Privacy policy

Bargain is the project’s trading name. The company name, tax number, address and registry details will be added once confirmed. For enquiries or rights requests: support@thebargainapp.com. No data protection officer has been appointed because no current legal requirement has been identified.

• Customers: identity and contact details, protected credentials, preferences, reservations, support, security and payment references.
• Venues: representative, business, location, catalogue, offers, subscription, payments and KYC verification.
• Technical data: device, IP, security logs and sanitised diagnostics.
• Optional location: approximate or point-in-time coordinates for sorting and filtering; no movement history is created.

We process data to create and protect accounts, manage applications, reservations, payments, redemptions, support, fraud, legal duties and aggregate service improvement. Legal bases are contract performance or pre-contractual steps, legal obligations, proportionate legitimate interests in security and improvement, and consent for promotional communications or optional features where required.

We share the minimum data with the relevant venue and necessary providers such as Stripe, Render, Vercel, AWS, Firebase/Google and Resend. We do not sell personal data. International transfers, if any, will rely on valid mechanisms and contractual safeguards.

Data is retained for the relationship and then for applicable tax, commercial, anti-fraud or claims periods. Credentials and tokens are encrypted or hashed where appropriate, exposure is limited and access controls and safe logging are used.

You may request access, rectification, erasure, objection, restriction or portability, and withdraw consent, by emailing support@thebargainapp.com. We may request minimum information to verify identity. You may also complain to the Spanish Data Protection Agency.

Spanish Data Protection Agency

Email or push promotions are sent only with the required legal basis and always include an easy opt-out. Business reports must be aggregated and avoid groups small enough to identify a person.

We use applicant-supplied details to process registration and prevent impersonation (pre-contractual steps and security). Resend processes verification email; Cloudflare Turnstile processes technical request information for abuse prevention. If Mapbox permanent geocoding is enabled, we send the business street address, municipality, postcode and country to locate the venue and determine coverage, not the representative’s name, email, password or documents.

Twilio Verify SMS or calls are optional and requested by an explicit action to receive a Bargain code at the supplied number. This does not authorise marketing or recurring messages. You may continue without phone verification and request no further messages; contact support to withdraw consent or report a number belonging to someone else. We record the request date, channel and notice version separately from evidence of business authority. We do not share telephone consent for third-party marketing.

Registration drafts expire after one hour and are removed by automatic database cleanup; codes expire after five minutes and proofs after thirty. We do not store plaintext passwords or codes. A completed application includes business details, status and an internal review reference accessible only to authorised staff. Do not send full ID copies or sensitive documents through general forms or ordinary email; if evidence is needed, we will agree a secure channel and request only the minimum.

The business-authority decision is not based solely on an automated code. Commercial details become public only when a venue is published; tax information, contact proofs and internal review records are not published. Providers, processing agreements, international transfers and case-retention periods must be confirmed in the final review before this new flow is opened.

Technical evidence of telephone-code requests is automatically removed after 90 days. For completed registrations, minimum contact proof stays associated with the account while necessary; changing the phone invalidates it. Specific retention periods for business cases, documents, account closure, claims and backups must be approved before the new registration flow opens.

Cloudflare Turnstile