Privacy Policy

Last updated: August 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and the Maltese Data Protection Act (Cap. 586) is:

ClarityBuilds Ltd
Registration Number: C 113250 (Malta Business Registry)
VAT Number: MT32239919
Director: Christian Bakker
Centris Business Gateway, Level 4/W
Triq is-Salib tal-Imriehel, Zone 3
Central Business District
Birkirkara, CBD 3020, Malta
Email: info@dealsdelivery.com

2. Data Protection Officer

The appointment of a Data Protection Officer is not required. ClarityBuilds Ltd does not meet any of the criteria set out in Art. 37(1) GDPR: the core activities consist neither of the large-scale regular and systematic monitoring of individuals nor of the large-scale processing of special categories of personal data. Maltese law (Cap. 586) does not impose any additional obligation on companies of this size.

For any data protection inquiries, please contact: privacy@dealsdelivery.com

3. Overview of Data Processing

DealsDelivery.com is a platform that aggregates current offers and deals from food delivery services and presents them to you in a clear overview. Below we provide detailed information about the type, scope and purpose of the processing of personal data.

4. Server Log Files

When you visit our website, the server automatically collects and stores information in server log files: IP address, browser type and version, operating system, referrer URL, date and time of access, and HTTP status code.

Purpose: Delivery of the website, ensuring system stability and security, error analysis.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring IT security, detecting and preventing attacks, and maintaining system stability.

Retention period: 30 days. Longer retention only occurs for the investigation of specific security incidents.

5. Hosting (Microsoft Azure)

Our website is hosted on Microsoft Azure App Service. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Parent company: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA.

The servers are located in the Azure region “West Europe” (Netherlands).

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the reliable and secure provision of our website.

Third country transfer: Microsoft may access data from the USA in the context of support services. The transfer is based primarily on the EU-US Data Privacy Framework (adequacy decision pursuant to Art. 45 GDPR); Microsoft Corporation is certified under the Data Privacy Framework. For any transfers not covered by the Data Privacy Framework, Standard Contractual Clauses apply as a fallback (Art. 46(2)(c) GDPR).

We have concluded a Data Processing Agreement with Microsoft pursuant to Art. 28 GDPR.

6. Cookies and Consent Management

6.1 Strictly Necessary Cookies

We currently use a single cookie:

Cookie	Purpose	Retention	Provider
NEXT_LOCALE	Language preference (German/English)	Session	DealsDelivery (first party)

This cookie is strictly necessary and is set without consent. Legal basis: Art. 5(3) of the ePrivacy Directive 2002/58/EC, transposed into Maltese law by Regulation 10 of the Processing of Personal Data (Electronic Communications Sector) Regulations (S.L. 399.35).

6.2 Consent-Based Cookies

Services such as Google Analytics and the Google Ads conversion and remarketing tag (see section 11) set cookies or use comparable technologies that are only activated after your explicit consent. Consent is obtained via our cookie consent banner.

Legal basis: Art. 6(1)(a) GDPR in conjunction with Art. 5(3) ePrivacy Directive 2002/58/EC (Regulation 10 S.L. 399.35, Malta).

You can withdraw your consent at any time via the cookie banner or by adjusting your browser settings.

7. Local Storage (localStorage)

When you select a city, this selection is stored in your browser’s localStorage (city name, coordinates, country). The city selection alone is not transmitted to our server.

Purpose:User-friendly experience — you do not need to select the city again on subsequent visits.

Legal basis:Art. 5(3) ePrivacy Directive (S.L. 399.35, Malta) — strictly necessary for the service you have requested.

Deletion: You can delete this data at any time via your browser settings.

8. Geocoding and Address Search

When you enter an address, the search text is transmitted to external geocoding services. Your IP address is also transmitted to the respective service.

8.1 OpenStreetMap Nominatim

Provider: OpenStreetMap Foundation (OSMF), St John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom.

Third country transfer: Adequacy decision of the European Commission for the United Kingdom (Art. 45 GDPR).

8.2 Photon (Komoot)

Provider: komoot GmbH, Friedrich-Wilhelm-Boelcke-Strasse 2, 14473 Potsdam, Germany. Processing within the EEA.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in providing a location-based restaurant search, which constitutes the core purpose of our service.

Storage: We do not store your geocoding queries on our own servers.

9. Restaurant Images

The restaurant images displayed on our website are cached by us and served from our own servers. No hotlinking takes place — your browser loads the images from our servers, not from the servers of the delivery platforms. Your IP address is not transmitted to the original platforms.

