Privacy Policy

Last updated: October 14, 2026

1. Who We Are

CardDeals LLC ("CardDeals", "we", "our", or "us") operates carddeals.co, the CardDeals browser extension, our public deal API and MCP server, and related services (the "Service"), and is responsible for the personal information described here. This policy explains what we collect, how we use and share it, how long we keep it, and the choices you have.

2. Data Categories at a Glance

The table below summarizes each category of personal information we collect, whether it is linked to your identity, whether it is used for advertising or cross-site tracking, and why we collect it, including for purposes of U.S. state privacy laws such as the California Consumer Privacy Act as amended by the CPRA.

Data Category	Specific Data Elements	Linked to You?	Used for Ads or Cross-Site Tracking?	Primary Purpose
Identifiers	Name, email address, account ID, IP address, browser user agent, cookie identifiers, and random IDs stored in your browser or the extension	Yes	Yes, where analytics is allowed: when you are signed in, Google Analytics receives your account ID and a hashed copy of your email address	Authentication, account management, security, fraud prevention, analytics
Identity Verification (buyers of supply-partner cards, and people who sold us cards)	The result of the identity check run by Didit, including details read from your ID document (such as your name and document number) and the outcome of selfie, liveness, face-match, and screening checks	Yes	No	Verifying buyers and sellers, preventing fraud, chargebacks, and money laundering, legal compliance
Financial & Transaction Info	Gift cards you bought from us or sold to us, amounts, order and payout status, Stripe payment and payout-account references, and the encrypted number and PIN of each card you sold us. Stripe collects your payment card, bank, and crypto wallet details; we do not receive full card or bank account numbers.	Yes	No	Order fulfillment, payouts for cards sold to us, refunds, fraud prevention, accounting and tax records
Commercial Activity	Orders, cards you sold us, price alerts, brand requests, and offers or sponsored links you click	Yes (if signed in)	Affiliate networks attribute purchases you make after clicking a partner link	Service functionality, price alerts, order history, commission attribution
Internet & Usage Activity	Pages viewed, referring page, campaign (UTM) parameters, search terms, offer and banner clicks, and session replays of the sign-in, sign-up, brand, and /sell pages with form inputs masked	Pseudonymous; linked to your account in Google Analytics and PostHog if you are signed in	Yes: Google Analytics advertising features, where analytics is allowed (see Section 4)	Analytics, product improvement, brand popularity rankings, sponsored placement rotation
Communications & Feedback	Messages you send to support or through our contact form, and ratings or comments you submit as browser extension feedback	Yes (messages); No (extension feedback)	No	Customer support, product feedback
Approximate Location	Country (and, in Google Analytics, region or city) derived from your IP address	No	No	Analytics, security
Diagnostics & Telemetry	Browser and operating system details, website error events, and browser extension version	No	No	Debugging, bot filtering, security

3. Information We Collect

We collect information directly from you, automatically when you use the Service, and from third parties:

Account & Profile Data: Your email address, an optional name, and your password, which we store only as a salted hash. If you sign in with Google, we receive your name, email address, and profile picture from Google.
Buying a Card from CardDeals: The email address the card should be delivered to (which may be a gift recipient's) and your order details. You enter payment details on Stripe's checkout page, including any bank account you link to pay by bank transfer (ACH) or crypto wallet you connect to pay with stablecoins; we keep Stripe's payment reference, not your card or bank account number. Before your first purchase of a card we source from a supply partner, you verify your identity with Didit, which collects a photo of your ID and a selfie and runs automated document, liveness, and face-match checks. We keep the result, including details read from your ID, link it to your purchases, and add Didit's reference to the Stripe payment so we can respond to a chargeback. If you think a verification result is wrong, contact us.
If You Sold Us a Card: The card's brand, balance, number, and PIN (encrypted before we store them), any notes you added, Didit's verification result (including details read from your ID), and your Stripe Connect account ID and status. Stripe holds the bank details used to pay you; we do not.
Price Alerts & Brand Requests: The brands and discount thresholds you set alerts for, and the brands you ask us to add.
Support Communications: Your email address and message when you email us or use our contact form, and our replies.
Usage, Device & Network Data: Pages viewed, searches, clicks, referring pages, campaign parameters, IP address, browser and operating system details, and approximate country, collected for analytics, security, and fraud prevention.
Cookies, Browser Storage & Pixels: As detailed in Section 4.
From Third Parties: Sign-in details from Google, verification results from Didit, payment and payout status from Stripe, and commission reports from affiliate networks (such as order references and sale amounts), which we do not link to your identity.

