Privacy Policy | GrabFinds

The data controller for grabfinds.com is Ints Sinkevics, trading as GrabFinds, a sole trader in the United Kingdom. Data controller: Ints Sinkevics trading as GrabFinds Email: [email protected] Business/service address: 6 Shackleton Road, Freckleton, PR4 1JR, United Kingdom Website: https://grabfinds.com/contact If you have any questions about this Privacy Policy or how we handle your personal data, please contact us using the details above.

This Privacy Policy applies to all visitors to grabfinds.com and all registered members of GrabFinds, including free members, Premium members, and members of the GrabFinds Community. GrabFinds is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you believe a person under 18 has provided us with personal data, please contact us and we will take steps to delete it.

When you create a GrabFinds account we collect: • Your name • Your email address • Your country of residence (optional) • Your password (stored as a cryptographic hash — we never store your password in plain text) • The date and time your account was created • Your marketing consent preference and the date and source of that consent • An unsubscribe token (a random identifier used to process one-click unsubscribes without requiring you to log in) We also record your account status (active, suspended, or banned), your membership tier (free or Premium), and any administrative notes added by GrabFinds staff in connection with moderation or support.

If you complete your GrabFinds profile you may provide: • A display name • A short biography • Your location (free-text field — you choose how specific to be) • A profile photograph or avatar image • Side hustles you are doing or learning • Skills • A TikTok handle or other social link • A profile visibility preference (public or private) All profile fields beyond your display name are optional. You can update or remove profile information at any time through your account settings.

When you participate in the GrabFinds Community we collect: • The text of posts and replies you submit • The channel and room group in which each post was made • The date and time of each post • Any images you attach to posts (see Section 6 below) • Reactions (emoji responses) you give to posts and replies • Reports you make about content or other members • Your poll and community vote choices • Content you have saved, liked, or commented on elsewhere on GrabFinds • Your recently viewed content • Members you have blocked Where a post is edited, we retain the pre-edit version of the body for moderation purposes. Where a post is hidden or removed by a moderator or administrator, the content may be retained in our moderation records.

When you attach images to community posts: • Images are stored in private server storage that is not publicly accessible on the web. • Images are served only through an authenticated proxy — only logged-in members can view community images. • All uploaded images are re-encoded as JPEG by our server before storage. This process strips EXIF metadata (including any location data embedded in the original file) before the image is saved. • We record metadata about each image: the post it belongs to, the uploader's member ID, the file size, and the image dimensions. Profile photographs are stored as a URL reference in your account record.

When you participate in GrabFinds Challenges we collect: • Your earnings figures (gross earnings, expenses, net profit) for the challenge period • Hours worked • The date the work was carried out • Optional notes • Evidence files you upload to support your submission (stored in private server storage, not publicly accessible) • Your acceptance of the challenge rules and the date of acceptance • Your participation status and any removal or disqualification records Evidence files are stored privately and are not publicly accessible. We retain evidence files only for as long as necessary for the purposes for which they were submitted, including verifying challenge submissions, resolving disputes, and maintaining the integrity of the challenge process. We review evidence files after the challenge verification period and delete them when they are no longer required for those purposes. Authorised administrators may delete evidence files when they are no longer required and where no active evidence hold, legal obligation, regulatory requirement or dispute-related retention reason requires them to be preserved. If you win a challenge, we record your member ID, the selection method, the number of valid entries, and the date you were contacted.

If you use the GrabFinds Profit Calculator or log earnings entries: • We store your vehicle profiles (make, model, fuel type, cost parameters you enter) • We store individual calculation records including earnings figures, mileage, time worked, platform used, and the full calculation result • We store earnings log entries (side hustle, earnings, expenses, hours, date, notes) • Saved calculations may optionally be shared via a unique token link — sharing is off by default and you control whether to enable it Free members are limited to 30 saved calculations. Older records beyond this limit are not automatically deleted — they are simply not accessible through the free member interface.