Legal basis:Art. 6(1)(f) GDPR. Our legitimate interest lies in the visually appealing presentation of restaurant offers and the protection of our users’ privacy by avoiding direct data transmission to third-party platforms.

Retention period: Maximum 24 hours, followed by automatic deletion and re-fetching.

10. Platform Logos (logo.dev)

To display the logos of delivery platforms, we embed images from img.logo.dev. When fetching these images, your IP address is transmitted to the provider.

Provider: HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the visual identification of delivery platforms for better orientation.

Third country transfer: EU-US Data Privacy Framework (Art. 45 GDPR). HubSpot is certified under the Data Privacy Framework.

11. Google Analytics and Google Ads

We use Google Analytics 4 (measurement ID G-6MWFS11CJL) for reach and usage analysis, as well as the Google Ads conversion and remarketing tag (conversion ID AW-18172020526) to measure the success of our advertising campaigns and to build remarketing audiences. Both services use cookies and similar technologies.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Purpose: Reach and usage analysis, conversion measurement, and remarketing.

Data collected: Usage and device data, IP address, pseudonymous identifiers (cookie identifiers), and the consent signals you set via the cookie consent banner (analytics_storage, ad_storage, ad_user_data, ad_personalization).

Consent control (Google Consent Mode v2):The gtag tags are present on the page but remain inactive until you consent: without consent they set no cookies and transmit no personal data. The consent signals named above are set to “denied” by default; only upon your consent are they switched to “granted” and the tags activated.

Legal basis: Exclusively based on your consent (Art. 6(1)(a) GDPR in conjunction with Art. 5(3) ePrivacy Directive / S.L. 399.35 Malta).

Third country transfer: Insofar as data is transferred to Google LLC, USA, the transfer is based primarily on the EU-US Data Privacy Framework (adequacy decision of the European Commission pursuant to Art. 45 GDPR); Google LLC is certified under the Data Privacy Framework. For any transfers not covered by the Data Privacy Framework, Standard Contractual Clauses apply as a fallback (Art. 46(2)(c) GDPR).

Withdrawal and opt-out: Cookie banner or Google Ads Settings.

12. Account, Sign-in, and Payment Processing

An account is required to use the personalised feed. Sign-in works via magic link: you provide your email address and receive a one-time sign-in link; no password is set. Data processed: email address, delivery address, subscription or trial status.

Legal basis (account): Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures).

The Subscription is subject to a charge (4.99 EUR per month or 39 EUR per year); a fourteen-day free trial without entering payment details is available to get started.

Payment processing (Stripe):The subscription and service contract is with the Operator (ClarityBuilds Ltd); the Operator is the seller of the Subscription and issues invoices and receipts itself. For payment processing we use the payment service provider Stripe; the EU contracting party is Stripe Payments Europe, Limited (SPEL), 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe processes the data required for the payment process (in particular payment and billing data) and, for the payment processing, is a separate controller under data protection law in accordance with its own privacy policy; contractually, Stripe does not become a party to the Subscription (see Terms § 5).

We do not store any credit card data. Payment data is processed directly by Stripe.

Legal basis (payment): Art. 6(1)(b) GDPR (performance of a contract). Fraud prevention by Stripe: Art. 6(1)(f) GDPR.

Third country transfer: Stripe Payments Europe, Limited is a company established in the EEA (Ireland). Insofar as Stripe transfers data to Stripe, Inc. in the USA, the transfer is based on the adequacy decision under the EU-US Data Privacy Framework (Art. 45 GDPR) or on Standard Contractual Clauses (Art. 46 GDPR).

Retention period: For the duration of the contractual relationship, followed by deletion unless Maltese retention obligations apply (Income Tax Act Cap. 123 and Companies Act Cap. 386: up to 9 years for tax-relevant records).

13. Contact and Deal email (Email)

13.1 Contact

When you contact us by email, your email address, name (if provided) and the content of your message are stored.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in responding to your inquiries and maintaining the business relationship. For contract-related inquiries: Art. 6(1)(b) GDPR.

Retention period: Your inquiry and the associated data will be deleted after final processing, unless retention is required for the fulfilment of legal obligations or for the establishment, exercise or defence of legal claims.

13.2 Deal email (email digest for signed-in users)

The deal email is a setting in your user account. When you turn it on, we email you the best deals near you at the frequency you choose (daily, every three days or weekly) to your account email address. For this we store your chosen frequency and, if set, your cuisine filter. Your delivery address and email address are already processed as part of your account (see the account and sign-in section).

Legal basis: Art. 6(1)(a) GDPR (your consent, given by turning on the deal email).

