Privacy Policy

1. Who we are

GiftWrapd ("we", "us", "our") operates giftwrapd.com, an AI-powered gift discovery platform. We are the data controller responsible for your personal data collected through this website.

GiftWrapd is registered with the Information Commissioner's Office (ICO) under registration reference ZC176874 (registered 17 June 2026, expires 16 June 2027).

Contact: hello@giftwrapd.com

2. What data we collect

Gift searchers (Basic account holders)

• Full name and email address (collected at account creation); phone number (optional)
• Search queries you enter into the gift search tool
• Basic usage data (searches performed, features used)
• Technical data: IP address, browser type, device information, cookies

Shoppers (applicants and approved shoppers)

• All of the above, plus:
• Location (city/town and travel radius)
• Professional biography, portfolio images, and case studies
• Identity documents (passport, driving licence, or national ID card) for verification purposes
• Instagram or portfolio URL (optional)
• Bank account details for payment (collected separately when approved)

Advertisers

• Name, company, and email address submitted via the advertising enquiry form

Concierge users

• Chat transcripts with our AI adviser, which may contain information about the gift recipient and your preferences

3. How we use your data

• Gift search: To provide personalised gift recommendations via our AI platform (processing powered by OpenAI — see Section 6)
• Account management: To create and manage your GiftWrapd Basic account
• Shopper matching: To match Concierge users with suitable personal shoppers
• Communications: To send transactional emails (account confirmation, application status). With your consent, we may also send marketing emails about gift ideas and platform updates
• Lead generation: Basic account holders' contact details may be used to connect you with our personal shoppers for relevant gifting services
• Shopper verification: Identity documents are processed solely to verify your identity before activation as a shopper
• Platform improvement: Anonymised and aggregated usage data helps us improve our AI recommendations and user experience
• Legal compliance: To comply with our legal obligations under UK law

4. Legal basis for processing

• Contract performance: Processing necessary to provide the gift search service and Concierge matching
• Legitimate interests: Improving our platform, fraud prevention, shopper verification
• Consent: Marketing emails (you may withdraw consent at any time)
• Legal obligation: Compliance with UK law

5. Data sharing

We do not sell your personal data. We share data only as follows:

• Personal shoppers: When you use GiftWrapd Concierge, relevant gift brief information (but not your full account details) is shared with your matched shopper
• Service providers: We use third-party services to operate our platform (see Section 6)
• Legal requirements: If required by law, court order, or to protect our rights
• Business transfer: In the event of a merger, acquisition or sale of assets, your data may be transferred as part of that transaction

Affiliate networks (Amazon Associates, Awin) may receive click data when you follow product links from our platform. This is governed by their own privacy policies.

6. Third-party processors

• OpenAI — Powers our AI gift recommendations and Concierge chat. Your search queries and chat messages are processed by OpenAI. See OpenAI's Privacy Policy. We have a Data Processing Agreement with OpenAI and API call logging is disabled.
• Netlify — Hosts our website and processes web requests. Servers are located in the US (N. Virginia). Data transfers are governed by Standard Contractual Clauses. See Netlify's Privacy Policy.
• Resend — Sends transactional emails. See Resend's Privacy Policy.
• Stripe — Processes payments (when live). See Stripe's Privacy Policy.
• Plausible Analytics — Privacy-friendly, cookieless website analytics. Plausible collects aggregated usage statistics only and does not store personal data or track you across websites. Data is hosted in the EU. See Plausible's Privacy Policy.

7. International transfers

Our platform infrastructure (Netlify) is hosted in the United States. Data transfers outside the UK are protected by Standard Contractual Clauses (SCCs) as approved by the UK Information Commissioner's Office (ICO).

8. Data retention

• Basic accounts: Retained while your account is active and for 2 years after your last interaction
• Shopper identity documents: Deleted within 30 days of application rejection, or within 12 months of leaving the platform
• Search queries: Retained for up to 12 months for platform improvement purposes
• Marketing consent records: Retained for 3 years from the date of consent

9. Your rights

Under UK GDPR you have the right to:

• Access — Request a copy of personal data we hold about you
• Correction — Request correction of inaccurate or incomplete data
• Erasure — Request deletion of your data ("right to be forgotten")
• Restriction — Request we restrict processing of your data
• Portability — Receive your data in a structured, machine-readable format
• Object — Object to processing based on legitimate interests or for direct marketing
• Withdraw consent — Withdraw marketing consent at any time (this won't affect lawfulness of prior processing)

To exercise any of these rights, email hello@giftwrapd.com. We will respond within 30 days.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Cookies

GiftWrapd uses minimal cookies and browser storage:

• localStorage: We store your account status, search count, your 10 most recent searches, and any gifts you save to your shortlist locally in your browser. This data stays on your device and is not sent to our servers, except where noted below.
• Shared shortlists: If you choose to share a shortlist link, the gift details in that list (product names, prices and links — no personal details) are stored on our hosting infrastructure (Netlify, see Section 6) so the link works for the person you share it with.
• Essential cookies: Required for the website to function (session management). No tracking or advertising cookies are used without consent.

11. Children

GiftWrapd is not intended for use by children under 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately.

12. Changes to this policy

We may update this policy from time to time. We will notify registered users of material changes by email. Continued use of the platform after changes constitutes acceptance of the updated policy. The "Last updated" date at the top of this page will always reflect the most recent version.