Choose essential cookies only or accept optional analytics. What each option includes is explained in our Cookie Policy; personal data is covered in our Privacy Policy.
Privacy Policy
Your privacy is important to us. This policy explains how we collect, use, and protect your personal information.
Last updated: April 11, 2026
At Cheaply, we respect your privacy and are committed to protecting your personal data. This privacy policy explains how we handle information when you use our AI-powered discount search platform, whether you're a customer searching for deals or a business listing products.
The list below maps common GDPR information requirements to sections in this policy:
- Identity of the controller and how to contact us — Sections 1 and 14
- Categories of personal data — Section 2 (cookies: Section 9)
- Purposes of processing — Section 3
- Lawful bases (contract, legal obligation, legitimate interests, consent) — Section 4
- Recipients and processors (subprocessors) — Section 5
- Transfers outside the EEA — Section 6
- Retention and deletion criteria — Section 7
- Your rights and the Dutch supervisory authority — Section 8
- Security and personal data breaches — Sections 11 and 12
- Children — Section 10
- Solely automated decisions with legal or similar significant effects (Article 22 GDPR) — we do not use this; see the note at the end of Section 8
The data controller responsible for processing your personal data is:
Websave
KVK number: 92785018
Dotterbloemkreek 3, 2353JA Leiderdorp, Netherlands
Email: info@cheaply.nl
We collect the following types of personal data:
Personal Accounts (Web Users)
- Name (first name and last name)
- Email address
- Password (stored using strong one-way hashing; we do not store your password in plain text)
- Location data (optional): postal code, house number, full address, city, province, and geographic coordinates
- Account verification status
- Login attempts and session information
Business Accounts (Companies)
- Company name and display name
- KVK (Chamber of Commerce) number and registered name
- Company description and website URL
- Contact information (email and optional phone number)
- Password for the business account (stored using strong one-way hashing)
- Location data: postal code, house number, full address, city, province, and geographic coordinates
- Company logo (if uploaded)
- Account verification status
- Login attempts and session information
Usage Data
- Product views and interactions
- Search queries and filters used
- Favorites and wishlist items
- Product votes (upvotes/downvotes)
- Notifications preferences
- Technical and security-related data from our hosting environment (e.g. HTTP requests, errors) where needed to run and protect the service
Cookies and Similar Technologies
- Authentication cookies (payload-token) - required for logged-in sessions
- Location preference cookies (user_location) - to remember your location preferences
- Optional operational cookie (cheaply-construction-bypass) - only when the site is in construction mode, to allow authorized preview of the full site
- Cookie/consent preference (cheaply-cookie-consent in browser storage) on the full marketplace site — remembers whether you accepted optional analytics until you clear site data for Cheaply
Launch waitlist (coming soon mode)
- When you join our email waitlist we collect your email address and optional first name.
- We use this to send launch and product updates you asked for. We use Brevo (formerly Sendinblue) as a processor to store contacts and send those marketing emails on our instructions under our agreement with them.
- Marketing emails are sent only if you opt in on the signup form. You can unsubscribe using the link in any marketing message.
