Privacy Policy

Last updated: September 4, 2026

1. Introduction

CardDeals LLC ("CardDeals", "we", "our", or "us") operates the website carddeals.co and related services, mobile applications, and browser extensions (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our Service. By using CardDeals, you agree to the collection and use of information in accordance with this policy.

2. Privacy Nutrition Label & Data Categories Matrix

In line with Apple App Store, Google Play Store, and state privacy disclosures (including the California Consumer Privacy Act / CPRA), below is our comprehensive "Privacy Nutrition Label" outlining every category of data collected, whether it is linked to your identity, whether it is used for tracking, and its business purpose.

Data Category	Specific Data Elements	Linked to You?	Used to Track You?	Primary Purpose
Identifiers	Name, email address, user account ID, IP address, device ID, cookie IDs	Yes	Consented analytics & ad attribution only	Authentication, account management, fraud prevention, security
Financial & Transaction Info	Gift cards bought/sold, transaction totals, payment token reference IDs (Stripe), payout bank account info (for sellers via KYC/Stripe Connect)	Yes	No	Order fulfillment, cash out payouts, tax compliance, fraud prevention
Purchases & Commercial Data	Orders placed, gift cards cashed out, price alert subscriptions, discount offers clicked	Yes (if signed in)	Consented conversion measurement only	Service functionality, price alert dispatch, transaction history
Usage & Interaction Data	Pages visited, brands searched, outbound merchant clicks, privacy-masked session interactions (PostHog)	Pseudonymous / Linked if signed in	Consented analytics only	Platform optimization, deal ranking, affiliate attribution, UI diagnostics
User Content & Uploads	Brand reviews, feedback comments, customer support messages, uploaded receipt images / balance screenshots for card cash out	Yes	No	Community reviews, support resolution, gift card balance verification
Diagnostics & Telemetry	Browser type, operating system version, crash reports, page load performance latency	No	No	Debugging, security monitoring, infrastructure scalability

3. Information We Collect

We collect information directly from you, automatically through your use of the Service, and from trusted third parties:

Account & Profile Data: Name, email address, and authentication credentials (or third-party OAuth profile data if you authenticate with Google).
Transaction & Seller Verification: If you sell a gift card to CardDeals, our identity verification partner (Didit) collects KYC information and Stripe processes your payout account details. We store tokenized references, not raw banking credentials.
Usage & Search Data: Information about your interactions with the Service, including brands searched, discount offers clicked, and price alerts created.
Device & Network Information: Browser type, operating system, IP address, and device characteristics collected for security, fraud mitigation, and analytics.
Cookies & Local Storage: First-party session tokens and consented third-party analytics/measurement cookies as detailed below.

4. Cookie Policy & Tracking Technologies

Cookies and local storage are small data files stored on your device by your browser. We categorize tracking technologies into strictly necessary cookies and consented analytics/measurement cookies:

Strictly Necessary Cookies

These cookies are essential for the Service to operate (such as maintaining your secure logged-in session and storing your cookie preferences). They cannot be disabled.

Cookie	Provider	Purpose	Duration
carddeals_cookie_consent	CardDeals	Stores your cookie consent & privacy preferences	13 months
session	CardDeals	Maintains your authenticated session state	Session

Analytics & Advertising Measurement (Require Consent / Subject to Opt-Out)

These technologies help us understand how visitors interact with our Service, evaluate marketing campaigns, and measure referral conversions across partner networks. In compliance with GDPR and CCPA/CPRA, optional analytics and advertising measurement scripts (including Google Analytics, PostHog, and affiliate conversion tracking) are subject to your consent and opt-out preferences.

Cookie / Tag	Provider	Purpose	Duration
_ga, _ga_*	Google Analytics 4	Distinguishes unique visitors, measures pageviews, and evaluates session traffic	2 years
Affiliate Conversion Tags	CardCash / Rakuten	Attributes qualifying gift card referral purchases to maintain free comparisons	Session / 30 days

Local Storage

We use browser local storage for client-side functionality and privacy-respecting caching:

Key	Purpose
carddeals-recent-searches	Stores your recent search queries for quick access (stored locally, never transmitted to external servers)
carddeals_session_id	Assigns a pseudonymous first-party identifier for operational telemetry without storing names or emails
ph_*_posthog	Stores PostHog product analytics session state after analytics consent is granted

Global Privacy Control (GPC) & Opt-Out

We automatically recognize and honor the Global Privacy Control (GPC) browser signal. If your browser or extension transmits a GPC signal, we immediately treat it as an opt-out from non-essential analytics, cross-context behavioral tracking, and data sharing, without requiring any manual action on your part. You can also adjust or withdraw cookie consent at any time by clicking Cookie Preferences in the website footer.

5. Artificial Intelligence & Algorithmic Processing (FTC AI Disclosure)

In compliance with Federal Trade Commission (FTC) enforcement guidelines regarding deceptive advertising, consumer protection, and artificial intelligence, we clearly disclose how AI and automated systems operate at CardDeals:

Automated Deal Aggregation & Ranking: We use proprietary algorithms to ingest pricing feeds from gift card merchants, verify in-stock availability, compute savings percentages, and sort deals by objective value.
Verification & OCR Data Extraction: Automated tools and optical character recognition (OCR) assist in extracting card balances and verification details from submitted receipts or card images when sellers cash out gift cards. All submissions remain subject to human verification prior to payout.
Strict Prohibition on Public Model Training: CardDeals does NOT sell, rent, or transfer your personal data, payment details, gift card claim codes, PINs, or identity verification documents to third parties to train public foundation AI models or generative AI datasets.
Third-Party AI Service Protections: To the extent we utilize enterprise AI APIs for support query categorization or data parsing, these services are bound by commercial contracts prohibiting the retention or use of customer data for model training.
No "AI-Washing": We do not make false or exaggerated claims regarding AI capabilities, nor do we fabricate discount percentages. All pricing data represents substantiated, live marketplace rates.

