Privacy Policy

2. Information We Collect

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve our services
• Personalize your experience and recommendations
• Process creator payments and affiliate commissions
• Communicate with you about updates, promotions, and support
• Prevent fraud, spam, and abuse
• Ensure the safety and integrity of our platform, including content moderation and compliance with legal obligations
• Provide human review of automated age-verification decisions when you request it, with a target response time of 5 business days
• Comply with legal obligations
• Facilitate partnerships and brand collaborations

We use partner contact details to respond to enquiries, onboard and manage participating businesses, maintain listings and offers, arrange partner materials and communications, and keep records of the agreement. We rely on our legitimate interests in managing business relationships, balanced against your rights. Where you are personally a party to the agreement, we also process information necessary to enter into or perform that contract. We retain records where necessary to comply with legal obligations.

Partner service messages relate to your enquiry or participation. For marketing, we obtain consent where required by law; otherwise we rely on legitimate interests where permitted. You can object to direct marketing at any time or withdraw consent using an unsubscribe link or by contacting us.

4. Analytics and Tracking Technologies

We use various analytics providers and tracking technologies to understand how our platform is used and to improve your experience:

5. Information Sharing and Disclosure

We may share your information in these situations:

• With Your Consent: When you explicitly agree to share information
• Service Providers: Third-party companies that help us operate our platform (Firebase, Google Cloud, payment processors, analytics providers listed in Section 4)
• Business Partners: Brands and affiliates for collaboration opportunities (with your permission)
• Legal Requirements: When required by law or to protect rights and safety
• Business Transfers: In case of merger, acquisition, or asset sale

We never sell your personal information to third parties for their marketing purposes.

Authorised staff and service providers supporting partner onboarding, record keeping and communications may process partner contact details on our behalf, including Google Forms and Sheets and Customer.io. We publish business listing information and social handles supplied for promotion; private contact details are not part of the public listing unless you ask us to publish them. Plugg Local partners receive aggregate redemption information, not individual members' personal data.

6. Data Security

We implement standard security measures to protect your data:

• Encryption in transit and at rest
• Regular security audits and monitoring
• Access controls and authentication
• Secure cloud infrastructure (Google Cloud Platform)

While we strive to protect your information, no method of transmission over the internet is 100% secure.

7. Your Rights and Choices

You have the right to:

• Access: Request a copy of your personal data. When you request access, we will conduct a reasonable and proportionate search to provide you with your personal information, in line with UK data protection guidance where applicable.
• Correct: Update or correct inaccurate information
• Delete: Request deletion of your personal data
• Port: Receive your data in a portable format
• Object: Opt out of certain data processing activities
• Restrict: Limit how we process your data
• Object to Automated Decisions: Challenge decisions made solely by automated systems where law applies

To exercise these rights, please contact us using the details below. We will respond to your request in accordance with applicable data protection laws.

Partner business contacts can exercise these rights without a Plugg member account. You can ask us to update the business's contact person, correct contact details, or stop direct marketing. Withdrawing marketing consent does not affect processing that was lawful before withdrawal or necessary service communications about an existing agreement.

Complaints (UK Users)

If you are a user in the UK and have a privacy concern, we encourage you to contact us first so we can try to resolve it. You are generally expected to raise your complaint with us before contacting the Information Commissioner's Office (ICO), as per guidance related to the UK's data protection framework.

8. Data Retention

We retain your information for as long as necessary to provide our services and comply with legal obligations:

• Account data: Until you delete your account plus 30 days
• Analytics data: Varies by provider
• Content and posts: Until manually deleted by you
• Payment records: 7 years for tax and legal compliance
• Partner contact details: For as long as needed to handle your enquiry or manage the business relationship. After it ends, we retain only information needed for legal obligations, agreement records or resolving disputes, and remove or update obsolete contact details. We may retain a minimal suppression record to respect an objection to marketing.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place through standard contractual clauses and adequacy decisions where applicable.

For transfers of data from the European Economic Area (EEA) to countries not deemed adequate by the European Commission, we rely on Standard Contractual Clauses (SCCs) and may implement supplementary measures where necessary to ensure a level of data protection equivalent to that in the EU.

For transfers of data from the UK, we rely on UK adequacy regulations and safeguards such as the UK's International Data Transfer Agreement (IDTA) or the Addendum to the EU Standard Contractual Clauses.

10. Children's Privacy

Our services are not intended for children under 13, and we do not knowingly collect personal information from children under 13 without verification of parental consent.

If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us.

For users between the ages of 13 and 18, we may provide additional protections. In the UK, we are committed to complying with the Online Safety Act and implementing appropriate measures to protect users under 18, which may include age assurance processes and specific content suitability measures. The data processed for these purposes will be handled in accordance with this Privacy Policy.

11. Updates to This Policy

We may update this Privacy Policy from time to time. We'll notify you of significant changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of our services after changes become effective constitutes acceptance of the updated policy.

12. Third-Party Analytics Provider Privacy Policies

Our analytics providers have their own privacy policies that govern their collection and use of data. We encourage you to review their policies:

• Google Privacy Policy: Google Privacy Policy
• Meta Privacy Policy: Meta Privacy Policy
• TikTok Privacy Policy: TikTok Privacy Policy
• PostHog Privacy Policy: PostHog Privacy Policy
• Vercel Privacy Policy: Vercel Privacy Policy

You may opt out of certain third-party analytics by visiting their sites and following their opt-out procedures.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us: