Privacy policy

Vouchrs is a sole proprietorship (Einzelunternehmen) based in Germany. The person responsible for the personal data described on this page (the “controller” under the EU General Data Protection Regulation, GDPR) is its owner:

Ivo Kanchev, Vouchrs
Aidenbachstraße 109
81379 München
Germany
Email: hello@vouchrs.store

The same details are in our Impressum.

Our web server writes a short log of every request: the address asked for, the time, the answer, your browser's name, the website you came from, and your IP address with its last part removed before it is written. We use it only to keep the site running and to find errors and attacks (Article 6(1)(f) GDPR), and it is deleted after 14 days at the latest. We keep no analytics or advertising profile of you and set no advertising cookies; the few cookies we set are described below, and none identifies you.

To see whether the site helps people find offers, we count a few things: a visit to the home page, a search (the words searched and how many offers matched), a click on a category, an offer or a code (and, when your browser refuses to copy a code, that it refused), and a tap on a button that opens the creator application. Each count records the page, what was clicked, which version of the home page headline was shown, the kind of place you arrived from (see Cookies), the time, and the same salted one-way hash of your IP address that changes every day. It holds no name, email address or account, and we do not count automated visitors.

We also count which pages are shown, so we know whether people find what they came for. Once a page has been on your screen for a moment, a short script on it tells us so, with the page and the words you searched for. Before it sends anything it checks only that the page is visible and that the browser is not run by a program; it reads nothing else from your device. We keep that with what your browser sent us anyway when it asked for the page, as it does to every website: the website your visit started from (only its name, for example facebook.com), the kind of place you arrived from (see Cookies), whether you are on a phone, tablet or computer, the family of operating system and browser it names (for example iOS and Safari, never a version or a model), the country your connection comes from (looked up from your IP address at that moment in a database kept on our own server; only the two-letter country is stored, never the address), if the page is open inside an app's built-in browser the name of that app (for example TikTok or Instagram, read from what your browser tells every website), and the same daily hash of your IP address; on the home page, also which version of the headline was shown (see Cookies). Only if you allowed “Statistics and tests” does the page also tell us whether you then scrolled, tapped, typed or stayed 15 seconds; without that yes it does not watch what you do on the page. Each page view gets a random number that is used for nothing else, and the pages one browser tab shows after arriving share another random number for that visit, which the page keeps in memory only (nothing is stored on your device, and it is gone when you close the tab). The first page of a visit also tells us what its link was tagged with, if anything: a campaign name or a short tag we put on our own ads and links (for example meta-p1), which ad platform's click marker it carried (only the platform's name, such as facebook, never the marker itself), and the public code of the creator whose link it was, so that creator can see the visit. We do not record what you type, where you move or click on the page, or anything that identifies you, and visits from our own team are kept apart from yours.

So that a broken page does not go unnoticed, the same kind of short script tells us when something goes wrong on your screen: an error in our own code (the message and where in our script it happened), one of our files that did not load, a page whose buttons never started working, or a tap on one of our links that did nothing for ten seconds. Each report holds the page, the kind of problem, those words, what your browser sent us when it asked for the page (the app's name and version if the page is open inside an app's built-in browser, the family and version of the operating system, the browser family and the kind of device) and the same daily hash of your IP address. It holds nothing you typed and nothing that identifies you, uses no cookie and stores nothing on your device. We keep these reports for 180 days, on the basis of our legitimate interest in a site that works (Article 6(1)(f) GDPR).

If you allowed “On this device” (see Cookies), your browser also keeps, on your device only, the offers you opened recently, your last few searches and the categories you look at most, so the site can show them back to you (“Where you left off”, “More in…”), and the offers and brands you saved with the save button. We do not receive that list: to fill those shelves your browser asks us for the offers or the category by name, and we do not store the request. Clearing this site's data in your browser erases it.

We record which offer and brand, the time, the website you came from, whether a creator's link or page brought you to Vouchrs in the last 30 days (and which creator, see Cookies), a salted one-way hash of your IP address that changes every day, and the country your connection comes from (as for page views). We do not store your IP address in click records. If you report a code that does not work, or answer “Did it work?” when you come back from a shop, we record the offer, your answer, the time and the same daily hash. That question is shown because the page's own address gets a mark when you head to the shop; nothing is stored on your device for it.

When you tap a button that takes you to a brand, your browser first asks the affiliate network's address (awin1.com) for a small public file, to see whether your device can reach it. If something on your device blocks it, we show you the brand's own address instead, so you are not left on an error page. This request goes from your browser to Awin, so Awin sees your IP address and browser type, as it does when you click through. If you have allowed “Creator and partner credit” in the cookie banner, your browser makes this check a moment after a page opens, so the button answers faster; otherwise it makes it only when you tap.

