Privacy policy

1Who we are

GiftEasy is run by [company legal name], a company registered in [England and Wales] with number [company number]. Our registered office is [address]. We are registered with the Information Commissioner's Office under number [ICO registration number].

We are the controller of your personal data. That means we decide how and why it is used.

Questions or requests: [privacy contact email]. Our data protection officer (or privacy lead) is [DPO contact].

2The short version

• We use your data to run your lists, find gift ideas and send the reminders you ask for.
• We earn money when you buy through our shop links. Most networks get a click reference from us so they can tell us which click led to a sale. Amazon links carry only our store tag.
• Commission never changes which gift ideas we show you, or their order.
• People you buy for stay private. Only you see the profiles you create.
• If you're 13–17, we keep things extra private. Your suggestions aren't personalised unless you switch that on. No marketing, no public lists, and your data never feeds other people's suggestions or our supplier insights.
• Later, we plan to sell supplier insights: aggregated trends, each from a group of at least 50 people, never including anyone under 18. They contain no names, contact details or individual records. You can opt out.
• You can ask to see, download or delete your data.

3What we collect

3.1 Data you give us

3.2 Data we collect when you use GiftEasy

3.3 Data from others

• Other users. Someone may create a private recipient profile about you, add you to a gift plan or invite you to view a list. See section 6.
• Affiliate networks. Awin, Impact, CJ, Skimlinks and Amazon Associates tell us whether a click led to a sale and the commission due. Amazon does not tell us who bought what.
• Sign-in providers. Google or Apple give us your name and email if you sign in with them.
• Stripe. Stripe tells us whether a partner or group-gift organiser has passed its checks, and the status of payments and payouts.

4How we use it, and our lawful bases (UK GDPR)

Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for that assessment and you can object (section 9).

Sensitive data. We don't ask for health, religion or similar details. Please don't put them in notes or recipient profiles. If you do, we use them only to give you gift ideas.

Automated decisions. We use AI to suggest gifts and lay out your screens. None of this has a legal or similarly significant effect on you.

5Gift ideas and AI

• We use AI models to understand what you tell us, suggest gifts, write suggested card messages, and pull product details from shop pages.
• We send the text, photos or voice notes you give us to our AI providers to do this. They act on our instructions as processors.
• Commission never changes what we suggest. It doesn't affect which gift ideas we show or how we rank them. If the same item is cheaper at another shop, we show the cheaper shop first.
• AI can get things wrong. Check prices and details on the shop's site before you buy.

6People you buy for, and people who haven't joined

• When you create a profile for someone you buy for, only you can see it. We keep it minimal: nickname, age band, interests, sizes.
• We don't hold their contact details unless you send them an invite.
• We use these profiles to suggest gifts for you.
• If you're the person in a profile and you'd like to know what we hold, or want it deleted, contact [privacy contact email]. We'll help where we can identify the profile.
• If that person joins GiftEasy and links to you, their own wish list replaces your guesses.

7Who we share data with

We sell only supplier insights, which are aggregated (section 7.5).

7.1 Service providers (processors)

They act only on our instructions, under contract.

7.2 Independent controllers

They use data under their own privacy policies.

• Shops and affiliate networks. When you tap through, the shop and its network receive the click.
  • Awin, Impact, CJ and Skimlinks also get our click ID, so they can tell us which click led to a sale.
  • Amazon links carry only our store tag. We never send Amazon a click ID or anything that identifies you.
  • Their cookies apply on their site.
• Stripe. Stripe handles payouts to partners and group-gift payments, and runs identity checks.
• Sign-in providers. Google and Apple.
• ChatGPT and Claude. If you connect GiftEasy to ChatGPT or Claude, you sign in with your GiftEasy account (we act as the sign-in provider). GiftEasy then returns your lists, profiles and gift ideas into that conversation. OpenAI and Anthropic are separate controllers for their consumer apps. They handle your conversation under their own privacy policies. (Anthropic also appears in section 7.1 as our AI processor. That is a different role.)

7.3 Other users

• Shared lists. People with your list link can see the list.
• Public lists. These are opt-in, and search engines can see them.
• Reservations. These are hidden from the list owner by default.

7.4 Partners

If you signed up through a partner's link, that partner sees only totals across everyone they referred. They don't see your name, your lists or any one person's purchases. In a small group, though, a total could hint at what one person spent. We're reviewing how totals are shown before payouts start.

