Introduction

1. About this Privacy Policy

This Privacy Policy describes how Molly processes personal data when you use:

• our website and web services at mollyapp.io
• Molly’s browser extension for Chrome, Edge, Firefox and Safari;
• Molly’s mobile apps for iOS and Android;
• a Molly account and features such as lists, price alerts, product search and scanning; and
• our support, newsletters and other communications.

Molly helps users find discount codes, compare prices and get relevant information when shopping. We strive to only process the information that is necessary to provide, secure and improve our services.

This Privacy Policy is information about our processing of personal data. It does not in itself constitute consent. When a processing requires consent, we ask for it separately.

In short

• We process the information necessary to provide, secure and improve Molly.
• The browser extension basically only sends the domain to determine whether a page is a supported webshop. The full URL or information about the page content is only sent in special functions that the user actively starts.
• In mobile apps, we use Firebase Analytics and Firebase Cloud Messaging. We send an installation ID, device information and push token to our backend when necessary for push notifications and synchronization.
• Our servers may log IP address, time and technical information for operational, security and troubleshooting purposes.

2. Data controller and contact information

The data controller for the processing described in this privacy policy is:

Bownty ApS
Company registration no.: 40199497
Address: Lautruphøj 5-7, 2750 Ballerup
Email: contact@mollyapp.io
Phone: +45 50 50 25 57

3. Overview of our processing

We process different information depending on which parts of Molly you use. Information such as IP address, account ID, device ID, browsing activity and purchase events may be personal data, even if they do not contain your name.

3.1 Visits to our website

When you visit our website, we may process:

• IP address;
• browser and device type;
• operating system and language;
• time of visit;
• the pages and features you use on the website;
• referring page or campaign; and
• cookie IDs and similar online identifiers, if you have given the necessary consent.

We use the information to:

• provide and secure the website;
• remember necessary settings;
• prevent abuse and technical errors;
• measure and improve the use of the website; and
• carry out marketing and performance measurement, where you have given consent.

Legal basis: Necessary operation and security are based on our legitimate interest in providing a stable and secure website, cf. GDPR Article 6(1)(f). Non-necessary analysis and marketing technologies are used on the basis of your consent, cf. Article 6(1)(a) and applicable cookie regulations.

Storage: See section 10.

On our website we use Google Analytics for statistics and usage analysis. If you have given your consent, we also use Google Ads, Meta/Facebook, Snapchat, Reddit and TikTok for marketing, targeting and measuring the effectiveness of campaigns. You can change or revoke your consent at any time via our cookie settings.

3.2 Contact and customer service

When you contact us, we may process:

• name and contact information;
• the content of your inquiry and any attached files;
• account and technical information necessary to investigate the matter; and
• our correspondence with you.

We use the information to respond to your inquiry, provide support and document the processing of the matter.

Legal basis: The processing is carried out to fulfill our agreement with you or to take action at your request, cf. Article 6(1)(b). In other cases, it is based on our legitimate interest in responding to inquiries and documenting our support, cf. Article 6(1)(f).

Enquiries and related correspondence are stored for as long as necessary to process and document the case. The information is deleted when it is no longer relevant, unless continued storage is necessary to handle a complaint, comply with a legal obligation or establish, assert or defend a legal claim.

Access is limited to employees and suppliers who need the information to provide support, troubleshoot or administer the case. Any external support suppliers process information on our instructions and in accordance with a data processing agreement.

We do not record telephone conversations with customer service.

3.3 Creation and use of a Molly account

When you create or use a Molly account, we may process:

• your email address;
• a hashed version of your password if you create an account directly with Molly;
• account ID;
• creation date and last login;
• account settings and consent choices; and
• optional profile information, if you choose to provide it: name, date of birth, and gender.

If you sign in with Apple or Google, we receive the information you have chosen to share with your sign-in provider. This may include your name, email address, and a unique sign-in ID. Molly does not receive or store your Apple or Google account password.

We use the necessary account information to:

• create and manage your Molly account;
• log you in securely;
• sync your features and settings across devices;
• protect your account and prevent abuse; and
• provide support.

Voluntary profile information, personalization and marketing

Name, date of birth and gender are voluntary information and are not required to create or use a Molly account.

If you consent to personalization, we may use the information to customize the inspiration, product recommendations and other content you see in Molly. For example, the information may be used to select and prioritize products and categories that we consider relevant to you.

If you separately consent to marketing, we may use the information to customize marketing from Molly, including offers, product inspiration and news sent via the communication channels you have chosen.

Consent to personalization and consent to marketing are given separately. You can use Molly without consenting and can change your information or withdraw one or both consents at any time under your profile and privacy settings. This does not affect your access to Molly's other features.

