CodeChaseDeal Landing Page
Last updated: August 5, 2026

Privacy Policy

This policy describes what personal data CodeChaseDeal collects, why we collect it, how long we store it, and the rights you have under the General Data Protection Regulation (GDPR) and other applicable privacy laws.

1. Who we are

CodeChaseDeal ("we", "us", "our") operates the website CodeChaseDeal and associated services. When we refer to "personal data" in this policy, we mean any information that can be used to identify you directly or indirectly, such as your name, email address, or browsing behavior linked to you.

If you have questions about this policy or your personal data, contact our Data Protection Lead at privacy@codechasedeal.com or write to us at support@codechasedeal.com.

2. Data we collect and why

Data category What we collect Purpose / Legal basis (GDPR) Retention
Subscriber account Name, email address, email verification status, last login time, subscription status (subscribed / paused / unsubscribed), digest-email opt-in flag, last timestamp the opt-in was edited. Provide your subscriber portal, send personalized digests, verify your identity via email OTP / magic link.
Legal basis: contract (when you sign up for emails) + consent (marketing digests, revocable anytime). 		Digest-email preference change is immediate (flip the opt-in flag) and the account persists unless you explicitly request deletion. For full erasure see § 3 and § 8: immediate hard-delete on unsubscribe with delete-data option selected. We keep no copy of your name/email after the erasure runs (see carve-outs for court orders / fraud / rolling-30-day backups).
Subscriber profile & preferences Country, preferred language, timezone, freeform notes, selected category interests, selected store interests, notification toggles (coupons, deals, stores, blogs), digest frequency (daily / weekly / instant). Personalize the deals, coupons, articles, and store updates we email to you. Also used for language/country content filtering in the future.
Legal basis: consent (explicit opt-in via "Receive updates" in preferences).		 Deleted permanently at the same time as your subscriber record (immediately on unsubscribe / erasure request).
Subscriber security records Email OTP codes (hashed), magic link tokens (hashed), expiry timestamps, and whether each token was consumed. Protect your account with password-less, per-session authentication (no stored passwords).
Legal basis: legitimate interest in account security + contract.		 30 days after expiry / consumption.
Blog comments & reactions Any comment text you post plus an in-browser "like/reaction" signal linked to your subscriber ID. Display your public contribution on article pages and moderate community quality.
Legal basis: legitimate interest in site moderation + your active choice to post.		 While the article is public, or on deletion request.
Change tracking logs Model-level create / update / delete change records (via our internal TracksChanges trait) for coupons, stores, categories, blog posts, subscribers, subscriber preferences, and CMS users. May include IP address and user/subscriber ID when we have it. Audit history for security investigations, customer support, and data-consistency debugging.
Legal basis: legitimate interest in secure, auditable operations.		 12 months for CMS events; 3 years for security-relevant events.
Anonymous traffic analytics For each successful public-page GET/HEAD navigation that is not blocked by an opt-out header:
  • Requested path and a sanitized query string (keys that could carry PII — token, verify_token, code, otp, password, email — are dropped before any query string is recorded).
  • Boolean flags for the HTTP response status, whether the request landed in the CMS/admin area (is_cms), and whether the requesting User-Agent looked like a crawler/automaton (is_robot).
  • Referrer host only (just the domain — full referrer URL and query strings are NOT stored, and same-host internal navigations are never recorded).
  • A daily-rotating anonymous visitor fingerprint: SHA-256(APP_KEY | page-visits-daily-salt | YYYY-MM-DD | raw IP | raw User-Agent).
    The raw IP address and raw User-Agent header are NEVER written to the database. Because the date is rolled into the hash input, the same visitor cannot be joined across days — the hash is effectively a fresh, anonymous identifier every midnight UTC.
  • If (and only if) you are already signed in as a subscriber in the same request: we also link the analytics row to your numeric subscriber ID via a nullable foreign key so we can answer questions like "how many of the day's unique readers were subscribers." We later null this FK as part of the Art. 17 erase pipeline if you permanently delete your account.

We do NOT run Google Analytics, Meta Pixel, Hotjar, or any third-party analytics script. All visitor metrics stay 100% inside your app server's database, on servers controlled by us and our infrastructure host.

