Privacy Policy

• We do not sell your personal information, and we do not use it for advertising.
• We never ask you for your Social Security number, your birthdate, or any financial account number. Most members verify on VerifyPass’s own website, and we receive only the result.
• If you upload an ID or service document instead, only our review team can open it, every opening is logged, and we delete it on a fixed schedule (Section 6).
• Businesses never see who you are. They see only counts of how their offers are used (Section 5).
• The App has no analytics, session recording, or ad tracking.
• You can delete your account at any time from Settings (Section 11).

2.1 Account sign-in. You can create an account and sign in in three ways:

• Email code: your email address.
• Sign in with Google: your name, email address, and profile picture, as provided by Google.
• Sign in with Apple: your name (Apple shares it only the first time you sign in) and your email address. If you choose Apple’s Hide My Email option, we receive a private relay address instead of your real one, and our emails reach you through Apple.

We do not receive your Google or Apple password.

2.2 Verification information. To confirm your eligibility, you verify in one of two ways:

• VerifyPass (the main way). We send VerifyPass your name, your email address, and a random reference number we create. You then verify on VerifyPass’s own website. Anything you enter or upload there, such as your Social Security number, birthdate, pay statements, or bank account documents, goes directly to VerifyPass and never reaches our systems. VerifyPass sends us back only the result: your community (military, first responder, or healthcare), the verification date, our reference number, your name, and your email address.
• Document upload (if VerifyPass cannot verify you). You may upload a military, dependent, or retiree ID, a DD-214 or other discharge papers, a badge, or a professional credential to our private storage, and a member of our team reviews it.

Before you upload, please cover your Social Security number and any other ID or account numbers you do not need to show. We never ask for these numbers and do not need them to verify you. A full DD-214, for example, usually shows a Social Security number. If a document you upload shows one of these numbers and you do not cover it, it stays in our storage until the document is deleted under Section 6.

2.3 Your account and activity. Information you add or create while using your account, including:

• an optional phone number in your account settings, which we do not currently use for anything, including verification or text messages;
• settings and notification preferences;
• offers you view, save, and mark as used;
• your referral link and a record of who joined through it; and
• support requests you send us and any attachments.

2.4 Business and sponsor accounts. If you manage a business listing or a sponsor account, we collect the business or company name, address, contact details, logo and images, the offers you post, and the details of your business verification fee payment (Section 2.7).

2.5 Location.

• Address suggestions. When you type an address, the characters you type are sent to Google Maps Places to suggest matching addresses.
• “Use my location.” Only if you click this button and allow it in your browser, your browser sends your approximate location (your browser’s low-accuracy location, which may be up to five minutes old) directly to BigDataCloud, which turns it into a city and state. We never save your coordinates. We put the city and state (not coordinates) into the page address to show nearby businesses. Because of this, your city and state can appear in our hosting provider’s logs, and in the link if you share the page.

2.6 Newsletter and contact forms. If you sign up for our newsletter or use our contact form, we collect your name, email address, the group you identify with (member, business, supporter, or volunteer), your business name if you are a business, your message, and whether you asked to join the newsletter or are interested in our beta program.

2.7 Payments. Businesses pay a one-time verification fee through Stripe. Stripe collects your card or bank details directly; we do not receive or store full card numbers. We receive the amount, currency, dates, status, and Stripe reference numbers.

2.8 Donations. Donations are processed by Givebutter. Givebutter shares with us your name, email address, mailing address, the donation amount and date, whether the gift is one-time or monthly, and any note or dedication you add. Your payment details are handled by Givebutter’s payment processors, not by us.

2.9 Information collected automatically.

• Server logs. Our host, Vercel, records your IP address, browser or device type, the page address requested (which may include a city and state, see Section 2.5), and the time of each request.
• Spam and abuse protection. When you submit a form, Vercel BotID analyzes browser and device signals to tell people from automated programs. We also keep short-term counters (for example, of requests from one address) to stop spam. These counters clear themselves within two days.
• Website analytics. Our public Website uses Google Analytics to count visits, see which pages are used, and count a few donation-related actions: viewing the donate page, viewing the thank-you page after a donation, sharing, and signing up for the newsletter. The App (accounts, dashboards, and listings management) uses no analytics of any kind.
• Images. Some images are delivered by Unsplash, and images in our emails are hosted by Brevo. When your browser or email program loads these images, those companies receive your IP address.
• Email activity. Brevo, our email service, may record whether our emails are opened and which links are clicked.

2.10 What we do not collect. We do not ask for your Social Security number, birthdate, or financial account numbers. We do not use session recording, advertising pixels, or ad tracking anywhere on the Platform.

