Legal
Privacy & Cookies
How Madai uses the personal data it collects on madai.com and its campaigns, and, in the last section, when you take part in Madai inside an online shop.
Last updated · 29 September 2026
Madai Limited (hereinafter “Madai”) is a UK company part of the Madai US Inc group. Madai manages the website madai.com (and the related campaigns), (hereinafter “Sites and Campaigns”). This Privacy Policy will explain how our organization uses the personal data we collect from you when you use our Sites and Campaigns. We recommend that you read this Privacy Policy in full to ensure you are fully informed. If you have any questions about this Privacy Policy or Madai’s data collection, use, and disclosure practices, please contact us.
Personal information collected
We collect information from you when you use our Sites and Campaigns. We may collect personal information you directly provide on our Sites. In addition, we may collect personal information from you as a user of our Campaigns. Information we may collect includes name and email address, demographic information such as gender, birth date, preferences, and interests, and any other information requested from you.
In addition, when you visit our Sites and Campaigns some information may be automatically collected. For example, it is standard for your Web browser to automatically send information to every Web sites you visit including ours. That information includes your computer’s Internet Protocol (IP) address, access times, browser type and language, and referring Web sites addresses.
We may also collect information about your computer’s operating system and information about your usage and activity on our Sites. We may automatically collect certain information through the use of “cookies”. Cookies are small data files that are stored on your hard drive by a Web sites. Among other things, the use of cookies helps us to improve our Sites and your experience. We use cookies to see which areas and features are most popular, to count the number of computers accessing our Sites, to personalize your experience, and to remember your preferences. If your browser is set not to accept cookies or if you reject a cookie, you may not be able to access certain features or services of our Sites.
Use of personal information we collect
We use your personal information to provide you with services, to operate and improve our Sites and Campaigns, and for other purposes described in this Policy or disclosed to you on our Sites or in connection with our services. For example, we may use the information we collect from you on our Sites and Campaigns:
- to personalize and improve your experience on our Sites and with our Campaigns;
- to respond to comments and questions and provide customer service;
- to deliver service messages and other services and content you request and to send information related to accounts and services, including confirmations, invoices, technical notices, updates, security alerts, and support and administrative messages;
- to conduct an aggregated analysis of the performance of promotions;
- to control the correct functioning of the platform and to identify possible fraudulent behaviors.
Personal information you provide may be linked or combined with other personal information we collect or obtain from third parties. We match your information, in part, to help understand your needs and provide you with better service. Madai ltd may store and process personal information in the UK and other countries.
Sharing of personal information
Some promotions and features of our Sites and Campaigns are presented jointly with other companies. If you choose to participate in those promotions or use those features, your information may be collected and used by madai and those other companies. Use of your information by those other companies for their own purposes is not controlled by madai and is subject to their own terms and privacy policies. Please review each partner’s promotion rules and privacy policy for details. We do not share your personal information with third parties other than as described above and as follows:
- with your consent, for example, when you agree to our sharing your information with other third party partners for their own marketing and other purposes subject to their separate privacy policies;
- with third party vendors, consultants and other service providers (“Service Providers”) who are working on our behalf and need access to your information to carry out their work for us;
- to (a) comply with laws or respond to lawful requests and legal process, (b) to protect the rights and property of madai, our agents, members, and others including to enforce our agreements, policies and terms of use, or (c) in the good faith belief that disclosure is needed to respond to an emergency or protect the personal safety of any person;
- in connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. In any such event, we will provide notice if your data is transferred and becomes subject to a different privacy policy.
Your data protection rights
Every user is entitled to the following:
- The right to access. You have the right to request Madai for copies of your personal data. We may charge you a small fee for this service.
- The right to rectification. You have the right to request that Madai correct any information you believe is inaccurate. You also have the right to request Madai to complete the information you believe is incomplete.
- The right to erasure. You have the right to request that Madai erase your personal data, under certain conditions.
- The right to restrict processing. You have the right to request that Madai restrict the processing of your personal data, under certain conditions.
- The right to object to processing. You have the right to object to Madai’s processing of your personal data, under certain conditions.
- The right to data portability. You have the right to request that Madai transfer the data that we have collected to another organization, or directly to you, under certain conditions.
If you make a request, we have one month to respond to you.
Security of your personal information
Madai ltd takes reasonable security measures to protect your personal information to prevent loss, misuse, unauthorized access, disclosure, alteration, and destruction. Please be aware, however, that despite our efforts, no security measures are impenetrable. If you use a password on our Sites, you are responsible for keeping it confidential. Do not share it with any other person. If you believe your password has been misused, please advise us immediately. If your personal information changes, we invite you to correct or update your information as soon as possible.