When you open our creator pages (the page that explains the programme and the sign-up form) we count the visit: the time, the tag on the link you followed if it had one (for example which outreach message it came from), the website you came from, and the same salted daily hash of your IP address. We do not store your IP address, and we do not count automated visitors or link previews. We use the counts to see which invitations bring people to the page and how many of them apply.

A creator can invite other creators with an invite link, and an Awin partner can bring creators with a partner link. When you apply through one, we keep who sent you (the inviting creator, or the partner) with your application, so we can give them their reward when you are approved, have a first order tracked and reach the order targets, and, for an inviting creator, a share of Vouchrs' side of your sales for a limited time (it is paid by Vouchrs and never reduces what you earn). The inviting creator sees your handle, how far you got (applied, approved, first sale, target) and, once you have sales, how much your sales have earned them and for how many more days; a partner sees how far you got. Nobody sees your email address, your own earnings or the value of your orders. The same goes for an agency, manager or community leader whose link you applied through: it sees your handle and name, how far you got, and your clicks and sales. If you do not want this, apply from the address vouchrs.store/creators without the tag at the end.

A partner account holds the name of your site or business, your email address, a hashed password, your Awin publisher ID, the site address and the text you wrote in your application, the credit you earned and what we paid you through Awin, and the messages we showed you. We use it to review your application, count what your link brought, pay you through Awin and talk to you. Awin sees your publisher ID because we pay you through it; Awin's own privacy policy covers what Awin does with it. We keep the account while you are a partner and for the time tax law requires for the payments.

An agency account holds the name of your agency or group, your name, your email address, a hashed password, your website or main profile, the number of creators and the categories you told us about, the text you wrote in your application, the level you are on and how it changed, the earnings we worked out for you and what we paid you, how you want to be paid (for example a PayPal or Wise email address, or your Awin publisher ID), and the messages we showed you. We use it to review your application, to count the creators who joined through your link, to pay you and to talk to you. The short tag in your link is stored with each creator who applied through it. Your first name, your agency's name and the invite note you may write are shown on the page a creator lands on from your link (an approved agency's only).

What you can see about your creators: their public handle and name, the step they have reached (applied, approved, has made links, has sales), how many clicks and sales they have, and the date they joined. Never their email address, their payout details, what they earn or what their customers spent. Each creator who joined through your link is told this in their own dashboard. The payout service you choose receives your payout details and the amount, as described under “Who we share data with”. We keep the account while you are an agency, and the earnings and payout records for the time tax law requires.

We keep your name, email address and message so we can reply. Brand enquiries also include the brand, its website and the affiliate network it uses.

Your account: your name, email address, a hashed password (or, if you sign in with Google or Apple, the name and email address that provider shares with us; we receive nothing else from them), whether your email is confirmed, and when you last signed in.

Your application and profile: the handle, platforms and links, audience size, country, categories and text you give us, and the short tag from the link you came from (for example “tiktok”), which tells us which channel brings creators. Our team reads applications, and may keep private notes about a decision.

Your activity and money: the links you create, clicks and sales attributed to them, how many people opened your public page (counted as described under “If you just browse”; your own visits while you are signed in are not counted), your earnings, and the payout details you choose to give us (for example a PayPal or Wise email address, or your Awin publisher ID if you are paid through Awin) and the payouts we make. With each click through your links, Awin and the brand also receive the address of your public Vouchrs page (see “Who we share data with”).

What you do in your dashboard: when you open it, press a copy or share button, download an image or a video, tick a first-post step or keep the suggested deals as your picks, we record that action, what it was for (for example an offer) and the time. It tells us which tools help and whether to send you a reminder, and it is what your posting streak (the days in a row you shared or saved a post) is counted from. For that streak the dashboard also tells us the time zone of your device, so that “today” is your day. It is not shown to anyone else and not used for advertising.

Your public page: what you choose to show at vouchrs.store/yourhandle: your name, handle, bio, the links to your social profiles, your picks with the headings and notes you write, and your photo if you add one. A photo is re-encoded when you upload it, which removes the hidden data phones add (such as location); you can remove it at any time. We also keep the language you chose for your dashboard, emails and page.

If you have an account or a pending application, we email you about it: confirming your address, resetting your password or sending a sign-in link when you ask for one, telling you our decision (with a button that signs you in), reminding you how to make your first post if nobody has visited your page yet (sent by our team, at most once every few days), telling you about sales and milestones on your links (for example your first click or your first sale; at most one email per milestone) and confirming payouts. They are written in the language you chose. These messages are sent through an email delivery service we use for this purpose, which processes your email address and the message on our behalf. We do not send marketing email to people who have not asked for it. Creators who ask for the weekly deals email (on the application or in their dashboard) get one email a week with offers they can share; they can stop it from the email or the dashboard at any time.

