Deal Once
← Back to Deal Once

Privacy Policy for Deal Once

Effective Date: 2 December 2025
Last Updated: 31 May 2026

Deal Once is a trading name of NENO GROUP PTY LTD AS TRUSTEE FOR TANEJA & SONS FAMILY TRUST
ACN: 671 083 711

Deal Once ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application.

Global availability: Deal Once is available worldwide. Your privacy rights may vary by country — see Sections 13–19 for jurisdiction-specific rights. Secure Payment and identity verification features are not available in certain sanctioned jurisdictions (see our Terms of Service §2.1).

1. Information We Collect

1.1 Personal Information

When you create an account and use Deal Once, we collect:

1.2 Automatically Collected Information

2. How We Use Your Information

We use the collected information for:

3. Permissions We Request

Camera Permission

We request camera access to allow you to:

You can deny camera permission and still use the app by selecting photos from your gallery.

Location Permission

We request location access to:

Location data is approximate and used only to enhance your experience.

Precise Location (GPS Coordinates)

During transaction verification, we collect precise GPS coordinates of both parties when entering the verification code:

This location data is used to:

Location data is only collected during the verification process and is stored securely for dispute resolution purposes.

Photo Library/Storage Permission

We request access to your photo library to allow you to select existing photos for your profile and listings.

Notification Permission

We request permission to send you push notifications about:

4. How We Share Your Information

With Other Users

When you create a listing or make an offer, certain information becomes visible to other users:

With Service Providers (Sub-processors)

Legal Requirements

We may disclose your information if required by law, court order, or to:

5. Data Security

We implement industry-standard security measures to protect your information:

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as:

When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law.

7. Your Rights and Choices

Access and Control

You have the right to:

How to Exercise Your Rights

To exercise any of these rights, contact us at the email address below. We will respond within 30 days.

8. Children's Privacy

Deal Once is not intended for users under 18 years of age. We do not knowingly collect personal information from minors. If we discover that a child has provided us with personal information, we will delete it immediately.

If you are a parent or guardian and believe your child has used Deal Once, please contact us immediately. For child-privacy concerns, include "Child Privacy" in your email subject line to support@dealonce.com.

9. Advertising and Privacy

Important: We display non-personalized advertisements in the app using Google AdMob. These ads are based on the content of the app, not on your personal data or browsing behavior across other apps and websites.

What Data AdMob Collects

AdMob may collect minimal technical information to serve ads:

Non-Personalized Ads

We use non-personalized advertising, which means:

App Tracking Transparency (iOS)

We do not use App Tracking Transparency (ATT) or any tracking frameworks. Since we only serve non-personalized contextual ads, user tracking is not necessary. This means:

SKAdNetwork (iOS)

We use Apple's SKAdNetwork framework for privacy-preserving ad attribution on iOS. This allows ad networks to measure ad effectiveness without tracking individual users or compromising your privacy.

Your Advertising Choices

While we don't use personalized advertising, you can still manage advertising preferences on your device:

Learn more about Google's advertising practices: Google Ads Policy

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. The table below identifies where each sub-processor is located and the safeguard used for transfers from the EEA/UK:

Sub-processor Country Transfer mechanism (EEA/UK users)
Supabase Singapore Standard Contractual Clauses (SCCs)
Stripe United States SCCs (Stripe's DPA)
Didit EU/EEA (Estonia) Within EEA — no transfer mechanism required; adequacy applies for AU/UK transfers
Cloudflare (Images & Stream) United States (global CDN) SCCs (Cloudflare's DPA)
Google (Gemini + AdMob) United States SCCs (Google's DPA)
ASIC / ABR Australia Australia only — no cross-border transfer

Where we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or their UK equivalent (IDTA/addendum), we ensure the sub-processor is bound by the same obligations regarding your personal data. You may request a copy of the relevant transfer mechanism by contacting us at support@dealonce.com.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. For material changes (changes that affect how we use or share your data, or that add new categories of data collection), we will give you at least 30 days' advance notice (or such longer period as required by applicable law in your jurisdiction) by:

If you do not accept a material change, you should stop using Deal Once before the change takes effect. Your continued use of Deal Once after the effective date of a change constitutes acceptance of the updated policy. For non-material changes (such as clarifications or corrections), we will update the "Last Updated" date without advance notice.

12. Third-Party Links

The app may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies.

13. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA, effective 1 January 2023):

To exercise your CCPA/CPRA rights, contact us at support@dealonce.com with "California Privacy Request" in the subject line. We will respond within 45 days (extendable once by a further 45 days with notice).

14. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR). As controller of your personal data, Deal Once processes data on the following legal bases under Article 6 GDPR:

For biometric data processed for optional identity verification (Didit), we rely on your explicit consent under Article 9(2)(a) GDPR. You may withdraw this consent at any time by contacting us.

