Privacy policy
Last updated: 8 October 2026
Draft under legal review — this text may still change.
This policy explains what personal data the PromoKOTSA mobile app and the promokotsa.com website collect, why, who it is shared with and what your rights are, in line with the Data Protection Act 2017 of the Republic of Mauritius.
1. Data controller
TAO Digital LTD, a company registered in Mauritius (BRN C26233822), 10 Riverside, Phoenix, Mauritius.
Contact for any question about your data: support@promokotsa.com.
2. The data we process
Your account
- E-mail address, name and account type (customer or business).
- Password: handled by our authentication provider and stored in encrypted (hashed) form; we never see it.
- If you sign in with Google, Facebook or Apple: your account identifier with that provider and the information it shares with us (name, e-mail address, profile picture where applicable). With Apple's "Hide My Email", we only receive a relay address.
How you use the app
- The deals you save as favourites and those you mark as interested.
- Your coupons: code, deal, status (unused, redeemed, void) and dates.
- Usage statistics: deal views, clicks and shares, linked to your account when you are signed in. Clicks from the website are recorded anonymously.
If you are a business
- Your business details: name, logo, phone, address, description and opening hours. They are public: any user can see them on your business page.
- Your deals and their photos, your plan, your deal credits and the history of redeemed coupons.
Photos and camera
The app only accesses the camera and your photos when you ask it to: to add a picture to your business or a deal, or to scan a coupon's QR code. Only the photos you choose are uploaded; scan images are not kept.
Technical data
- Your sign-in session is stored on your phone (encrypted if you ticked "Remember me").
- Our hosting providers keep technical logs (IP address, date, page or service requested) to run and secure the service.
- The e-mails you send to support.
We use no advertising and no advertising trackers, and we do not sell your data. We do not collect your GPS location: a deal's region is chosen by the business.
3. Why we use it
- To provide the service (performance of our terms of use): create and secure your account, show deals, manage your favourites and coupons, let businesses publish offers and redeem coupons.
- To send the e-mails your account needs: password reset, address confirmation, e-mail change.
- To measure and improve the service (legitimate interest): deal statistics, including the view and click counters shown to businesses, which do not identify users.
- Security and abuse prevention (legitimate interest): technical logs, moderation of deals and accounts.
- To meet our legal obligations, including accounting once payments are offered.
4. Who we share it with
Your data is only shared with the following technical providers, who process it on our behalf and on our instructions:
| Provider | Role | Location |
|---|---|---|
| Supabase, Inc. | Database, authentication, photo storage | US company; servers in the United Kingdom (London) |
| Resend, Inc. | Sending account e-mails (e-mail address and message content) | US company; sent from Ireland (European Union) |
| Netlify, Inc. | Hosting of promokotsa.com (technical logs) | US company; global network |
| Zoho Corporation | Support mailbox (support@promokotsa.com) | Zoho group; data hosted in the United States |
| Google, Meta (Facebook), Apple | Sign-in with your account with them, only if you choose it | US companies |
Business names, logos and contact details are public by nature. When a business redeems your coupon, it only sees its code and the deal — not your name or e-mail address.
We may also disclose data when the law requires it (for example, a request from a judicial authority).
5. Transfers outside Mauritius
As our providers are based abroad, your data is transferred outside Mauritius. We only use providers that contractually commit to protecting your data (data processing agreements), and we limit the data shared to what is necessary.
6. How long we keep it
- Your account data is kept for as long as your account exists.
- When you delete your account, your profile, favourites, unused coupons, notifications and, for a business, its business profile, deals and photos are permanently deleted. Statistics and coupons already redeemed are kept with no link to you (they become anonymous). Details on the Delete my account page.
- We keep no database backups: deleted data is gone for good.
- E-mails exchanged with support are kept for as long as needed to handle the request.
7. Your rights
Under the Data Protection Act 2017, you can:
- access your data and get a copy of it;
- have inaccurate data corrected;
- have your data erased — directly in the app (Profile → My settings → Account → Delete my account) or by e-mail;
- object to processing based on our legitimate interest, or ask for it to be restricted;
- withdraw any consent you have given at any time.
Write to us at support@promokotsa.com from your account's e-mail address. We reply within one month. If you believe your rights are not respected, you can contact the Data Protection Office of Mauritius (dataprotection.govmu.org).
8. Security
Traffic between the app, the website and our servers is encrypted (HTTPS). Access to data is restricted by security rules in the database itself: each user can only access their own private data.
9. Children
PromoKOTSA is not intended for children under 16. If you believe a child has given us personal data, contact us and we will delete it.
10. Changes
We may change this policy, for example when a new feature is added. The date of the last update is shown at the top of the page; for significant changes, we will let you know in the app.