Privacy Policy

Undacut Services LLC (referred to herein as "Undacut," "we," "us," or "our") is the operator of undacut.com (the "Site"). We are committed to protecting the privacy of all individuals who access or use our Site and to ensuring that personal data is collected, processed, and stored in a manner that is transparent, lawful, and consistent with applicable data protection legislation.

This Privacy Policy governs the collection and use of personal data across all pages and features of the Site. It applies to all visitors and registered users, regardless of their country of residence. Users located in the European Union or European Economic Area are afforded additional rights under Regulation (EU) 2016/679 (the General Data Protection Regulation, or "GDPR"), which are addressed in the relevant sections of this Policy. By continuing to access or use the Site, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices it describes.

We collect personal data from three principal sources. First, information provided directly by you: this includes your email address and chosen username, submitted in connection with account creation on the Site or newsletter registration; your password, which is stored solely as a salted cryptographic hash and is never retained by us in plain text; any optional profile information you elect to provide, including a display avatar and biography; the criteria you configure for deal alerts, such as keywords, product categories, retailers, and price or discount thresholds; the items you add to your wishlist or save to your favourites; the social media handle you submit where you elect to claim a promotional or giveaway task; and any correspondence you direct to us.

Second, information collected automatically upon your use of the Site: this includes the pages you visit, recorded as a path without query-string parameters; the referring URL of any external page from which you arrived; your device category, browser, and operating system as derived from the user-agent string transmitted by your browser; your approximate country, as determined at the network edge; and your interactions with the Site, including clicks on outbound affiliate links. We do not retain your Internet Protocol (IP) address in our own analytics records. Your IP address and user-agent string are instead combined with a secret value and a date component that rotates daily to produce an irreversible visitor hash, which permits us to count unique visitors without storing data that identifies you. Our analytics provider, identified in Section 3 below, separately processes IP address and derived geolocation data in accordance with its own documentation.

Third, information received from third parties: where you authenticate using a social login provider, currently Google, Meta (Facebook), or Apple, we receive the account identifier issued by that provider together with such profile information as it makes available to us in accordance with its own terms and privacy disclosures. Additionally, Amazon.com and other participating retailers may transmit transactional confirmation data to us in connection with purchases completed through affiliate links on the Site.

The Site employs cookies and analogous tracking technologies to support its operation and to enhance the user experience. These technologies serve several purposes. They enable us to keep you signed in between sessions, to retain user preferences and personalisation settings, to analyse traffic patterns and understand how visitors interact with the Site, to assess the performance of individual deal pages, to facilitate the delivery of contextually relevant advertising (where applicable), and to attribute affiliate link clicks accurately for commission reporting purposes.

The cookies set by the Site itself fall into two categories. Strictly necessary cookies comprise the authentication cookie that maintains your signed-in session, which carries the HttpOnly and Secure attributes and is therefore inaccessible to scripts running in your browser, together with short-lived cookies that protect the social login process against cross-site request forgery and which expire within ten minutes. Analytics cookies are set by the provider identified below. We additionally store certain preferences, such as your saved search filters, in your browser's local storage; that data remains on your device and is not transmitted to us.

The following third-party services are integrated into the Site and may independently set cookies or otherwise process data concerning your device: PostHog, which we use for product analytics, session replay, and web performance measurement, and which is configured to process and store that data on infrastructure located within the European Union; and the Amazon Associates programme, through which affiliate link activity and associated commissions are tracked and attributed. Session replay reconstructs your interactions with the Site, such as navigation between pages, clicks, and scrolling, for the purpose of diagnosing usability and technical problems; the contents of form fields, including any password you enter, are masked at source and are not captured.

You retain the right to manage or disable cookies through your browser settings at any time. Please note, however, that disabling strictly necessary cookies will prevent you from signing in and will impair Site functionality. Where required by applicable law, we will present you with a consent mechanism prior to the placement of any non-essential cookies.