If you become a GrabFinds Premium member: • We record your Premium status, activation date, and expiry date • Premium membership is activated manually by GrabFinds staff after you complete payment through Payhip • GrabFinds does not receive your payment details, card information, or transaction data from Payhip — Payhip processes your payment independently and their own privacy policy applies to that transaction • We do not store any payment card details See Section 16 (Third-Party Processors) for more information about Payhip.

When you contact us through the GrabFinds contact form or by email: • We receive your name, email address, and the content of your message • Contact form submissions generate an internal staff notification — they are not stored in a separate database table • If you submit a moderation appeal or complaint, this is handled through the contact form or by email to [email protected] When we send you email notifications or marketing emails: • We record whether you have consented to marketing emails and the date of that consent • We maintain a log of email campaigns sent (subject, audience, date, recipient count) — this log does not contain per-recipient delivery data • We record a deduplication log to prevent sending the same notification twice — this log records content type and campaign ID, not individual recipient details

If you subscribe to GrabFinds push notifications through your browser: • We store your push subscription endpoint and the encryption keys provided by your browser (these are required to send push notifications to your device) • We store your browser user-agent string, device type, and a device name • We store your notification preferences (which types of notification you want to receive) • Push subscriptions are linked to your member account if you are logged in, or stored anonymously if you subscribe without logging in You can unsubscribe from push notifications at any time through your browser settings or your GrabFinds notification preferences.

When you use GrabFinds we automatically collect certain technical data: • Session data: when you log in, we create a session record that includes your IP address, your browser user-agent string, and the session expiry time. This is necessary to keep you logged in securely. • Analytics data: we collect page view and content view data to understand how GrabFinds is used. For analytics purposes, your IP address and user-agent are combined and hashed (converted to a one-way fingerprint) — we do not store your raw IP address in analytics records. This produces a pseudonymous visitor identifier; it does not make the data fully anonymous. • Registration and acquisition events: we record pseudonymised registration and sign-up events using the same hashed fingerprint approach. Your raw IP address is stored in your session record for security purposes (to detect session hijacking). It is not used for profiling or shared with third parties for advertising purposes.

Where moderation action is taken in connection with your account or content: • We maintain a moderation log recording the action taken, the reason, the moderator who took the action, and the date. This log is an operational and compliance record. Where your account is deleted, your identifying information is removed from these records (see Section 22), but the record of the moderation action itself is retained for as long as a continuing moderation, complaints/appeals, legal, regulatory or accountability purpose exists. • We record formal warnings, suspensions, and bans on your account record. • Content reports you make about other members or posts are stored with your member ID, the reason given, and the outcome. • Reports made about you by other members are stored with the reporter's member ID, the reason, and the outcome. • Where illegal or seriously harmful content is identified, we may retain records in accordance with our legal obligations and our Illegal Content Procedure, which is available to administrators at /admin/legal/illegal-content-procedure.

We process your personal data for the following purposes: • To create and manage your GrabFinds account • To provide the GrabFinds Community, including posts, reactions, and moderation • To operate the Profit Calculator and save your calculations and vehicle profiles • To administer GrabFinds Challenges, including verifying submissions and selecting winners • To manage Premium membership, including activation and access control • To send you service communications (account notifications, challenge updates, moderation notices) • To send you marketing emails, but only if you have explicitly opted in • To moderate content and enforce our Community Guidelines and Terms & Conditions • To maintain the security of GrabFinds and detect and prevent fraud or abuse • To understand how GrabFinds is used and to improve the service • To comply with our legal obligations

Under UK GDPR, we rely on the following lawful bases: • Contract: processing your account data, providing the services you have requested (Community, Calculator, Challenges, Premium), and sending service communications is necessary to perform our contract with you or to take steps at your request before entering into a contract. • Legitimate interests: we process certain data on the basis of our legitimate interests, including: operating and improving GrabFinds; maintaining the security and integrity of the platform; moderating content and enforcing our policies; understanding how GrabFinds is used through pseudonymised analytics; and retaining moderation records as an audit trail. We have assessed that these interests are not overridden by your rights and interests. • Consent: we send marketing emails only if you have explicitly opted in. Consent: where optional analytics or tracking activity requires consent, GrabFinds enables that activity only after you have opted in through the cookie consent banner. For the GoDaddy platform analytics script described in Section 20, the script loads on the site but optional click tracking is enabled only after consent. You can withdraw consent at any time (see Section 19). • Legal obligation: we may process or retain data where required to comply with applicable law, including data retention obligations and obligations to respond to lawful requests from authorities.