The information is not shared with webshops or other partners for their own marketing, unless you have specifically consented to this.

Legal basis: We process the information necessary to create and administer your account in order to fulfill our agreement with you, cf. GDPR Article 6(1)(b). Processing in connection with account security and prevention of abuse is based on our legitimate interest in protecting Molly and our users, cf. Article 6(1)(f). We only use the voluntary profile information for personalization and marketing when you have given your consent, cf. Article 6(1)(a).

3.4 The browser extension

The browser extension must be able to register which page is visited in order to determine whether Molly can offer a relevant function. Depending on the specific page and function, the extension can process:

• the visited URL or parts of the URL;
• domain and page type, e.g. product, cart or payment page;
• time and technical events;
• product data such as product name, price, variant, availability and product link;
• basket value and number of items;
• information about used and tested discount codes and savings achieved;
• purchase event, webshop and order amount;
• interactions with Molly, e.g. messages displayed and clicks; and
• browser, device and error information.

We use the information to:

• determine whether Molly supports the page you are visiting;
• display relevant features, discount codes, prices, reviews and notifications;
• test discount codes and calculate savings;
• record affiliate referrals and purchases;
• improve the quality and relevance of the features;
• prevent errors, fraud and abuse; and
• compile statistics on the use of Molly.

Legal basis: Processing necessary to provide the features you have activated is carried out to fulfill our agreement with you, cf. Article 6(1)(b). Operation, security and necessary product improvement may be based on our legitimate interests, cf. Article 6(1)(f). Processing for non-necessary analysis or marketing only takes place when there is valid consent, cf. Article 6(1)(a).

Pages that are not supported webshops

When you visit a website, the browser extension will generally send the domain of the page to Molly to check whether the website is a supported webshop and whether Molly should activate its functions.

If the website is not supported, the browser extension will generally not send the full URL, the content of the page or information about your activity on the page.

For security, operational and troubleshooting reasons, the domain, IP address, time of access and technical information about the browser extension may be included in our server logs. The information is not used to build a browsing history, personalisation or marketing.

Legal basis: The control of the domain is necessary to provide the browser extension you have activated, cf. Article 6(1)(b). Storage in server logs is based on our legitimate interest in ensuring stable operation, identifying technical errors and preventing abuse, cf. Article 6(1)(f).

Manually entered discount codes

If you enter a discount code that works and that Molly does not already know, we ask whether you want to share the code with Molly.

If you say no, the discount code will not be sent to Molly. It will only be stored temporarily and locally on your device so that it can be used for a possible discount check while you are still on the website in question. The code will be deleted from local storage when you leave the website.

If you say yes, the discount code will be sent and stored by Molly. We can then use it in future discount checks and share it with other Molly users.

You should not share personal discount codes or codes that are only issued to you or a limited group of people.

Chrome Web Store

The use of information received from Google APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

This means, among other things, that information from the browser extension is only used for the user-oriented feature that is clearly described in the Chrome Web Store and in Molly's user interface. Browsing activity is collected only to the extent necessary to provide or improve that feature. Information from the browser extension is not used for personalized ads and is not shared with advertising platforms, data brokers, or other information vendors.

3.5 Mobile apps for iOS and Android

When you use Molly's mobile app for iOS or Android, we may – depending on the features you choose – process:

• account and login information;
• a persistent installation ID and internal device ID;
• operating system and version, app version, device model, and language;
• IP address and approximate geographic area derived therefrom;
• interactions with app features;
• searches, product views, and clicks;
• lists, saved products, and price alerts;
• push tokens and your notification preferences;
• purchase events and affiliate referrals; and
• crash, performance, and error data.

We use Firebase Analytics to measure the usage of the app and Firebase Cloud Messaging to deliver push notifications. The installation ID, relevant device information and push token are sent to Molly's backend when necessary to register the device, sync features and send the notifications you have selected.

Saved lists, price alerts, purchase information and affiliate events are only processed when you actively use or sync the relevant features.

We use the information to provide the selected app features, sync your account, send notifications, perform analytics, secure and debug the app and improve the user experience.

Legal basis: Core functions are processed to fulfill our agreement with you, cf. Article 6(1)(b). Operation, security and necessary product improvement may be based on our legitimate interests, cf. Article 6(1)(f). Non-necessary analysis or marketing is only done on the basis of consent, cf. Article 6(1)(a).