Lookups, embedded services, and optional AI
In certain flows we send limited information to external services. This does not change who is responsible for your account data (Cheaply / Websave as controller), but those providers process data under their own terms for the specific function:
- KVK (Netherlands Chamber of Commerce) API: when a company enters a KVK number we query the official register to validate it and retrieve registered business details shown in the verification flow
- API Postcode (api-postcode.nl): when you or a company enter a Dutch postal code and house number we may request address fields and coordinates to complete or verify a location
- OpenAI: when a verified merchant uses optional AI-assisted translation while creating or editing product text, only the content they submit for translation is sent to OpenAI to produce a draft (this happens only if the feature is available and they choose to use it)
- Google Maps: some product pages embed Google Maps (including directions links). When the map loads, Google may process technical data under Google's policies
We use your personal data for the following purposes:
- To provide and maintain our discount search platform
- To create and manage your account
- To verify your email address and ensure account security
- To show you relevant local deals based on your location (if provided)
- To enable you to save favorite products and create wishlists
- To send you transactional and security-related emails (e.g. email verification, password reset, important account updates)
- To send you in-product service notifications by email (e.g. when a saved product is removed or a deal is expiring, according to your notification preferences)
- To send operational emails to our team or designated inboxes when needed to run the platform (e.g. company listing requests, company verification or fraud reports, scraper or import summaries, and similar service messages triggered by activity on the site)
- To notify companies by email about verification outcomes or account-related updates
- To operate launch waitlists and send marketing updates you have opted into, using Brevo as our email campaign provider
- To verify business legitimacy (for companies) using KVK data
- To operate, secure, and improve our service (including abuse prevention and development using aggregated or technical data where appropriate)
- To prevent fraud and ensure platform security
- To comply with legal obligations
We process your personal data based on the following legal grounds under GDPR:
Contract Performance
- Account registration and authentication
- Email verification
- Providing the discount search service
- Company verification (KVK data) for business accounts
- Location data for companies (required to show location-based deals)
- Optional AI-assisted translation of product text for merchants who choose that feature (the submitted text is processed to generate a draft translation)
Legal obligation
- Keeping or disclosing certain records where required by applicable law (for example tax or accounting obligations)
- Cooperating with lawful requests from competent authorities when we are legally required to respond
Consent
- Optional location data for personal accounts (to show local deals)
- Marketing emails from our launch waitlist when you opt in on the coming-soon signup form (you may withdraw consent by unsubscribing from those messages)
- Where we rely on consent, you may withdraw it at any time; this does not affect the lawfulness of processing carried out before withdrawal
Legitimate Interest
- Sending service notifications (product updates, deal expirations)
- Fraud prevention and security measures
- Operating and protecting the platform using technical and security logs from our infrastructure
We do not sell, rent, or share your personal data with third parties for marketing purposes.
Service Providers
We share data with the following service providers who help us operate our platform:
- Vercel - Hosting; on the full marketplace site, Vercel Web Analytics loads only if you choose "Accept all" on our cookie banner (aggregated traffic metrics)
- Brevo (Sendinblue) - email marketing lists and campaign delivery when you sign up for our launch waitlist or other marketing lists you explicitly opt into
- Neon PostgreSQL - Database hosting
- Typesense - Search and discovery (product index; search queries are processed to return results)
- SMTP email delivery - transactional and service email is sent through an SMTP provider configured for our environment (e.g. TransIP in a typical setup; the exact provider depends on deployment)
- ImageKit - storage, resizing, and delivery of images you upload (e.g. company logos and product photos)
- Payload / Payload Cloud - content management, APIs, and related hosting features we enable for the platform
- KVK (Chamber of Commerce) API - validation and retrieval of registered company data for business verification
- API Postcode (api-postcode.nl) - Dutch postal code and house number lookup to complete addresses and coordinates
- OpenAI - optional AI-assisted translation when merchants use that feature
- Google - Maps embeds and directions links on product pages
These service providers are bound by contractual obligations where required to protect your data and only process it for the purposes we specify. Providers may also process data under their own terms for security or operations (for example map or AI vendors).
Third-party websites, deals, and affiliate-style links
Cheaply helps you discover deals. Opening a deal often sends you to an external website (for example a merchant checkout, booking page, or campaign landing page).
- Today, consumer search and browsing in the app focus on verified local listings. We may introduce additional partner or affiliate listings over time; we will update this policy when that changes materially.
- Websites you visit after leaving Cheaply apply their own privacy policies and may use cookies or trackers we do not control.
- Outbound links may include affiliate, referral, or campaign parameters so partners can measure traffic or attribute purchases. Cheaply does not sell your account data to those merchants for their own marketing.
Embedded content
Some pages load embedded content from other providers when you view them (for example Google Maps on a product page). Those providers may collect device, technical, or usage information under their own policies.
Legal Requirements
We may disclose your personal data if required by law, court order, or government regulation, or to protect our rights, property, or safety, or that of our users.
Some of our service providers may process your data outside the European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions by the European Commission
- Other appropriate safeguards as required by GDPR
If you have questions about specific data transfers, please contact us at info@cheaply.nl.
We retain your personal data for as long as necessary to provide our services and comply with legal obligations.
While your account is active, we retain all data associated with your account.
Account Deletion
When you request account deletion:
- Your account will be immediately marked as deleted and hidden from the system (soft delete)
- After 30 days, your data will be permanently removed from our systems (hard delete)
- This 30-day period allows for account recovery in case of accidental deletion and ensures backups are updated
Exceptions
We may retain certain data longer if required by law (e.g., accounting records) or for legitimate business purposes (e.g., anonymized product data from deleted company accounts for historical accuracy).