Where we rely on legitimate interests as our lawful basis, we have considered whether our interests are overridden by your rights. The key legitimate interests we rely on are: • Platform security and fraud prevention: we have a strong interest in keeping GrabFinds secure and preventing abuse. Storing session IP addresses and maintaining moderation records serves this interest. Members have a corresponding interest in a safe platform. • Moderation accountability: retaining moderation records is necessary to ensure accountability, resolve disputes, and demonstrate compliance with our safety obligations. Where your account is deleted, your identifying information is removed from these records. Records are retained only for as long as a continuing moderation, complaints/appeals, legal, regulatory or accountability purpose exists, and are deleted or further minimised when no longer necessary. • Pseudonymised analytics: understanding how GrabFinds is used helps us improve the service. We use hashed fingerprints rather than raw IP addresses, which reduces privacy impact. This produces pseudonymous rather than fully anonymous data. If you wish to object to processing based on legitimate interests, see Section 22 (Your Rights).

We share your personal data with the following third parties: • GoDaddy (Airo platform): GrabFinds is hosted on GoDaddy's Airo platform. GoDaddy acts as a data processor for GrabFinds, providing website hosting, database hosting, and transactional email delivery services. Personal data processed through the GrabFinds platform may be processed by GoDaddy and its subprocessors in the United Kingdom, the European Economic Area, the United States, or other countries in which GoDaddy or its subprocessors operate. GoDaddy's privacy policy is available at godaddy.com/legal/agreements/privacy-policy. • Cloudflare (Turnstile): We use Cloudflare Turnstile for bot and spam protection on forms. When you submit a form protected by Turnstile, your IP address and a challenge token are sent to Cloudflare's servers for verification. Cloudflare may process this data internationally. Cloudflare's privacy policy is available at cloudflare.com/privacypolicy. • Payhip: When you purchase a GrabFinds Premium membership, you are directed to Payhip (payhip.com) to complete your payment. Payhip is a UK-registered company that processes your payment and personal data independently under its own privacy policy. GrabFinds does not receive your payment card details or transaction data from Payhip. Payhip may use subprocessors that process data outside the UK. Payhip's privacy policy is available at payhip.com/privacy. • Google (Firebase Cloud Messaging): If you opt in to web push notifications, GrabFinds sends notification payloads to Google's Firebase Cloud Messaging (FCM) service to deliver notifications to your browser or device. FCM receives your push subscription endpoint (a unique token assigned by your browser) and the notification content. Google is a US company. You can withdraw consent for push notifications at any time through your browser settings or your GrabFinds notification preferences. We do not sell your personal data to third parties. We do not share your personal data with advertisers.

Some of our third-party service providers may process personal data outside the United Kingdom. Where a restricted transfer of personal data occurs under UK GDPR, we rely on an applicable lawful transfer mechanism. • GoDaddy (Airo platform): GoDaddy is a US-headquartered company. Personal data processed through the GrabFinds platform may be transferred to and processed by GoDaddy and its subprocessors in the United States or other countries. GoDaddy provides appropriate safeguards for restricted UK transfers, which may include the UK International Data Transfer Agreement (UK IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another applicable lawful mechanism. Further information about the safeguards applicable to GoDaddy's processing can be requested from us at [email protected]. • Cloudflare (Turnstile): Cloudflare is a US-headquartered company. When Turnstile verification is performed, your IP address may be transferred to Cloudflare's infrastructure internationally. Cloudflare provides appropriate safeguards for restricted UK transfers, which may include the UK IDTA or another applicable lawful mechanism. Further information is available at cloudflare.com/privacypolicy. • Google (Firebase Cloud Messaging): Google is a US-headquartered company. Push notification payloads and subscription endpoints are transferred to Google's FCM infrastructure in the United States. Google provides appropriate safeguards for restricted UK transfers, which may include the UK IDTA or another applicable lawful mechanism. Further information is available at firebase.google.com/support/privacy. • Payhip: Payhip is a UK-registered company. Payhip may use subprocessors that process data outside the UK; further information is available in Payhip's privacy policy at payhip.com/privacy. Where we are required to transfer personal data outside the UK, we take steps to ensure that appropriate safeguards are in place in accordance with UK GDPR. You can request further information about the safeguards applicable to any specific transfer by contacting us at [email protected].

Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. • Marketing emails: you can withdraw consent at any time by clicking the unsubscribe link in any marketing email, or by updating your preferences in your GrabFinds account settings. • Analytics cookies and scripts: you can withdraw consent for optional analytics by updating your cookie preferences through the cookie consent banner on GrabFinds. • Push notifications: you can unsubscribe from push notifications at any time through your browser settings or your GrabFinds notification preferences.

GrabFinds uses the following cookies and similar technologies: • Session / authentication cookie: this cookie keeps you logged in to your GrabFinds account. It is strictly necessary for the service to function and does not require your consent. • Cookie consent preference: we store your cookie consent choice in your browser's local storage for up to one year. • Platform analytics (GoDaddy): GrabFinds is hosted on GoDaddy's Airo platform, which loads a platform analytics script from GoDaddy's CDN (wsimg.com). This script is loaded on every page. Click tracking through this script is gated on your consent. We do not currently use Google Analytics or any other third-party advertising or tracking cookies. For full details of the cookies we use, please see our Cookie Policy at /cookie-policy.

We retain your personal data for as long as necessary for the purposes described in this Privacy Policy, subject to the following: • Account data: retained for as long as your account is active. If your account is closed or deleted, we will delete or anonymise your personal data within a reasonable period, subject to the exceptions below. • Session data: sessions expire automatically. Expired sessions are cleared by the authentication system. • Password reset tokens: deleted automatically after one hour or on first use, whichever is sooner. • Community posts and content: if your account is deleted, your posts and replies are deleted. Where a post is subject to an active evidence hold, it is de-identified rather than deleted until the hold is cleared. • Community images: deleted from storage when the associated post is deleted. • Challenge evidence files: retained only for as long as necessary for verifying submissions, resolving disputes, and maintaining challenge integrity. Evidence files are reviewed after the challenge verification period and deleted when no longer required for those purposes. • Earnings and calculator data: retained for as long as your account is active. This data is linked to your account and is deleted when your account is closed or deleted. We do not retain earnings or calculator records after account closure except where required for legal or compliance purposes. • Analytics records: GrabFinds collects pseudonymous analytics data to understand how the site is used. This includes page view records (page path, a pseudonymous visitor identifier derived from a one-way hash of your IP address and browser, referrer, browser type, and whether you were logged in), content interaction records, and registration funnel events. Raw IP addresses are never stored. We retain analytics records for as long as necessary to operate and improve the service. We will delete or anonymise analytics records when they are no longer required for those purposes. • Moderation and safety records: moderation log entries and community safety records are operational and compliance records. Where your account is deleted, your identifying information is removed from these records (see Section 22). The records themselves are retained only for as long as a continuing moderation, complaints/appeals, legal, regulatory or accountability purpose exists. Records are deleted or further minimised when no longer necessary. They are not retained indefinitely. • Legal and compliance records: retained for as long as required by applicable law or our legal obligations. Where we are required by law to retain data for a specific period, we will retain it for that period even if you request deletion.