4. Cookie Policy & Tracking Technologies

Cookies, browser storage, and pixels store or read information on your device. Whether optional analytics runs before you make a choice depends on where your browser indicates you are:

Consent regions: If your browser's time zone or language indicates that you are in Europe (including the EEA, the United Kingdom, and Switzerland) or Brazil, we load Google Analytics and PostHog only after you click "Accept All" in our cookie banner. You can change your choice at any time with the Cookie Preferences link in the footer.
Everywhere else (including the United States and Canada): Google Analytics and PostHog load automatically. You can opt out of both with Global Privacy Control, as described at the end of this section.

Strictly Necessary Cookies

These cookies keep you signed in and remember your cookie choice. They cannot be disabled.

Cookie	Provider	Purpose	Duration
carddeals_cookie_consent	CardDeals	Stores your cookie choice, including an opt-out recorded from a Global Privacy Control signal	13 months
__Secure-better-auth.session_token	CardDeals	Keeps you signed in on carddeals.co and api.carddeals.co	7 days, renewed while you use the Service
__Secure-better-auth.session_data	CardDeals	A short-lived, signed copy of your session that saves a lookup on each request	2 minutes

Analytics (Consent in Consent Regions / Opt-Out Elsewhere)

These tools help us understand how visitors use the Service and measure our marketing. They follow the consent and opt-out rules described above.

Cookie / Tag	Provider	Purpose	Duration
_ga, _ga_*	Google Analytics 4	Distinguishes visitors and sessions and measures pages and events. When you are signed in, we also send your CardDeals account ID and a hashed copy of your email address for cross-device and conversion measurement. Our tag permits Google's advertising features; where Google signals is active, Google may associate this activity with your Google account.	Up to 2 years
ph_*_posthog (local storage)	PostHog (U.S. cloud)	Product analytics, linked to your CardDeals account ID when you are signed in, and session replays of the sign-in, sign-up, brand, and /sell pages with all form inputs masked	Until cleared

To control how Google uses this data for ads, use Google's Ads Settings.

Affiliate Partners (Not Controlled by the Cookie Banner)

These load for all visitors, regardless of your cookie choice:

Technology	Provider	Purpose	Duration
Impression pixels	Rakuten Advertising, Awin	Sponsored banners load a small image from the affiliate network that counts each time the banner is shown	Set by the network
Affiliate links	Rakuten Advertising, Awin, CJ, and providers' own affiliate programs	When you click a provider or sponsored link, you pass through the network or provider, which may set its own cookie to credit a purchase to CardDeals. We add only a reference to the placement you clicked, never your name or email address.	Set by the network or provider

First-Party Measurement

For every visitor, our website records page views and interactions such as searches and clicks, together with a random ID stored in your browser, the page and referring page, campaign parameters, your browser's user agent, and your country. These events go to our own servers and are stored with our analytics provider, Axiom. We use them to count traffic, rank popular brands, and weight sponsored placements, not to target ads to you. They are not affected by the cookie banner or Global Privacy Control.

Browser Storage

We also use local storage (kept until you clear it) and session storage (cleared when you close the tab). None of it is shared with advertisers:

Site features: your name, email address, and profile picture while you are signed in (removed when you sign out), brands you recently searched or asked us to add, a price alert in progress while you sign in, whether you have visited before or dismissed a promotion, whether the cookie banner has been shown, and which sponsored banner design you saw, so it stays the same during your visit.
Measurement: the random ID attached to our first-party events (carddeals_session_id), a random visit ID used to count each brand page view once per visit, and the campaign (UTM) parameters of the link that brought you here.
PostHog: analytics state (ph_*_posthog), created only once PostHog is allowed to run.