We use personal information to:

• create your account, sign you in, and keep your account secure;
• verify your eligibility and keep a record of your verification result;
• show you offers, including nearby offers if you ask;
• publish and manage business listings, offers, and sponsor recognition, and show businesses counts of how their offers are used;
• process business verification fees and donations, and send receipts;
• send you emails about your account, such as sign-in codes, verification results, and deletion notices;
• send you our newsletter, only if you sign up for it;
• answer support requests and messages;
• prevent fraud, spam, and misuse, including misuse of verified status; and
• comply with the law, keep tax records, and protect our rights and the rights of others.

4.1 What we receive. From Google: your name, email address, and profile picture. From Apple: your name (first sign-in only) and your email address or a private relay address.

4.2 How we use it. We use your name and email address to create your account, sign you in, keep the account secure, and send you emails about your account. We send you newsletters only if you sign up for them. We do not use your profile picture for any purpose, and we never display it publicly or share it with any business.

4.3 What we never do. We do not sell this information, use it for advertising, or share it with businesses or advertisers. We do not use it to train artificial intelligence models.

4.4 Where it is stored. It is stored in our database hosted by Supabase.

4.5 Google’s rules. Our use of information received from Google APIs follows the Google API Services User Data Policy.

4.6 Removing it. Deleting your account (Section 11) deletes this information. If you signed in with Apple, we also revoke our access with Apple when your account is deleted. You can also remove VetDiscounts.org’s access in your Google Account or Apple Account security settings, which stops future sign-ins with that method but does not delete your VetDiscounts.org account.

5.1 Public. Business listings, their offers and images, and sponsor recognition are public.

5.2 Not public. Member profiles, verification results, uploaded documents, phone numbers, and viewed, saved, or used offers are not public.

5.3 What businesses see. Businesses never see members’ names, email addresses, phone numbers, or verification details, including when a member uses an offer. A business’s dashboard shows only counts for each of its offers: views, number of people who viewed it, saves, uses, number of people who used it, and the date of the most recent use. Businesses cannot access the member records behind these counts. To get a discount in person, you may need to show a business that you are a verified member.

6.1 Who can see them. Uploaded documents are kept in private storage, not on public web pages. Only team members who review verifications can open them, and we keep a log of which team member opened which document and when.

6.2 When we delete them. We delete each uploaded document as soon as our team makes a decision on it, and in any case:

• no more than 30 days after an approval;
• no more than 7 days after a denial; and
• 30 days after upload if no decision has been made. In that case we will ask you to upload again or use VerifyPass.

6.3 What we keep. After deletion we keep only the verification result (your community and the verification date), not the document.

7.1 Service providers. These companies process personal information for us. Each may use it only to provide its service to us, except where Section 7.2 says otherwise.

• Supabase: our database, sign-in system, and file storage (including uploaded documents).
• Vercel: hosting, server logs, scheduled jobs, and bot protection.
• Brevo (based in France): all our email, including sign-in codes, account notices, and our mailing lists, and hosting of images in our emails.
• Stripe: business verification fee payments.
• Givebutter: donations.
• VerifyPass: service verification.
• Google: Sign in with Google, if you choose it; Google Maps Places address suggestions; and Google Analytics on the public Website.
• Apple: Sign in with Apple, if you choose it.
• BigDataCloud: turning your approximate location into a city and state, only when you click “Use my location.”
• Unsplash: delivery of some images (receives only your IP address).
• Our team email provider: receives messages and notifications sent to our team.

7.2 Text-message sign-in. Text-message sign-in codes are switched off. If we turn them on, your phone number would be sent to the text-message provider connected to our sign-in system so it can deliver the codes, and we will update this policy before we do.

7.3 Companies with their own policies. Stripe, Givebutter, VerifyPass, Google, and Apple also handle your information under their own privacy policies when you pay, donate, verify, or sign in with them. In particular, what you enter or upload on VerifyPass’s website is governed by VerifyPass’s privacy policy, and Givebutter may use its own cookies and data partners on its donation forms. We do not control these companies’ own practices.

7.4 Other disclosures. We may disclose information when the law requires it, to protect the safety or rights of any person, to investigate fraud or misuse, or to a successor organization if our programs are transferred to one.

7.5 No sale. We do not sell personal information, rent it, trade it, or share it for advertising.

We use encrypted connections (HTTPS), private storage for uploaded documents, limited team access, and access logging. No system is completely secure, so we cannot guarantee absolute security. If a security breach affects your personal information, we will notify you and others as the law requires.

9.1 App cookies. The App uses only these cookies:

• Supabase sign-in cookie: keeps you signed in. The App does not work without it.
• vd_ref: remembers the referral link you arrived through, for 30 days.
• vd_ref_checked: records that a referral link has been checked, for 1 day.
• vd_oauth_join_type: remembers the type of account you are creating while you sign in with Google or Apple, for 10 minutes.

9.2 Browser storage. The App also saves a few settings in your browser: whether you dismissed the welcome tour, which offers have already been counted as viewed, and whether the sidebar is open.

