Privacy Policy

The Service is operated by Think Compared Ltd, a company registered in England & Wales (company no. 16446607) with its registered office at Kemp House, 124 City Road, London EC1V 2NX, United Kingdom.

For any privacy question or request, contact us at hello@daffo.app. We have not appointed a Data Protection Officer, as we are not required to. We have not yet appointed a representative in the EU; where one is required for users in the EEA, we will appoint and identify one here.

This policy covers both our marketing website (including the waitlist) and the Daffo app. Some sections only apply to the app — for example, social posts, connected email accounts, product tracking and orders — and we say so where relevant. The Service is intended for users aged 13 and over(see “Children & minors”).

We collect the following categories of data:

You give us

• Account & profile: name or handle, email, password, date of birth/age, avatar, bio and preferences.
• Content you create (app): posts, photos/video, reviews, comments, wishlists, hypes, and who you follow.
• Waitlist: your email address and whether you joined as a shopper or a brand.
• Support & communications: messages you send us.

You connect (app)

• Connected email accounts (e.g. Gmail) you link via OAuth, and the order/brand emails we surface from them (see “Connected email”).
• Proxy-email channels: messages sent to the unique addresses we generate for you.
• Tracked products: the product URLs you ask us to monitor and related price/availability data.
• Orders: order and delivery details you add or that we detect from connected sources.

We collect automatically

• Device & usage: device type, app version, identifiers, IP address, and how you interact with the Service.
• Cookies & similar technologies on the website (see “Cookies”).

Under UK and EU GDPR we rely on the following legal bases. We use your data to:

• Provide the Service — create your account, run the feed, tracking, inbox and orders. Basis: performance of our contract with you.
• Keep the Service safe — security, fraud prevention, moderation and enforcing our terms. Basis: legitimate interests; legal obligation.
• Improve the Service — analytics and product development. Basis: consent (cookies) and/or legitimate interests.
• Communicate — service messages, and (with consent) launch and marketing updates. Basis: consent and/or legitimate interests.
• Advertising & measurement — only with your consent, and never to profile-advertise to users we know are minors. Basis: consent.
• Comply with law — respond to legal requests and meet our obligations. Basis: legal obligation.

You can withdraw consent at any time without affecting prior processing.

If you connect an email account (e.g. Gmail) via OAuth, we request only the access needed to identify and surface order confirmations, shipping updates and brand messages inside Daffo.

• We use this email data only to provide that in-app feature.
• We do not use it for advertising, we do not sell it, and we do not transfer it except as needed to provide the feature, with your consent, for security, or to comply with law.
• We limit human access to this data except where you allow it, for security, or where required by law.
• You can disconnect a connected account at any time in settings, which stops further access. Our use of information received from these APIs adheres to the applicable provider’s API user-data/limited-use requirements.

We do not sell your personal data. We share it only with service providers (processors) acting on our instructions, and with others where you ask us to or the law requires it. By category, these are:

• Hosting & infrastructure — to run and store the Service.
• Email & notifications — to send service and (with consent) marketing messages, and push notifications.
• Analytics & advertising partners — engaged only with your consent (see “Cookies”). For California residents, sharing data with advertising partners for cross-context behavioural advertising is a “sale”/“sharing” you can opt out of (see “US privacy rights”).
• Professional advisers, authorities & successors — where necessary to comply with law, protect rights and safety, or in connection with a business transfer.

We are a social layer over third-party retailers and do not process your payments; purchases happen on the retailer’s own site under their terms. A current list of sub-processors is available on request at hello@daffo.app.

We may transfer personal data outside the UK/EEA. Where we do, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement/Addendum, EU Standard Contractual Clauses, or an adequacy decision. Contact us for a copy of the relevant safeguard.

We keep personal data only as long as needed for the purposes above, then delete or anonymise it. As a guide:

• Account & profile: while your account is active, then deleted or anonymised within ~30 days of account deletion.
• Waitlist email: until launch or until you unsubscribe.
• Content & orders: while your account is active, then removed with your account (subject to legal retention).
• Logs & security data: up to ~12 months.

We may keep limited data for longer where the law requires it or to resolve disputes.

If you are in the UK or EEA, you have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent. You also have the right to lodge a complaint with a supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk); in the EEA, your local data-protection authority.

To exercise any right, email hello@daffo.app. We do not use solely-automated decision-making that produces legal or similarly significant effects about you.

Depending on your US state, you may have the right to know, access, delete and correct your personal information, to opt out of its “sale” or “sharing” for cross-context behavioural advertising, and to limit the use of sensitive personal information, free from discrimination for exercising these rights.

• To opt out of sale/sharing, use the “Do Not Sell or Share My Personal Information” link in our footer, or set your browser’s Global Privacy Control — we honour GPC signals.
• To make any other request, email hello@daffo.app. We will verify your identity before responding and will not discriminate against you for exercising your rights.

Daffo is for users aged 13 and over. We do not knowingly collect personal information from children under 13; if we learn we have, we will delete it. If you believe a child under 13 has given us data, contact hello@daffo.app.

For users we know to be under 18, we apply high-privacy defaults, minimise the data we collect, turn profiling off by default, and do not show advertising based on profiling. Depending on country, parental consent may be required for users aged 13 to 16, consistent with applicable law.

Our website uses strictly-necessary cookies to function, and — only with your consent — analytics and advertising cookies. You can accept, reject or manage these from the cookie banner or the “Cookie settings” link in the footer. Full details are in our Cookie Policy.

We use technical and organisational measures designed to protect personal data, including encryption in transit and access controls. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and regulators of breaches where the law requires.

We may update this policy from time to time. We will post the new version here with an updated date and, for material changes, give additional notice.

Questions or requests? Email hello@daffo.app, or write to Think Compared Ltd, Kemp House, 124 City Road, London EC1V 2NX, United Kingdom.