Privacy Policy

1. The short version

KEY-DEALS is a price comparison site. The only personal data we hold is what you give us when you choose to create an account: an email address, a display name, your wishlist, and anything you post publicly as a review or comment. Everything else we store about how the site is used is a counter with no name attached to it.

This policy explains all of it — what we collect, why, who it reaches, how long we keep it, and what you can ask us to do with it.

2. Who is responsible for your data

The company that will operate KEY-DEALS is being established, so this policy does not yet name it. We would rather leave that blank than print the name of an entity that will not be the one responsible — a wrong name here would tell you the wrong thing about who to hold to account. This section will carry the company name, registered address and registration details as soon as they exist, and the date at the top of the page will change when it does.

In the meantime, every question, request and complaint about your data reaches us at key-deals@outlook.com, and is answered on the terms set out in section 11.

3. What we collect

If you never create an account, we hold nothing that identifies you. You can browse, search, filter, compare and follow links out to shops without giving us anything at all.

If you create an account, we hold:

• your email address, and a password that is stored only as a cryptographic hash — we never see it and cannot recover it;
• a display name and, if you have one, a profile picture. If you sign in with Google, the name, email address and picture come from your Google account;
• when the account was created, and when it was last used;
• your wishlist — which products you saved, and when;
• any review, rating or comment you post, with your display name and picture against it. These are public.

Whether or not you have an account, the site also handles:

• Your country — two letters, nothing finer. Our hosting provider works it out at the network edge and passes it to the page so we can show you which regional restrictions apply to you. It is used for that one answer and is not stored.
• A reader count on product pages. Your browser generates a random identifier that lives only until you close the tab, so the page can show how many people are looking at it. It is not linked to you or to an account, and it is discarded shortly after you leave.
• Counters. We count how many times a product page is opened and how many times each listing is clicked. These are plain numbers against a product — no identifier of any kind is recorded alongside them, so they cannot be traced back to a person.
• Small items stored in your own browser — your theme choice, display preferences, and your sign-in session if you have one. These stay on your device. Section 7 covers them.

4. Why we process it, and on what basis

• To run your account and your wishlist — because it is necessary to provide the service you asked for (Article 6(1)(b) GDPR).
• To publish your reviews and comments — the same basis; posting is a thing you chose to do.
• To show the right regional information — our legitimate interest in showing you information that applies where you are (Article 6(1)(f)).
• To count views and clicks, and to keep the site secure — our legitimate interest in understanding which products matter to readers and in protecting the site from abuse (Article 6(1)(f)). Because these counters hold no identifier, the effect on you is close to none.
• To send you service email — confirming your address and letting you reset your password. Necessary to run the account.

5. What we do not do

This is worth stating as plainly as the rest, because much of it is unusual:

• We do not log your IP address. No part of this site records it. Our hosting provider necessarily sees it in order to route your request, and uses it to derive the two-letter country described above, but it never reaches us and we never store it.
• We take no payments, so we hold no card details, no billing address and no purchase history. There is no payment processor involved in this site at all.
• We run no analytics product — no Google Analytics, no Matomo, no heatmaps, no session recording, nothing of that kind.
• We run no advertising and no advertising trackers, and we do not build a profile of you or follow you across other websites.
• We never sell, rent or trade personal data, and we do not share it for anyone else’s marketing.
• We send no marketing email, because there is nothing to subscribe to. If that changes, it will be opt-in and you will be asked.
• We do not collect special-category data — nothing about health, beliefs, politics or anything else in Article 9 GDPR. Please do not send us any.

6. Who else can see it

Two providers process data on our behalf, under contract, on our instructions and for no purpose of their own:

• Our database, sign-in and file storage provider, which holds accounts, wishlists, reviews and comments, and runs the authentication and the service email that goes with it.
• Our hosting provider, which serves the site and resolves the country described in section 3.

Both are established outside the European Economic Area or have parent companies that are. Where data is transferred outside the EEA it is covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard under Chapter V GDPR, with encryption in transit and at rest.

