Your data, handled with care

• We only collect what we need to run Giftory: your account, the gift situations you describe, and the people, dates, ideas and plans you choose to save.
• Gift suggestions are created by an AI model (Gemini, by Google). What you type into the gift finder or the plan builder is sent to it, so please leave out sensitive details.
• We don’t use analytics or advertising cookies, we don’t build advertising profiles and we never sell your data.
• Sponsored listings are always labelled and are matched to your current search only.
• You can download your data or delete your account at any time on your account page.

The controller responsible for processing your personal data on Giftory is the operator of the service, established in the Republic of Lithuania. We have not appointed a data protection officer, as the law does not require one for a service of our size; you can send any privacy question directly to us.

Most of the data comes directly from you; some is created automatically when you use Giftory.

Your account

• Email address and name. If you sign in with Google, we receive your Google profile name, email address and profile picture.
• Sign-in sessions, including the IP address and browser they were started from, so we can keep your account secure. Sign-in links can be used only once, are stored only as a hash and expire after 5 minutes.
• Preferences: language, delivery country, currency, time zone and reminder settings.

Gift searches and surprise plans

• What you tell us about the person and the occasion: name or nickname, relationship, age range, gender (optional), occasion and date, interests, personality, style, things they already have or should avoid, budget, delivery country and any free-text details.
• The suggestions and plans the AI creates for you, and which steps of a plan you have ticked off. Identical searches are answered from a cache for 24 hours to save time and energy.

Free-text fields can contain anything you write. Please don’t include sensitive information, for example about someone’s health, religion, sexual orientation or political views, or anything else that isn’t needed to find a good gift.

People, dates and saved ideas

• People you save: name, relationship, birthday, interests and notes.
• Dates and events: title, date and time, repetition, reminder settings, budget and notes, and which reminders we have already sent.
• Saved gift ideas and their status (idea, bought, wrapped, given).

This information is about other people. It is visible only to you; please only store what you need to find them a good gift.

Google Calendar (optional)

• If you connect Google Calendar, we create a separate “Giftory” calendar in your Google account and keep it in sync with your dates in both directions. Our access is limited to calendars Giftory created itself: we cannot see your other calendars.
• We store the ID of that calendar, the Google IDs and versions of synced events and the access tokens (encrypted). Our use of data received from Google APIs complies with the Google API Services User Data Policy (opens in a new tab)↗, including the Limited Use requirements.

Usage, security and fraud prevention

• Daily usage counters linked to your account or, if you are not signed in, to a keyed hash of your IP address (for IPv6, of your network prefix). We don’t store the IP address itself for this.
• Clicks on shop links: which product link was opened from which search, so we can count visits to shops.
• Views and clicks of sponsored listings, with keyed hashes of your IP address and of your wider network, to detect click fraud and bill advertisers fairly.
• Technical logs kept by our hosting provider (such as time, requested page and IP address) and error reports. Our own error logs are designed to leave out personal data.

Product images

Product pictures in the results are loaded through our own server, so shops don’t learn your IP address while you browse. Only when you open a product link do you visit the shop directly; from then on, the shop’s own privacy policy applies.

Gift suggestions and surprise plans are created by Gemini, an AI model provided by Google. When you start a search or a plan, we send the details you entered to Google together with our instructions. We don’t send your email address or account ID along with it.

To find real products, the AI runs Google searches that it writes itself based on your description. Our server then opens the product pages to check that the links lead to real products. No personal data is sent to shops in the process. We keep a library of products found this way (public product information only, nothing about you), so later searches can reuse them. When a product has no usable picture, an AI illustration is generated from the product’s public description by fal.ai and clearly labelled as such; nothing you typed is sent to fal.ai.

We use Google’s paid Gemini API: under its terms Google does not use the data to improve its products and keeps it only for a limited time to detect misuse or where the law requires it. Grounded results come with Google Search suggestions; selecting one opens Google Search.

Please don’t enter sensitive information about yourself or others, such as health details, in the gift finder or the plan builder. It is never needed for a good gift.

