Introduction

Thank you for considering joining our shappy community. We at shappy (“Company”, “we”, “us” or “our”) value your privacy and are committed to protecting your personal information and being transparent about how we collect, process, and use it. This Privacy Policy explains what information we collect from you when you use the shappy mobile application, browser extensions, website (including joinshappy.com), and any related services (collectively, the “Services”), how we use that information, and the rights and choices you have regarding your data. If you do not agree with any part of this Privacy Policy, please discontinue use of our Services.

We comply with applicable privacy and data protection laws, including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), New York’s SHIELD Act, and relevant personal data protection laws in the Gulf Cooperation Council (GCC) region (such as the Saudi Personal Data Protection Law and United Arab Emirates data protection laws). We strive to meet the highest global standards of privacy compliance.

1. Information We Collect

We collect personal information that you provide to us directly, information we collect automatically about your use of our Services, and information from third-party sources (such as if you choose to connect your email account for order tracking). The types of personal information we collect include:

• Account Information: When you sign up for shappy, we ask for your full name, email address, and phone number. If you create an account using a third-party login (e.g., Google, Apple), we will receive basic profile information such as your name and email from that provider, in accordance with their privacy settings. You will also create a password or use authentication through a third-party provider. We require that you provide accurate information and update it as needed.

• Shopping and Order Data: If you link your email inbox to shappy or otherwise grant us permission, we will securely access your retail and shopping-related emails only to help track your orders and find promo codes in those messages. Specifically, the shappy systems will identify relevant emails (such as order confirmations, shipping notifications, and promotional emails from retailers) and extract useful information like order status (tracking numbers, delivery updates) and discount codes. Importantly, we do not access personal or sensitive emails unrelated to shopping, and we do not use information from your email for any purpose other than providing our Services. We do not use this information for advertising or marketing purposes. If you connect a Gmail account, our use of data from your Gmail is subject to Google’s policies (including the Google API Services User Data Policy’s limited use requirements), and the same applies if you connect your Microsoft account. You can revoke shappy’s access to your email at any time via the shappy app or your email account settings.

• Browsing and Device Information: When you use our browser extension or app, we automatically collect certain information about your device and browsing actions. This may include your device type, operating system, browser type, IP address, unique device IDs, and your interactions with websites you visit where shappy is active. For example, our browser extension will detect the website you are shopping on and the contents of your shopping cart or checkout page to provide relevant coupon codes or price comparisons. It may also collect data such as the retailer’s name, product pages viewed, and whether a purchase was made (and for purchased items, basic transaction info like amount and whether an order was completed or returned). We do not collect any sensitive personal data through the extension (for instance, we do not collect credit card numbers), and we do not collect your browsing content beyond what is needed to provide the shopping-related Services.

• Usage Data and Analytics: We collect information about how you interact with our Services. This includes features you use, pages or screens you view, links you click, search queries within the app, and time spent on different parts of our Services. If we send you marketing emails or push notifications, we may collect data on whether you open the emails or engage with the content. This helps us understand what features are helpful to you and improve our Services. We may use cookies and similar tracking technologies (like pixels or mobile SDKs) to collect this usage data (see Cookies and Tracking Technologies below).

• Profile Inferences: Using the various data above, shappy may infer your preferences and interests to build a “smart profile” about you. For example, based on your shopping history and browsing, we might infer your preferred brands or product categories. We also learn from your order history (e.g., product types you buy, purchase frequency, favorite stores) to personalize product discovery and anticipate your needs. These inferences help power shappy AI, our personalized shopping assistant, so it can make recommendations or alerts tailored to you. (See How We Use Your Information below for more on personalization.)

• Contact and Support Information: If you contact us for support or feedback, we will collect the information you choose to provide in that communication (such as your name, email, and the contents of your message).

• Location Information (if applicable): We do not actively track your precise GPS location. However, your IP address may give us a general idea of your region or country, which can help us tailor the experience (e.g., showing relevant stores or complying with regional legal requirements). If we ever introduce features that use precise location, we will ask for your permission.

• Children’s Data: Our Services are not intended for anyone under the age of 18. We do not knowingly collect personal information from children under 18, and if we become aware that a child under 18 has provided us with personal data, we will delete it. If you are a parent or guardian and believe your minor child has provided personal information to shappy, please contact us (support@joinshappy.com) so we can take appropriate action.

2. How We Use Your Information

We use the collected information for the following purposes:

• To Provide and Maintain the Services: We use your information to operate shappy’s core functionalities. For example, we use your account info to create and secure your account and authenticate you at login. We use your browsing and shopping data to apply verified promo codes at checkout automatically, suggest deals, and show relevant discounts while you shop. We use your linked email data to show you order tracking information (e.g., package status) and surface any promo codes from your inbox, all within the app or extension interfaces. Essentially, your data enables shappy to function as your shopping assistant and provide a seamless experience across the app, extension, and other platforms.

