Privacy Policy
Last updated: 26 October 2026
This policy explains how Incodea LTD handles personal data when you use CapCoupon, whether you are a Creator with an account or a Visitor browsing pages. We collect as little as possible to run the service.
1. Who is responsible for your data
The controller of your personal data is Incodea LTD (ИНКОДИА ЕООД), registered in the Bulgarian Commercial Register under UIC 208774569, with its registered office at 17 Sv. Angelariy St., Dragalevtsi, Vitosha district, 1415 Sofia, Bulgaria. Contact us about anything in this policy, or to exercise your rights, at contact@incodea.bg.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data (Creators): email address, name, password (stored hashed by our sign-in provider), sign-in method | Creating and securing your account, signing you in, service messages | Contract — Art. 6(1)(b) |
| Profile and content: username, display name, bio, photo, social links, merchants, logos, offers, promo codes, countries | Publishing your page and showing it in Browse | Contract — Art. 6(1)(b) |
| Billing data (paid plans): name, billing address, company and tax ID if given, plan, payment status. Card details are handled by Stripe; we never see or store them. | Taking payments, invoicing, tax and accounting records | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) |
| Page analytics: counts of page views, code copies, and link clicks per creator and offer, with a timestamp | Showing Creators how their page performs | Legitimate interests — Art. 6(1)(f) |
| Technical data: IP address and request details processed transiently by our servers and hosting provider; server logs | Delivering the site, security, abuse and fraud prevention, rate limiting | Legitimate interests — Art. 6(1)(f) |
| Correspondence: messages you send us | Answering support, legal, and privacy requests | Contract or legitimate interests; legal obligation for rights requests |
3. If you are a visitor
You can browse CapCoupon without an account. Analytics events record only what happened (for example "a code was copied for offer X") and when. We do not store your IP address, a cookie ID, or any other identifier with these events, and we do not build profiles of visitors.
When you click an offer, you leave CapCoupon and go to the merchant's website. The merchant or an affiliate network may then use their own cookies to attribute your purchase. Their privacy policies apply to that processing, not ours.
5. International transfers
Some providers process data outside the European Economic Area, mainly in the United States. Where this happens, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses, together with additional safeguards such as encryption in transit and at rest. You can request a copy of the relevant safeguards at contact@incodea.bg.
6. How long we keep data
- Account, profile, and content: while your account exists. When you delete your account, we delete it within 30 days, apart from backups which roll off within a further 30 days.
- Analytics events: while the related account exists; deleted with it.
- Billing and invoice records: for the period required by Bulgarian accounting and tax law (currently up to 10 years).
- Analytics and marketing cookies: as listed in the Cookie Policy (at most 2 years); deleted from your browser when you withdraw consent.
- Server logs: typically up to 30 days, unless needed to investigate a security incident.
- Correspondence: up to 3 years after the matter is closed.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, where processing is based on consent.
Email contact@incodea.bg to exercise these rights. We will reply within one month, and may ask you to confirm your identity. Many details can also be edited directly in your dashboard.
You can also lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria (cpdp.bg), or with the data protection authority in the EU country where you live or work.
8. Security
We use encryption in transit (HTTPS) and at rest, access controls, least-privilege access for staff, and reputable infrastructure providers. Passwords are handled by our sign-in provider and never stored by us in plain text. If a personal data breach is likely to put your rights at risk, we will notify you and the supervisory authority as the law requires.
10. Children
Creator accounts are for people aged 16 and over. We do not knowingly collect data from younger children. If you believe a child has created an account, contact us and we will delete it.
11. Automated decisions
We do not make decisions with legal or similarly significant effects based solely on automated processing. The order of creators in Browse is determined by plan, number of matching offers, and recency, as explained on that page.
12. Changes to this policy
We will update this page when our practices change, and notify Creators by email or in the dashboard about material changes.