Privacy Policy

1. Introduction

Viffy, Inc. (“Viffy,” “we,” “us,” or “our”) issues AI 8112–compliant single-use digital codes that connect a creator’s content to a verified in-store purchase. This Privacy Policy explains what we collect from you when you claim an offer, how we protect it, and how long we keep it.

It is written for shoppers. When you open a creator’s link and ask for a code, you are dealing with Viffy: we collect your phone number and issue your code, even when the offer page is styled with a brand’s look.

2. What We Collect

To give you a code, we collect one thing: a US mobile phone number. You enter it on the offer page, and we text you a one-time verification code to confirm the number is yours. That is what lets us hand you a single-use offer code without an account, a password, or an app install.

We do not ask you for your name, email, address, or payment details, and we never see your card or your receipt. We collect no shopper data beyond what issuing and attributing your code requires.

3. How We Store Your Number

Your raw phone number is never stored, logged, or exported. The moment you submit it, we convert it into a one-way keyed hash (HMAC-SHA256) using a secret key that is held in our server configuration, outside the database. We keep only that hash.

Because the key lives apart from the database, a copy of the database alone cannot be turned back into phone numbers. The hash is deterministic — the same number always produces the same hash — so that we can give you back the code you already hold instead of issuing a second one, and so support can find your claim when you contact them.

4. Text Messages

We send the verification code by SMS through our messaging provider, Twilio. Message and data rates may apply. Submitting your phone number is your consent to receive that one-time message — there is no separate checkbox, because the code is the thing you asked for.

The verification code is the only message Viffy will ever send you. A phone number given to claim an offer is never used to reach you again. We do not send marketing texts, ever, and we do not add you to any list.

5. How We Use Your Number

We use your phone number and its hash only to:

• Send you the one-time verification code.
• Issue your single-use offer code, and give it back to you if you return to the link or verify the same number on another device.
• Enforce limits on how often a code can be requested — both per phone number and per network origin — so the offer cannot be drained or used to send bulk messages.
• Let the operator’s support staff look up the status of your claim if you reach out for help at the register.

6. What We Do Not Receive About Your Purchase

Redemptions clear through The Coupon Bureau, the AI 8112 clearing network. When your code is redeemed, the report we receive back identifies only the code that was redeemed, the offer and manufacturer it belongs to, and the time it was redeemed.

It does not tell us the store where you used it, and it does nottell us anything about your transaction — not the items in your basket, not the total, not the amount you paid. Viffy never sees your in-store purchase itself, only that the offer’s code was redeemed.

7. Retention and Deletion

Records that can be linked to you — your phone hash, your verification record, and your claim — are automatically purged 90 days after the offer’s redemption window closes. After that, the attribution history a campaign is reported on survives without carrying any shopper identifier.

If you ask us to delete your data, the same mechanism satisfies the request: no part of the product depends on keeping a shopper record beyond its purge date. To make a request, contact us at [email protected].

8. Security

Traffic to and from our services is encrypted in transit. Your phone number is kept only as a keyed hash whose secret key is held outside the database, and every code we issue is single-use and registered with the clearing network so it cannot be duplicated or reused. Access to our systems is restricted and monitored.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on our website and update the effective date above.

10. Contact

If you have questions about this Privacy Policy, contact us at [email protected] or write to Viffy, Inc., Massachusetts.