• Personalized Product Discovery and Recommendations: Shappy leverages your data (purchase history, browsing behavior, saved items, etc.) to personalize the content you see. This includes recommending products you might like, showing you similar items or alternative options while you shop, and highlighting exclusive deals that match your interests. We also use your data to send you reminders and notifications that matter. For instance, a reminder when a product you showed interest in is dropping in price. Personalization is a key aspect of our Service, and we perform it in a way that respects your privacy (see Your Choices below for how you can control certain personalization).

• Shappy AI (Personalized Shopping Assistant) - COMING SOON: One of Shappy’s features is an AI-driven assistant that can provide tailored advice, answer questions about products or orders, and help you with shopping decisions. To make shappy AI truly personalized, we may use advanced algorithms and, when available, large language models (LLMs) by feeding your relevant data (e.g., your preferences, past orders, or queries) into these systems. We only share the minimum necessary information with such AI services and do so under strict controls. For example, if shappy AI uses a third-party LLM platform to generate a response for you, we either anonymize your personal data or use a secure context to protect your identity. We do not allow any AI service providers to use your data for their own purposes (such as training general-purpose models) beyond serving your requests, in accordance with their applicable data-handling policies. Using your data in this way helps Shappy AI give you more relevant and helpful answers or recommendations. If you prefer that we do not utilize your data with shappy AI, you may choose not to use the AI features; shappy’s core features (coupons and tracking) will still be available.

• Improving and Developing Our Services: We continuously work to improve shappy. We analyze usage data, bug reports, and feedback to understand how users interact with our Services and identify areas for improvement. For example, usage patterns might indicate whether a feature is not popular or whether a new coupon source is yielding significant savings for users. We also may use data (often in an aggregated, anonymized form) for research and development of new features or services. This could include training our algorithms to predict valid promo codes better or to improve the accuracy of product recommendations. Any insights we derive from analytics are used to enhance user experience, optimize performance, and innovate responsibly.

• Communicating with You: We use your contact information (such as your email or phone number) to send you service-related communications. These include confirmations or alerts (e.g., confirming your account creation, notifications of significant changes to our Terms or Privacy Policy), as well as transactional updates such as order status notifications. If you agree or as permitted by law, we may also send you marketing communications to inform you about new features, promotions, or content that we think could be of interest. For example, we might send a newsletter featuring top-trending deals or an offer from one of our retail partners. You can opt out of marketing emails or messages at any time (see Your Choices below).

• Safety, Security, and Fraud Prevention: We may use information to protect our users, our company, and our partners. This includes monitoring for fraudulent or suspicious activity on your account (for instance, if we detect login attempts from unusual locations), enforcing our Terms and Conditions, and generally ensuring the integrity of our platform. If necessary, we will use data to investigate potential violations of law or malicious actions. We also use technical data (like device information and IP addresses) to maintain the security of our Services.

• Compliance with Legal Obligations: In some instances, we may need to use or disclose your information to comply with a legal obligation under applicable law, regulation, legal process, or enforceable governmental request. For instance, we may retain and use some of your information for tax reporting, or respond to lawful requests by public authorities (such as for national security or law enforcement purposes). We will only disclose what is necessary and will inform you if permitted.

• Other Purposes with Consent: If we ever need to use your personal information for a purpose not covered above, we will explain it to you at the time and, if required, obtain your consent. You have the right to withdraw such consent at any time.

3. How We Share Your Information

We understand that your personal information is essential, and we do not sell your personal data to third parties for profit. However, we do share certain information with third parties in the following situations, ensuring that appropriate safeguards are in place:

• Service Providers: We employ trusted third-party companies and individuals to perform functions and provide services to us (e.g., cloud hosting providers, data analytics services, customer support software, email service providers for sending communications, etc.). These service providers will have access to your personal information only to the extent necessary to perform their tasks on our behalf and are obligated not to disclose or use it for other purposes. For example, we might use a cloud infrastructure service to store data, or an email delivery service to send verification emails. We contractually require these providers to handle your data securely and in compliance with applicable laws.

• AI Processing Partners: As mentioned, if shappy AI uses third-party AI platforms to process your data, we share some information with these platforms. This sharing is limited to what is needed for the service (such as a query or context that you provided) and is done under terms that protect your data (including, where applicable, agreements that the provider will not retain or use the data beyond the immediate query processing). In many cases, the data we send is anonymized or does not directly identify you.

