Privacy Policy

Last updated 21 October 2026

Shopperazzi is operated by Datafly Ltd, registered in England and Wales, company number 14411653. Registered office: 167–169 Great Portland Street, London W1W 5PF. VAT number GB437689640. We are the data controller for the personal data described below. This policy explains what we collect, why, the legal basis for processing it, who we share it with, how long we keep it and the rights you have under the UK GDPR and the Data Protection Act 2018 — and, if you live in the US, under US state privacy laws (see “US residents” below). We have written it in plain English on purpose.

What we collect

We collect only what we need to run the service. You can browse most of Shopperazzi without giving us any personal data at all.

• Account data — if you create an account, your email address (and, where you sign in with Google, the basic profile your provider shares). Authentication is handled by Google Firebase Authentication on our behalf.
• Saved items and follows — the shops, brands, keywords and products you choose to follow or save, so we can build your personalised feed and send the alerts you ask for.
• Email preferences — whether you have opted in to deal alerts or price-drop emails, and your double opt-in confirmation.
• Newsletter and waiting-list sign-ups — if you sign up for our emails without an account, or join the waiting list for an edition that hasn't launched yet, your email address, which edition it's for and your confirmation.
• Push notifications — if you turn notifications on, the push address your browser gives us, so we can send the alerts you choose.
• Usage and device data — anonymous or pseudonymous analytics about how pages are used (for example pages viewed, approximate region, device and browser type), collected through cookies and similar technologies.
• Click-out data — when you click an outbound link to a retailer, we record the click (the page it came from, the shop, the time and your approximate country) so we can measure performance and (where applicable) attribute affiliate commission. We do not see your card details or what you ultimately buy.
• Secret Santa groups and gift lists — the details people put into them. These have their own sections below.

Why we use it, and our legal basis

• To provide the service you ask for — running your account, your feed, your saved items and your follows. Legal basis: performance of a contract.
• To send deal alerts and emails you have opted into. Legal basis: your consent, which you can withdraw at any time by unsubscribing.
• To understand and improve how the site is used (including our own first-party measurement, with Google Analytics processing it for us), keep it secure and prevent abuse. Legal basis: our legitimate interests in operating and improving a reliable service.
• To run the optional extras you allow in Privacy choices: extended analytics, personalisation and marketing. Legal basis in the UK and EU: your consent, which you can withdraw at any time in Privacy choices.
• To measure outbound clicks and affiliate performance on our own systems. Legal basis: our legitimate interests in running a sustainable, free-to-use comparison service. Sending your click through an affiliate network: in the UK and EEA, your “Marketing & affiliate tracking” choice; elsewhere, our legitimate interests (see “Affiliate links and the networks we use”).
• To comply with our legal obligations, such as keeping necessary financial records. Legal basis: legal obligation.

Cookies and analytics

We use a small number of cookies and similar technologies. Some are strictly necessary — for example, keeping you signed in and remembering your privacy choices.

In the UK we also run our own first-party measurement by default: Datafly Signal, and Google Analytics, which receives the same statistics and processes them only for us (Google's data sharing and advertising features are switched off, and Google Analytics doesn't store IP addresses). It counts visits and clicks for our own statistics; UK law (the Data (Use and Access) Act 2025) allows this without asking first, as long as we tell you and let you switch it off. In the EU and EEA it stays off until you turn it on. Outside Europe, including the US, it is on by default. You can switch it off at any time in Privacy choices (the “Manage cookies / Privacy choices” link at the bottom of every page).

Everything else that isn't essential — extended analytics, personalisation and marketing — stays off in the UK and EU until you turn it on. Elsewhere, including the US, it is on by default and you can switch it off; if your browser sends a Global Privacy Control signal, we keep it off. Declining optional cookies will not stop you using the site.

The cookies we use

Cloudflare, which delivers the site, may set short-lived security cookies (such as __cf_bm) to tell people apart from bots. Google Analytics, as part of our measurement, also receives some of it straight from your browser. After you click through to a shop, the retailer and any affiliate network in between set their own cookies under their own policies (see “Affiliate links and the networks we use” below).