Retention / unsubscribe: You can switch the deal email off at any time in your account or via the unsubscribe link at the bottom of every email; it takes effect immediately.

Delivery: Emails are sent via our email service provider IONOS SE (Montabaur, Germany).

14. AI-powered search (AI-Suche)

Signed-in users can use an AI-powered free-text search (“AI-Suche”) in the feed: you describe in your own words what you're craving, and we determine the matching deals from your personal feed. To evaluate your query, we transmit the search text you entered together with the current deals of your feed to our AI service provider.

Provider: Google (Gemini API). The EEA contracting party is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; the parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Purpose: Determining the offers matching your free-text query (semantic search over your feed).

Legal basis:Art. 6(1)(b) GDPR — AI-Suche is a feature of the service requested by you.

Data minimization: We do not permanently store your AI-Suche queries on our servers; only the daily count of your AI searches is recorded for usage control, not their content.

No use for training: Google does not use content submitted via the (paid) Gemini API to train its models; content is retained only briefly for security, abuse detection and legal compliance purposes.

Data processing agreement: A Data Processing Addendum pursuant to Art. 28 GDPR is in place with Google.

Third country transfer: Insofar as data is transferred to Google LLC, USA, the transfer is based both on the EU-US Data Privacy Framework (adequacy decision pursuant to Art. 45 GDPR; Google LLC is certified under the Data Privacy Framework) and on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Note:Please do not enter special categories of personal data (Art. 9 GDPR) or unnecessary personal details in the AI search — a description of what you're craving is all the search needs.

Privacy: policies.google.com/privacy

15. Reach Measurement (Plausible Analytics)

To analyse the reach and usage of our website, we use Plausible Analytics, a privacy-friendly, cookieless statistics tool. Plausible uses no cookies and stores no identifiers on your device; no cross-device profiles are built and no personal user profiles are stored. The evaluation is carried out exclusively in aggregated form (e.g. page views, referral source, approximate region at country/city level, device and browser type).

To count returning visits, your IP address is processed only transiently and in the form of a daily-rotating, non-reversible hash; the IP address itself is not stored.

Provider: Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia.

Purpose: Aggregated reach and usage measurement to improve our service.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the data-minimising, aggregated analysis of the usage of our website. As Plausible neither stores nor reads information on your device, no consent under Art. 5(3) of the ePrivacy Directive (S.L. 399.35, Malta) is required.

Data processing exclusively within the EU: The data collected is processed and stored entirely on servers within the European Union; no transfer to third countries takes place.

Data processing agreement: A Data Processing Agreement pursuant to Art. 28 GDPR is in place with Plausible.

16. Conversion Measurement for Advertising (Google Ads)

We run advertisements via Google Ads. To measure the success of these ads, we want to be able to tell whether a click on one of our ads later led to a sign-up or a subscription. When you click on one of our Google ads, Google appends a click identifier (the “GCLID”, Google Click Identifier) to the destination URL.

We read this click identifier from the URL and store it exclusively on our own servers. No cookies are set for this and no information is stored on or read from your device. If you later sign up for the free trial or take out a subscription, we transmit the stored click identifier together with the time of that event to Google Ads so that the conversion can be attributed to the original ad. No content of your usage and no profile data is transmitted in the process.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Purpose: Measuring the success of our advertising campaigns (conversion measurement) at the campaign, ad and keyword level.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in measuring the success of our advertising spend. As the click identifier is read solely from the URL and processed server-side, and no information is stored on your device, no consent under Art. 5(3) of the ePrivacy Directive (S.L. 399.35, Malta) is required.

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to this processing (Art. 21 GDPR). To do so, please contact privacy@dealsdelivery.com.

Retention period: The click identifier is stored only for as long as is necessary for conversion attribution (Google Ads attribution window, a maximum of 90 days from the click) and is deleted thereafter.

Data processing: The Google Ads Data Processing Terms apply to the conversion measurement (processing on our behalf pursuant to Art. 28 GDPR).

17. Spam and Abuse Protection (Google reCAPTCHA)

On the “Sign in”, “Contact” and “Cancellation” pages we use Google reCAPTCHA v3 to tell automated requests apart from genuine ones. reCAPTCHA v3 is invisible: there is no puzzle to solve and nothing to click.