Personal data collected through the Site is processed to operate, maintain, and continuously improve the Site and its features including to deliver deal alerts, promotional communications, and newsletters to which you have subscribed; to personalise the content and deal recommendations presented to you; to monitor and evaluate Site performance and traffic acquisition channels; to identify, investigate, and prevent fraudulent activity or misuse of the Site; to fulfil our obligations under applicable law; and to respond to enquiries and communications received from you. We do not subject your personal data to solely automated decision-making processes that produce legal effects or otherwise significantly affect you without the involvement of a human review.

We process personal data only where we have a lawful basis for doing so. Where you create an account, subscribe to deal alerts, or otherwise request a service from us, we process your data in order to perform our contract with you, or to take steps at your request prior to entering into one. Where we place non-essential cookies or comparable tracking technologies on your device, and in any jurisdiction in which prior consent is required for such technologies, we process your data on the basis of your consent, which you may withdraw at any time and as easily as it was given. Where we operate and secure the Site, measure aggregate traffic, prevent fraud and abuse, and develop the features we offer, we process your data on the basis of our legitimate interests in providing a functioning and secure service, having weighed those interests against your rights and freedoms. Where we are subject to a legal obligation, including the retention of records and responses to lawful requests from competent authorities, we process your data on the basis of that obligation. You may object to processing carried out on the basis of our legitimate interests as described in Section 8.

As an Amazon Associate I earn from qualifying purchases.

Undacut Services LLC is a participant in the Amazon Services LLC Associates Programme, an affiliate advertising programme administered by Amazon and designed to provide a means for affiliated websites to earn commission fees through the advertisement of, and linking to, Amazon.com. We may additionally participate in affiliate programmes operated by other retailers. Where you follow an affiliate link from the Site and subsequently complete a purchase, we may receive a commission in respect of that transaction. Such commission is payable by the retailer and is at no additional cost to you. The Site contains hyperlinks to third-party websites and platforms, including but not limited to Amazon and other retail partners. Upon navigating away from the Site, your activity is governed exclusively by the privacy policies and terms of those third-party operators. Undacut Services LLC exercises no control over, and accepts no responsibility for, the content, data practices, or privacy standards of any third-party site or service accessible via links on the Site. We strongly recommend that you review the applicable privacy documentation of any third-party platform before completing a transaction.

Undacut Services LLC does not sell, rent, or trade your personal data to third parties. Disclosure of personal data is limited to the following circumstances: To third-party service providers engaged to support the operation of the Site, each of which is contractually bound to process personal data only on our instructions and in accordance with applicable data protection law. To competent authorities, courts, or regulatory bodies where disclosure is required by law, court order, or is reasonably necessary to protect the rights, property, or safety of Undacut, our users, or the public. To a successor entity in the event of a merger, acquisition, restructuring, or disposal of all or part of our business assets, in which case we will provide reasonable advance notice of any change to this Policy. In any other circumstances where you have provided your prior, express, and informed consent.

The service providers currently engaged by us are: Vercel Inc., which provides application hosting and content delivery and which additionally stores images uploaded to the Site; Railway Corp., which provides the managed database in which Site data is stored; PostHog, which provides product analytics and session replay from infrastructure located within the European Union; and Resend, which delivers transactional email, including account verification, password reset, and deal alert messages. Where you authenticate using a social login provider, or follow an affiliate link to a participating retailer, your data is additionally processed by that provider or retailer as described in Sections 2 and 5.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulation. The following retention periods apply: registered account data is retained until you submit a formal request for account deletion; email subscription data is retained until you unsubscribe or formally request its removal; analytics records generated by the Site are retained in pseudonymised form, in which a visitor is represented only by an irreversible, daily-rotating hash rather than by directly identifying data; event and session replay data held by our analytics provider is retained in accordance with the retention period configured with that provider and may be deleted upon request; and server log data is retained for a maximum period of twelve months from the date of generation, following which it is securely deleted. Upon expiry of the applicable retention period, personal data will be securely deleted or irreversibly anonymised in accordance with our internal data governance procedures.