We also keep a few things in your browser's storage so the site remembers them on that device: your privacy choices; the items you save, watch (♥) or hide; the shops and brands you follow; products you've viewed recently; when you last looked at the feed, so new deals stand out; which tips and sign-up prompts you've already seen; your sort choice for this visit; your private Secret Santa links; a random ID for your ♥ watches, made the first time you use ♥; and, for our measurement, a copy of your visitor ID, a Google Analytics ID and some visit details (names starting “sz_” and “_df”).

We don't load any analytics on private Secret Santa pages (organiser, participant, join and email opt-out links) or on shared gift-list pages. Their web addresses work like keys, so they never reach our analytics or Google.

Who we share data with

We do not sell your personal data. We share it only with the service providers and partners that help us run Shopperazzi, and only as far as needed:

• Google Firebase — for account authentication.
• Datafly Signal — our own analytics service, run by Datafly Ltd. It records page views and clicks against a random ID for your browser and, if you're signed in and haven't switched our measurement off, links them to your account ID (not your email address or name). We use it for our own statistics and to improve the site.
• Google Analytics — processes our measurement data for us: usage data from Datafly Signal, some of it directly from your browser, only while our measurement is on in your Privacy choices. Google's data sharing and advertising features are switched off, so it isn't used for Google's own purposes or for ads. It is never loaded on private Secret Santa or shared gift-list pages.
• Resend — sends our emails: account emails, the alerts you ask for, and Secret Santa emails.
• Your browser's push service (for example Google, Mozilla or Apple) — delivers the notifications you turn on. It handles the notification, not your account details.
• Cloudflare — delivers the site, protects it from attacks and abuse, and on some forms runs a check that tells people apart from bots.
• Affiliate networks and retailers — only when you click through to a shop. See “Affiliate links and the networks we use” below.
• Our hosting and infrastructure providers, who process data strictly on our instructions.

Some of these providers operate outside the UK and EEA. Where that happens, we rely on appropriate safeguards (such as the UK International Data Transfer Addendum or Standard Contractual Clauses) to protect your data.

Affiliate links and the networks we use

When you click a link from Shopperazzi to a retailer, we may send you through an affiliate network so the retailer can credit us if you buy. We record the click on our own systems (the page it came from, the shop, the time and your approximate country) and, when the link goes through a network, may pass the network a short reference code that does not identify you. The network receives your IP address, browser details and the page you came from, and the network and retailer may set cookies to attribute a purchase.

We use, or are joining, the networks below. Each acts as an independent controller of the data it collects when you click one of its links, under its own privacy policy, as does each retailer.

Skimlinks. We use, or are joining, Skimlinks and its affiliates (the “Skimlinks Group”). To the extent the Skimlinks Group processes your personal data when providing affiliate marketing links, they act as controllers in respect of this data. They use automated means of data collection, the Skimlinks Link Wrapper (third party, active while enabled), to earn income from our content when you click a link that takes you to a merchant's website; outside the UK and EMEA they may also set the t_gid cookie (third party, 1 year). See the Skimlinks privacy policy and Taboola's privacy policy; you can opt out at optout.skimlinks.com.

Sovrn Commerce (Sovrn, Inc., formerly VigLink). Links that pass through redirect.viglink.com let Sovrn attribute your click to us; Sovrn may log your IP address and browser details and set cookies after you click. See Sovrn's privacy policy and Privacy Center for opt-outs.

Awin, CJ, Impact, Rakuten Advertising, Partnerize and TradeDoubler. We also use, or are joining, these networks. When a link goes through one of them, it receives the same kind of information and may set cookies to attribute a purchase.

Legal basis: in the UK and EEA, your “Marketing & affiliate tracking” choice in Privacy choices — without it, your click goes straight to the shop with no affiliate network in between. Elsewhere, our legitimate interests in running a free service that is funded by commission; we honour Global Privacy Control and your Marketing choice there too. No affiliate tracking happens when you simply view a page — only when you choose to click through to a shop. (Some shop logos and product images load from Awin's and Skimlinks' image servers, which see your IP address as any image host does; Awin's also sets the security cookie in the table above.)