We only process personal data when the GDPR allows it. This is what we do, and on which legal basis:

Providing Giftory: your account, gift searches, surprise plans, people, dates, saved ideas and reminder emails

Performance of our contract with you (Art. 6(1)(b) GDPR).

Connecting Google Calendar and other optional features you switch on

Your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, for example by disconnecting the calendar on your account page or in your Google account settings (opens in a new tab)↗.

Security, preventing abuse, daily limits, click-fraud protection and error logs

Our legitimate interest in a safe, reliable and fairly billed service (Art. 6(1)(f) GDPR).

Answering your messages and requests

Our contract with you (Art. 6(1)(b)) or our legitimate interest in replying (Art. 6(1)(f)); for requests about your data protection rights, our legal obligation (Art. 6(1)(c)).

Advertiser accounts, payments, invoices and accounting records

Our contract with the advertiser (Art. 6(1)(b)) and our legal obligations under tax and accounting law (Art. 6(1)(c)).

Handling reports of illegal content and complaints about sponsored listings

Our legal obligations under the EU Digital Services Act (Art. 6(1)(c)) and our legitimate interest in a trustworthy service (Art. 6(1)(f)).

Where we rely on legitimate interests, you can object at any time (see “Your rights”).

We work with a small number of carefully selected service providers. They process data on our behalf under data processing agreements and only as we instruct them:

Google (Gemini API)

AI model (Gemini) that creates gift suggestions and surprise plans, including the Google searches it runs. Processing may take place in the USA.

fal.ai

Generates AI illustrations for products without a usable picture, from public product information only. Processing in the USA.

Vercel

Hosting and content delivery. Our application runs in the EU (Frankfurt); static content may be delivered from servers close to you; it also provides anonymous page-view statistics (Vercel Web Analytics).

Neon

Database hosting in an EU region.

Google

Sign-in with Google and, if you connect it, Google Calendar sync (Google Ireland Limited for users in the EEA).

Stripe

Payments for advertiser top-ups (Stripe Payments Europe, Limited, Ireland). We never see full card details. Stripe also acts as an independent controller for its own legal duties, such as fraud prevention and anti-money-laundering checks.

Email provider

Sends sign-in links and reminders, through an email delivery service based in the EU (for example Brevo, France). The provider may change, but it is always bound by a data processing agreement.

We also disclose data where the law requires it, for example to courts or authorities, or where this is necessary to establish, exercise or defend legal claims. Advertisers only see aggregated numbers (views, clicks and costs), never who clicked.

When you open a product link, you leave Giftory. Purchases are made directly with the shop, which is responsible for its own processing of your data.

Some of our providers are based in the USA: Google may process AI requests there, fal.ai creates product illustrations there, and Vercel, Neon, Google and Stripe may access data from there, for example for support and maintenance. Such transfers are based on the EU–US Data Privacy Framework (opens in a new tab)↗ where the recipient is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses, with additional safeguards where needed.

You can ask us for more information or a copy of the relevant safeguards using the contact details below.

We keep personal data only as long as we need it for the purposes above. Many of these periods are enforced automatically by a daily clean-up job:

Your account and everything in it (people, dates, saved ideas, plans, searches, preferences)

Until you delete your account. Deletion removes this data immediately; backups are overwritten in the normal backup cycle.

Sign-in sessions (with IP address and browser)

Until you sign out, or at the latest 7 days after your last visit.

Gift searches made without an account

Deleted automatically after 30 days.

Daily usage counters

Deleted automatically after 31 days.

Dates you have deleted

Kept as a hidden deletion marker for 30 days (longer if the deletion has not yet reached your Google Calendar), then removed for good.

Clicks on shop links

Linked to your account until you delete it; afterwards kept for statistics without any link to you.

Views and clicks of sponsored listings

The keyed hash of your IP address is deleted after 7 days. The click records themselves, with a keyed network hash, are kept as the basis for advertiser billing; they are no longer linked to you once you delete your account.

Advertiser billing records (top-ups, charges, refunds, invoices)

As long as required by Lithuanian accounting law (generally 10 years), also after the advertiser account is closed; contact details are removed at closure.

Messages and requests you send us

As long as needed to deal with them, and afterwards only where we need them to establish or defend legal claims.

