Privacy Policy

What we collect

When you sign up for Deal Diver, we collect:

• Your email address — to deliver your newsletter and send account-related messages.
• Your display name — shown in personalisation of your newsletter.
• Your preference data — the categories, brands, sizes, and budget thresholds you provide during onboarding or update in the preferences portal.
• Your click behaviour — when you click a deal link in a newsletter, we record which product was clicked and when. This is used to improve your deal recommendations over time.
• Your feedback signals — thumbs up / thumbs down reactions on deal cards are recorded to refine your taste profile.
• Your IP address at the time of sign-up — recorded alongside your consent timestamp to satisfy CASL and PIPEDA requirements.
• Your country — if Deal Diver isn't available in your market yet, we keep your email and country so we can tell you when we expand there. If you join from outside Canada, the privacy laws of your country may also apply to that information.

Why we collect it

We use your data solely to operate Deal Diver:

• To personalise the deal newsletters we send you.
• To learn your taste over time from click and feedback signals.
• To send transactional account emails (verification, password-less login links).
• To comply with CASL (Canada's Anti-Spam Legislation) by recording explicit consent.

How we store your data

Your account and preference data is stored in a database on servers located in Canada. Data is sent over encrypted connections (TLS), and access to it is restricted to the people and systems that need it to run Deal Diver.

We keep your data for as long as your account is active. If you delete your account, we permanently delete your account and the preference, delivery and activity data linked to it. We keep routine backups for disaster recovery with a cloud storage provider in North America (Canada or the United States), and delete them after 30 days, so deleted data may remain in a backup for up to 30 days.

There is one exception to deletion. Anti-spam law (CASL) puts the burden on us to prove that you agreed to receive our email and what we sent you, so we keep a minimal consent record that is separate from your account and is not deleted with it. It holds the dates you agreed, confirmed, unsubscribed or deleted your account, the version of the consent wording you saw, the IP address and browser details recorded when you agreed, and the date and type of each email we sent you (not its contents). It does not contain your email address, name or preferences: you are identified in it only by a one-way cryptographic fingerprint of your email address, which lets us find your record if you ask us or contest it, but cannot be read back into your address. We keep this record for three years after your last activity, and for as long as your account exists, and then delete it. We use it only to answer legal claims and regulator requests about consent and email sent, never for marketing or personalisation.

Feedback you send us

If you send feedback through the feedback page, we store your message, where you came from (for example a link in a newsletter), your browser details, and your account if you were signed in. Signed-out submissions are also tied to a one-way fingerprint of your IP address, not the address itself, so we can limit abuse.

Giving us a way to reply is optional: you can type an email address or, if you are signed in, let us reply to your account email. We use it only to reply about your feedback, and never add it to the newsletter or waitlist. We remove a typed address once we have dealt with your feedback, and in any case after 12 months. We keep the message itself, which is no longer linked to you if you delete your account. To have a specific message removed, email us at the address below.

Cookies and site analytics

We measure visits to this website with Vercel Web Analytics. It is cookieless: it doesn't set cookies or store anything on your device, doesn't track you across other websites, and records only aggregate page views, referrers and broad device and location information. The only cookie we set is the session cookie that keeps you signed in, which is strictly necessary and only used once you log in.

Service providers and where data is processed

We do not sell, trade, or share your personal data with third parties for marketing or advertising purposes. We use service providers to run Deal Diver, and they process data only on our behalf and for that purpose:

• Website hosting and delivery.
• Email delivery, for your newsletter and account emails.
• Cookieless website analytics, described above.

Some of these providers may process limited data, such as your email address or basic visit information, outside Canada, including in the United States, where it is subject to the laws of that country. We choose providers that commit to protecting personal information.

Your rights

Under PIPEDA and applicable provincial privacy law, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — update your preferences at any time from the preferences portal.
• Deletion — request that your account and the data linked to it be permanently deleted, apart from the minimal consent record described above. You can do this from the preferences portal, or by emailing us.
• Withdrawal of consent — unsubscribe at any time by clicking the unsubscribe link in any newsletter, or from the preferences portal.

Contact

For privacy inquiries, data access requests, or deletion requests, contact us at:

Email: privacy@dealdiver.app