How long we keep it

We keep account data for as long as your account is active. If you delete your account, we remove your personal data within a reasonable period, except where we must keep limited records to meet a legal obligation. Analytics data is kept against random IDs rather than your name or email address, and we delete event-level analytics data after 26 months. Newsletter sign-ups are kept until you unsubscribe; push addresses until you turn notifications off or they stop working. Secret Santa groups are deleted automatically on the schedule set out in the Secret Santa section below.

Secret Santa

Our Secret Santa tool lets someone (the organiser) set up a group, add people and draw names. Nobody needs an account. This section covers what happens to the details in a group.

What we collect

• About the group — its name, budget, cut-off and exchange dates, any exchange details and any message from the organiser.
• About the organiser — their name and email address, if they give them. If they're signed in, the group is also linked to their Shopperazzi account.
• About each person taking part — their name (and an optional label to tell apart two people with the same name) and, if given, their email address, a household label and anyone they shouldn't be drawn to buy for. The organiser may enter these for other people, or people can add themselves with the group's join link.
• What people add to their own page — gift hints, notes and wishlist items (products from our catalogue or links they paste).
• How the draw is going — who is buying for whom, whether each person has opened their match, and a record of the emails we've sent for the group and whether they were delivered.
• On your device — so you can find your groups again, we save your private links in your browser's storage on that device. They aren't sent to us, and you can remove them with “Forget” on the Secret Santa page.
• To stop abuse, we briefly use your IP address to limit how many requests can be made. We don't store it with the group.

What we use it for

Only to run that group: making the draw, showing each person their own page and sending that group's emails — for example an invitation, news that the names have been drawn, a reminder, or a copy of someone's private link. We never use Secret Santa details for marketing, never add these email addresses to a mailing list, and never sell or share them.

Our legal basis

Legitimate interests: the organiser's and participants' interest in running a gift exchange together, and ours in providing the tool. If an organiser adds you, every email we send you says who added you and why, and has a one-click link to stop all Secret Santa emails from us.

Who can see what

• Each person sees their own page: their own details and wishlist and, once names are drawn, the name, hints and wishlist of the person they're buying for. They never see anyone else's email address or anyone else's match.
• Anyone with the group's join link can see the group's name and budget, its dates, the organiser's name and the names of the people already in it, so nobody joins twice by mistake.
• The organiser sees the group's settings, everyone's names and who has opened their match. They see the email addresses they entered, or that people they added typed in later; addresses people gave when joining through the join link are partly hidden.
• Unless the group is set to “Keep it secret from me too”, the organiser also has everyone's private link, so they could look at anyone's match. With that setting on, we don't show the organiser anyone's private link (other than their own) or who is buying for whom, and we email people their own links instead. It's there so an organiser can take part without spoiling it for themselves: an organiser who types in an address of their own for someone could still receive that person's link.
• Private links work like keys: anyone who has one can open that page, so keep yours to yourself. We keep these pages out of search engines and out of our analytics.
• Shopperazzi staff only look at a group when we need to — to fix a problem, answer a request or stop abuse.

How long we keep it

Groups delete themselves automatically, with everything in them — people, wishlists, the draw and the email records:

• 60 days after the gift-exchange date, if the organiser set one;
• otherwise, 90 days after the names were drawn or the group was last changed, whichever is later;
• otherwise, if the names are never drawn, 180 days after the group was last changed.

Without an exchange date, a group is never deleted while its joining cut-off is still to come or less than 30 days ago.

If you stop Secret Santa emails, or an email to you bounces or is reported as spam, we keep your email address on a do-not-email list (with the reason and date) so we don't send to it again.