To do this, a Google script is loaded when you open these pages. Google processes your IP address along with information about your browser, your device and your behaviour on the page (e.g. mouse and keyboard input, time spent) and derives a score from it. reCAPTCHA also stores information in your browser (among other things the _grecaptcha entry in localStorage). When you submit the respective form, we send the score token generated by Google to our server, which has Google verify it directly. We do not store this token.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Purpose: Protection against automated abuse. For us this is not an abstract risk: signing in sends a sign-in link to whatever email address is entered, so a script could use our form to burden other people’s inboxes with mail. We likewise protect the contact and cancellation forms against bulk automated submissions.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our systems and third parties’ email inboxes from automated abuse.

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to this processing (Art. 21 GDPR). To do so, please contact privacy@dealsdelivery.com.

Retention period: The data is processed and stored by Google according to its own rules; we ourselves store neither the score token nor the score.

18. Our Own Reach Measurement (First-Party Analytics)

To understand how our service is used and where it fails to help people, we keep our own statistics. They run entirely on our own servers; no third party is involved and no data is passed to any third party.

Nothing is stored on or read from your device for this. We use no cookies, no localStorage and no comparable technology for these statistics. Consent under Section 25 TTDSG is therefore not required.

Events recorded: a page view (the path requested and, where present, the referring page and campaign parameters such as gclid or utm_source), entering a delivery address (only the fact of it – neither the address nor the coordinates), a click on a deal (which deal, which delivery service, and its position in the list), and an AI search query.

A pseudonymous identifier instead of a cookie: so that the events of one visit belong together, we compute an identifier on our server from your IP address, your browser identification (user agent) and a secret value that changes every day. Only the result of that computation is stored; your IP address and browser identification are not stored for this purpose and cannot be derived back from the identifier. Because the secret value changes daily, the same visitor produces a different identifier the next day, so recognition across days is impossible by construction.

Linking to your account: when you sign in, we link that day’s identifier to your account so that we can see what happened before the sign-in. By construction this works only within the same day: if the visit and the sign-in fall on different days, no link is made.

AI search queries: for the AI-powered search (see section 14) we additionally store the search text you entered, verbatim, together with the deals that were returned. We use this to understand which requests our search does not yet serve. Please do not enter personal data into that field.

Purpose: understanding how our service is used, identifying where people drop out and where it breaks, and improving the product and its content.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in designing and improving our service to meet actual needs. We have deliberately designed this processing to reveal as little as possible about any individual.

Retention: individual events are deleted automatically after 90 days, with no action required by anyone. Before that they are condensed into plain daily totals (e.g. “page views per page per day”) which no longer relate to any individual; we keep those totals indefinitely.

Right to object: you have the right to object at any time, on grounds relating to your particular situation, to this processing (Art. 21 GDPR). Please contact privacy@dealsdelivery.com.

19. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

Right of access (Art. 15 GDPR): You have the right to obtain confirmation as to whether and which personal data we process.
Right to rectification (Art. 16 GDPR): You have the right to rectification of inaccurate data.
Right to erasure (Art. 17 GDPR): You have the right to erasure of your data, provided the legal requirements are met.
Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of processing.
Right to data portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used and machine-readable format.
Right to object (Art. 21 GDPR): You have the right to object, on grounds relating to your particular situation, to the processing based on Art. 6(1)(f) GDPR.

To exercise your rights, please contact: privacy@dealsdelivery.com. We will process your request within one month (Art. 12(3) GDPR).

20. Withdrawal of Consent

Where processing is based on your consent (Art. 6(1)(a) GDPR), you may withdraw it at any time with effect for the future, without affecting the lawfulness of processing carried out prior to the withdrawal (Art. 7(3) GDPR).

Cookie withdrawal: Via the cookie consent banner on our website.

Other withdrawal: By email to privacy@dealsdelivery.com.

21. Right to Lodge a Complaint with a Supervisory Authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your data violates the GDPR.

The supervisory authority responsible for us is:

Office of the Information and Data Protection Commissioner (IDPC)
Floor 2, Airways House
High Street
Sliema SLM 1549
Malta
Website: idpc.org.mt
Email: idpc.info@idpc.org.mt

You may also lodge a complaint with the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement (Art. 77(1) GDPR).

22. Obligation to Provide Data

The provision of personal data is neither legally nor contractually required. However, not providing it may result in you being unable to use our website or its full range of features (e.g. no address search without entering an address, no account and no personalised feed without an email address, no paid Subscription without payment data).

23. Automated Decision-Making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

24. SSL/TLS Encryption

Our website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar and the lock icon.

25. Changes to this Privacy Policy

We reserve the right to amend this privacy policy to ensure it always complies with current legal requirements or to reflect changes to our services. The version in effect at the time of your visit shall apply.

26. Validity

This privacy policy is currently valid as of August 2026.