Information for App Store and Google Play

Depending on the user's choice and use of the features, the following categories may be relevant in App Store Privacy and Google Play Data Safety:

• Data associated with the user: Account information as well as purchases, saved products and lists, if the information is synchronized with the user's account.
• Device identifiers: Installation ID, internal device ID and push token.
• Usage data and analytics: Searches, product views, clicks and other Firebase Analytics events. Data may be associated with the user if associated with an account, installation or device ID.
• Diagnostics: Crash, performance and error logs, if collected.
• Approximate location: Approximate geographic area, if inferred from the IP address in server logs.

3.6 Barcode scanning on iOS

When you scan a barcode on iOS, the app uses Apple's AVFoundation to read the code directly from the camera video stream on your device. The camera image itself is not saved or uploaded as part of the normal scan.

The scan returns the barcode value and format, such as EAN or UPC. The scanned code can be sent to Molly to find product information, prices, and retailers, as well as to enable saving the product or creating a price alert.

3.7 Image upload on Android

When you choose to take or upload a picture, the image may first be made available to the app as a local file or URI. The image is adjusted and compressed in the app or frontend and is only uploaded to Molly when you actively choose to save it in the relevant function.

An uploaded image can be saved together with a product or item in a list. If you are logged in and synchronize the list, the image can be associated with your Molly account, the list and the product in question. Together with the image, we can process technical information such as file type, file size and upload time.

The upload function accepts common image formats and can therefore also be used for images of receipts or other documents if you choose such an image yourself. You should avoid uploading images that contain CPR numbers, payment card information, health information or other sensitive or confidential information.

Storage and suppliers

Uploaded images are stored in Molly's image storage, which may include Amazon Web Services (AWS). In the examined scanning and uploading flows, an external supplier for AI-based image analysis is not used. If we later introduce image analytics or share images with a new vendor, we will update this Privacy Policy and obtain consent when required.

Images associated with a saved product or list are retained for as long as the content is stored in your account or list, and are deleted when you delete that content or your account, unless continued retention is required by applicable law.

Legal basis: The processing is necessary to provide the scanning, product search or image upload functionality that you have actively chosen, cf. GDPR Article 6(1)(b). Any future, unnecessary image analysis or use for other purposes will only be carried out on a relevant legal basis and, where required, with your consent.

3.8 Lists, price alerts and saved products

When you save a product, create a list or price alert or share a list, we may process:

• product name, product link, price, variant and image;
• list name, content and settings;
• desired price or other alert criteria;
• time and history of changes; and
• name, email address or user ID of people you invite, as well as the status of the invitation.

We use the information to store and sync content, track price changes, send selected notifications, and manage collaboration on lists.

Sharing with other users

When you share a list, people who gain access can see the name and content of the list, as well as relevant product information such as product name, product link, price, variant, and image.

We do not display internal technical information such as installation ID, device ID, push token, IP address, backend token, or internal audit IDs to other participants. An invited user's email address is also not displayed to other users.

Invitations

Depending on the sharing method selected, an invitation can be sent via email, as a message in Molly to a registered user, or via a shareable link.

Email invitations contain a unique and time-limited acceptance link that is validated by our server. The invitee's email address is used solely for sending and managing the invitation and not for newsletters or other marketing.

The invitation message contains information about the sender, the purpose of the invitation, and a link to this privacy policy.

Unaccepted invitations expire and are deleted from the active invitation data no later than 30 days after they are sent. The associated email address is deleted at the same time. We may retain a limited event log of the invitation being sent, accepted, revoked, or expired for up to 90 days for operational, security, and troubleshooting purposes. The event log does not contain the invitee's full email address after deletion.

Your Control Over Shared Lists

As the owner of a list, you can view and revoke other people's access, delete unaccepted invitations, and delete the entire list. When a list is deleted, the other participants lose access and the list content, images and alerts are deleted following the deletion processes described in this policy.

Legal basis: The processing of your lists, saved products, price alerts and sharing choices is necessary to provide the functionality you have requested, cf. GDPR Article 6(1)(b). The processing of an invited person's contact information is based on our legitimate interest in providing the sharing functionality requested by a Molly user, cf. Article 6(1)(f).

3.9 Product views, shopping and purchase activity

When you use Molly's shopping features, we may record products you have viewed or saved, as well as information about purchases that can be attributed to Molly. The information may include:

• product name, product link, product ID or SKU;
• price, variant and quantity;
• webshop and date;
• cart value, order amount and currency;
• order or transaction ID; and
• an affiliate, campaign or partner reference.

Depending on the integration, the information may be sent to Molly from a webshop or an affiliate network, for example via a redirect, callback or webhook. Molly does not receive your payment card number, password or other login information for the webshop.

Product and purchase information may be associated with your Molly account or installation if the information is received along with a user token, installation ID, or other identifier. This may allow your shopping or purchase history to be displayed and synchronized across devices.

