Privacy Policy

Family Deal Scanner ("we", "us") operates familydealscanner.com, a free service that helps parents and guardians find kids' activities, events, and offers near a given address. Family Deal Scanner is the data controller for the personal data described here; you can reach us at any time at contact@familydealscanner.com. This page explains what personal data we collect, why, and the choices you have about it.

Who this service is for

Family Deal Scanner is intended for use by adults — parents, guardians, and carers searching on behalf of the children in their care. You must be 18 or over to register. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, contact us using the details below and we'll remove it.

What we collect

• Account details: the email address you register with, and your password — stored only as a salted hash by our login provider, never in plain text.
• Your home address, converted to an approximate map coordinate so we can find activities near you. We don't need or ask for anything more precise than the address you choose to enter.
• Search activity: addresses searched (including via the free, no-account homepage search), and, for registered users, when you run an update and what it finds.
• Marketing preference: whether you've opted in to receive emails about new deals and features, and when.
• Usage records: page visits, searches, updates you run, and clicks through to a business's website. For signed-in users these records carry your account id; they also record the city and an approximate coordinate (rounded to roughly 1 km) of the address you searched — never your device's location and never your full address. We use them to understand how the service is used and to report aggregate figures to participating businesses (e.g. "this many people saw your listing this month"). We also keep a record of which paid lookups (map searches, AI analysis) each update triggered, so we can control our running costs and spot abuse.
• Your IP address: recorded when you use the free homepage search (to limit it to a fair number of searches per network) and, briefly, when you log in, register or request a password reset (to block brute-force and abuse). Our hosting and security providers (Render, Cloudflare) also see it as part of serving the site.
• Link clicks on public pages: when you click "Visit website" or "Book tickets" without being signed in, we count the click so we know which listings are useful. To avoid counting the same person twice we store a scrambled, one-way code made from your IP address and that day's date. It can't be turned back into your IP address and can't be used to recognise you from one day to the next.
• A free-search cookie: after a homepage search we set a cookie holding a random id so we can show you your own results again if you come back (see Cookies below).

How we use it, and on what legal basis

• To run the core service — finding and showing you nearby activities and offers — and to keep your account working (login, password reset, email verification). Necessary to perform our contract with you (our Terms of Service).
• To email you service-related messages (verification, password resets) regardless of marketing preference, since these are necessary to operate your account, not marketing. Same basis as above.
• To email you about new deals, activities, or features near you — only if you've opted in. Based on your consent, which you can withdraw at any time via the unsubscribe link in any such email, or by contacting us.
• To understand and improve the service, and to report aggregate, non-identifying traffic statistics to participating or prospective business partners (e.g. "this many people near you saw your listing this month") — we do not sell or share your individual search history or identity with those businesses. Based on our legitimate interest in running and sustaining a free service, balanced against your privacy — we only ever report data in aggregate, never anything that identifies you.
• To keep the service secure and fair — rate-limiting logins and free searches, detecting abuse. Based on our legitimate interest in protecting the service and its users.

We don't make automated decisions about you that have legal or similarly significant effects. We do use AI (Anthropic's Claude) to read and summarise businesses'public websites — it never receives your personal data and makes no decision about you.

Who else sees data, and why

We use a small number of service providers to run Family Deal Scanner:

• Supabase — hosts our database and handles account authentication.
• Render — hosts the website itself and the servers that run searches.
• Google Maps Platform — turns addresses into map coordinates and finds nearby businesses; we cache some of this data (see below) to keep repeat searches fast and to avoid unnecessary API calls. The optional map view on your dashboard loads Google Maps in your browser, so Google sees your IP address when you use it.
• Resend — sends our emails (verification, password resets, and marketing emails if you've opted in).
• Cloudflare — sits in front of the site to provide security and protect against attacks, so it handles every request, including your IP address.
• Have I Been Pwned — when you choose a password we check it hasn't appeared in a known data breach. Only the first five characters of a one-way hash are sent, so neither your password nor anything identifying you leaves our server.
• Anthropic (Claude) — reads the public website of each nearby business to summarise it and identify current offers, events, and announcements. Only a business's own public website text is sent for this — never your personal data.