Data deletion
The right to have your personal data (including personal information) deleted depends on the privacy regulations in place which vary by country and region. The General Data Protection Regulation (“GDPR”) identifies the right to have your personal data deleted, this right is known as the “right to erasure”. At Madai, we extend the right to delete your data to all users, regardless of a country or region’s regulation.
Once your account has been deleted you will no longer be able to use the deleted data to create or to verify a new madai account.
To exercise your right of erasure under data protection law please contact us or send an email to support@madai.com.
Changes to this policy
Madai ltd may change this Policy from time to time. If we make any changes to this Policy, we will change the “Last Updated” date above. If there are material changes to this policy, we will notify you more directly.
We encourage you to review this Policy whenever you visit our Site or use our Campaigns to understand how your personal information is used.
Madai in online shops
When this section applies
Some online shops let you pay less on a product by doing a few simple things for the shop, through a Madai window that opens on the product page. This section explains what Madai does with your personal data when you take part in Madai on a shop's website, with or without a Madai account. The rest of this policy applies to madai.com and its campaigns; where this section says something different, this section applies to Madai in shops.
Madai Ltd, company number 07129658, registered office 27 Pelham Road, Beckenham BR3 4SQ, United Kingdom, is the controller of the data described here. You can reach us at privacy@madai.com.
The shop whose website you are on is a separate controller for what it receives from Madai: your answers, without your identity, and your email address if you choose to give it. The shop's own privacy notice applies to that.
What we collect, why, and on what basis
| Data | When | Why | Lawful basis |
|---|---|---|---|
| Your Madai account: email address and password (stored only as a one-way hash) | When you create an account in the Madai window | To keep your value, to let you sign in, and to know which address to show you if a shop asks for your email | Performance of our contract with you (the Terms and Conditions, section 12) |
| Anonymous session: a random token held in your browser tab; Madai keeps only a fingerprint of it | When you take part without signing in | To hold the value you earn for a limited time until you sign in | Performance of a contract at your request; legitimate interest in letting you start without an account |
| Your answers to the shop's actions, including free text, linked to your account or to your anonymous session | Each time you complete an action | To deliver them to the shop, without your identity; to make sure you do not see the same question twice; for Madai's aggregated and anonymised statistics | Performance of our contract with you; legitimate interest in improving the service (aggregated use only) |
| Your Madai value, and the ledger of what you earned and used, under a pseudonym | Each time you earn or use value | To keep the accounts of value, which are never rewritten | Performance of our contract with you; legitimate interest in keeping accurate and tamper-proof accounts |
| Checkout context: the promoted products in your cart, quantities, line amounts, currency and order total; the order number and its status | When you apply value at checkout and when the order is paid, cancelled or refunded | To authorise your value and to bill the shop. We never receive your name, delivery address or payment details from the shop | Performance of our contract with you; legitimate interest in billing the shop |
| Consent proof: your email as it was, the time, the shop, the promotion, and the exact words you were shown | When you press Give my email | To prove what you agreed to. It cannot be rewritten, by anyone | Legal obligation to be able to demonstrate consent; legitimate interest in evidence |
| Technical data: your network address and browser type, and security logs with those details removed | When the Madai window loads on a page, before any click, including on the order confirmation page | To show the window and to protect the service against abuse and attacks | Legitimate interest in operating and securing the service |
Madai does not make automated decisions about you with legal or similarly significant effects. Limits on how fast you can act are applied automatically; any freeze or closure of an account is decided by a person.
What we do not collect
Madai does not collect your name, postal address, date of birth, age, country or payment details. Your email address is not verified. Madai sets no cookies on you: the Madai window keeps your session in the browser tab only. Madai does not track you across websites. Madai does not send you emails today.
What the shop receives, and what it never receives
The shop receives your answers, question by question, with no name, email or account attached. Answers given without signing in are marked as anonymous. It receives your email address only if you choose to give it (below), listed separately from your answers. It receives counts of how many people took part and, for orders where value was used, the value applied.
The shop never receives your Madai email address unless you give it, your password, your value, or your history in other promotions or shops. A shop learns only that a session is signed in, never who.
Free text you write in an open answer goes to the shop as you wrote it. Do not include personal details you do not want the shop to have.
Giving your email to a shop
Some promotions include a step where the shop asks for your email so it can write to you. You will see the shop's name, its reason, a link to its own privacy notice, and your Madai email address in full. If you press Give my email, Madai passes that address to the shop. Pressing the button is your consent; there is nothing else to tick. You do not have to: pressing Skip only means you do not earn the value of that step, and what you have already earned stays yours.
