Privacy policy

Last updated: October 9, 2026. This is a translation; if it differs from the Spanish version, the Spanish version prevails.

In short

The extension recognizes stores by comparing the domain with a public list downloaded to your browser. Sites that aren't stores are never sent to us.
When you're on a store from the list, it asks for that store's coupons by sending only the store's name.
If you allow it, it tells us pseudonymously whether a code worked and why not, so we can remove expired ones. We delete this after 90 days.
With "Compare prices" (on by default; you can turn it off in the settings), opening a product page sends us its code (EAN or manufacturer reference; if the store shows neither, the brand, model and capacity), its price and the store's name, to look for it cheaper. We don't store those requests.
If you use cashback, we keep an anonymous wallet with the purchases stores credit to you. Only when you withdraw do you give us an email address and your payout details, which we store encrypted.
No sign-up, no selling of data, no profiling and no ads.

1. Who is responsible

Luis Emilio Liriano (Kupoki), tax ID (NIF) 60038864D, Calle Alfonso XII 29, 1.º 4, 41001 Seville (Spain). Privacy contact: privacidad@kupoki.com.

2. What stays in your browser

This data is kept in the extension's storage on your device, is not sent to anyone and is deleted when you uninstall it:

Your settings (notices, testing in the cart, sharing results).
Your total savings and a history of your latest savings (store, code and amount).
What the extension has learned on each store: which codes worked for you or not, so it doesn't try them again.
A random installation identifier, not linked to you or your browser.
If you use cashback, your wallet: a random identifier and key the extension uses to identify itself to our server. We only keep an irreversible fingerprint (hash) of the key.
The public store list and a cache of the stores looked up. The cache is cleared when you close the browser.
The stores where you've hidden the notice (for 24 hours) and the ones you've asked us to add. For now, these requests are only kept in your browser.

To read the price, the code field and the store's answer, the extension analyzes the store page inside your browser. The contents of your cart never leave it.

3. What data reaches our servers

When	What is sent	Why and for how long
Every few hours	A request for the public store list. It contains no data about you.	Knowing which sites are stores without asking us on every page. Nothing is stored.
When you open a store from the list	That store's domain name (for example "store.com"). Never the full address, the page or the cart.	Returning its coupons. We don't store it and it doesn't appear in our logs.
When testing codes, only if you turned on "Help verify coupons"	Store, code, whether it worked, the already-classified failure reason (e.g. "minimum order $50"), the saving, the store type, the date and an installation pseudonym.	Knowing which coupons work and removing those that don't, for everyone. Deleted after 90 days.
When you tap "Share" on a code you typed yourself	That code, the store, the fact that it worked and the saving, with the same pseudonym.	Offering it to other people once another installation confirms it works. Results are deleted after 90 days.
On a product page, unless you turn off "Compare prices"	The product's code (EAN, or brand and manufacturer reference; if the store shows neither, as on Amazon, the brand, model name and capacity, e.g. "Apple", "iPhone 17 Pro", "256 GB"), its price and the store's domain (for example "amazon.com"). Never the page address or the product's full title.	Looking for the same product cheaper at other stores. We don't store it or link it to you; results are cached for a few hours per product, without knowing who asked.
When you tap "Activate" for cashback on a store	Your wallet identifier and the store. We create a random click identifier that travels to the affiliate network inside the link; the network receives nothing else from us.	Crediting you with the cashback for your purchase. If there's no purchase, the click is deleted after 12 months.
After a purchase with cashback activated (sent to us by the affiliate network)	The click identifier, the purchase and commission amounts, the currency, the date and the status (pending, confirmed, declined). We don't receive what you bought or your personal details.	Calculating your cashback and keeping our accounts. Kept while your wallet exists and for the periods required by accounting and tax law (up to 6 years).
When you open your wallet	Your wallet identifier and key.	Showing you your balance. We store the date it was last used; a wallet unused for 3 years that never had any cashback is deleted.
When you withdraw your balance	Your email address, the payout method and its details (PayPal email; account holder and IBAN; Bizum phone number; or the gift card store) and the amount.	Paying you and telling you about the payment. Stored encrypted and only decrypted to make the payment. We keep the request for the periods required by accounting and tax law (up to 6 years).

Installation pseudonym. It's the result of irreversibly hashing (SHA-256 with a secret key) the extension's random identifier. It's used to count each installation only once and to curb abuse. We don't keep the original identifier.

What we never store: your IP address, your browsing history, page addresses, your cart contents or the text of the store's messages (they could include your name).

IP address. As with any internet connection, our infrastructure provider receives it to serve the request and uses it transiently to limit abuse (requests per minute). We don't store it.

4. Cashback and affiliate links

Only if you tap "Activate" for cashback on a store do we take you there through the link of an affiliate network (such as Awin or Tradedoubler). The network sets a cookie on the store that credits your purchase, and later reports its amount to us with the click identifier, which doesn't identify you. The network and the store are responsible for that cookie and for your purchase data under their own policies. Without that click, the extension doesn't touch any affiliate cookie. If you arrive at the store through another affiliate's link (a creator, a deals site), we don't offer cashback on that visit.

The same applies if you tap "View" on a price-comparison offer: we take you to that store through its affiliate network's link.

The cashback rules (how much, when and how you get paid) are in the cashback terms.

5. Legal basis (EU users)

Consent (Art. 6(1)(a) GDPR) for code results and the codes you share. You can withdraw it at any time from the extension's settings.
Performance of a contract (Art. 6(1)(b) GDPR) for the cashback you activate: crediting purchases to you, calculating your balance and paying you.
Legal obligation (Art. 6(1)(c) GDPR) for keeping accounting and tax records of commissions and payments.
Legitimate interest (Art. 6(1)(f) GDPR) for looking up coupons for the store you're on and comparing the price of the product you're viewing, which are the service you ask for, and for the transient processing of the IP address to protect the service from abuse.

6. Service providers

Cloudflare, Inc.: network and API infrastructure.
Neon, LLC (a subsidiary of Databricks, Inc.): database, hosted in Frankfurt (European Union).

Both act as data processors and are US companies. For Cloudflare, transfers rely on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses (Decision 2021/914). For Neon, on the European Commission's standard contractual clauses (Decision 2021/914) in Databricks' data processing agreement, which Neon's refers to.

To pay you cashback, your payout details go to whoever makes the payment for the method you choose (PayPal, our bank and yours, Bizum or the gift card store), who handle them under their own policies.

We don't sell or share data with third parties, we don't use third-party analytics and we don't show ads.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to privacidad@kupoki.com. Bear in mind that we don't know who you are: the results we receive carry nothing that lets us identify you. To stop sending us data, simply turn off "Help verify coupons" or uninstall the extension. Anything already sent is deleted automatically after 90 days.

For cashback, we can find your data if you write to us from the email address you used to withdraw. We will never ask for your recovery code. We can delete your wallet if you ask, except for the commission and payment records the law requires us to keep.

If you think we haven't handled your data properly, you can file a complaint with the Spanish Data Protection Agency (aepd.es) or the data protection authority where you live.

8. United States residents

We don't sell personal information and we don't share it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act (as amended by the CPRA) and similar state laws. We don't use your data for targeted advertising or profiling. The categories of information we receive are those listed in section 3, collected for the purposes and kept for the periods stated there. You can ask us about your rights under your state's law at privacidad@kupoki.com; we won't treat you differently for doing so.

9. Children

Kupoki is not directed to children under 14, and we don't knowingly collect personal information from children under 13.

10. Changes

If we change this policy in a meaningful way, we'll say so in the extension before the change takes effect.