Affiliate links

Some "Book tickets" links are affiliate links, always labelled where they appear. We don't run any affiliate or advertising code on our site, and we don't pass your name, email, address or account details to anyone when you click. A click first goes through a short redirect on our own site (so we can count it), then to the affiliate network — Awin or Partnerize — and on to the ticket seller. From that point you are on their sites: the network and the seller will see your IP address, browser details and the page you came from, and will set their own cookies to record that the visit came from us and whether a booking followed. They do this as independent controllers under their own privacy policies (awin.com/gb/privacy and partnerize.com/privacy-policy), and any purchase details stay with them — we only ever receive totals and commission amounts, never who booked. If you'd rather not be tracked this way, use the venue's "Official website" link instead, which is never an affiliate link.

Supabase, Render, Anthropic, Resend and Cloudflare process data on our behalf, as our processors, under their data-processing terms. Google Maps Platform is different: it acts as an independent controller of the data it receives (an address to look up, or your IP address if you open the map view) under Google's own Controller-Controller Data Protection Terms. We don't share your personal data with anyone else, and we never sell it. Your account data is stored in the UK (Supabase, London) and the site runs in the EU (Render, Frankfurt), which the UK recognises as providing adequate protection. Google, Anthropic, Resend and Cloudflare are US companies and may process data in the US; those transfers are covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent approved safeguard. Email us if you'd like a copy of the relevant safeguards.

Caching

Results for a given area (which businesses are nearby, their photos, and the offers found on their websites) are cached and reused across different users searching the same or a nearby area. This is about a business's public information, not about you personally, and it's what keeps searches fast and keeps our running costs reasonable enough to keep this service free.

How long we keep data

Account data (email, address, preferences, your results): for as long as your account is active. When you ask us to delete your account we remove it within 30 days; it may persist in encrypted backups for up to a further 14 weeks before those cycle out. Usage and cost records (page views, searches, clicks, paid lookups, with your account id): 24 months, after which they're deleted or permanently unlinked from your account. If you ask us to delete your account we delete them straight away rather than waiting. Free homepage searches (a scrambled, non-reversible form of your IP address, and the address you typed): up to 31 days, only to limit free searches and show you your results again, then deleted automatically. Login and sign-up rate-limit records (scrambled, non-reversible forms of your IP address and email): deleted within 48 hours. We may keep something longer where the law requires it.

Your rights

Under UK GDPR you have the right to:

• Ask what personal data we hold about you, and get a copy of it.
• Receive the data you gave us in a portable, machine-readable format.
• Ask us to correct inaccurate data.
• Ask us to delete your account and personal data.
• Withdraw consent (for example to marketing) at any time, as easily as you gave it.
• Object to, or ask us to restrict, processing based on our legitimate interests.
• Complain to us directly — email contact@familydealscanner.com with "Data protection complaint" in the subject. We'll acknowledge it within 30 days, look into it, and tell you the outcome.
• Complain to your local data protection authority — in the UK, the Information Commissioner's Office (ICO) — at any time, whether or not you've come to us first.

To exercise any of these, contact us using the details below.

Cookies

We set only cookies that are strictly necessary to provide what you've asked for:

• Sign-in session (sb-…-auth-token, set by our login provider Supabase): keeps you logged in. Removed when you log out.
• Free search (fds_teaser): a random id set after you use the homepage search, so we can show you your own results again and count the free search you've used. Lasts 30 days.
• Security (Cloudflare, e.g. __cf_bm): short-lived cookies that help tell people from bots. Typically expire within 30 minutes.
• Staff sign-in (admin_2fa): only ever set for our own administrator accounts.
• "Maybe later" (fds:update-prompt:snoozed-on, kept in your browser's own storage, not a cookie): if you press "Maybe later" on the "your weekly update is ready" message, your browser remembers that day's date so we don't ask again until tomorrow. It holds a date and nothing else, never leaves your device, and is only written when you press that button.

Strictly necessary cookies don't require consent under UK law (PECR), which is why there's no cookie banner. We don't use any advertising, analytics or tracking cookies, and no third party sets cookies through our site for their own purposes. Our own usage statistics are collected on our servers without cookies. If you click a labelled affiliate link you leave our site, and the affiliate network and ticket seller set their own cookies on their own sites — see "Affiliate links" above.

Businesses we list

The businesses shown in the service are compiled automatically from Google's business listings and from each business's own public website. Where a business is run by an individual (a childminder or sole trader, for example) that information can include personal data such as a name or address. We process it on the basis of our legitimate interest in helping parents find local activities, and only as it's already published. If you run a listed business and want your entry corrected or removed, email us and we'll act promptly.

Contact us

Questions about this policy, or to exercise any of the rights above, email contact@familydealscanner.com.

Changes to this policy

We'll update this page if how we handle data changes, and update the date at the top. If a change is significant, we'll email registered users before it takes effect and highlight it on the site.