Privacy Policy

1. Who we are

Menbru is a local discovery platform for one valley in Wyoming. For the purposes of data-protection law, Menbru is the controller of the personal data described in this policy.

This policy covers the Menbru website and every feature reachable from it: the directory, search, the offers and coupons board, the events calendar, Member accounts and Partner listings.

2. What we collect

Four categories, and nothing outside them.

Account data

Your name, email address, a hashed password if you set one, and the identifier your provider returns if you sign in with an external identity provider. We never receive your password from those providers.

Activity data

Saved places, claimed coupons and their redemption status, reviews and reports you submit, and events you mark as interesting.

Partner data

For a Partner: the business name, address, contact details, categories, opening hours, images and the offers and events published under that listing.

Technical data

IP address, browser and device type, pages requested and timestamps — the ordinary server log any website keeps. Analytics beyond that is aggregate and optional; see the Cookie Policy.

We do not collect payment card details, because Menbru does not process payments. We do not collect special-category data — health, beliefs, biometrics — and we ask you not to put any into a review or a message.

3. Why we collect it

• To run your account. Signing you in, keeping you signed in, confirming your email address, and letting you recover access.
• To make the product work. A wallet needs to know whose coupons it holds; a saved list needs to know whose places it lists.
• To publish listings. Partner data exists to be seen — that is the point of a directory.
• To keep it honest. Detecting duplicate claims, fake reviews and abusive accounts.
• To answer you. A support message and the address it came from, for as long as the conversation is open.
• To improve it. Aggregate, non-identifying measurement of which pages get used and which get abandoned.

We do not build advertising profiles, we do not sell personal information, and we do not share it with data brokers.

4. Legal bases

Where the GDPR or an equivalent regime applies, we rely on:

• Contract — account data and activity data, because without them there is no Service to provide.
• Legitimate interests — security, abuse prevention, and aggregate product measurement, balanced against your rights.
• Consent — optional analytics cookies and any marketing email. Consent is refusable up front and withdrawable at any time, with no loss of core functionality.
• Legal obligation — where we must retain or disclose something to comply with the law.

5. Who else sees it

A short list, and it stays short:

• Infrastructure providers that host the site, store the database and send transactional email. They process data on our instructions, under contract, and may not use it for their own purposes.
• Identity providers, but only if you choose to sign in with one, and only to the extent needed to confirm it is you.
• Partners, strictly as described in section 6.
• Authorities, where a valid legal request compels disclosure. We tell you when we are allowed to.

If Menbru were ever acquired, personal data would transfer with the business, and you would be told before it happened and given the chance to delete your account first.

6. What Partners can see

This is the question we get most, so it gets its own section.

When you claim a coupon, the Partner sees that a coupon of that kind was claimed, and later whether it was redeemed. When you redeem it in person, they see the code you show them.

They do not see your email address, your name, your other claims, your saved places, or anything you have done on another listing. Partner dashboards report counts and trends, not people.

The exception is a review or a report you sign — those are attributed to your display name, because an unattributable review is worth nothing to anybody.

7. How long we keep it

Account data

For as long as the account exists, then deleted within 30 days of closure.

Unconfirmed accounts

Deleted automatically 14 days after sign-up if the email address is never confirmed.

Claimed coupons

12 months after redemption or expiry, then reduced to an anonymous count.

Support messages

24 months, so that a recurring problem can be recognised as recurring.

Server logs

90 days, then deleted. Security incidents may extend this for the affected records only.

Backups

35 days on a rolling cycle. Deleted data disappears from backups as the cycle turns over.

8. How we protect it

Transport is encrypted end to end. Passwords are stored as salted hashes and are never recoverable in plain text — which is why a reset link replaces a password rather than reminding you of it. Access to production data is limited to the people who need it, logged, and reviewed.

No system is perfect. If a breach affects your personal data and creates a real risk to you, we will notify you and the relevant supervisory authority without undue delay, and tell you what happened and what to do about it.

9. Your rights

Depending on where you live, you have some or all of the following. We honour them for everyone regardless, because operating two standards is how mistakes happen.

• Access — a copy of the personal data we hold about you.
• Rectification — correction of anything inaccurate.
• Erasure — deletion, subject to what we must retain by law.
• Portability — your data in a structured, machine-readable format.
• Restriction and objection — including objecting to processing based on legitimate interests.
• Withdrawal of consent — at any time, without affecting what was lawful before.
• Complaint — to your local supervisory authority, at any point, without going through us first.

To exercise any of these, use the contact page. We acknowledge within 5 days and respond within 30. There is no fee unless a request is manifestly excessive, and we will say so before doing any work.

10. Location and devices

Menbru asks for your location only when you use a "near me" sort or map view, and only through the browser's own permission prompt. Deny it and everything still works — results order by area instead of by distance.

We do not run background location tracking, we do not fingerprint devices to re-identify you across sessions, and we do not buy location data from anyone.

11. Children

Menbru is not for people under 16. We do not knowingly collect their data, and if we learn that an account belongs to someone under 16 we delete it. A parent or guardian who believes this has happened should use the contact page.

12. International transfers

Menbru operates from the United States, and our infrastructure providers may process data in other countries. Where data leaves the European Economic Area or the United Kingdom, we rely on Standard Contractual Clauses or an equivalent approved mechanism, and assess whether additional safeguards are needed.

13. Changes to this policy

The version and dates at the top of the current policy always identify the text in force. Material changes are announced by email at least 30 days before they take effect, and a summary of what changed is included — not just a link to a new document.

14. Contacting us

Data questions and rights requests, and anything else about the Service, go through the contact page. The related documents are the Terms of Service and the Cookie Policy.