Privacy Policy for Offerlash

Last Updated: October 28, 2026

1. Introduction

Welcome to Establishment Offerlash ("we," "us," or "our"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App"), visit our website (the "Site"), and use our services (collectively, the "Services").

By using our Services, you agree to the collection and use of information in accordance with this policy. Your use of our Services is also governed by our Terms and Conditions and, if you use our mobile application, our End-User License Agreement (EULA).

2. Information We Collect

We collect information that you provide directly to us, information we collect automatically, and information from third parties.

2.1. Information You Provide to Us

• Account & Profile Information: When you sign in or create an account (using Google, Apple, or other enabled sign-in methods), we collect basic account details such as your name, email address, and profile photo. You may also optionally add a public handle, display name, bio, mobile number, gender, birth date, social links, and optional analytics or advertising settings for your public profile.
• User-Generated Content & Feedback: We collect the content and interactions you submit to our Services, including coupons, deals, store and offer ratings, comments, and content reports.
• Communications: If you contact us directly (for example, by email or customer support), we receive your contact details and the contents of your message.

2.2. Information We Collect Automatically

• Usage Data: We collect information about how you interact with our Services, including the pages and profiles you view, searches and filters you use, coupons you copy or save, and stores you visit or follow.
• Device & Connection Information: We collect basic information about the device and browser you use, including device model, operating system, app version, language and theme preferences, IP address, and general diagnostic data.
• Clipboard Access: When you use the "Copy Code" feature to copy a coupon code, we copy that code to your device clipboard for your convenience. We never read, monitor, or access existing clipboard content.
• Security & Activity Logs: When you use our Services, we record basic connection and security details, such as IP address, browser or device type, language, and sign-in status. We use these logs for security, fraud prevention, and troubleshooting.
• Referral Attribution & Personalization: When you arrive through a referral link or visit a creator's public profile before signing in, we may keep a referral record in your browser for up to 7 days. Referral information helps credit visits and registrations, personalize offer order, and select the affiliate credited through deal links. These records are not used for cross-site profiling.
• Website Analytics, Diagnostics, and Advertising (Optional): On offerlash.com, analytics, performance monitoring, error reporting, and personalized advertising are enabled by default and can be turned off at any time in our Privacy & Consent Settings. When enabled, we use analytics and diagnostic tools (PostHog, Google Analytics, Google Tag Manager, Microsoft Clarity, and Sentry) and measure campaign visits and creator signups (including via X). Public creator profiles may also run the creator's configured analytics or advertising measurement tools (Google Analytics, Google Ads, Meta, TikTok, or Snapchat) when your privacy settings allow them.
• Smart Links & Install Attribution: We use LinkForty on our Website and App to route smart download and referral links and attribute app installs and registrations. Attribution operates on a best-effort basis using available referral and device signals and is not guaranteed to be 100% accurate.
• Public Trust and Launch Badges: Unless analytics is disabled, we display TrustedSite verification badges on public pages. Product Hunt badges may also appear on public pages.

3. How We Use Your Information

We use the information we collect for various purposes, including to:

• Provide, operate, and maintain our Services and Creator Studio features.
• Process, display, and moderate the coupons, deals, and profile content you submit.
• Communicate with you regarding account activity, security alerts, and promotional updates. Push notifications require your permission on your device or browser and can be disabled at any time. Engagement emails (such as creator onboarding tips) are sent to verified emails by default. You can turn them off anytime in notification settings or via the unsubscribe link.
• Monitor and analyze trends, usage, and reliability across our Website and App.
• Personalize your experience, such as remembering your language, theme, and followed stores, and using referral information to help order offers.
• Maintain security logs and referral records to comply with legal obligations, enforce our Terms, and prevent fraud or abuse.

4. How We Share Your Information

We do not sell your personal information. However, we may share information in the following situations:

• With Your Consent or Direction: We share information when you direct us to do so, including when you publish a public creator profile or public offers.
• Third-Party Service Providers: We share necessary information with service providers who help us operate, secure, analyze, and support our Services.
• Affiliate Partners & Public Profile Owners: When you follow an affiliate link, basic referral information may be shared with the merchant or affiliate network to credit the purchase. If you visit a creator's public profile while analytics and advertising settings are enabled, interaction activity on that profile may be shared with the analytics or advertising tools configured by that creator.
• For Legal Reasons: We may disclose information if required by applicable law, regulation, legal process, or governmental request.