Global Privacy Control (GPC) & Opt-Out

If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out of Google Analytics and PostHog in every region: we do not load them, even if you accepted them earlier in our cookie banner, and we save the opt-out in the carddeals_cookie_consent cookie. GPC applies only to those two tools: it does not turn off affiliate network pixels or our first-party measurement. You can also block or delete cookies in your browser settings. Where our cookie banner applies, you can change your choice at any time with Cookie Preferences in the website footer.

5. How We Use Your Information

To provide, maintain, and improve our gift card comparison and buying features
To fulfill and deliver orders for gift cards sold by CardDeals, including deciding from your order history when a card paid by bank transfer can be delivered, and from the security checks Stripe reports on a card payment (such as card authentication and the card's issuing country) when a card paid by card can be delivered (see Section 5 of our Terms of Use)
To complete payouts, and keep records, for cards you sold us
To verify the identity of buyers of cards we source from a supply partner, and to respond to chargebacks on those purchases
To send transactional emails, such as order and payout updates, and the price alerts you set up
To authenticate you and protect against unauthorized account access
To analyze usage, diagnose errors, and review masked session replays of the sign-in, sign-up, brand, and /sell pages (where analytics is allowed)
To rank popular brands and rotate sponsored placements using aggregated click data
To measure marketing performance and affiliate commissions, and to show sponsored placements
To detect and prevent fraudulent transactions, theft, money laundering, and security incidents
To comply with legal obligations, such as tax and record-keeping requirements, and to respond to lawful requests and copyright notices

6. Legal Basis for Processing (EEA/UK Users)

If you reside in the European Economic Area or the United Kingdom, our legal bases for processing personal data under GDPR include:

Consent: For Google Analytics (including its advertising features) and PostHog analytics and session replay. You may withdraw consent at any time with Cookie Preferences in the footer.
Contractual Necessity: To create your account, fulfill gift card purchases, complete payouts for cards you sold us, and send the price alerts you request.
Legitimate Interest: For fraud prevention, platform security, bot detection, first-party measurement of how the Service is used, and improving the Service.
Legal Obligation: To comply with applicable tax laws, consumer protection statutes, and regulatory reporting requirements.

7. Information Sharing & Third-Party Features

We do not sell personal information for money. We disclose information only to the following categories of recipients:

Payments & Payouts: Stripe processes payments and refunds for cards sold by CardDeals and payouts for cards sold to us (through Stripe Connect).
Identity Verification: Didit verifies the identity of buyers of cards we source from a supply partner, and verified people who sold us cards.
Analytics: Google Analytics and PostHog receive usage data where analytics is allowed, including your CardDeals account ID when you are signed in; Google Analytics also receives a hashed copy of your email address. Form inputs are masked in PostHog session replays. Axiom stores our first-party measurement events.
Affiliate Partners: Affiliate networks (Rakuten Advertising, Awin, and CJ), and providers' own affiliate programs receive information about ad and banner impressions and the links you click. We do not give them your name or email address.
Fulfillment Partners: When you buy a card that we source from a supply partner, such as CardCenter, we order it under a CardDeals order reference and do not share your name or email address.
Communications: Resend delivers our transactional and price alert emails, and our email hosting provider stores support correspondence.
Infrastructure & Security: Cloudflare (content delivery, security, and the servers that run our APIs) and Hetzner (servers and databases in the United States).
Sign-In: Google, if you choose to sign in with Google.
Legal Requirements & Business Transfers: When required by law or in connection with a corporate merger, acquisition, or asset sale.

8. International Data Transfers

Our servers and databases are located in the United States, and many of our service providers process data there. If you use the Service from outside the United States, your information will be transferred to and processed in the United States and other countries where our providers operate. Where required by law, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses approved by the European Commission) to protect your data during international transfer.

9. Data Security

We use administrative, technical, and physical safeguards to protect personal information. Connections to the Service are encrypted with TLS. Gift card numbers and PINs are encrypted (AES-256-GCM) before we store them, and cards you buy are delivered through a secure link rather than in the body of an email. Passwords are stored only as salted hashes. Access to customer data is limited to authorized team members, and our databases accept connections only from approved servers. However, no electronic transmission or storage method is completely secure, and we cannot guarantee absolute security.