We use the information to:

• provide the shopping features you choose to use;
• display saved products, price history, price alerts, and calculated savings;
• record and document purchases that may trigger affiliate commissions;
• reconcile information with online stores and affiliate networks;
• prevent errors, abuse, and misreporting of commissions; and
• compile product, usage, and business statistics.

If you have given the necessary consent, we may also use your product and purchase history to tailor inspiration, product recommendations and marketing to your interests. You can withdraw your consent at any time with effect for future processing.

We limit the information we receive and store to what is necessary for the purposes described. If we receive additional information from a webshop or an affiliate network that we do not need, we will not store it or will remove it as soon as possible.

Legal basis: Processing that is necessary to provide a shopping function that you actively use is carried out to fulfill our agreement with you, cf. Article 6(1)(b). Processing for the purpose of documenting and reconciling affiliate income, preventing abuse and necessary product and business statistics may be carried out on the basis of our legitimate interests, cf. Article 6(1)(f). Personalization and marketing that require consent are carried out on the basis of your consent, cf. Article 6(1)(a).

We store product and purchase information for as long as necessary for the relevant shopping function, reconciliation of affiliate commissions or documentation of a possible legal claim.

3.10 Analysis and product development

We analyze the use of Molly to understand which functions are used, where errors occur and how our services can be improved. The analysis may include, among other things, use of functions, product views, searches, clicks as well as technical information about the app, browser and device.

Where possible, we use aggregated or anonymized information. Information is only considered anonymous when it cannot be linked to an identified or identifiable person by reasonable means. Pseudonymous information and information linked to an account, cookie or device ID is still personal data. Hashing does not in itself make information anonymous.

We may share or, for a fee, make anonymous and aggregated statistics available to partners, for example on product views, price developments, conversions and general market trends. We do not share or sell personal data that allows others to identify individual users or gain insight into individual user behaviour.

Legal basis: Necessary analysis for the purposes of operation, troubleshooting, security and product development may be carried out on the basis of our legitimate interest in improving and protecting Molly, cf. Article 6(1)(f). Analysis using non-necessary cookies or similar technologies is only carried out with consent, cf. Article 6(1)(a).

3.11 AI-based onboarding and chat

Molly may use artificial intelligence as part of the onboarding for the Safari extension on iOS and macOS. When you start the AI chat, we will inform you that you are interacting with an AI-based service.

We may process:

• questions, messages, and responses you enter;
• the most recent messages in the current session;
• completed onboarding steps, choices, errors, and retries;
• activation status and relevant Safari permissions; and
• operating system, platform, browser, language, user agent, and IP address.

We use the information to guide you through installation and activation, answer questions, select a relevant next step, troubleshoot, analyze churn, and improve the quality and security of the service.

The AI chat does not have direct access to your Molly account, your lists, your shopping history, or information about other users. It cannot make changes to your account itself. The AI does not make decisions that have legal effect or similarly significantly affect you.

Before a new answer is generated, your question may be compared to existing answers using an embedding service provided through AWS Bedrock and Cohere. If a relevant answer is not found, your question, recent messages, and relevant onboarding and technical information may be sent to OpenAI to generate an answer.

We do not use AI chat conversations for advertising or to create marketing profiles. Data sent through OpenAI's API is not used to train OpenAI's general models by default.

Legal basis: Processing necessary to provide the onboarding assistance you request is necessary to perform our agreement with you, pursuant to Article 6(1)(b). Security, troubleshooting, analysis and quality improvement are based on our legitimate interests, pursuant to Article 6(1)(f).

Molly stores chat and session data for up to 90 days and deletes or anonymizes it thereafter, unless longer retention is necessary to comply with the law or to handle a specific legal claim. OpenAI may retain API input and output for up to 30 days for security and abuse monitoring, unless another agreed configuration applies.

Do not share passwords, payment card details, social security number, health information or other sensitive or confidential information in the chat. AI-generated responses may be inaccurate or incomplete and should not be used as professional legal, financial or medical advice.

3.12 Newsletters and direct marketing

If you have given your consent, we may send you news and offers from Molly, including offers from partners if your consent includes this. We process your email address, your consent choices and any information about language, openings and clicks to send, customize and measure the communication. Openings and clicks are only tracked with the necessary consent.

You can unsubscribe from marketing at any time via the link in the email or by contacting us at contact@mollyapp.io. This does not affect necessary service messages about your account, security or features you use.

3.13 Legal requirements and legal claims

We may process and disclose personal data when it is necessary to:

• comply with a legal obligation, cf. Article 6(1)(c);
• establish, exercise or defend legal claims;
• respond to a valid request from a government agency or court; or
• protect Molly, our users, or others from fraud, abuse, or security threats.

4. Information from other sources

We may receive information from:

• Apple or Google when you use their login solution;
• webshops and affiliate networks in connection with clicks, purchases, commissions, and returns;
• analytics, security, and technical vendors; and
• people who invite you to a shared list or other collaboration feature.

5. Sharing Personal Information

We only share personal information when necessary and have a lawful basis. Recipients may include:

5.1 Suppliers and other recipients

We use external vendors to operate and develop Molly. This includes:

• Amazon Web Services for hosting, cloud infrastructure, email, logs, and semantic matching via Amazon Bedrock;
• OpenAI for generating AI responses;
• Google for web and app analytics, and push notifications on Android; and
• Apple for push notifications on iOS.

We only share the information that is necessary for the individual service. When a supplier processes personal data on our behalf, it does so on our instructions and in accordance with a data processing agreement.

Some suppliers and their subcontractors may process information outside the EEA, including in the USA. Such transfers are based on an adequacy decision by the EU Commission or the EU Commission's standard contractual clauses and any necessary additional measures. You can contact us at contact@mollyapp.io for further information on the basis for the transfer.

5.2 Affiliate networks, webshops and other independent data controllers

When you click through to a webshop or make a purchase via an affiliate link, the affiliate network and the webshop may process information such as IP address, cookie or click ID, time, webshop, order amount and commission data. They may be independent data controllers for their processing and must therefore inform you about it themselves.

Molly uses:

5.3 Business Transfer

If Molly or significant parts of the business are sold, merged or restructured, relevant personal data may be shared with advisors and potential buyers under appropriate confidentiality and security measures. Any final transfer will only take place in accordance with data protection legislation and affected users will be informed where required.

6. Transfer to countries outside the EU/EEA

Some of our suppliers may process personal data outside the EU/EEA, including in the USA. Transfers are made on the basis of an adequacy decision by the EU Commission, including the EU–US Data Privacy Framework for certified companies, or the EU Commission's standard contractual clauses and any necessary supplementary measures.

You can contact us at contact@mollyapp.io for further information about the basis for the transfer and the safeguards used.

7. Cookies and similar technologies

On our website and in relevant parts of our services, we may use cookies, local storage, pixels, SDKs and similar technologies.

We divide them into:

• Necessary technologies, which are required for operation, security, login and the user's explicitly selected features.
• Preference technologies that remember choices and customizations.
• Statistics technologies that help us understand the use of our services.
• Marketing technologies that are used for advertising and campaign measurement.

We only use non-necessary technologies after you have given consent. You can change or revoke your choice at any time. The revocation does not affect the lawfulness of previous processing.

8. Automated decisions and profiling

If you consent, Molly may use your voluntary profile information to customize inspiration, product recommendations and marketing from Molly. Personalization may affect which products, categories, offers and messages you see and in what order they are displayed.

We do not make decisions solely by automated processing, including profiling, that have legal effects or similarly significantly affect you.

9. How long we keep information

We keep personal information for as long as it is necessary for the purposes for which it was collected. After that, it is deleted or anonymized. Information may be kept longer if necessary to comply with the law, handle a dispute, or assert a legal claim.

10. Security

We use appropriate technical and organizational security measures, including encrypted data transmission and access restrictions, to protect personal data against loss, alteration, unauthorized access and disclosure. The measures are adapted to the nature and risks of the processing.

11. Your rights

Under data protection regulations, you have the right to access, rectification, erasure, restriction, objection and data portability, depending on the circumstances. You can object to direct marketing at any time and withdraw consent with effect for the future. The rights may be limited by law.

You can exercise your rights or request the deletion of your Molly account by contacting us at contact@mollyapp.io. You can also request account deletion via app.mollyapp.io/profile.

12. Complaint to the Danish Data Protection Agency

If you are dissatisfied with our processing of your personal data, you are welcome to contact us in the first instance.

You also have the right to complain to:

Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
www.datatilsynet.dk

If you live in another EU/EEA country, you can also contact the relevant local supervisory authority.

13. Links and third-party services

Molly may link to webshops and other third-party services that we do not control. When you leave Molly or use a third-party service, the third party's own terms and privacy policy apply to their processing.

14. Changes to the Privacy Policy

We may update the Privacy Policy when our services, suppliers or legal requirements change. The current version will always be available at mollyapp.io/privacypolicy with the date and version number.

If a change is of significant importance to you, we will inform you in an appropriate manner, e.g. in the app, via the browser extension or by email. If a new processing requires consent, we will ask for a new consent before the processing begins.

Last updated: 9/9-2026