Your GDPR Rights

To exercise your GDPR rights, contact us at support@dealonce.com with "GDPR Request" in the subject line. We respond within 30 days (extendable by two further months for complex requests).

Automated Processing and Profiling

Some Deal Once features use automated processing. When you use the optional AI listing tool, images are processed by Google Gemini to generate suggested titles, descriptions, and price ranges — this does not produce legal or similarly significant effects and is not subject to Article 22 GDPR. Fraud-signal analysis may use algorithmic checks on transaction patterns; where this produces significant effects you have the right to request human review, express your point of view, and contest the decision by contacting us at support@dealonce.com.

14A. United Kingdom Privacy Rights (UK GDPR)

If you are in the United Kingdom, the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA 2018) apply. Your rights mirror those set out in §14 above. The UK's supervisory authority is the Information Commissioner's Office (ICO):

Transfers of your data from the UK to our sub-processors in third countries use the UK's International Data Transfer Agreement (IDTA) or an addendum to EU SCCs, as applicable. Australia holds an adequacy decision from the UK for the purposes of transfers to ASIC/ABR.

15. Australian Privacy Rights (Privacy Act 1988)

If you are an Australian resident, Deal Once complies with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

Your Rights Under Australian Privacy Law

Collection and Use of Personal Information

We collect and use your personal information in accordance with the APPs:

Making a Privacy Complaint

If you have a complaint about how we handle your personal information:

  1. Contact us at support@dealonce.com with details of your complaint
  2. We will acknowledge your complaint within 7 days
  3. We will investigate and respond within 30 days
  4. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC):

Data Retention in Australia

We retain your personal information for as long as necessary to provide our services and comply with Australian legal obligations. When we no longer need your information, we will take reasonable steps to destroy or de-identify it.

16. New Zealand Privacy Rights (Privacy Act 2020)

If you access Deal Once from New Zealand, the Privacy Act 2020 applies. Deal Once acts as an agency under that Act. You have the right to:

We collect your information only for the purposes described in this policy and handle it in accordance with the Privacy Act 2020's Information Privacy Principles. If you have a complaint about our privacy practices, contact us at support@dealonce.com. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner:

17. Canadian Privacy Rights (PIPEDA / Quebec Law 25)

If you access Deal Once from Canada, your privacy rights are governed by the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Quebec, by Law 25 (Act Respecting the Protection of Personal Information in the Private Sector, as amended 2022):

To exercise your rights, contact us at support@dealonce.com with "Canadian Privacy Request" in the subject line. We respond within 30 days. If not satisfied, you may contact the Office of the Privacy Commissioner of Canada:

Quebec residents may also contact the Commission d'accès à l'information (CAI) at cai.gouv.qc.ca.

18. US State Privacy Rights (Beyond California)

In addition to California rights (§13), residents of the following US states have rights under their respective state privacy laws. In each case you have, at minimum: the right to know/access; the right to delete; the right to correct; the right to opt out of sale or sharing; and the right to appeal a decision about your request.

We do not sell personal information and do not process personal data for targeted advertising. To exercise your rights under any of the above laws, contact us at support@dealonce.com with "US State Privacy Request — [your state]" in the subject line. We respond within 45 days (extendable by a further 45 days with notice). To appeal a decision, reply to our response email with "Appeal" in the subject line.

19. Indian Privacy Rights (DPDP Act) & Grievance Officer

If you access Deal Once from India, the Digital Personal Data Protection Act, 2023 (DPDP Act) may apply to digital personal data we process there. Where it applies, Deal Once acts as a Data Fiduciary and you may have rights, subject to conditions in Indian law and delegated rules, to:

You may escalate complaints to the Data Protection Board of India when its operational procedures permit.

Grievance Officer (India)

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, 2023, the following Grievance Officer is designated for users in India:

We acknowledge grievances within 24 hours and aim to resolve them within 15 days of receipt. Complaints relating to content that exposes the private area of an individual, depicts such individual in any sexual act or conduct, or is in the nature of impersonation in an electronic form (including artificially morphed images), will be acted upon as expeditiously as possible and resolved within 72 hours, in line with Rule 3(2) of the IT Rules 2021.

20. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us:

Deal Once
A trading name of NENO GROUP PTY LTD AS TRUSTEE FOR TANEJA & SONS FAMILY TRUST
ACN: 671 083 711

Email: support@dealonce.com
Website: www.dealonce.com
Response Time: We will respond to all inquiries within 30 days

For data deletion requests or privacy-related concerns, please include "Privacy Request" in your email subject line.

© 2026 Deal Once. All rights reserved.