Privacy and Cookie Policy

This Privacy Notice is issued by Student Outlets Inc. (referred to in this policy as "we", "us", or "our") and governs the processing of personal information on the Koupon.ai UK platform (the "Site"). We act as the "controller" under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Unlike our other regional operations, the Koupon.ai UK Platform maintains a strictly isolated data infrastructure. This means your personal information collected through this Site is stored and processed independently and is not shared with or integrated into our United States operations or any other regional databases. This isolation ensures that your data remains subject to the specific protections afforded by UK law. Our Site contains links to third-party merchant websites; once you navigate away from Koupon.ai via these links, you are subject to the privacy notices of those respective merchants. We do not exercise control over, and assume no liability for, the data processing practices of these external retailers.

In accordance with the UK GDPR, "personal information" refers to any data that identifies you as a specific individual, whether directly or indirectly. This includes direct identifiers such as your email address, as well as indirect identifiers like your IP address, browser metadata, and unique device identifiers that, when aggregated, could be used to distinguish your identity. Our "Services" consist of providing valid discount codes, deal aggregation, and a personalized user interface designed to enhance your shopping efficiency. We treat all such information with the highest standards of security and confidentiality.

We are committed to transparency in our communications. For all matters relating to your data privacy or to exercise your statutory rights, you may reach our Data Protection Liaison at contact@koupon.ai. General product support and inquiries should be directed to support@koupon.ai, or submitted via our digital portal. Our registered headquarters for formal legal service is located at Student Outlets Inc., 2225 W. Commonwealth Ave, Suite 306, Alhambra, CA 91803, USA. To ensure the security of your data, we may require you to verify your identity before processing specific requests related to your personal information.

The information we collect is strictly limited to what is necessary for the delivery of our Services. We currently do not support third-party social logins, such as Google or Facebook, meaning all account data is provided directly by you.

• Account Information: This includes your registered email address and an encrypted (hashed) version of your password.
• User-Generated Content: Information you voluntarily provide when saving a deal, following a specific store, or contributing to community feedback.
• Automated Technical Data: When you access our Site, our servers automatically record your IP address, device type, operating system, and unique hardware identifiers. We utilize this hardware-level data specifically to prevent fraud, such as the systematic creation of multiple accounts or the manipulation of deal popularity metrics through automated scripts.
• Affiliate Redirect Data: We record technical markers indicating which deal links you have interacted with to ensure the correct merchant redirection.

The collection of your email address is a contractual necessity to provide you with a personalized account experience. Without this information, we are unable to facilitate features such as "Saved Deals" or "Store Following." Technical data, including IP addresses and device identifiers, is collected as a fundamental security requirement. This data allows us to maintain the integrity of our voting systems and ensure that our Platform remains a trusted environment for all users. Failure to permit the collection of these technical markers may result in restricted access to certain interactive elements of the Site to prevent potential system abuse.

We process your personal information only when a valid legal basis exists under Article 6 of the UK GDPR.

• Contractual Necessity: We process your email and account details to fulfill our agreement to provide you with the Platform's core functionalities.
• Legitimate Interest: We rely on this basis for activities such as fraud prevention, platform security, and our affiliate marketing business model. Our legitimate interest lies in maintaining a sustainable and secure deal-sharing ecosystem that remains free for all users.
• Consent: We seek your explicit consent before sending any optional marketing communications or deploying non-essential analytical cookies.
• Legal Compliance: We process data when required to satisfy statutory, regulatory, or law enforcement obligations.

Koupon.ai is a commercial entity supported by affiliate marketing commissions. We do not offer direct cashback or financial rewards to users; instead, our revenue is derived from merchants when a successful referral is made. When you click a deal link or copy a promo code, you are redirected to the merchant's site through an affiliate network. This redirection involves the transmission of a non-identifying click-ID which signals to the merchant that the referral originated from Koupon.ai. This technical process is essential for the continued operation of our free Service. It is important to understand that the merchant, as an independent controller, will process your purchase data according to their own privacy standards once you leave our Platform.

We operate under a principle of strict data minimization and do not sell your personal information to any third parties. Your data is only shared with trusted service providers who act as our "processors," such as secure cloud hosting facilities and email delivery platforms. These processors are contractually prohibited from using your data for any purpose other than providing services to us. We may also disclose limited technical identifiers to affiliate networks solely for the purpose of confirming the success of a deal referral. We may be legally compelled to share information with UK law enforcement or regulatory bodies if required by a court order or to prevent criminal activity.

While your data is stored in a dedicated environment for the UK market, it is physically hosted on our secure infrastructure located in the United States. To ensure your information remains protected at the standards required by the UK GDPR, we utilize the International Data Transfer Agreement (IDTA) and Standard Contractual Clauses (SCCs). These legal instruments mandate that our US-based infrastructure provides data protection safeguards equivalent to those in the United Kingdom. Because our UK data is isolated, your information is not accessible to our US marketing teams or integrated into our broader global analytics.

We retain your personal information only for the duration of your active relationship with the Platform. If an account remains inactive for a period of three years, we will initiate a process to permanently delete or anonymize the data, unless a specific legal or tax obligation requires a longer retention period. We implement robust organizational and technical security measures, including end-to-end encryption for data in transit and strict access controls for our internal systems, to prevent unauthorized access, alteration, or disclosure of your information.

Our Site uses cookies to distinguish you from other users and to optimize site performance.

• Strictly Necessary Cookies: These are essential for core site functions, such as security tokens and session management.
• Functional Cookies: These allow the Site to remember your preferences, such as your UI layout or "Expired Deal" display settings.
• Affiliate Tracking Cookies: These are deployed when you click a deal link to facilitate the referral process. We do not use tracking cookies for behavioral advertising or cross-site profiling without your explicit consent, which can be managed via the Cookie Settings on the Site.

Under the UK GDPR, you possess significant rights regarding your personal information. You have the right to request access to the data we hold about you and to receive a copy in a portable format. You may also request the rectification of inaccurate data or the total erasure of your personal information (the "Right to be Forgotten"). Furthermore, you may object to processing based on our legitimate interests or request a restriction of processing while a dispute is being investigated. To exercise any of these rights, please contact us at contact@koupon.ai.

To exercise any of the statutory rights outlined in Section 12, please direct your request to contact@koupon.ai. When submitting a request, please describe the specific information or action you require and ensure that you provide any email addresses you have previously utilized on the Platform. We aim to respond to all legitimate requests within one month of receipt. However, if your request is particularly complex or if you have submitted multiple concurrent requests, we may extend this period by up to two additional months. In such instances, we will notify you of the extension within the initial month and provide regular updates regarding our progress. Please note that we generally do not charge a fee for the exercise of these rights. However, if a request is manifestly unfounded, repetitive, or excessive, we reserve the right, as permitted by the UK GDPR, to either charge a reasonable administrative fee for the provision of the information or refuse to comply with the request entirely. While you maintain the legal right to report concerns to the Information Commissioner's Office (ICO), we are committed to resolving any issues or grievances through our internal data protection liaison process as a primary step to ensure your satisfaction and data security.