Produce internal "Visitor Tracking Metrics" reports in the admin dashboard (daily unique visitors, top pages, top external referrers, 24 h traffic heatmap, CMS vs public traffic split, subscriber vs non-subscriber split); detect performance issues, crawler spikes, and break-the-site regressions; audit that GDPR erasure actually removed subscriber-ID links when requested.
Legal basis: legitimate interest in understanding overall site usage and operating a secure, performant service — we balance this with the DNT/GPC opt-out (see § 5), the daily-rotating hash, and the ability to object via Art. 21 at any time (see § 8). 		Raw rows are kept for 180 days from created_at to enable trend lookups. If and when we add automated TTL pruning, rows older than 180 days will be hard-deleted on a rolling daily schedule. Analytics rows that are linked to a subscriber account lose that foreign-key link (subscriber_id → NULL, is_subscriber → false) immediately when you exercise the Art. 17 delete path via the unsubscribe form. There is no subscriber-identity joinable residue left in the analytics table after erasure.
Cookies & localStorage Essential session cookies only: Laravel session (your_session_name), XSRF/CSRF token cookie. We use signed, HttpOnly, SameSite=Lax cookies for the subscriber portal. No Google Analytics / GA4 / Meta Pixel / Hotjar / advertising / third-party cookies are ever placed on your device. Keep you signed into the subscriber portal, protect HTML forms against cross-site request forgery, preserve anonymous visitor state if we add a cookie-consent banner later.
Legal basis: legitimate interest (essential cookies — strictly necessary to deliver the web app you requested). We do not set any non-essential analytics or advertising cookies, so no cookie consent banner is currently required for analytics alone. If we add non-essential cookies in the future, you will see a consent banner and can opt-in/opt-out granularly.		 Session cookies: deleted automatically when you close your browser window (or after the Laravel session lifetime configured in config/session.php, currently 120 minutes idle, whichever comes first). CSRF/XSRF cookie: tied to the session, not persistent.
Contact & support requests Content of email / contact-form messages plus your email address. Respond to your question or complaint.
Legal basis: legitimate interest in customer care.		 6 months after case closure.

3. Personalized subscriber digests & marketing

When you subscribe, we ask for your category and store interests along with email-sending toggles (coupons, deals, store updates, blog updates) and digest frequency (daily / weekly / instant). We use ONLY those preferences to build the digest — we do NOT sell, share, or rent your personal data to third parties for their own marketing purposes.

Every marketing email we send includes two one-click links at the bottom:

  • Update your preferences — opens the password-less member portal where you can change interests or toggle individual email types.
  • Unsubscribe & email preferences page (GDPR Art. 17 Right to Erasure). Clicking "Unsubscribe" in any digest footer opens a page with three clear choices — you decide whether to keep or erase your data:
    1. Pause all digest / marketing emails (recommended default). Flips the explicit receive_digests opt-in flag for your account so the daily / weekly digest pipelines skip you. Your member portal, saved interests, profile, comments, and reactions are kept intact so you can re-enable in one click any time from the preferences page. For your account security, a 6-digit OTP confirmation code is sent to your email before the pause is applied.
    2. Tweak my interests / update preferences. Redirects you straight to the password-less member portal. (The magic-link email already proves you own the inbox, so no extra OTP step is required.)
    3. Unsubscribe & permanently delete all my data (Art. 17 erasure). Immediately and permanently deletes: your subscriber row, profile, notification settings, category/store interests, magic-link tokens, email-OTP tokens, the subscriber-ID foreign key on any visitor-analytics rows, and the direct foreign-key link on any model audit rows (tracking_logs) so the erased record can no longer be joined to an identity. Blog comments you authored remain to preserve thread context, but their author name/email fields are replaced with the placeholder Deleted user and the subscriber FK is nulled so they can no longer be traced back to you. For your account security, a 6-digit OTP confirmation code is sent to your email before any data is removed; a second client-side "final confirmation" prompt appears on the OTP screen to make absolutely sure you intended to permanently erase.
    See § 8 for how to exercise erasure on a custom/accelerated timeline or for ancillary data (support tickets, backups).

Legal carve-outs. The only time we keep a copy of your name/email beyond the erasure event is (a) when a court order, regulator request, or on-going fraud/chargeback investigation requires retention — in which case the data is held in a quarantined, access-controlled record and deleted as soon as the legal basis expires (hard cap of 12 months from the date of erasure), and (b) in encrypted off-site backups that are retained on a rolling 30-day cycle; erased records drop out of the backup window automatically within the next 30 daily rotations.

You can also reach out directly at support@codechasedeal.com and we will process your request within one working day.

4. Affiliate links & coupon partners

Many links on CodeChaseDeal pointing to retailer / merchant store pages are affiliate links. When you click an affiliate link and make a qualifying purchase on the partner's site, we may earn a small commission at no extra cost to you. To make this work, the partner receives only the anonymous referral signal (our affiliate ID) via HTTP referrer or tracking parameter — they do not receive your name, email, or any subscriber data from us. We never share your personal data with coupon merchants or affiliate networks for marketing purposes.

Because deals and coupons are sourced from public retailer feeds, always verify the final price, coupon code, and offer terms on the merchant's checkout page before completing your purchase — coupon validity on our site is provided on a best-effort basis.

5. Cookies, visitor analytics & opt-outs

We believe analytics should be privacy-first, so we built our own first-party-only visitor tracking instead of embedding third-party trackers like Google Analytics, Meta Pixel, Hotjar, or Plausible.

What we do (always)

  • Run the internal LogPageVisit middleware on the public website for each successful GET/HEAD navigation.
  • Record only the sanitized, anonymous, day-locked data points listed in § 2's "Anonymous traffic analytics" row — no raw IP, no raw User-Agent, no cross-day identity link.
  • Drop obviously sensitive query-string keys before any URL fragment is stored.