From that moment the shop is the controller of your email address, under its own privacy notice. It has agreed with Madai to use it only for the reason it stated and to honour any request to stop. If you change your mind, ask the shop; Madai cannot stop the shop from writing to you and does not recall an address once given.
Madai keeps the consent proof described above so that it can show what you agreed to. Madai may give it to you, to the shop or to an authority.
Our own use of your answers
Madai uses answers for itself only in aggregated and anonymised form, in a way that identifies neither you, nor the shop, nor the product, to produce statistics and to improve the service. Madai does not sell answers, and does not share them with anyone other than the shop you gave them to.
How long we keep it
| Data | Retention |
|---|---|
| Your Madai account (email, password hash) | While your account exists. If you do not sign in for 3 years, Madai deletes it, after a warning where a way to send one exists. |
| Anonymous session fingerprints | Removed within 90 days after the session ends. |
| Your answers, in a form linked to your account or session | 2 years from the end of the promotion, then anonymised. The shop keeps its own copy under its own notice. |
| Ledger of value earned and used | Permanent, under a pseudonym. The ledger is never rewritten; if your account is deleted, the link between the pseudonym and you is severed, and the entries can no longer be traced to you. |
| Consent proof for an email given to a shop | For as long as the shop may lawfully contact you, and 6 years after that, as evidence of your consent. If your account is deleted, the proof is kept, because it records a consent that the shop still relies on. |
| Checkout context and order status | 6 years, as the basis of Madai's invoices to the shop. They identify an order, not you. |
| Technical logs | About 30 days, on a rolling basis. |
| Backup copies | Encrypted copies of the database are made every night and kept for 30 days, plus one monthly copy kept for 6 months. Data deleted from the live system stays in those copies until they expire, and is not restored except to recover the service after a failure. |
Where your data is, and who else touches it
The service runs on servers of Hetzner Online GmbH in Helsinki, Finland; encrypted backup copies are kept by Hetzner in Falkenstein, Germany, and by Cloudflare, Inc. in Europe and the United States. Madai Ltd, in the United Kingdom, accesses the data from there. Transfers between the European Economic Area and the United Kingdom rely on the adequacy decisions in force between the two. Where personal data is transferred to the United States, the transfer is made under a lawful transfer mechanism as required by applicable data protection law.
Madai's providers of security certificates, source-code hosting and domain name service are established in the United States and do not receive your personal data.
Madai does not share your data with anyone else, except where the law requires it, to establish, exercise or defend legal claims, or in connection with a merger, sale or reorganisation of Madai's business, in which case Madai will tell you before your data becomes subject to a different privacy policy.
Browser storage
The Madai window stores a token in your browser tab to keep your anonymous or signed-in session. It is not a cookie, it is not shared with the shop, and it disappears when you close the tab or the session ends. Because it is strictly necessary to provide what you asked for, no consent banner is shown. The shop's own website may set cookies under the shop's own cookie policy; Madai does not control them.
Your rights in shops
You have the right to ask Madai for access to the personal data it holds about you, for its rectification, for its erasure, for the restriction of its processing, to object to processing based on Madai's legitimate interests, and to receive the data you provided in a portable format. Where Madai relies on your consent, you may withdraw it at any time, without affecting what was done before; for an email given to a shop, withdrawal is addressed to the shop, which holds it.
To exercise a right, write to privacy@madai.com from the email address of your Madai account, or tell us enough for us to find your account. There is no charge. Madai answers within one month, which may be extended by two further months for complex requests, in which case Madai tells you why. Deletion, correction and export of shopper accounts are not yet available as self-service: they are done by hand on request.
What erasure means here. When Madai deletes your account, it deletes your email address and password, severs the link between you and the pseudonym in the ledger, and removes any value still in the account after telling you. Some data is kept: the ledger entries, because the accounts of value are never rewritten and they no longer point to you; the proof of any consent you gave to a shop, because the shop relies on it; the checkout and order data used to bill the shop, which identify an order and not you; and a non-identifying fingerprint used only to prevent the same account from being created again. Data in backup copies expires with those copies.
Madai cannot identify who gave an answer once it is delivered to a shop, and cannot recall an email address already given to a shop. For those, contact the shop.
Complaints
If you are not satisfied with how Madai handles your data, you may complain to the Information Commissioner's Office in the United Kingdom (ico.org.uk) and, if you live in the European Union, to the data protection authority of your country. Madai would appreciate the chance to address your concern first, at privacy@madai.com.