Privacy Policy

This Privacy Policy explains how YourGiftPro (“we”, “us”) collects, uses, and protects personal data when you use our gift-concierge service. We are committed to processing personal data in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR, and applicable data-protection laws.

1. Who we are (Data Controller)

YourGiftPro is the data controller responsible for your personal data. For any privacy questions or to exercise your rights, contact our privacy team at privacy@yourgiftpro.com.

2. The data we collect

• Account data: your name, email address, and a securely hashed password.
• Recipient data you provide: the names, relationships, interests, important dates, shipping addresses, and notes for the people you add. See “Data about other people” below.
• Payment data: card payments are processed by Stripe. We never see or store your full card number; we store only a Stripe customer reference and the card's brand, last four digits, and expiry.
• Gift & order data: shortlists generated, gifts you approve, messages, and order/fulfilment status.
• Technical data: IP address, device/browser information, and security logs.

3. How and why we use your data (legal bases)

• To provide the service: researching, ordering, and shipping gifts (legal basis: performance of a contract).
• To take payment for approved gifts (legal basis: contract).
• To send service emails such as reminders, approval requests, and delivery updates (legal basis: contract / legitimate interest).
• To send marketing tips only where you have opted in (legal basis: consent, withdrawable at any time).
• To secure the service and prevent abuse (legal basis: legitimate interest).
• To meet legal obligations such as tax and accounting (legal basis: legal obligation).

4. Data about other people (recipients)

When you add a recipient, you provide us personal data about another individual. You confirm you have a lawful basis to share it and, where appropriate, that they would reasonably expect a friend or family member to arrange gifts for them. We use recipient data solely to research and deliver gifts on your behalf. A recipient may contact us to access or delete their data, and we will honour valid requests.

5. Sharing & processors

We share data only with the processors needed to run the service, under data-processing agreements:

• Stripe: payment processing
• Anthropic (Claude): gift research from recipient interests (no payment data sent)
• SerpAPI: product search
• Resend: transactional email
• Microsoft Azure: hosting and infrastructure
• Google: if you choose “Continue with Google” to sign in, Google acts as our identity provider and shares your name and email with us for that purpose
• Google Analytics: website and product analytics (see “Cookies” below)

Some processors may be located outside the EEA/UK. Where that is the case, transfers are protected by Standard Contractual Clauses or an equivalent adequacy mechanism.

We are not currently using Shopify or another order-management platform for fulfilment; gifts are ordered directly from the merchant that sells them. If that changes, we will list the new processor here.

5a. Affiliate relationships

YourGiftPro may participate in affiliate or referral programs with some of the shops and makers we order gifts from. Where that applies, we may earn a commission on a purchase, at no additional cost to you, since the price you pay is the gift's price plus shipping plus our service fee, calculated the same way regardless of any commission we receive. This does not influence which gift we recommend for a recipient.

6. Retention

We keep account and recipient data for as long as your account is active. When you delete your account, we delete associated personal data, except records we are legally required to retain (e.g. order and tax records, typically up to 6–7 years).

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• erase your data (“right to be forgotten”);
• restrict or object to processing;
• data portability: receive your data in a structured, machine-readable format;
• withdraw consent at any time; and
• lodge a complaint with your supervisory authority (e.g. the ICO in the UK).

You can delete your account and data at any time from your Account settings, or by emailing privacy@yourgiftpro.com.

8. Cookies

We use strictly necessary cookies required to keep you signed in and to secure the service. We also use Google Analytics, which sets its own cookies (_ga and similar) to measure how the site is used, for example which pages are visited and how people move through sign-up. Analytics cookies are not strictly necessary, and we do not use advertising or cross-site advertising cookies.

You can block analytics cookies through your browser settings or Google's opt-out browser add-on.

9. Security

Passwords are hashed with bcrypt, data is encrypted in transit (TLS), and access to production systems is restricted. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authority of any breach as required by law.

10. Children

The service is not directed to children under 16, and we do not knowingly create accounts for them.

11. Changes

We may update this policy; we will post the new version here and update the “Last updated” date.

12. Contact

Questions? Email privacy@yourgiftpro.com.