• Retail Partners and Affiliates: When you engage with an offer or promotion through shappy (for example, clicking through a deal to a retailer’s site or using a coupon code we provided), we may share limited information with that retailer or affiliate network to validate and record the transaction for attribution and commission purposes. This typically does not include identifying details about you; rather, it uses an order ID or an affiliate identifier to signal that shappy was the source of the referral. Any data sharing in these cases is incidental to providing you the Service (for instance, to ensure you receive cashback or to ensure we get credit for a sale, which keeps our Service free). We do not provide our retail partners with your personal details, like your name or email, except as needed to complete a specific action you’ve requested (e.g., if you knowingly participate in a promotion that requires such information, we will tell you).

• Aggregated or Anonymized Insights: We may share aggregated, non-personally identifiable information publicly and with our partners. For example, trends in coupon usage or popular product categories that cannot be linked back to any individual user. This data is stripped of personal identifiers, combined, and used for industry analysis, marketing, and advertising by shappy or our partners. For instance, we might share statistics like “Users in Dubai saved X amount on electronics this month using shappy.” This information will not identify you.

• Business Transfers: If shappy or its parent company is involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider, your information may be transferred as part of that transaction. We would ensure the recipient of the data commits to a Privacy Policy with standards at least as strict as this one, and we will notify you of any change in data ownership or use, giving you choices if applicable.

• Legal Requirements and Protection: We may disclose your information to comply with applicable law or respond to valid legal process, including requests from law enforcement or government agencies, to investigate or participate in civil discovery, litigation, or other adversarial legal proceedings, to ensure compliance with know-your-client (KYC) and anti-money laundering rules (AML), and to enforce or investigate potential violations of our terms or policies.

• With Your Consent: In cases where you have explicitly consented to additional sharing (for example, if you opt in to a feature where shappy partners with another app and you authorize the exchange of information), we will share your information in accordance with that consent. You have the right to revoke your consent in these situations.

Importantly, any third parties with whom we share personal data are contractually bound to privacy and security obligations consistent with this Privacy Policy and applicable law. We do not allow them to use your personal data for their own marketing or other purposes without your consent.

4. Cookies and Tracking Technologies

shappy uses cookies and similar tracking technologies to provide, personalize, and improve our Services:

• Cookies: Small data files stored on your browser or device. Our website, app, and extension use cookies to remember your preferences (e.g., language or region), keep you logged in, and gather analytics about site usage. For example, cookies help us understand whether you are a new visitor or a returning user and how you navigate our site, which informs improvements.

• Browser Extension Local Storage: Our browser extension may use local storage or browser cookies to remember user settings and cache data (such as recently found coupons or your cart items for quick access). This is to ensure the extension works efficiently even without continuous server calls.

• Analytics Tools: We may use third-party analytics tools that employ cookies or scripts to collect information about how users interact with our Services. These tools provide us with aggregated insights (e.g., the number of users on a page and general usage trends). The information collected typically includes browser information, device information, time spent, pages visited, and referral URLs. This data helps us analyze usage and improve functionality. These third-party analytics providers process data on our behalf and are bound by privacy obligations.

• Advertising and Marketing Tags: Currently, shappy does not host third-party ads. If in the future we partner with advertising networks or run campaigns, we might use tracking pixels or similar technology in our emails or website to measure the effectiveness of campaigns (for instance, a pixel to see if you opened a promotional email). If any such technology involves sharing data (such as your device ID for ad attribution), we will update this policy and obtain consent where required by law.

• Your Choices for Cookies: You can control or disable cookies in your browser settings. Most web browsers automatically accept cookies, but you can usually modify your settings to decline cookies if you prefer. Please note that disabling certain cookies may affect functionality. For instance, the website might not remember your preferences, or the extension may not retain some settings if cookies/local storage are turned off. For our mobile app, you can control certain tracking via your device privacy settings (like resetting your mobile ad identifier or limiting ad tracking, which we honor).

5. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements. In general:

• Account Information: We keep your profile information and account data while your account is active. If you choose to delete your shappy account, we will delete or anonymize your personal information within a reasonable period after your request, except for information we are required or permitted to retain by law. For example, we may retain certain data for recordkeeping, such as payment or transaction records (if any), for legal compliance or in an aggregated form for business analytics.

• Browsing and Email Data: Information collected via the browser extension or email integration (such as identified promo codes and order statuses) is typically ephemeral and stored only long enough to perform the service or as part of your account history for your reference. For instance, your saved deals or tracked orders will persist in your account until you remove them or delete your account. However, raw email data fetched (such as whole email bodies) may only be processed transiently on our servers and not stored long-term, aside from extracted relevant details (such as “order shipped on X date”). We design our systems to avoid storing full copies of your personal emails whenever possible. Instead, we store the key order info or coupon codes derived from them.

• Analytics Data: Aggregated usage data that cannot identify an individual may be retained longer for historical analysis. If usage data is linked to your profile, it is treated as personal data and retained in the same way as other account data.

