Privacy Policy

Last updated 2026-09-05

Promos hands out one-time promo codes. Two kinds of people use it, and their data is handled differently: owners, who hold an account and upload codes, and claimers, who enter an email address on a project page to receive one code.

Controller

Full operator details are in the Legal Notice. We have not appointed a data protection officer, as we are not required to. For anything about your data, write to support@hazelfin.com.

Who is responsible for what

We are the controller for running the platform: owner accounts, payments, and the mechanics of collecting and confirming a claimer's address.

A claimer's email address is passed on to the owner of the project they claimed from. From that point the owner is a separate controller for the copy they hold. We do not control what an owner does with it, and we are not able to delete it on their behalf. The Terms oblige owners to state on the project page what they will use your address for, to stay within that, and to obtain your consent where the law requires it — so read the project description before you claim. If you want your address removed from an owner's records, you have to ask that owner. We will tell you which project you claimed from if you ask us.

Visiting the site

The site is served by Cloudflare. Every request reaches Cloudflare with your IP address, the requested address, the time, and details your browser sends such as the user agent and language. This is needed to deliver the site and to defend it against attack and abuse. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in operating a functioning and secure service. Cloudflare keeps this data for a short period under its own retention rules; we do not build profiles from it and do not keep our own long-term access logs.

We do not use analytics, tracking pixels, advertising, or any third-party embeds. The only cookie we set is a session cookie, set after you sign in as an owner. It holds a random token, is HttpOnly, Secure and SameSite=Lax, and expires after 30 days. It is strictly necessary to keep you signed in, so no consent banner is required (§ 25 (2) no. 2 TDDDG). Claimers are never given a cookie.

Owner accounts

To create an account we store your email address, the version of the Terms you accepted, and the time of creation and confirmation. There is no password. Signing in sends a one-time link to your address; we store only a hash of that token and its expiry, and the token is valid for 30 minutes. An active session is stored as a hash of the session token with its expiry.

Your projects, the codes you upload, your project settings, and your payment records are stored under your account. Codes are stored as you supplied them, because they have to be handed out unchanged; we never validate or redeem them.

Legal basis: Art. 6 (1) (b) GDPR, performance of the contract with you, and Art. 6 (1) (c) GDPR for the commercial and tax records we are required to keep.

Claiming a code

When you request a code we store:

• your email address, so we can send you the confirmation link and so the project owner can see who claimed a code;
• a keyed identifier derived from your address (an HMAC), which lets us tell that the same address has already claimed from that project without keeping the address itself. It cannot be reversed into your address by anyone who does not already know it, and it is specific to this service;
• a hash of the secret in your confirmation link, and the times of submission, confirmation, and of first viewing the code.

Confirming the link is required: it proves the address is yours, and it is what stops someone else from entering your address. The form is protected by ALTCHA, a proof-of-work check that runs in your browser. We host it ourselves, it sets no cookie, it does not profile you, and no data goes to a third party for it.

Legal basis: Art. 6 (1) (b) GDPR, because you asked us to send you a code, and Art. 6 (1) (f) GDPR for the keyed identifier and the abuse protection — our legitimate interest, and the owner's, in each person receiving one code and in the inventory not being drained.

How long we keep things

• Unconfirmed claims are deleted 48 hours after they were made. If you never open the confirmation link, nothing of yours remains.
• Confirmed claims, with auto-prune on (the default): your email address becomes eligible for deletion 7 days after a code was assigned to you. The keyed identifier stays so the same address cannot claim twice from that project. This is also how long you have to open your code, so the delay cannot be shorter.
• Confirmed claims, with auto-prune off: the owner has chosen to keep claimer addresses, and the address stays until the owner deletes the project or their account. Whether auto-prune is on is stated on the project page before you enter your address.
• Sign-in tokens expire after 30 minutes, sessions after 30 days.
• Owner accounts are kept until you delete them. Deleting an account removes your projects, codes, claims, and payment records from our database.
• Payment and invoice records held by us and by Stripe are kept for the statutory retention periods of up to 10 years under §§ 147 AO and 257 HGB, even after an account is deleted. This is the one thing account deletion does not reach.

Deleted projects are soft-deleted first, so an accidental deletion can be undone. They are removed for good after a short grace period.

Payments

Code capacity is bought through Stripe. When you start a purchase you leave our site and enter your payment and billing details with Stripe; we never see or store a card number. We give Stripe your email address and the identifiers of your account and project, and we store back the Stripe customer and payment identifiers, the quantity bought, the link to Stripe's receipt, and whether the payment was later refunded or disputed. Stripe also acts as controller for its own purposes under its own privacy policy. Legal basis: Art. 6 (1) (b) and (c) GDPR.

Processors and recipients

• Cloudflare — hosting, CDN, and the code that runs the service.
• Turso — the database everything above is stored in.
• Brevo — sends confirmation and sign-in emails. It receives the recipient address and the message.
• Stripe — payments, as described above.
• Pushover — operational alerts to the operator. These carry events such as a payment or a dispute, not claimer addresses.
• Project owners — receive the addresses of the claimers of their own project, as their own controller.

Each provider is engaged under a data processing agreement under Art. 28 GDPR where it acts as our processor. Some of them process data outside the EU, including in the United States; those transfers are covered by the EU standard contractual clauses under Art. 46 (2) (c) GDPR and, where the provider is certified, by the EU–US Data Privacy Framework. Beyond these, we disclose data only where we are legally required to.

Your rights

You have the right to access your data (Art. 15), to correct it (Art. 16), to have it erased (Art. 17), to restrict its processing (Art. 18), to receive it in a portable form (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing rests on consent, you may withdraw it at any time with effect for the future.

Owners can exercise most of this directly: the dashboard exports a project as CSV, and the account page deletes the account outright. For anything else, write to support@hazelfin.com. Claimers should write to the same address; remember that a copy of your address also sits with the project owner, who has to be asked separately.

Removing your address yourself

Claimers do not have to write to us at all. /forgetme takes an email address, sends a confirmation link to it, and opening that link removes the address from every project it claimed from, whatever the owner of each project configured. Where a code was received we keep the keyed identifier, so the same address cannot claim a second one; where no code was ever received the record is deleted outright. Codes already received stay valid.

You also have the right to complain to a supervisory authority, in particular in the member state of your residence, place of work, or of the alleged infringement. The authority responsible for us is Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

Is any of this required?

Providing your data is neither required by law nor by contract, but it is necessary to use the service: without an email address we cannot create an account for you, and without a confirmed address we cannot send you a code. There is no automated decision-making or profiling under Art. 22 GDPR.

Changes

We update this policy when the service changes. The date at the top says when it last changed.