Privacy Policy
Last Updated: January 2, 2026
Paylow.io ("Paylow," "we," "us," or "our") operates the Paylow price tracking service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information.
Summary: We collect only what we need to provide price alerts. We never sell your personal information. You control your data and can delete it anytime.
1. Information We Collect
1.1 Information You Provide
- Account Information: Email address, full name (optional), Google account info if using Google Sign-In
- Price Alert Information: Product URLs, target prices, preferred retailers, alert preferences
- Communication Preferences: Notification settings, quiet hours, timezone, digest frequency
1.2 Information Collected Automatically
- Usage Data: Pages visited, features used, time spent
- Device Information: Browser type, operating system, device type
- Product Data: Extracted product information (name, price, images, availability)
2. How We Use Your Information
- Create and manage your account
- Track product prices and send notifications
- Process your notification preferences
- Respond to inquiries and support requests
- Improve our service and develop new features
- Generate aggregated, anonymized analytics (not personally identifiable)
3. Email Communications & Anti-Spam Compliance
3.1 Types of Emails
Transactional (Service-Related)
- Price drop notifications
- Back-in-stock alerts
- Email verification requests
- Account security notifications
Marketing (Opt-In Only)
- Product recommendations
- New feature announcements
- Promotional offers
3.2 Anti-Spam Compliance
We comply with:
- CAN-SPAM Act (US): Clear unsubscribe mechanism, physical address in emails
- CASL (Canada): Express consent required, consent records maintained
- GDPR (EU): Explicit consent, right to withdraw anytime
3.3 Email Verification
For users creating alerts without an account, we require email verification before sending notifications. Verification links expire after 24 hours. Unverified alerts are automatically deleted.
3.4 Your Email Choices
- Unsubscribe: One-click unsubscribe link in every email
- Frequency: Choose immediate, daily, or weekly digest
- Quiet Hours: Set times when you don't want notifications
- Rate Limits: Set maximum emails per day
4. How We Share Your Information
We do NOT sell your personal information. We never sell, rent, or trade your personal data to third parties for marketing.
4.1 Service Providers
| Provider | Purpose | Data Shared |
|---|---|---|
| Firebase (Google) | Authentication | Email, name, profile picture (from OAuth) |
| Postmark | Email delivery | Email address, notification content |
| Google Cloud | Hosting & database | All service data (encrypted) |
| Zyte | Product extraction | Product URLs only |
5. Data Security
- Encryption in Transit: TLS/SSL for all data transmission
- Encryption at Rest: Sensitive data encrypted in databases
- Access Controls: Restricted and logged employee access
- Secure Authentication: OAuth 2.0 for Google Sign-In
6. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Until you delete your account |
| Price alerts | Based on your settings (default 90 days) |
| Price history | 2 years (for trend analysis) |
| Email consent records | 2 years (legal requirement) |
7. Your Rights
Access & Portability
Access and download your personal data
Correction
Update your personal information anytime
Deletion
Request deletion of your data
Opt-Out
Unsubscribe from communications anytime
8. International Data Transfers
Our servers are located in North America. We ensure appropriate safeguards for international transfers, including standard contractual clauses and data processing agreements with all service providers.
9. Children's Privacy
Our Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we discover such data, we will delete it immediately.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy and sending an email notification.
11. Contact Us
If you have questions about this Privacy Policy or our data practices:
12. Jurisdiction-Specific Rights
California Residents (CCPA)
Right to know, delete, and opt-out of sale (we don't sell data). Contact privacy@paylow.io.
European Union Residents (GDPR)
Rights to access, rectification, erasure, restrict processing, data portability, and object.
Canadian Residents (PIPEDA/CASL)
Rights to access, challenge accuracy, and withdraw consent for communications.