Privacy Policy

Danny Meier, Switzerland
[email protected]

This Privacy Policy governs the collection, processing, and protection of personal data by benefit.codes in accordance with the Swiss Federal Act on Data Protection (nDSG, SR 235.1) and, where applicable, the General Data Protection Regulation (EU) 2016/679 (GDPR).

2.1 Account Data

Upon account creation, the following personal data is collected and processed:

Email address

Stored in encrypted form with a blind index for secure lookup.

Username

Freely chosen by the user and publicly visible unless Anonymous Mode is enabled.

Authentication credentials

Managed exclusively by Hanko (passkeys, magic links). No passwords are stored by benefit.codes.

2.2 Usage Data

The following anonymized usage data is collected for the purpose of service improvement:

• Page views and navigation patterns
• Performance metrics (page load times, errors)
• Device type and browser information

2.3 User-Generated Content

Referral codes, votes, and reports submitted by users are stored and associated with the respective user account.

Personal data is processed exclusively for the following purposes:

• Provision and operation of the platform
• Authentication and identity verification
• Delivery of notifications regarding referral codes (where enabled by the user)
• Prevention of abuse and quality assurance through content moderation
• Service improvement based on anonymized analytics

The following third-party service providers process personal data on behalf of or in connection with benefit.codes:

4.1 Hanko (Authentication)

Hanko processes email addresses and authentication credentials (passkeys, magic links) for the purpose of identity verification. The processing of data by Hanko is subject to Hanko’s privacy policy.

4.2 Cloudflare (CDN & Security)

Cloudflare serves as content delivery network and security layer for protection against DDoS attacks. Cloudflare may process IP addresses and request metadata. See Cloudflare’s privacy policy.

4.3 Fontshare (Web Fonts)

Fontshare by Indian Type Foundry delivers web fonts. When loading a page, the user’s browser requests font files from Fontshare’s servers, which may result in the logging of the user’s IP address.

4.4 DiceBear (Avatars)

DiceBear generates avatar images displayed on the platform. When loading a page, the user’s browser requests avatar images from DiceBear’s servers (api.dicebear.com), which may result in the processing of the user’s IP address. The request URL contains a seed value derived from the site name or username. See DiceBear’s privacy policy.

All application data, databases, and analytics are hosted exclusively in Switzerland. No transfer of personal data to countries outside Switzerland or the EU/EEA takes place, except where necessitated by the third-party services specified in Section 4.

benefit.codes uses SigNoz, a self-hosted open-source observability platform, for analytics and performance monitoring. SigNoz operates on infrastructure owned and controlled by the operator in Switzerland. No data is transmitted to external analytics providers. benefit.codes does not employ Google Analytics, Facebook Pixel, or any other third-party tracking service.

benefit.codes uses only strictly necessary cookies. Details are set out in our Cookie Policy. No tracking or advertising cookies are employed.

In accordance with the nDSG and the GDPR, data subjects have the following rights:

Right of access

To obtain confirmation of whether personal data is being processed and to access such data

Right to rectification

To request correction of inaccurate personal data

Right to erasure

To request deletion of personal data (“right to be forgotten”)

Right to restriction of processing

To request limitation of data processing

Right to data portability

To receive personal data in a structured, commonly used, and machine-readable format

Right to object

To object to the processing of personal data

Requests may be directed to [email protected]. The operator will respond within 30 days of receipt.

Account data is retained for the duration of the account’s existence. Upon account deletion, all associated personal data will be permanently removed within 30 days. Anonymized usage data, which does not constitute personal data, may be retained indefinitely for statistical purposes.

The operator reserves the right to amend this Privacy Policy at any time. Registered users will be notified of material changes via in-app notification. Continued use of the platform following such notification constitutes acceptance of the revised policy.