You have the following rights regarding your personal data:
Right of Access
You can ask us whether we process your personal data and request a copy, subject to applicable law and identity verification.
Right to Rectification
You can update most of your personal data directly through your profile settings. For certain fields (such as KVK numbers for companies), please contact us at info@cheaply.nl.
Right to Erasure
You can delete your account at any time through your profile settings. Your account will be soft-deleted immediately and permanently removed after 30 days.
Right to Restriction of Processing
In certain circumstances you can ask us to restrict processing of your personal data (for example while a dispute is resolved).
Right to Data Portability
Where processing is based on consent or contract and is carried out by automated means, you may have the right to receive your personal data in a structured, commonly used format, where technically feasible.
Right to Object
You can object to certain processing based on legitimate interests, subject to compelling grounds. Some processing is necessary to provide the service.
Right to Withdraw Consent
Where we process data based on consent (for example optional personal location), you may withdraw consent at any time via profile settings or by contacting us.
Right to Lodge a Complaint
You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you believe we have violated your privacy rights. More information: https://autoriteitpersoonsgegevens.nl
We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you (Article 22 GDPR). Search results and rankings depend on your queries, filters, and how listings are configured on the platform—not on profiling that meets that Article 22 threshold.
To exercise any of these rights, please contact us at info@cheaply.nl. We will respond to your request within 30 days as required by GDPR.
We use cookies and similar technologies as described in our Cookie Policy. The details below are the same as on the dedicated Cookie Policy page, repeated here for convenience.
Cookie Policy (dedicated page) — Use this link if you need the cookie information on its own (for example from a footer or compliance checklist).
Consent and third-party scripts
On the full marketplace site we show a cookie banner on your first visit (or after you clear site data for Cheaply). If you choose "Essential only" we do not load non-essential analytics scripts. If you choose "Accept all" we load Vercel Web Analytics for aggregated, privacy-oriented usage metrics (see Vercel’s documentation for what they collect). Product pages may embed Google Maps; when you view a map, Google may process technical data under Google's policies, outside our control. If we add further non-essential cookies or advertising scripts, we will update this policy and obtain consent where legally required before loading them.
Our cookies (essential and operational)
These cookies and similar storage are necessary for the platform to function or for specific operational modes:
- Authentication cookies (payload-token) - Required to keep you logged in
- Location preference cookies (user_location) - To remember your location settings
- Optional cookie (cheaply-construction-bypass) - Only when the site is in construction mode, to allow authorized preview of the full site
- Cookie/consent preference (cheaply-cookie-consent in browser storage) - Remembers your choice on the cookie banner on the full marketplace site
Analytics after consent (full marketplace site)
Vercel Web Analytics runs only after you choose "Accept all" on the cookie banner. It is not used for third-party advertising cookies. Coming-soon waitlist pages do not load this analytics script from our cookie flow.
Cookie banner and browser controls
Use the banner at the bottom of the screen to accept analytics or continue with essential features only. You can clear cookies and site data in your browser at any time; essential cookies or storage may be set again when you sign in or use core features.
Embedded maps (Google)
Product pages may embed Google Maps. Loading the map can cause Google to process technical data and use cookies or similar technologies under Google's policies, outside our direct control.
Changes to this Cookie Policy
We may update this Cookie Policy when our use of cookies or third-party scripts changes. The “Last updated” date will change and, where appropriate, we will also reflect updates in our Privacy Policy.
Our platform is intended for users aged 16 and older. Users under 16 years of age require parental or guardian consent to use our service. If we become aware that we have collected personal data from a child under 16 without appropriate consent, we will take steps to delete that information promptly.
We implement appropriate technical and organizational measures to protect your personal data, including:
- Strong password hashing (passwords are not stored in plain text)
- Secure HTTPS connections
- Regular security assessments
- Access controls and authentication
- Secure data storage with reputable providers
However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
In the event of a data breach that poses a high risk to your rights and freedoms, we will:
- Notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours as required by law
- Notify affected users without undue delay via email
- Provide information about the nature of the breach, what data was affected, and recommended actions you should take
We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.
If you have any questions, concerns, or requests regarding this privacy policy or your personal data, please contact us:
Email: info@cheaply.nl