Privacy Policy

CostFinders is a price-comparison and referral service for medical spas in the United States. We publish the treatment prices providers advertise, collected from providers' public websites and public business listings, and we help people who want a treatment get in touch with the provider offering it. This policy applies to the CostFinders website, the emails we send, and any other service that links to it.

It applies to people who browse and claim deals, to providers who ask us to add, correct or remove a listing, and to providers who hold a business account. The service is intended for use in the United States only.

CostFinders is not a healthcare provider. We do not deliver treatment, we do not create or hold medical records, and we are not a HIPAA covered entity or business associate. Please do not send us medical history, diagnoses, or other clinical details — share those directly with a licensed provider. Some state laws do treat interest in a treatment as health data; section 5 explains how we handle it.

Information you give us directly:

• Account information — first name, last name, email address, and password credentials handled by our authentication provider.
• Phone number — optional on your profile, and required when you claim a deal so the provider can reach you.
• Profile details — city and state, the deals you save, and your email notification setting.
• Deal claim details — which deal and provider you claimed, your preferred appointment date and time, and any note you add for the provider.
• Messages — the content of messages you exchange with a provider through CostFinders (possible only with a provider that holds a business account), and any support correspondence with us.
• Provider requests — for providers, the name, email address, role and details you give us when you ask us to add, correct or remove a listing, or when you hold a business account.
• Privacy requests — the email address and message you send through our Do Not Sell or Share My Personal Information form.

Information we collect automatically:

• Usage and device data — pages viewed, referring page, approximate location derived from IP address, browser and device type, and timestamps.
• Performance data — page load and responsiveness measurements.
• Session cookies — set by our authentication provider to keep you signed in.

Information from other sources: business names, addresses, phone numbers, categories, websites, social profiles, Google ratings and review counts, and advertised pricing, collected from providers' public websites and public business listings. This is business information, not consumer personal information.

We do not ask for and do not want payment card numbers, Social Security numbers, government ID numbers, or clinical records. Payment for any treatment happens directly between you and the provider.

• To create and maintain your account and keep you signed in.
• To show you a provider's name and contact details when you claim one of its deals, and to pass your request on to that provider (see section 4).
• To send email about your account and your claims — claim confirmations, word that we passed your request on, sign-in links, and account or security notices.
• To operate, secure, and improve the service, including preventing spam, abuse, and fraudulent claims — for example, we limit how many open claims one account can hold at a time.
• To measure aggregate usage and performance so we can improve pages and pricing coverage.
• To comply with law and to enforce our Terms of Service.

We also share information with:

• Service providers that run the platform on our behalf — hosting and analytics, our database and authentication provider, and our email delivery provider. They may use the data only to provide services to us.
• Legal and safety recipients — where we are required to comply with law, respond to lawful requests, or protect the rights, safety, or property of users, businesses, or CostFinders.
• A successor entity in connection with a merger, acquisition, financing, or sale of assets. We will notify you if your information becomes subject to a materially different privacy policy.

We do not sell or share your information with unrelated advertisers or data brokers, and we do not publish your personal information on the public pages of the site.

A claim shows that you are interested in a cosmetic treatment, such as a neurotoxin injection or a dermal filler. Some state laws treat that as consumer health data, so we handle it this way:

• We collect it only when you submit a claim.
• We use it only to show you the provider's details, to pass your request on to that provider, and to keep a record of the claim. We never use it for advertising.
• We share it only with the provider you chose and with the service providers named in section 4.
• We keep it until you delete your account, and for no longer than [to be supplied] after the claim closes.
• You can cancel an open claim from your claims page, and deleting your account deletes every claim you made.

We use a small number of cookies and similar technologies. Essential cookies keep you signed in and secure your session; the site does not work without them.

For measurement we use Vercel Web Analytics and Vercel Speed Insights. Vercel Web Analytics is designed to be privacy-friendly: it does not use cross-site tracking cookies and does not build a persistent cross-site profile of you. Speed Insights measures real-user page performance. Both collect page URL, referrer, device and browser type, and coarse country-level location.

We do not currently run third-party advertising pixels or cross-context behavioral advertising trackers. If that changes, we will update this policy and provide any opt-out the law requires before turning them on.

Most browsers let you block or delete cookies in their settings. Blocking essential cookies will prevent you from signing in. We do not currently respond to browser Do Not Track signals.

We send email about your account and your claims: claim confirmations, word that we passed your request on, sign-in links, and account and security notices. We do not send marketing email or deal alerts, and we do not send text messages.

The email notifications setting in your account, and the unsubscribe link in every email, turn off everything except claim confirmations and sign-in or security email. A claim confirmation still goes out, because it carries the provider's contact details you claimed.

Messages a provider sends you after we pass your request on come from that provider, not from CostFinders. Opting out with us does not opt you out with them.

• Account and profile data — kept while your account is open. Delete my account in Settings removes your login, profile, claims, messages and saved deals straight away. Copies in backups are gone within [to be supplied].
• Claims and messages — kept while your account is open, for no longer than [to be supplied] after the claim closes, so we can answer questions about a claim.
• Analytics data — retained in aggregated form by our analytics provider under its own retention schedule.
• Legal, tax, and security records — retained as long as required by applicable law, and to enforce our agreements.

Information already passed to a provider is retained by that provider under its own schedule, which we do not control.

• Access and correct — view and edit your name, phone number, location, and email setting at any time in your account settings.
• Delete — Delete my account in Settings removes your login, profile, claims, messages and saved deals. It cannot reach information we already passed to a provider.
• Turn off email — use the email setting in your account or the unsubscribe link in any email.
• Withdraw a claim — cancel an open claim from your claims page. This stops us passing it on, but does not recall details already passed on.
• Portability — download a copy of the personal information you gave us from your account settings.

To exercise any other right, email support@costfinders.ai. We will verify your identity — usually by confirming control of the email address on the account — before acting on a request, and we will respond within the time the applicable law allows. We will not discriminate against you for exercising a privacy right.

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) gives you the rights below.

• Right to know — request the categories and specific pieces of personal information we collected about you, the sources, our business purpose, and the categories of third parties we disclosed it to.
• Right to delete — request deletion of personal information we collected from you, subject to legal exceptions.
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale or sharing — direct us not to sell or share your personal information, using the Do Not Sell or Share My Personal Information form.
• Right to limit use of sensitive personal information — we do not collect or use sensitive personal information for purposes that trigger this right.
• Right to non-discrimination — we will not deny service, charge a different price, or provide a different quality of service because you exercised a right.

California residents may also use an authorized agent. The agent should email us at support@costfinders.ai with your signed permission; we may still verify your identity with you directly. California "Shine the Light" requests may be sent to the same address.

Residents of other states with comprehensive privacy laws may have comparable rights to access, correct, delete, and opt out of targeted advertising or the sale of personal data. We honor those requests through the same contact address.

We use industry-standard measures to protect your information, including encryption in transit, row-level access controls in our database, and restricting employee access to what is needed to operate the service. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you as required by law.

CostFinders is not directed to children. You must be at least 18 years old to create an account or claim a deal, because the treatments listed on this site are aesthetic medical services. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, email us and we will delete it.

We may update this policy as the service changes or the law requires. We will revise the "Last updated" date at the top of the page, and for material changes — particularly any change to how we share your information with providers — we will give notice by email or an in-product notice before the change takes effect.

Questions, requests, or complaints about this policy can be sent to:

See also our Terms of Service.