10. Data Retention

We keep account information while your account is open. We keep records of orders, card sales, payouts, refunds, and identity verification for as long as we need them for accounting, tax, warranty, fraud-prevention, and legal purposes, even after you close your account. Analytics data is kept according to the retention settings of the analytics providers described above. To delete your account, email us; we complete verified deletion requests within thirty (30) days, except for records we are required or permitted by law to keep.

11. Your Rights & Regional Notices

Depending on your jurisdiction, you have specific statutory rights regarding your personal information:

Right to access, inspect, and receive a copy of your personal data
Right to correct inaccurate or incomplete information
Right to request deletion of your personal data
Right to object to or restrict certain processing activities
Right to data portability in a structured, machine-readable format
Right to withdraw consent for analytics and tracking cookies at any time

California Residents (CCPA / CPRA Notice)

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), California residents have the right to know what categories of personal information we collect, the business purposes for which it is used, and to request deletion or correction of personal data.

Sale and Sharing of Personal Information: CardDeals does not sell personal information for money. Google Analytics' advertising features may use information collected on our site for cross-context behavioral advertising, which the CPRA treats as "sharing," and you have the right to opt out of it. To opt out, turn on Global Privacy Control in your browser, which turns off Google Analytics and PostHog on our site (see Section 4).

Sensitive Personal Information: We use identity verification data only to verify identity, prevent fraud, respond to chargebacks, and meet legal obligations, and we do not use it to infer characteristics about you.

To exercise your CCPA/CPRA rights, email us at [email protected]. We do not discriminate against users for exercising their privacy rights.

European Economic Area & UK Residents (GDPR)

Under the GDPR and UK Data Protection Act, you have the right to lodge a complaint with your local supervisory authority and exercise your rights of access, rectification, erasure, and restriction. Contact us at [email protected].

12. Third-Party Links

Our Service contains links to third-party gift card providers and external websites. We are not responsible for the privacy practices, content, or terms of third-party platforms. We encourage you to review their privacy policies before providing personal information or completing purchases on their sites.

13. Browser Extension Privacy & Security

The free CardDeals browser extension (available for Chrome, Firefox, and Edge) works without an account and handles data as follows:

Domain Matching on Your Device: On each page, the extension compares the site's domain with a list of supported brand domains that it downloads from us. It also checks the page address on your device to recognize checkout pages; that address is not sent anywhere.
What It Sends: Only when the domain matches a supported brand does the extension ask our servers for that domain's offers. We log that lookup (the domain, brand, time, and a random ID the extension creates for your installation) and, when offers are shown or clicked, which offer, provider, and discount, whether you were on a checkout page, and your browser name and extension version. We use these events to measure the extension and rank popular brands. Full URLs, page paths, query strings, search queries, and visits to unsupported sites are never sent.
No Page Content or Keystrokes: The extension does not read page content, form fields, passwords, or payment details. It shows offers in its own isolated panel.
On-Device Storage: Your settings, cached offers and brand domains, the random installation ID, when you last saw or dismissed offers for each brand, and, if you buy a card from CardDeals through the extension, the email address you entered so that it can be prefilled next time.
Purchases, Feedback & Uninstall: If you buy a card from CardDeals through the extension, your email address goes to CardDeals and Stripe to complete checkout. Ratings and comments you submit as feedback are stored by us. When you uninstall, your browser opens an optional survey hosted by Tally.
Brand Logos: Logos are loaded from Brandfetch's image service, which receives your IP address and the brand being shown.
No Sale of Extension Data: We do not sell extension data, and the extension does not add affiliate codes to the pages you visit; when you click an offer, it opens the provider link from our catalogue, which may be an affiliate link.

14. Children's Privacy

CardDeals is intended for adult consumers and is not directed to individuals under the age of 16 (or the age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If we discover that a child has provided us with personal information, we will take immediate steps to delete such data.

15. Changes to This Policy

We update this policy when our features, providers, or legal obligations change. We will post the new version here with a new "Last updated" date and, for material changes, give prominent notice on the website or by email.

16. Contact Us

If you have questions, comments, or data privacy requests regarding this Privacy Policy, please contact us at [email protected] or visit our Contact page.