Privacy Policy

1. Who we are

DealStacker (“we”, “us”, “our”) operates the website at deal-stacker.co.uk and the DealStacker Chrome browser extension. We are based in the United Kingdom and operate under UK GDPR and the Data Protection Act 2018.

For privacy queries, contact us at: privacy@deal-stacker.co.uk

2. What data we collect

Account data (if you sign in)

• Your email address — used only to send your magic sign-in link.
• Your saved loyalty card preferences (e.g. Nectar, Clubcard) — stored so we can personalise your stacking calculations.
• Your saved credit card preferences — stored to calculate cashback rates in your stack.

Extension data

• Product prices on retailer pages — the extension detects the price shown on a retailer page you are visiting in order to run the stacking calculation. This price is sent to our API and is not stored against your account.
• Session cookie — if you are signed in to deal-stacker.co.uk, the extension reads your session cookie from that domain only, to sync your saved cards automatically. No other cookies are accessed.
• Retailer page visits — the extension activates only on the 40+ UK retailer domains listed in its permissions. We do not track which pages you visit or your browsing history.

Price history data

We store snapshots of product prices over time to power the price history charts on our website. These snapshots contain product identifiers and prices only — no personal data.

Stack reliability feedback

When you tell us whether a stacked deal tracked successfully (👍/👎), we store your answer against the offer along with a random identifier so each browser counts once. To time a helpful follow-up, we also record which deals you click through to and when — this lets us ask, a couple of weeks later, whether your cashback or discount tracked. We store a hashed (irreversible) version of your IP for abuse prevention only — never the raw IP. None of this requires an account, and the random identifier is not linked to your identity.

Technical logs

Like all web services, our servers automatically record IP addresses, browser type, and request timestamps in standard server logs. These are retained for up to 30 days for security and debugging purposes only.

3. How we use your data

• To send you a magic sign-in link when you request one.
• To personalise stacking calculations with your saved loyalty and credit cards.
• To display price history charts on product search results.
• To improve and maintain the service.

We do not sell your personal data. We do not use your data for advertising profiling. We do not share your data with third parties except as described in section 5.

4. Marketing communications

If you ask to receive our weekly deals email, we process your email address to send it. This is separate from the magic sign-in link — signing in does not opt you into marketing, and we never pre-tick the box.

• Lawful basis: consent. We only send the newsletter to people who actively opted in and then confirmed via a link we email them (double opt-in).
• What we record as evidence of consent — the exact wording you agreed to, where you opted in, your IP address, and the date and time.
• Withdraw anytime. Every marketing email has a one-click unsubscribe link that works without signing in, and you can re-subscribe whenever you like.

We use Resend to deliver these emails (and our service emails). Resend processes the recipient address and email content on our behalf as a data processor. See Resend’s privacy policy.

5. Third parties

Supabase

We use Supabase (EU data centre) to handle authentication and store account data. Supabase is SOC 2 certified. Your email address and preferences are stored in our Supabase database. See supabase.com/privacy.

Affiliate networks (AWIN)

Product links on our site and extension are affiliate links via the AWIN network. When you click through to a retailer, AWIN may set a tracking cookie on that retailer’s domain to attribute any resulting commission to us. We do not receive your personal data from AWIN — only aggregate commission reports. See AWIN’s privacy policy.

Affiliate networks (Skimlinks)

With your consent (see section 9), our site uses Skimlinks (a Taboola company) to turn ordinary outbound retailer links in our content into affiliate links. When you click through to a retailer, Skimlinks may set a cookie or use similar technologies to attribute any resulting commission to us. We do not receive your personal data from Skimlinks — only aggregate commission reports. See Skimlinks’ privacy policy.

Vercel

Our website and API are hosted on Vercel. Vercel processes request data (IP address, headers) as part of serving pages. We also use Vercel’s privacy-friendly, cookieless Web Analytics to count anonymous page views and visits — it does not use cookies and does not track or identify individuals. See vercel.com/legal/privacy-policy.

6. Legal basis for processing

• Contract — processing your email to deliver the sign-in link you requested.
• Legitimate interests — storing your preferences to provide the personalised stacking service; maintaining security logs.
• Consent — for our weekly marketing email, which you can opt into and withdraw from at any time (see section 4).

7. Data retention

• Account data (email, preferences) — retained while your account is active. Deleted within 30 days of an account deletion request.
• Newsletter consent record — retained while you are subscribed and for a reasonable period after you unsubscribe, as evidence that consent was given and withdrawn.
• Server logs — retained for 30 days.
• Price history snapshots — retained indefinitely as aggregate product data (no personal data).

8. Your rights (UK GDPR)

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your account and personal data.
• Portability — receive your data in a machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent.

To exercise any of these rights, email privacy@deal-stacker.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the ICO (Information Commissioner’s Office).

9. Cookies and consent

deal-stacker.co.uk uses a single session cookie set by Supabase for authentication purposes — this is essential to signing you in and runs without consent. Our analytics (Vercel Web Analytics) is cookieless.

The Skimlinks affiliate script is a non-essential (marketing) technology and is only loaded after you opt in via the cookie banner shown on your first visit. If you accept, Skimlinks may set a cookie or use similar technologies solely to attribute affiliate referrals when you click an outbound retailer link (see section 5). If you decline, it is not loaded at all. We remember your choice locally (not in a cookie); to change it, clear this site’s data in your browser and the banner will appear again. We do not use advertising or profiling cookies. The Chrome extension reads only the Supabase session cookie on the deal-stacker.co.uk domain.

10. Chrome extension permissions

The DealStacker Chrome extension requests the following permissions:

• activeTab / scripting — to read the product price on the retailer page you are currently viewing.
• storage — to save your loyalty and credit card preferences locally in your browser.
• cookies — to read your deal-stacker.co.uk session cookie so your saved cards sync automatically when you are signed in.
• Host permissions (retailer domains) — to activate the extension on supported UK retailer websites only.

The extension does not read cookies from retailer websites. It does not capture form data, passwords, or payment details.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified via the website. The “last updated” date at the top of this page reflects the most recent revision.