What we never do

  • Embed any third-party analytics, advertising, or session-replay script in the public site.
  • Match the anonymous visitor hash against your subscriber identity unless you are already signed in in the same request (see § 2), and even then only for aggregate reporting, never for ad targeting.
  • Sell, rent, or share the raw analytics feed with any partner, ad network, or data broker.
  • Set persistent tracking cookies, device-ID cookies, or third-party advertising identifiers.

How to opt out of visitor analytics (GDPR Art. 21 objection)

You can opt out of any analytics log entry in either of these ways, and both are honored before any database write is attempted — no cookie is required, and no row is stored for your request at all:

  1. Browser DNT / Global Privacy Control headers. If your browser sends the DNT: 1 header or the Sec-GPC: 1 header, the middleware returns early and nothing about your page visit is written. Modern Firefox, Brave, Safari, DuckDuckGo, and the Opt Me Out extension all send Sec-GPC: 1 automatically when the user has configured them to.
  2. Manual opt-out via request. Email privacy@codechasedeal.com with "Object to analytics processing" in the subject; we will treat this as an Art. 21 objection, stop processing your subscriber-linked analytics rows (if any), and confirm your objection in writing within 14 days.

Essential cookies (signed session / CSRF for the subscriber portal) cannot be opted out of individually because the password-less member portal literally cannot function without them. If you block cookies entirely in your browser, CodeChaseDeal will still be fully usable as a public coupon/deals/blog reader — the only features that will stop working are the password-less member portal (sign-in, preferences) and any protected HTML forms that rely on CSRF tokens.

6. Data sharing & international transfers

We share your personal data only in these narrow circumstances:

  • Service providers strictly necessary to operate the site (email delivery provider, database host, transactional email / queue workers). Each provider is contractually required to treat your data with the same protections in this policy and process it only on our documented instructions.
  • Legal obligations — when we are compelled by a valid court order, warrant, or enforceable regulatory request; we will attempt to notify you beforehand when legally permitted.
  • Business transfer — in the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction; you will be notified before your personal data becomes subject to a different privacy policy.

Your data may be processed in countries outside your own (including European Economic Area to the United States for some infrastructure). When transfers occur outside the EEA / UK, we rely on Standard Contractual Clauses or a recognized adequacy decision.

7. Security of your data

We apply industry-standard controls appropriate to the sensitivity of each data category:

  • Subscriber passwords are never stored — authentication is exclusively via short-lived email OTP or signed magic link tokens.
  • OTP codes and magic link tokens are stored only as SHA-256 hashes, never in plaintext.
  • CMS user passwords use bcrypt cost-factor 12+; CMS admins may additionally require TOTP (Google Authenticator style) and/or email OTP two-factor authentication per site settings.
  • Database backups are encrypted at rest and access-restricted to the operations team on a least-privilege basis.
  • All traffic between you and CodeChaseDeal is encrypted in transit via HTTPS with HSTS enabled.

No method of storage or transmission over the Internet is 100% secure. In the event of a personal data breach that creates a risk to your rights and freedoms, we will notify you and the competent supervisory authority within 72 hours as required by applicable law.

8. Your rights under GDPR

If you are in the EEA, UK, or another jurisdiction with equivalent privacy laws, you have these rights in respect of your personal data:

Right of access

Request a copy of all personal data we hold about you, in a structured, machine-readable format.

Right to rectification

Ask us to correct inaccurate or incomplete personal data (or simply update it yourself in the member portal).

Right to erasure ("be forgotten")

Request deletion of all or part of your personal data where processing is no longer necessary for the original purpose. For subscriber records, using the one-click /unsubscribe form automatically triggers the erasure process immediately. You may also request a custom accelerated erasure for support tickets or backup records via the DPO contact — allow up to 30 days (legal carve-outs excepted).

Right to restrict / object

Restrict further processing of your data, or object to processing based on legitimate interest — for example, the first-party visitor analytics described in § 5 (send a DNT/GPC header or email the DPO contact to object in writing).

Right to data portability

Receive your personal data (subscriber record, preferences, interests) as JSON so you can take it to another provider.

Right to withdraw consent

Revoke any marketing consent you previously gave. The easiest way is "Unsubscribe" in any footer, or preferences in the member portal.

To exercise any of these rights, email privacy@codechasedeal.com from the address associated with your account; we will respond within 30 calendar days and confirm completion (or tell you if we need an extension in complex cases). You also have the right to lodge a complaint with your local data protection supervisory authority at any time.

9. Children

CodeChaseDeal is not directed at children under the age of 16 and we do not knowingly collect personal data from anyone under 16. If you become aware that a child under 16 has provided us with personal data, contact us immediately and we will take steps to remove the information.

10. Changes to this policy

We may update this policy from time to time. Material changes will be announced with a prominent notice on the site, and the "Last updated" date at the top of this page will be revised. We will email active subscribers about policy changes that materially reduce your rights where required by applicable law.

11. Contact

Data Protection Lead
Email: privacy@codechasedeal.com
General support: support@codechasedeal.com
← Back to home