This policy covers the Bursly browser extension and app. It describes what the software actually does. When the code changes, this text changes in the same release.
Who is responsible
The data controller is the company operating the market your account belongs to.
| Market | Company | Reg. no. |
|---|---|---|
| Norway, Sweden, Denmark | Mosel AS, Bergen, Norway | 937 308 809 |
| Estonia, Finland, Germany, the Netherlands | Monsen AS, Bergen, Norway | 931 063 499 |
Privacy questions: personvern@spareborsen.no.
The browser extension
What it does
Bursly activates cashback at shops we have an agreement with, and shows current discount codes at those shops. Activation only happens when you press a button yourself. The extension has no content scripts and never reads the content of the page you visit: no text, no form fields, no shopping cart.
What information it holds
- A device token. Created when you pair this browser with your account using a pairing code from the app or the website. The token identifies this browser and lets us register a click. It cannot request a payout or change your account. It is stored in the browser's local storage, which the websites you visit cannot access.
- The hostname in the address bar, for example komplett.no. The extension only sees the hostname itself, not the rest of the address, not search terms, not parameters. It is kept locally and used to check whether the shop is a partner.
- Your first name, retrieved from your account when you pair, and shown as a greeting.
When anything leaves your device
- When you open the popup at a shop we recognise: the hostname is sent to api.spareborsen.no to fetch current discount codes for that shop. Nothing besides the hostname and the device token is sent.
- When you press "Activate cashback" yourself: the address of the tab you are on is sent to your market's website to register the click, together with the device token. This never happens on its own.
- When you pair with a code: the code and a browser identifier (user agent) are sent to exchange the code for a device token. You receive an email that a browser was connected.
Nothing else is sent anywhere. The extension has no analytics, no third-party tracking code and no advertising.
What is not collected
- No browsing history.
- No page content, form fields or shopping cart.
- No searches you make on the websites you visit.
- No location, no device ID beyond the token the extension itself creates when pairing.
How long information is kept
The device token, partner catalogue and coupon results stay in the browser's local storage until you disconnect, uninstall the extension, or remove the browser from your account. Coupon results for a shop are considered fresh for ten minutes. If your account revokes access, the extension deletes everything it stored locally right away. A device token unused for 180 days stops working by itself.
Permissions it asks for
- Storage: device token, catalogue and coupon results, locally.
- Tabs: reading the address of the tab you are on, to show the right shop and send you on after activation.
- Alarms: refreshing the partner catalogue in the background at regular intervals.
- Host permissions for spareborsen.no, sparborsen.se, spareborsen.dk, rahatagasi.ee, rahatakaisin.fi, meinspartopf.de, spaarbeurs.nl and api.spareborsen.no. These are the only servers the extension talks to.
The app
Without an account the app only stores your chosen country and language on the device, plus a local copy of the coupons it last fetched so it opens without a connection.
If you sign in with your Sparebørsen account, your clicks to shops are sent together with your account ID so purchases can earn cashback. The app uses no advertising ID, no location and no crash reporting, and shares no information with anyone but the shop you choose to visit and the affiliate network that passes on the cashback.
When you press "Copy", the app writes the code to the clipboard. It never reads from it.
Your account
The account itself, your balance and payouts are handled by Sparebørsen or its sister service in your country, under the privacy policy on that market's website. If you delete your account there, your click history and all connected browsers disappear with it.
Your rights
You have the right to access, correct and delete information about you, and to object to the processing. Contact us at the address above and we answer within 30 days. You can also complain to the Norwegian Data Protection Authority (Datatilsynet).
Changes
This page is updated when the software changes. The date at the top shows the current version.