Deal emails (a daily or weekly selection of offers, alerts such as “tell me when this brand has a new deal”, and a creator's new picks when you follow them) are optional and need no account. We keep your email address, the choices you made (how often, which categories, your alerts, the creators you follow), the language you signed up in (your emails are written in it), the page you signed up on, the kind of place you had arrived from (see Cookies), when you confirmed, and which offers we sent you so we never send the same one twice in a week. Nothing is sent until you press the button in the confirmation email, and every email has a link to change your choices and a one-click unsubscribe. An address that never confirms is deleted after 14 days; one that unsubscribes is deleted 30 days later; the list of what we sent is kept for 13 months. Links in these emails are tagged so that a visit from them counts as coming from email; we do not track whether you open an email.

Our servers regularly visit brands' websites and the pages their offers point to, to take down anything broken. These visits involve no personal data about you.

To run the site and keep offers accurate; to count clicks and credit the right creator when a purchase happens (including a purchase within 30 days of following their link); to review creator applications and pay creators; to answer messages; to prevent fraud and abuse (for example automated or repeated clicks); and to improve the catalogue. We do not sell personal data.

• Your consent (Article 6(1)(a) GDPR and § 25(1) TDDDG): the optional cookies and the list kept on your device (“Cookies” above), and deal emails (you confirm them first). You can withdraw it at any time; what we did before is not affected.
• A contract with you (Article 6(1)(b)): creator and partner accounts, applications, tracking your links' results and paying what you earned.
• Our legitimate interests (Article 6(1)(f)): counting page views, searches and clicks without cookies, keeping the site secure, preventing fraud and automated abuse, checking that offers work, answering messages.
• A legal duty (Article 6(1)(c)): keeping accounting records for payments.

Awin and the brands. When you click through to a brand, the affiliate network Awin receives the click reference attached to the link (a code for Vouchrs or for the creator whose link it was, plus the offer) and, when a creator's link brought you, the address of that creator's public Vouchrs page, which Awin's rules for networks of creators require. Never your name or email. Brands see the same in their Awin reports.

Services that work for us. Our servers are run by Hetzner Online GmbH in Nuremberg, Germany, which is where the data described on this page is stored. Email is delivered by Google (Gmail; Google Ireland Limited, with Google LLC in the USA), which receives the recipient's address and the message in order to deliver it. Google LLC in the USA is certified under the EU-US Data Privacy Framework, which the European Commission has found to give adequate protection (Article 45 GDPR).

Payouts. To pay a creator, the payout service the creator chose receives the payout details they gave us and the amount: PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg), Wise (Wise Europe SA, Belgium) or, for creators paid through Awin, Awin. They act under their own privacy policies. We disclose data if the law requires it, and we do not sell personal data.

• Web server log: 14 days at the latest.
• Click records and creator-page visit counts: up to 24 months. Home page visit, page view, search and click counts: up to 13 months. Code reports and answers to “Did it work?”: 90 days. Reports of problems in a visitor's browser: 180 days.
• Contact messages: up to 24 months after we have handled them.
• Email: the content of a message for 30 days, the record that it was sent for 6 months; sign-in and reset links stop working within 24 hours and their content is removed once sent.
• Brand enquiries: while we are in touch, and up to 24 months after we close them.
• Creator account data, including what you did in your dashboard: while the account exists. You can close your account at any time by writing to us; we then delete it, except the earnings and payout records the law requires us to keep as accounting records (up to 10 years).

Wherever you live, you can ask us for a copy of the personal data we hold about you, and ask us to correct it, delete it, limit how we use it or give it to you in a format you can take elsewhere. You can object to how we use it and, where you gave your consent, withdraw it at any time. Because click records contain no direct identifier, we usually cannot tie them to a person. Use the contact page or write to hello@vouchrs.store and we will respond within one month.

Your right to object (Article 21 GDPR). Where we use data on the basis of our legitimate interests (the counting without cookies, the server log, keeping the site secure, preventing fraud, checking offers, answering messages), you can object at any time for reasons that arise from your particular situation. We then stop, unless we have compelling legitimate grounds that override your interests or need the data to establish, exercise or defend legal claims. To stop the counting for your browser straight away, block the address /api/pv with a content blocker.

You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work, or where you believe your data was misused. The authority responsible for Vouchrs is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

No. You can use the store without telling us anything. To apply as a creator or a partner, we need the details the form asks for; without them we cannot review the application, credit your sales or pay you. Everything marked optional stays optional.

A person on our team decides on every application. The rewards in our terms (the boosted share, Founding seats, invite days and partner credit) are worked out automatically from the orders the affiliate network tracks, exactly as the terms describe them; nothing else about you is decided by a machine. You can ask us to have a person check any of these results.

Passwords are stored as salted hashes, one-time links are stored only as hashes, sessions are signed and expire, admin access is separate, and the database is not exposed to the internet. No system is perfectly secure; if we learn of a breach affecting you we will tell you.

Vouchrs is not directed at children under 16 and creator accounts require adults. Our servers are in Germany; data leaves the EU only as described under “Who we share data with”.

If we change this policy we will update the date above and, for material changes, tell signed-in creators.