5. Third-Party Services

Our Services integrate with trusted third-party providers to deliver core functionality, analytics, and communications:

• Authentication, App Analytics & Crash Reporting (Google Firebase): We use Firebase for user authentication (including Google, Apple, email, and phone verification), mobile app analytics, performance monitoring, and crash reporting.
• Product & Behavioral Analytics (PostHog, Google Analytics, Google Tag Manager, and Microsoft Clarity): We use these tools across our Website and App to understand how users navigate and interact with features when analytics is enabled.
• Smart Links & Attribution (LinkForty): We use LinkForty on our Website and App to manage smart links, support deep linking, and attribute referrals and app installs using direct or estimated matching.
• Push Notifications (Firebase Cloud Messaging and OneSignal): We use Firebase Cloud Messaging and OneSignal to deliver optional push notifications on mobile devices and web browsers. You can opt out at any time in your device, browser, or account settings.
• Advertising & Creator Profile Measurement (X, Google Ads, Meta, TikTok, and Snapchat): When analytics and personalized advertising are enabled, we use the X Pixel to measure Offerlash marketing campaigns. Public creator profiles may also run the creator's configured Google Ads, Meta, TikTok, or Snapchat tags when those categories are enabled.
• Error & Performance Monitoring (Sentry): We use Sentry on our Website and backend services to detect application errors and monitor performance in accordance with its privacy policy.
• Security & Abuse Verification (Google reCAPTCHA): We use Google reCAPTCHA during security-sensitive verification flows (such as phone verification where enabled) to protect against automated abuse, governed by Google's Privacy Policy and Terms of Service.
• Search: Search queries are processed on our own servers and are not shared with third-party search providers.
• Trust & Launch Badges (TrustedSite and Product Hunt): We use TrustedSite and Product Hunt to display verification and launch badges on public pages under their respective privacy policies.

These providers process data under their own privacy policies, and we encourage you to review them.

5.1. Data Processing Agreements

We maintain Data Processing Agreements (DPAs) with our service providers to ensure they handle personal data in accordance with Saudi PDPL and GDPR standards. These agreements require processors to:

• Process personal data only on our documented instructions
• Implement appropriate technical and organizational security measures
• Maintain confidentiality of personal data
• Assist us in responding to data subject rights requests
• Notify us of any data breaches without undue delay
• Delete or return personal data upon termination of services

These contractual safeguards protect your data when processed on our behalf in compliance with PDPL Article 16 and GDPR Article 28.

6. Our Legal Bases for Processing (Saudi PDPL)

Because we are registered and operate in the Kingdom of Saudi Arabia, we process personal data in accordance with the Personal Data Protection Law (PDPL). Depending on the activity, we rely on the following legal bases:

• Performance of a contract: To create and manage your account and deliver the features you request.
• Compliance with legal obligations: To satisfy record-keeping requirements, respond to lawful requests, and meet SDAIA directives.
• Legitimate interests: To protect our platform against fraud and abuse, maintain service reliability, and honor referral links and creator profile attribution through short-lived referral records.
• Consent: Where we ask for your permission, such as for push notifications. You can withdraw that permission at any time through the relevant device, app, or website settings.

Optional website analytics and advertising, and promotional emails to verified addresses, are enabled by default. You can turn them off using the privacy and notification controls described above.

7. Your Rights Under the Saudi PDPL

Individuals located in the Kingdom of Saudi Arabia have the following rights under the PDPL (and we extend similar rights to other regions where required, such as GDPR or CCPA):

• Right to be informed: To know why and how your personal data is collected, used, and shared.
• Right of access and copies: To obtain a copy of the personal data we hold about you in a commonly used format.
• Right to correction and updating: To request that inaccurate or incomplete data be corrected.
• Right to destruction/deletion: To ask us to delete your account and personal data that is no longer needed for the stated purposes.
• Right to withdraw consent: To opt out of promotional messages, optional cookies, or optional tracking features at any time without affecting prior processing.
• Right to data portability: To request that we transfer your data to you or another controller when technically feasible.
• Right to complain: To file a complaint with the Saudi Data & Artificial Intelligence Authority (SDAIA) if you believe we have violated the PDPL.