9.3 Website analytics cookies. Google Analytics sets cookies (such as _ga and _ga_*) on the public Website to count visits. We have not turned on Google’s advertising features. You can block these cookies in your browser or use Google’s Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.

9.4 Third-party forms. The Givebutter donation form and the Stripe payment form may set their own cookies under those companies’ policies.

9.5 Do Not Track and Global Privacy Control. We do not track you across other websites, and we do not sell or share your information for advertising, so these browser signals do not change what we do.

10.1 Your account. For as long as your account is open, and then until it is deleted under Section 11.

10.2 Uploaded documents. As described in Section 6.

10.3 Support requests. For as long as the related account exists. Requests from people without an account are deleted 30 days after they are closed.

10.4 Newsletter and contact form information. Newsletter contacts are kept until you unsubscribe or delete your account. Contact form messages are kept for up to two years. Records of business and partner inquiries are kept for up to three years after our last contact.

10.5 Business verification fee records. The amount, currency, dates, status, and Stripe reference numbers are kept for seven years for tax purposes and then deleted automatically. The Stripe reference numbers link to Stripe’s own record of the payment, which includes the business’s name and email address.

10.6 Donation records. For about seven years, for tax and accounting purposes.

10.7 Deletion records. When we delete an account, we keep a coded reference that cannot be turned back into your account, the account type, and the relevant dates, as proof that we honored the request.

10.8 Email suppression. If you unsubscribe or delete your account, Brevo keeps your email address alone, marked so that it receives no marketing email. If you later sign up again and opt in, the block is lifted.

10.9 Logs and analytics. Server logs are kept for the short period set by Vercel. Website analytics data is kept for no more than 14 months.

10.10 Backups. Deleted information may remain in backups until they expire on our host’s normal schedule.

11.1 How to delete. Go to Settings > Delete account and type your account’s email address to confirm. You can also email policies@vetdiscounts.org.

11.2 What happens right away. You are signed out on every device. Your profile, and any business listing and its offers, are removed from the Platform. Your referral link stops working. You are removed from our mailing lists. We email you the date your account will be deleted.

11.3 30 days to change your mind. Your account is deleted on the first midnight (UTC) at least 30 days after your request. Until then you can sign in and choose Keep my account to restore it, or ask us to cancel the deletion.

11.4 What we delete. On the deletion date we delete your sign-in and profile; settings and preferences; saved and used offers; your referral link and history; sponsor company details; your support requests and attachments (including requests sent from the same email address without signing in); your profile photo, company logo, and any ID document; your VerifyPass verification record; business listings, with their offers, images, and contact details; unused invitations sent to your email address; and your contact record in Brevo except the suppression entry in Section 10.8. If you signed in with Apple, we also revoke our access with Apple.

11.5 What we keep. Only the records listed in Sections 10.5 to 10.8. If you replied to support tickets as a member of our team, those replies stay on the other person’s ticket, signed “Former team member.”

11.6 Records other companies keep. Deleting your account does not delete records kept by Stripe, Givebutter, VerifyPass, or Brevo’s logs of emails it sent. Contact those companies to ask about their records.

11.7 Monthly donations continue. Deleting your account does not cancel a monthly donation. Cancel it through Givebutter, using the link in your donation receipt or your Givebutter donor account.

12.1 Access, correction, and deletion. You can correct most account information in Settings. You may also ask us what information we hold about you, or ask us to correct or delete it, by emailing policies@vetdiscounts.org. We may need to confirm your identity first, for example by asking you to write from the email address on your account. We will respond within 45 days, and if we need more time we will tell you why.

12.2 Marketing email. Use the unsubscribe link in any newsletter, or change your preferences in Settings. You will still receive emails needed to run your account, such as sign-in codes and deletion notices.

12.3 Location. “Use my location” works only if you click it and allow it in your browser. You can turn off location access in your browser settings at any time.

12.4 State privacy rights. Some states give residents additional rights over their personal information. We honor reasonable requests from residents of any state to the extent the law applies to us. If we deny a request, you may reply and ask us to reconsider.

13.1 Adults only. You must be 18 or older to create an account, verify, or donate. This applies to military dependents too: dependents may join only if they are 18 or older. We ask you to confirm your age when you sign up.

13.2 Children. The Platform is not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn that an account belongs to someone under 18, including from an uploaded ID, we will close the account and delete its information and any uploaded document. If you believe a child has given us personal information, email policies@vetdiscounts.org and we will delete it.

The Platform is intended for people in the United States. Your information is processed in the United States and by service providers in other countries, including France. The Platform is not designed to meet the legal requirements that apply in the European Union or the United Kingdom.

We will update this policy when our practices change, and the date at the top shows the latest version. If we make a material change to how we use information you have already given us, we will tell you by email or by a notice on the Platform before the change applies to that information.

Email: policies@vetdiscounts.org