If you create a Creator Profile

• Your username, and everything you put on the page: name, bio, photo, links, text and images you upload. Once you publish, this is public at kuponguru.com/@username, and search engines may list it unless you switch that off.
• Your unpublished draft, kept so you can keep editing. Unpublishing takes the page offline. Deleting your account deletes the profile; the images you uploaded are deleted too when you ask us.

If you pay for membership

• The plan, period, amount and currency; the payment reference or transaction ID, and for mobile-wallet payments the sending number you type in; the status and notes from the staff member who checked the payment; and, if you add them, the name and address you want on your invoices. You pay inside the payment provider’s own app or page. We never see your card details, PIN, password or balance.

When you use the site

• Page views: the page and the website that sent you there. No IP address, browser details or visitor ID.
• Creator Profile visits: a view or link click, the device type (phone, tablet or computer) and the website that sent the visitor, shown to the profile’s owner as totals. No IP address, browser details, location or visitor ID.
• Offer activity: which offer was viewed, copied or opened, and on which page, with your account attached only if you were signed in, so your dashboard can show it.
• Tool limits: for the few tools with a daily limit, a count against your account, or against a random ID in a cookie if you are not signed in, plus a one-way hash of your IP address so the limit cannot be dodged by clearing cookies.
• Sign-in protection: a salted hash of your IP address, held briefly in memory to slow down password guessing.
• Our web server’s access log: IP address, requested address, time and browser type, kept for 14 days for security and fixing faults.

If you report a problem with an offer: which offer, the reason you chose, the page you were on, and your note and email address only if you give them.

If you email us: we keep the message and your address to reply.

Staff accounts: actions in the admin console are logged with the staff member’s email and IP address.

• To run your account and membership: because you asked us to (contract).
• To send email: account and payment messages always; deal digests and marketing only if you opted in (consent), with an unsubscribe link in every one.
• To keep the site secure and working: rate limits, access logs and the staff audit log (legitimate interests).
• To understand which offers and pages are useful: our own counts and Google Analytics (legitimate interests, or consent where the law requires it).
• To show ads: Google AdSense (consent where the law requires it).
• To meet legal obligations: such as keeping payment records.

We use a few cookies of our own and Google uses others. Every one is listed, with how long it lasts, in the cookie policy, which also explains how to change your choice.

We do not sell personal information or share it for others’ marketing. These services receive some of it to do their part:

• Google Analytics: visit statistics. Google’s privacy policy; opt out.
• Google AdSense: ads. How Google uses cookies in advertising and how Google uses data from sites like ours.
• Google sign-in: only if you choose to sign in with Google.
• Resend: delivers our emails. Resend’s privacy policy.
• Payment providers: you pay inside the provider you choose at checkout, under that provider’s own terms and privacy policy. We receive only the payment reference and the details you enter.
• Merchants and affiliate networks: when you follow a link to them, they see that you came from KuponGuru. What you do on their site is covered by their privacy policy, not this one.

We may also disclose information when the law requires it, or to protect people or the site from fraud or abuse.

• Account information, saved items, preferences and payment records: while your account exists.
• Sign-in and verification codes: until used or expired.
• Web server access logs: 14 days.
• Page-view and offer-activity counts: kept as site statistics. They hold no IP address, and deleting your account removes your account from any offer activity it was attached to.

• Change your email preferences in your dashboard, and unsubscribe from any email with the link inside it.
• Ask us to delete your account, email info@kuponguru.com from the address you signed up with. Deleting it removes your profile, sign-in details, saved deals, ratings, notifications, preferences, subscriptions and payment records; offer activity you took part in is kept without your account attached.
• Ask us for a copy of your information, to correct it, or to stop using it for a purpose, at the same address. We may need to confirm the request comes from you, and we reply within 30 days.
• Withdraw consent to cookies at any time from the cookie policy.
• If you are unhappy with how we handled your information, you can complain to the data protection authority where you live.

The site is served only over HTTPS. Passwords are hashed, sign-in attempts are rate limited, and the admin console is limited to staff, with every change logged. No system is perfectly secure, so if you think your account has been misused, tell us straight away.

Google and Resend may process information in countries other than yours, under their own safeguards described in their policies.

KuponGuru is not meant for children under 13, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will delete it.

When this policy changes, the date at the top changes with it. If a change affects how we use information you already gave us, we will tell account holders by email before it applies.