Getting your details removed

• Organisers can delete the whole group at any time from the organiser page.
• People taking part can leave a group from their private page until the names are drawn. The record of emails we've already sent them (address, type and date) stays with the group until it's deleted, so a group can't be used to email more and more addresses.
• Anyone can stop Secret Santa emails with the link at the bottom of each one.
• Or email hello@shopperazzi.com and we'll remove your details from a group, or delete it. If the names have already been drawn, removing someone changes another person's match, so we may need to contact the organiser first.
• If you organised a group while signed in, downloading your account data includes it (names, dates and status, but not the private links), and deleting your account deletes it.

Gift lists

If you have an account you can make gift lists. A list holds its title, occasion and date, its sharing setting, and the items you add — products from our catalogue or links you paste, with any notes. When you paste a link, our server visits that page once to pick up its title, picture and price.

Private lists are only visible to you. Shared lists can be opened by anyone who has the link, without an account; shared-list pages are kept out of search engines and out of our analytics. When someone reserves an item or marks it as bought, we save a random code in a cookie on their device (for up to a year) so they can change their mind later — we don't ask for their name.

Lists are kept until you delete them or your account. Reservations are deleted with the list.

Your rights

Under UK data protection law you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to certain processing, to data portability, and to withdraw consent at any time. You can exercise any of these rights — or ask us a question — by emailing us. We will respond within the timescales the law requires.

If you are unhappy with how we have handled your data, you can also complain to the UK Information Commissioner's Office (ico.org.uk), though we would always rather you came to us first so we can put things right.

US residents

This section applies if you live in the United States, including California. It adds to the rest of this policy.

What we collect, where it comes from and why

• Identifiers — your email address and account ID if you have an account; random IDs for your browser; and your IP address, which we use for security and rate limiting and to work out your approximate location (country).
• Internet activity — the pages you view, the links you click, your searches, and your device and browser type.
• Information you give us — saved items, follows, alerts, gift lists and Secret Santa details.
• Inferences — the kinds of products and shops you seem interested in, used only to tailor your feed.

We collect this from you, from your browser or device, and, if you sign in with Google, from Google. We use it for the purposes in “Why we use it” above: to run the service, send the emails you ask for, measure and improve the site, keep it secure, and get credited by retailers when you buy. We don't collect sensitive personal information.

No sale, sharing or targeted advertising

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising. We haven't done any of these in the past 12 months. We disclose personal information only to the service providers listed in “Who we share data with”, and to an affiliate network or retailer when you choose to click through to a shop.

Global Privacy Control and Do Not Track

If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out: personalization, marketing and extended analytics stay off for that browser unless you turn them on yourself. Our own first-party measurement, including Google Analytics processing it for us, is not a sale or sharing of your data, so it stays on; you can switch it off in Privacy choices. Browsers' “Do Not Track” setting has no agreed standard, so we don't respond to it — please use GPC or Privacy choices instead.

Other companies' tracking

When you use Shopperazzi, other companies may collect information about your online activities over time and across different websites: Google, if extended analytics is on; Awin and Skimlinks, whose image servers host some shop logos and product images; and, after you click through to a shop, the affiliate network and the retailer.

Your rights and how to use them

Depending on the state you live in, you may have the right to know what personal information we hold about you and get a copy, to correct it, to delete it, and to opt out of its sale, sharing or use for targeted advertising (we don't do any of those). We honor these requests wherever you live in the US. If you have an account, you can download or delete your data yourself from your account page. Otherwise, email hello@shopperazzi.com with “US privacy request” in the subject line.

We'll check the request comes from you, usually by replying to the email address on your account, and respond within 45 days. You can use an authorized agent; we'll ask for proof that they can act for you. If we turn down a request, you can appeal by replying to our answer with “Appeal” in the subject line. We won't treat you differently for using your rights.

Children

Shopperazzi is intended for adults. We do not knowingly collect personal data from children under 16. If you believe a child has given us their data, please contact us and we will delete it.

Changes and contact

We may update this policy from time to time; the date at the top shows when it last changed. For any privacy or data-protection request, email hello@shopperazzi.com and mark it for the attention of the data team.