Hosting and server logs

For a short period, typically a few days, set by our hosting provider.

We only use cookies that are strictly necessary to provide the service you request. Under the Lithuanian Law on Electronic Communications, which implements the EU ePrivacy Directive, such cookies don’t require consent, which is why you won’t see a cookie banner here.

Session cookie

Keeps you signed in. Expires when you sign out or after 7 days without use.

Security cookies during sign-in

Protect the sign-in with Google against forgery. Deleted within minutes.

Language cookie

Remembers the language you chose.

Free-search cookie

Counts how many of the free searches without an account this browser has used. It holds only that number and a signature, nothing that identifies you. Expires after 400 days.

Unsent drafts in the gift finder and the plan builder are kept in your browser’s storage on your own device. So that you can carry on after signing in (sign-in links may open in a new tab), a copy is kept for at most 1 hour and deleted as soon as it has been used.

We don’t use tracking pixels or advertising cookies, and we don’t embed third-party content that sets cookies. We count page views with Vercel Web Analytics, which sets no cookies, stores no IP address and only produces aggregated statistics.

Shops can pay to have relevant products shown more prominently. These sponsored listings are always labelled “Sponsored” and are selected using only the details of your current search, never a profile of you. We don’t share personal data with advertisers and we never sell it.

When a sponsored listing is shown or clicked, we record this together with the search it belongs to, so that we can bill the advertiser and prevent fraud (see “How long we keep data”). Learn more in How ads work.

If you open an advertiser account for your shop, we also process:

• Company details: shop name, website, country, VAT number, contact email, description and logo.
• Products, campaigns and budgets, their review status and the reasons for any decision.
• Prepaid balance, top-ups, click charges, refunds and invoices. Payments are processed by Stripe; we receive the payment status, amount and a customer reference, but never full card details.

We use this data to run the advertiser account, review listings, bill clicks and meet our accounting and tax obligations. If you delete your account, the advertiser profile is closed and its contact details are removed, but billing records are kept for the period required by Lithuanian accounting law.

The AI creates suggestions automatically, and an automatic relevance check decides whether a sponsored listing fits your search. These steps help you find gifts; they have no legal effect on you and don’t affect you in a similarly significant way. Decisions about advertiser accounts and listings are made by a person.

We therefore don’t make decisions based solely on automated processing within the meaning of Art. 22 GDPR.

Under the GDPR you have the right to:

• access your data and receive a copy: use “Download my data” on your account page (Art. 15);
• rectification of incorrect data; you can edit most of it yourself (Art. 16);
• erasure: use “Delete my account” on your account page (Art. 17);
• restriction of processing (Art. 18);
• data portability: the export is a machine-readable JSON file (Art. 20);
• object at any time to processing based on our legitimate interests (Art. 21);
• withdraw your consent at any time, without affecting processing that took place before (Art. 7(3)).

To exercise your rights, simply contact us. We reply within one month and may first ask you to confirm your identity.

You also have the right to lodge a complaint with a supervisory authority. In Lithuania, this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt (opens in a new tab)↗). You can also contact the authority in the EU country where you live or work.

You must be at least 14 years old to create a Giftory account. This matches the age of digital consent in Lithuania.

Giftory is not directed at children. If you believe a child under 14 has created an account, please contact us and we will delete it.

We use appropriate technical and organisational measures, including:

• encrypted connections (TLS) everywhere and hosting in EU data centres;
• no passwords that could leak: you sign in with a one-time email link or with Google, and sign-in links are stored only as a hash;
• Google access tokens stored encrypted and revoked when you delete your account;
• IP addresses used for limits and fraud prevention stored only as keyed hashes;
• signed links and images, protection against cross-site attacks, strict access rights for administrators and an audit trail of admin actions;
• logs designed to leave out personal data and secrets.

No system is perfectly secure. If a data breach is likely to put your rights at risk, we will inform you and the supervisory authority as the GDPR requires.

We update this policy when our service or the law changes. The date at the top shows the current version. If a change significantly affects you, we will let signed-in users know in advance, for example by email or with a notice in the app.

Questions about privacy, or want to exercise your rights? Write to us; we’re happy to help.