Separately, some things on our pages are loaded by your browser directly from other companies, which means those companies see the request your browser makes:

• cover images and artwork served from sellers’ own image servers;
• video trailers from YouTube, embedded in privacy-enhanced mode so that YouTube does not set tracking cookies unless you actually press play;
• profile pictures, served from Google if you signed in with Google, or from a generated-avatar service otherwise.

We may also disclose data where the law requires it, or to establish or defend a legal claim.

7. Cookies and things stored on your device

We set no advertising or analytics cookies. There is nothing on this site that follows you anywhere else, which is why you are not asked to dismiss a consent banner.

What we do use is local storage in your own browser, for a small number of strictly necessary things: your light or dark theme choice, a few display preferences such as currency, a short-lived identifier for the reader count described in section 3, and — if you are signed in — your session, which is what keeps you signed in between pages. None of it is sent anywhere for tracking, and clearing your browser data removes all of it.

Third-party content described in section 6 may set its own storage when it loads. YouTube in particular is embedded in its no-cookie mode specifically to avoid this until you choose to play a video.

8. When you click through to a shop

Most links here lead to other companies’ websites. When you follow one, that shop receives the normal information any website receives when you visit it, including the fact that you arrived from here, and they may set their own cookies to credit us with the referral. What happens from that point is covered by their privacy policy, not this one.

We are told by those partners only that a sale happened and what it was worth. We do not receive your name, your email address, your card details or what you bought as an identifiable person.

9. How long we keep it

• Account, profile and wishlist — for as long as the account exists. When you close it, these are deleted.
• Reviews and comments — these stay published after an account closes, because removing one side of a conversation makes the rest unreadable. Ask us and we will take your name off them or delete them.
• The reader-count identifier — minutes. It is cleared shortly after you stop looking at the page, and in any case when you close the tab.
• View and click counters — kept indefinitely, because they are numbers against a product and contain nothing about you.
• Email you send us — up to three years, so we can follow up on anything unresolved.

10. Your rights

Under the GDPR you can ask us to:

• give you a copy of the personal data we hold about you, and tell you what we do with it (Article 15);
• correct anything inaccurate or incomplete (Article 16);
• delete it — the right to be forgotten (Article 17);
• restrict what we do with it while something is disputed (Article 18);
• hand it over in a portable, machine-readable format (Article 20);
• object to processing we base on legitimate interests (Article 21);
• withdraw consent at any time where we rely on it, without affecting what was done before (Article 7(3)).

We do not make any decision about you by automated means that has a legal or similarly significant effect, so Article 22 does not arise.

11. How to use those rights

Email key-deals@outlook.com. It costs nothing. We will reply within one month, and will tell you if we need longer because the request is complicated, as Article 12 allows. We may need to check that the request really comes from you before we act on it — that is to stop somebody else getting your data, not to slow you down.

If you are unhappy with how we have handled your data you can complain to the data protection authority in the EU country where you live, where you work, or where you think the problem happened. We would appreciate the chance to put it right first.

12. Security

All traffic to and from the site is encrypted in transit. Data is encrypted at rest by our database provider. Passwords are stored only as hashes. Administrative access is limited to the people who need it.

No system is perfect. If a breach happens that is likely to put your rights at risk, we will report it to the relevant supervisory authority within 72 hours of becoming aware of it, and tell you directly where the risk to you is high.

Your part: use a password you have not used elsewhere, and email us at key-deals@outlook.com if you think somebody has got into your account.

13. Children

Accounts here are for people aged 16 and over, and we do not knowingly collect personal data from anyone younger. If you believe a child has registered, tell us at key-deals@outlook.com and we will remove the account and its data.

14. Changes to this policy

We will update this page when what we do changes — a new feature, a new provider, a change in the law. The date at the top shows when the wording last changed. Where a change is significant and you have an account, we will email you before it takes effect.

15. Contact

For anything in this policy, or to use any of the rights in section 10, email key-deals@outlook.com.