• Backup and Cache: It’s possible that residual copies of your personal information may remain in our backup systems for a short time after deletion, but these are governed by strict access controls and purged periodically.

• Legal Retention: If required for legal obligations or legitimate business purposes, such as resolving disputes or enforcing agreements, we might retain specific information as necessary. For example, if you made a purchase or earned rewards through shappy, we might keep records of that transaction for auditing.

6. How We Protect Your Information

We take the security of your personal information seriously. shappy implements appropriate technical and organizational measures (access controls, encryption, anonymization, etc.) to protect your data against unauthorized access, loss, misuse, or alteration.

However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security, and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

7. Your Rights and Choices

We believe in user empowerment when it comes to personal data. Depending on your location and subject to applicable law, you have certain rights regarding your personal information. These rights may include:

• Access and Portability: You have the right to request a copy of the personal data we hold about you and to receive it in a structured, commonly used, and machine-readable format.

• Correction (Rectification): If any of the personal information we hold is inaccurate or incomplete, you have the right to request that we correct or update it. You can also make certain changes directly by logging into your account.

• Deletion: You have the right to request deletion of your personal data (“right to be forgotten”). Deleting your shappy account will remove most of your data from our active systems, but please note we might retain minimal information as noted in our Data Retention section.

• Withdrawal of Consent: If we are processing your personal information based on your consent (for example, if you gave us consent to read your inbox for order tracking or to receive marketing emails), you have the right to withdraw that consent at any time.

• Objection to Processing: In certain jurisdictions, you have the right to object to our processing of your personal information, particularly if we are doing so based on legitimate interests. If you object, we will evaluate the request and cease or adjust processing unless we have compelling legitimate grounds to continue or as otherwise permitted by law. For marketing emails, you can always opt out by using the unsubscribe link in the email or adjusting your preferences in-app.

• Restriction of Processing: You have the right to request that we restrict the processing of your personal information under certain circumstances, such as if you contest the accuracy of the data or if the processing is unlawful but you oppose deletion. When processing is restricted, your data will be stored rather than actively processed until the issue is resolved.

• Complaint to Authorities: If you believe we have infringed your privacy rights or local privacy laws, please contact us at support@joinshappy.com, and we will do our best to resolve it. You can also choose to file a complaint with the relevant data protection authority.

We will need to verify your identity before fulfilling certain requests. We will try to respond to your request within the timeframe required by law (30 to 45 days). There is no charge for making these requests, though repetitive or excessive requests may incur a fee as permitted by law.

8. International Data Transfers

shappy is a global service. The personal information we collect may be transferred to and stored on servers in countries different from your own. In particular, if you are using our Services from the Gulf region (GCC) or Europe, please be aware that your data may be processed in countries such as the United States or other jurisdictions where some of our service providers or infrastructure are located.

We take steps to ensure that appropriate safeguards (in accordance with applicable laws) are in place to protect your data during such transfers.

By using shappy, you understand that your information may be transferred to our facilities and those third parties with whom we share it as described in this policy, even if they are located in other countries. We will always strive to protect your personal data, no matter where it is processed.

9. Third-Party Links and Services

Our Services may contain links to third-party websites or integrations with third-party services that we do not own or control, such as retailer websites you visit via shappy or links to social media accounts. This Privacy Policy does not apply to information collected on those external sites or services. We encourage you to review the privacy policies of any third-party websites or services you visit or use. For example, if you click a coupon in shappy and are taken to a merchant’s site, any data you provide to that merchant is governed by their privacy practices, not shappy’s.

That said, we do try to work only with trusted partners. If you have a concern about a third party with whom shappy Services interacts (for instance, a retailer we showed you a deal for), let us know, and we will do our best to help or clarify how your data may have been shared in that process.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will update the “Last Updated” date at the top of this Policy. If the changes are significant, we will provide a more prominent notice (such as by emailing you or displaying a notification within the app or extension). We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

If you continue to use shappy’s Services after a revised Privacy Policy has become effective, you are deemed to have accepted the updated terms. However, if a change requires your consent (for example, if we plan to use your data for a new purpose that requires consent under law), we will obtain that consent before the new processing begins.

11. How to Contact Us

If you have any questions or concerns about this Privacy Policy or shappy’s data practices, or if you wish to exercise your rights regarding your personal information, please contact us at support@joinshappy.com.

We will respond to your inquiries as soon as reasonably possible, and within any timeframe required by law. Your privacy is extremely important to us, and we welcome feedback that helps us improve our policies and practices to better protect your rights and data.

Thank you for trusting shappy with your personal information. We are committed to keeping that trust by treating your data with care and respect, and by continuing to put your privacy first.