7.5 Suppliers (later)

We plan to sell supplier insights. They contain aggregated trends only, such as "wishes for golf gear among 35–44s in the West Midlands rose 30% this month". Each data point comes from a group of at least 50 people. They never include data from anyone under 18, and contain no names, contact details or individual records. Suppliers must agree not to try to identify anyone. You can opt out in [settings / by email].

7.6 Others

Authorities, courts or advisers where the law requires it. A buyer of our business, under the same protections.

8International transfers

Some providers are in the United States or elsewhere outside the UK. When we transfer data, we use the UK–US data bridge (for certified US companies), the ICO's International Data Transfer Agreement or Addendum, or another lawful safeguard. Ask us for a copy.

9Your rights

You have the right to:

• see the data we hold about you, and get a copy;
• correct it;
• delete it;
• restrict or object to our use of it, including objecting to supplier insights and to any marketing;
• take it to another service (portability);
• withdraw consent at any time, for example by turning off marketing in settings.

You can always email [privacy contact email]. We reply within one month.

If you're unhappy, please tell us first. You can also complain to the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/ or 0303 123 1113.

10Cookies and similar tech

• We use essential cookies to keep you signed in and secure.
• We use [analytics] cookies only [with your consent / as allowed under PECR as amended by the Data (Use and Access) Act 2025].
• We don't use advertising cookies or behavioural ads.
• Shops and networks set their own cookies when you tap through to them.
• See [cookie notice link].

11How long we keep data

12Children and teenagers

• You must be 13 or over to have an account. If we learn that someone under 13 has an account, we will delete it.
• Under-13s can have a wish list only through a parent's account. The parent controls it. The child does not sign in.
• If you're 13–17, we set things to extra private:
  • no marketing messages, including price drops;
  • no public lists;
  • your suggestions aren't personalised unless you switch that on (we explain what it means first);
  • your data never helps make other people's suggestions;
  • your data never goes into supplier insights;
  • you can't be a partner;
  • you join group gifts only through a parent.

13Marketing

• We send marketing (gift ideas, price drops, card nudges) only if you opt in, and never to anyone aged 13–17.
• Reminders you set up contain only the occasion, the date and a link. We send them because you asked.
• You can opt out at any time in settings, or by replying STOP on WhatsApp or using the unsubscribe link in emails.

13AWaitlist

Before launch, you can leave your email on the website to hear when sign-ups open.

• What we collect: your email address, whether you came to start a wish list or find a gift, the person you picked ("Mum", "Dad" and so on) if you picked one, your market (UK or US, from your country), the version of the sign-up wording you saw, and a salted hash of your IP address. We use the hash only to stop abuse. We do not store your IP address.
• Why: to send you launch news. Nothing else.
• Lawful basis: consent.
• How long we keep it: we delete waitlist data 12 months after launch, or sooner if you ask.
• Unsubscribe: every email has an unsubscribe link. You can also ask us to delete your email at any time.

14Security

We protect data with encryption in transit, access controls and monitoring. No system is perfect. If a breach puts you at high risk, we'll tell you.

15Changes

If we make important changes, we'll tell you in the app or by email before they take effect.

US privacy notice (including California)

This section applies to US residents.

Categories we collect (last 12 months)

"Sale" and "sharing"

• We do not sell personal information. Supplier insights are deidentified aggregates (below).
• We do not "share" it for cross-context behavioural advertising.
• When you tap through to a shop on Awin, Impact, CJ or Skimlinks, the network receives a click ID so we can be paid. Amazon receives only our store tag.
• Supplier insights will be deidentified aggregates. We will publicly commit not to re-identify them, and we will contractually bar suppliers from trying.

Your rights

You can:

• know what we collect, use and disclose;
• access it and get a copy;
• correct it;
• delete it;
• opt out of sale or sharing;
• limit the use of sensitive personal information (we only use it as permitted);
• not be discriminated against for using these rights.

Submit a request at [privacy contact email] or [web form]. We will verify your identity. An authorised agent can make a request for you.

Retention

See section 11.

Other states

Residents of other states with privacy laws (for example Virginia, Colorado, Connecticut, Texas, Oregon) have similar rights to access, correct, delete and opt out. Use the same contact. If we refuse, you can appeal by replying to our decision.

Children (COPPA)

We do not knowingly collect personal information from children under 13. Under-13 lists are created and managed by a parent. The child does not use an account. If you believe we have collected data from a child under 13, contact us and we will delete it.

Do Not Track

We do not respond to browser Do Not Track signals.