If you reside in a jurisdiction with additional statutory rights, such as the European Economic Area or California, we will honor those requirements as well. We do not sell personal data.

To exercise these rights, you can use the self-service privacy and account deletion tools in the App or on the Site, or email [email protected]. We may verify your identity before completing a request and will respond within the timelines required by the PDPL (typically within 30 days). You may also contact SDAIA.

8. Data Security

We use technical, administrative, and organizational safeguards—including encrypted connections, access controls, and regular security reviews—to protect your personal information. While we take strong precautions to protect your data, no method of transmission or storage is completely impenetrable.

8.1. Data Breach Notification

In the unlikely event of a personal data breach affecting your information, we follow strict incident response and notification procedures:

• Notification to SDAIA: We will notify the Saudi Data & Artificial Intelligence Authority (SDAIA) within 72 hours of becoming aware of a reportable breach, in accordance with PDPL Article 28.
• Notification to Affected Users: We will notify affected individuals without undue delay when a breach is likely to pose a high risk to your rights and freedoms.
• Information Provided: Our notification will describe:
  • The nature of the personal data breach
  • The likely impact of the breach
  • The steps taken or planned to address the breach
  • How to contact our Data Protection Officer
• GDPR Compliance: Where applicable for users in the European Economic Area, we also comply with GDPR Articles 33 and 34 notification requirements.

9. Data Storage and International Transfers

Our primary application and database infrastructure is hosted on secure cloud servers in the European Union. We protect data in transit and at rest using industry-standard encryption and strict access controls.

9.1. International Transfer Safeguards

When personal data is transferred outside the Kingdom of Saudi Arabia to our European Union hosting infrastructure or the service providers in Section 5, we protect it properly. We ensure these transfers comply with applicable data protection laws using appropriate safeguards, including:

• Contractual & Adequacy Safeguards: Data Processing Agreements and Standard Contractual Clauses (SCCs) with our hosting and technology providers, alongside hosting in jurisdictions with strong data protection standards.
• Performance of Services & Consent: Processing necessary to provide the Services you request and in accordance with your privacy preferences.
• Security Controls: Encrypted data transmission, restricted administrative access with multi-factor authentication, and ongoing security monitoring.

10. Data Retention

We retain personal data only as long as necessary to provide our Services, fulfill the purposes described in this policy, and comply with legal obligations:

• Account data: Stored while your account is active. Once your deletion request is accepted, your account is deactivated and active sessions are ended. We then permanently remove your profile, preferences, and associated account data from our active systems. Deletion may take additional time if a technical issue occurs. Limited records may be retained as described below.
• Audit & security logs: Basic security and activity logs are retained for up to 24 months to support fraud prevention, security investigations, and regulatory compliance.
• Anonymous referral sessions: Unlinked referral records (where no account registration occurs) expire automatically after 7 days.
• Financial and tax records: Where applicable, accounting and tax records are retained for the period required under Saudi commercial and tax regulations (typically 7 years).

11. Data Protection Officer

Offerlash has appointed a Data Protection Officer responsible for privacy oversight and PDPL compliance. You can contact our Data Protection Officer at [email protected] (please include "Data Protection Officer" in the subject line) or at the postal address below.

12. Children's Privacy

Our Services are not directed to children under the age of 13 (or the minimum age required by applicable local law). We do not knowingly collect personal information from children without verifiable parental or guardian consent. If we learn that we have collected personal information from a child without required consent, we will promptly delete it.

13. Changes to This Privacy Policy

We may update our Privacy Policy from time to time, at our sole discretion and without prior notice. We will post the revised Privacy Policy on this page and update the "Last Updated" date. Your continued use of the Services after any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this page periodically.

14. Contact Us

If you have any questions about this Privacy Policy, please contact us at: