Privacy Policy

What we collect

Account data: your email and password (stored hashed by our database provider, we never see it in clear).

Billing data: plan, status, amounts and dates of payments, received from our payment processor. Your card is handled by the processor; we never receive the full card number.

Usage data: what you search and save in the app, pages visited, the campaign that brought you (UTM parameters and referrer) and basic technical logs (IP address, browser) kept for security.

Messages: emails and, if you give your number and agree, text messages you exchange with us, plus what you write in the in-app chat and its history.

Account activity: when you were last active, which tools you use and your recent chats, summed up in an internal account-health indicator our team uses to decide who to help. It has no legal or similarly significant effect on you.

Why we use it

To run your account and the service (contract), to bill you and prevent fraud (contract and legitimate interest), to send service emails such as trial and payment notices (contract), to improve the product (legitimate interest), and to send you product picks, tips and offers (consent or legitimate interest for customers; you can unsubscribe in one click). Text messages are sent only if you opted in; reply STOP to stop them.

Who processes it for us

Supabase (database and login), Vercel (hosting), Whop (payments and memberships), Brevo (emails and text messages), Meta and Google (ad measurement, with your consent) and Anthropic (AI features and the in-app chat: the content you submit and your chat history), plus specialist data providers for product, marketplace, ad and store research, which receive what you search (keywords, product IDs, store domains) but never your name or email. Each acts on our instructions under its own data protection terms. Some are in the United States; transfers rely on standard contractual clauses or equivalent safeguards.

Cookies

We keep your login in your browser’s local storage: this is essential and always on.

With your consent (the cookie banner) we also load the Meta Pixel and the Google tag to measure which ads bring people to DumaHunt. Without consent they never load. You can change your choice any time with “Cookie settings” at the bottom of the site.

If you arrive through an affiliate’s link, we keep that link’s code on your device for up to 60 days and count the visit (with a one-way hash of your connection, never your IP itself), so the affiliate is credited if you sign up. If you choose “Only essential”, the code is kept only until you close the tab.

When you sign up, start a trial or pay, we may also send that event with a hashed (unreadable) version of your email to Meta and Google from our server, to measure our ads. We never send your password, payment details or what you search in the app.

The DumaHunt browser extension

On Amazon product and search pages the extension reads what the page already shows (price, ratings, sales badges, best-seller rank, seller) to display it in its panel. This happens in your browser and is not sent to us.

When you ask for a full analysis or a store report, or when it shows your account and credits, the extension sends us only what that needs: the product ID and marketplace, or the store domain, with your DumaHunt sign-in. We treat these requests like the same searches made in the app.

To sign you in, it reads your DumaHunt login on dumahunt.com once and receives its own sign-in, kept in the extension’s storage on your device. The supplier costs you type into its profit calculator stay on your device.

It does not read other websites, does not collect your browsing history, and uses no tracking or advertising cookies. On a site you open it on, it only checks whether the site is a Shopify store when you click its icon. Uninstalling the extension deletes everything it stored.

How long we keep it

Account data while your account is open and up to 24 months after it closes; billing records as long as tax law requires (usually 7–10 years); security logs up to 12 months.

Your rights

You can ask to access, correct, export or delete your data, object to marketing, or withdraw consent at any time, by writing to info@dumahunt.com. If you are in the EU or UK you can also complain to your data protection authority. California residents have the rights of the CCPA; we do not sell or share personal information for cross-context advertising.

Contact

VA International Network FZCO, IFZA Business Park, Dubai Silicon Oasis, Dubai, United Arab Emirates · info@dumahunt.com