You can permanently delete your GrabFinds account yourself using the Delete Account option on your Account page (Settings → Delete account). You may also contact GrabFinds if you need assistance with a deletion or data-rights request: [email protected] or through the Contact page. Normal account data, profile data, sessions, personal tool data, posts/replies and other ordinary account records are deleted as described below. Certain moderation, reporting, challenge and compliance records may instead be de-identified or minimised and retained where a continuing legal, regulatory, dispute-resolution or safety purpose applies. When an account is deleted: • Your account record, profile data, session data, community posts and replies, reactions, earnings records, calculator data, saved items, and push subscriptions are deleted. • Community images attached to your posts are deleted from storage. • Your challenge submission records are de-identified: your member ID and personal notes are removed, but the submission outcome (approved/rejected, winner status) is retained for challenge integrity and dispute resolution purposes. • Your achievement badges are deleted. • Moderation log records that reference your account are de-identified: your identifying information (member ID and name) is removed from those records. The moderation action record itself is retained as an operational and compliance record for as long as a continuing moderation, complaints/appeals, legal, regulatory or accountability purpose exists. • Community safety reports you have made are de-identified: your reporter identity is removed or minimised. The underlying safety record may be retained subject to the Moderation and Report Retention Review process, where a continuing legal, regulatory or safety purpose applies. • Where challenge evidence (uploaded files) is subject to an active hold due to a genuine dispute, fraud investigation, or legal claim, that evidence may be retained beyond your account deletion until the hold is cleared by an administrator. We will respond to data-rights requests within one month in accordance with UK GDPR.

Community posts and replies are visible to logged-in GrabFinds members. They are not publicly accessible without a GrabFinds account. Member profiles may be set to public or private. Public profiles are visible to other logged-in members. Private profiles are not visible to other members. Challenge leaderboards display anonymised or pseudonymous data — your display name may appear but your full account details are not shown. If you delete your account, your posts and profile are removed. Content that has been quoted or referenced by other members in their own posts may remain visible in that context.

Under UK GDPR and the Data Protection Act 2018, you have the following rights: • Right of access: you have the right to request a copy of the personal data we hold about you (a Subject Access Request). • Right to rectification: you have the right to ask us to correct inaccurate or incomplete personal data. • Right to erasure: you have the right to ask us to delete your personal data in certain circumstances (for example, where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and there is no other lawful basis for processing). • Right to restrict processing: you have the right to ask us to restrict how we process your personal data in certain circumstances. • Right to data portability: where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format. • Right to object: you have the right to object to processing based on legitimate interests or for direct marketing purposes. • Rights related to automated decision-making: see Section 26. To exercise any of these rights, please contact us at [email protected] or through the Contact page. We will respond within one month. We may need to verify your identity before processing your request.

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection supervisory authority. ICO website: ico.org.uk ICO helpline: 0303 123 1113 We would appreciate the opportunity to address your concerns before you contact the ICO, so please contact us first at [email protected].

GrabFinds does not make decisions about you that produce legal or similarly significant effects solely by automated means. Some automated processes operate on GrabFinds — for example, the streak system automatically calculates your daily activity streak based on your community posts and replies. These automated calculations affect your streak count and badge eligibility but do not produce legal effects or significantly affect you in a comparable way. Content moderation on GrabFinds is carried out by human moderators and administrators. Automated tools may assist in flagging content for review, but moderation decisions are made by humans.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include: • Passwords stored as cryptographic hashes (never in plain text) • Community images and challenge evidence stored in private server storage, not publicly accessible on the web • Images served only through an authenticated proxy • EXIF metadata (including location data) stripped from uploaded images before storage • Session tokens stored securely with expiry times • HTTPS encryption for all data in transit No method of transmission over the internet or electronic storage is completely secure. While we take reasonable precautions, we cannot guarantee absolute security.

GrabFinds is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. We do not carry out technical age verification. If you are under 18, please do not use GrabFinds or provide us with your personal data. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected] and we will take steps to delete it.

We may update this Privacy Policy from time to time to reflect changes to our data processing activities, legal requirements, or the way GrabFinds operates. The "Last Updated" date at the top of this page shows when the policy was most recently revised. Where changes are material, we will notify members by email or by a prominent notice on GrabFinds before the changes take effect. Your continued use of GrabFinds after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. If you do not agree to the revised policy, you should stop using GrabFinds and close your account.

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have a concern about how we handle your personal data, please contact us: Data controller: Ints Sinkevics trading as GrabFinds Email: [email protected] Business/service address: 6 Shackleton Road, Freckleton, PR4 1JR, United Kingdom Website: grabfinds.com/contact We aim to respond to all data protection enquiries within one month.