Subject to your jurisdiction of residence and the applicable legal framework, you may be entitled to exercise a number of rights in relation to your personal data. Users located in the EU or EEA hold these rights pursuant to the GDPR; users in California hold analogous rights under the California Consumer Privacy Act (CCPA). These rights include: the right to request access to the personal data we hold about you and to receive a copy thereof; the right to request rectification of any inaccurate or incomplete personal data; the right to request erasure of your personal data (the "right to be forgotten"), subject to applicable legal exceptions; the right to receive your personal data in a structured, commonly used, and machine-readable format (the right to data portability); the right to object to the processing of your personal data for direct marketing or other legitimate interest purposes; the right to request that we restrict our processing of your personal data in specified circumstances; and the right to withdraw consent at any time where our processing is founded upon consent, without prejudice to the lawfulness of processing carried out prior to such withdrawal. To exercise any of the foregoing rights, please submit a written request to contact@undacut.com. We will acknowledge and respond to all valid requests within thirty (30) calendar days of receipt. We reserve the right to verify your identity prior to processing any request.

In addition to the rights set out above, you have the right to lodge a complaint with a data protection supervisory authority. If you are located in the European Union or European Economic Area, you may complain to the supervisory authority of the Member State in which you reside, in which you work, or in which the alleged infringement took place. If you are located in the United Kingdom, you may complain to the Information Commissioner's Office; if you are located in Switzerland, to the Federal Data Protection and Information Commissioner. We would nonetheless welcome the opportunity to resolve your concerns directly, and encourage you to contact us at contact@undacut.com before approaching a supervisory authority.

The Site is not directed at, and is not intended for use by, individuals under the age of eighteen (18). Consistent with Section 1 of our Terms of Service, registration for and use of the Site require that you be at least eighteen years of age. We do not knowingly solicit or collect personal data from individuals below this age. In the event that we become aware that a person under the age of eighteen has submitted personal data through the Site, we will take prompt steps to delete such data from our records. If you are a parent or legal guardian and have reason to believe that your child has provided personal data to us without your authorisation, we ask that you contact us immediately at contact@undacut.com so that we may investigate and take appropriate remedial action.

Undacut is operated by a limited liability company incorporated under the laws of the State of Wyoming, United States. Accordingly, personal data collected through the Site may be transferred to, stored in, and processed within the United States, a jurisdiction which the European Commission has not recognised as providing an equivalent level of data protection to that afforded within the European Economic Area. Where such international transfers are required, we take appropriate safeguards to ensure that your personal data remains subject to protections consistent with the GDPR, including the use of the European Commission's Standard Contractual Clauses (SCCs) where applicable. By accessing or using the Site and providing us with your personal data, you acknowledge that your information may be processed in jurisdictions outside your country of residence.

Our product analytics and session replay data is processed and stored on infrastructure located within the European Union. Other categories of Site data, including registered account records, are hosted in the United States as described above.

We implement and maintain appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, unlawful destruction, alteration, or disclosure. Such measures include the use of encrypted data transmission protocols (HTTPS/TLS), role-based access controls, and periodic internal security reviews. Notwithstanding the foregoing, no method of transmission over the internet or electronic storage can be guaranteed to be completely secure, and we are accordingly unable to warrant the absolute security of personal data submitted to or processed by the Site. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected data subjects, in accordance with our obligations under applicable law, including within seventy-two (72) hours of becoming aware of the breach where required under the GDPR.

We reserve the right to amend this Privacy Policy at any time to reflect changes in our data practices, applicable legislation, or the features and functionality of the Site. Any such amendments will take effect upon publication of the revised Policy on this page, accompanied by an updated "Last Updated" date. In the case of material amendments, changes that substantively alter the manner in which we collect or use your personal data, we will, where reasonably practicable, provide advance notice by email to registered subscribers and by means of a prominent disclosure on the Site. Your continued use of the Site following the publication of any amended Privacy Policy constitutes your acceptance of the revised terms. If you do not accept the amended Policy, you should discontinue your use of the Site and may submit a data deletion request in accordance with Section 8 of this Policy.

If you have questions or concerns about this Privacy Policy or our data practices, or if you wish to exercise your rights as a data subject, please contact us at contact@undacut.com. We are committed to addressing all legitimate enquiries in a timely and transparent manner.

Undacut Services LLC, a limited liability company incorporated under the laws of the State of Wyoming, United States, is the data controller responsible for the personal data described in this Policy. You may contact us by email at contact@undacut.com.