6. How We Use Your Information

To provide, maintain, and improve our gift card marketplace and comparison features
To fulfill orders for gift cards sold directly by CardDeals
To process cash out submissions, complete KYC verification, and deliver seller payouts
To send price alert notifications you have explicitly configured
To authenticate your identity and protect against unauthorized account access
To analyze platform usage trends, diagnose technical errors, and evaluate privacy-masked sessions on selected product flows (where consented)
To measure marketing efficiency and partner referral attribution
To detect and prevent fraudulent transactions, theft, money laundering, and security incidents
To comply with legal, statutory, and regulatory obligations (e.g. IRS reporting, KYC regulations, and DMCA compliance)

7. Legal Basis for Processing (EEA/UK Users)

If you reside in the European Economic Area or the United Kingdom, our legal bases for processing personal data under GDPR include:

Consent: For optional cookies, Google Analytics, PostHog session replay, and advertising attribution. You may withdraw consent at any time.
Contractual Necessity: To execute your account creation, fulfill gift card purchases, or process card cash out payouts.
Legitimate Interest: For fraud mitigation, platform security, bot detection, and basic site optimization.
Legal Obligation: To comply with applicable tax laws, consumer protection statutes, and regulatory reporting requirements.

8. Information Sharing & Third-Party Features

We do not sell personal information. We disclose information only to authorized service providers and partners under strict data protection terms:

Payment & KYC Providers: Stripe processes payments and seller payout routing. Didit performs identity verification for gift card sellers. Both operate under industry-standard PCI-DSS and privacy security standards.
Analytics & Measurement: Consented visitation data is processed via Google Analytics 4 and PostHog. In PostHog, user inputs and form fields are privacy-masked.
Affiliate Merchants: When you click a third-party deal link (such as CardCash), a referral token is transmitted to attribute qualifying purchases.
Infrastructure & Security: Cloud hosting, database, and email delivery providers bound by strict confidentiality and data-processing agreements.
Legal Requirements & Business Transfers: When required by law or in connection with a corporate merger, acquisition, or asset sale.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. Where required by law, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses approved by the European Commission) to protect your data during international transfer.

10. Data Security

We implement robust administrative, technical, and physical safeguards to protect personal information, including encryption in transit (TLS 1.3), encryption at rest, secure password hashing, and role-based access restrictions. However, no electronic transmission or storage method is completely impenetrable, and we cannot guarantee absolute security.

11. Data Retention

We retain your personal information for as long as your account remains active or as needed to provide our services and maintain transaction records for warranty and tax compliance. Operational telemetry and analytics are aggregated or anonymized. You may request account deletion at any time by contacting us; verified deletion requests are completed within thirty (30) days, subject to legally required record-retention requirements.

12. Your Rights & Regional Notices

Depending on your jurisdiction, you have specific statutory rights regarding your personal information:

Right to access, inspect, and receive a copy of your personal data
Right to correct inaccurate or incomplete information
Right to request deletion of your personal data
Right to object to or restrict certain processing activities
Right to data portability in a structured, machine-readable format
Right to withdraw consent for analytics and tracking cookies at any time

California Residents (CCPA / CPRA Notice)

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), California residents have the right to know what categories of personal information we collect, the business purposes for which it is used, and to request deletion or correction of personal data.

Do Not Sell or Share My Personal Information: CardDeals does not sell personal information for monetary consideration. Under CPRA, "sharing" includes using personal data for cross-context behavioral advertising. You have the right to opt out of the sharing of personal data. We automatically honor the Global Privacy Control (GPC) browser signal as a valid opt-out request.

To exercise your CCPA/CPRA rights, email us at [email protected]. We do not discriminate against users for exercising their privacy rights.

European Economic Area & UK Residents (GDPR)

Under the GDPR and UK Data Protection Act, you have the right to lodge a complaint with your local supervisory authority and exercise your rights of access, rectification, erasure, and restriction. Contact us at [email protected].

13. Third-Party Links

Our Service contains links to third-party gift card providers and external websites. We are not responsible for the privacy practices, content, or terms of third-party platforms. We encourage you to review their privacy policies before providing personal information or completing purchases on their sites.

14. Browser Extension Privacy & Security

The free CardDeals browser extension (available for Chrome, Firefox, and Edge) is engineered with a strict privacy-first architecture:

Domain Matching Only: The extension inspects solely the hostname of your active browser tab to identify matching gift card discount offers in our database.
No Browsing History Recording: The extension does not log, save, or transmit your full browsing history, search engine queries, or URL parameters.
Zero Keystroke / Input Capture: The extension never reads form fields, payment credentials, personal identity data, or passwords.
No Telemetry Monetization: We do not sell or monetize extension usage data.

15. Children's Privacy

CardDeals is intended for adult consumers and is not directed to individuals under the age of 16 (or the age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If we discover that a child has provided us with personal information, we will take immediate steps to delete such data.

16. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our legal obligations, features, or data practices. We will notify you of material changes by updating the "Last updated" date at the top of this page and, where appropriate, providing prominent notice on our website. Continued use of the Service after changes indicates your acceptance of the updated policy.

17. Contact Us

If you have questions, comments, or data privacy requests regarding this Privacy Policy, please contact us at [email protected] or visit our Contact page.