Privacy Policy - Giftycle

Who we are (Controller)

Controller: Giftycle.

Address: Wybrzeże Stanisława Wyspiańskiego 11, 50-370 Wrocław, Poland

What this policy covers

This policy explains how we collect, use, and share personal data when you use Giftycle (the “Service”). If you do not agree with this policy, please do not use the Service.

Personal data we process

Account data: email, display name, password hash, settings.
Content: gift lists, notes, attachments you upload.
Usage & logs: device/browser info, IP, timestamps, pages and actions for security and analytics.
Payments (if applicable): limited billing info and transaction IDs from our payment processor; we do not store full card numbers.
Affiliate interactions: when you click a recommendation link, the click may be tracked by our affiliate partners.
Cookies & similar tech: necessary cookies for sign-in and preferences; with consent, analytics and affiliate cookies.

Why we use your data (legal bases)

Provide the Service and core features (Performance of a contract).
Security, fraud prevention, diagnostics (Legitimate interests; legal obligations).
Analytics to improve the Service (Consent where required; Legitimate interests otherwise).
Communications about your account, updates, and service messages (Legitimate interests/contract).
Billing and compliance (Legal obligations; contract).
Affiliate recommendations and disclosures (Legitimate interests; Consent for cookies where required).

Cookies and tracking

We use necessary cookies to run the Service. With your consent (in the EEA/UK), we use analytics and affiliate cookies. You can change preferences anytime via the “Cookie Settings” link in the footer. See our separate Cookie Policy if provided.

Sharing your data

We share data only with service providers that help us operate the Service, for example:

Hosting & infrastructure (e.g., cloud hosting, CDN, storage).
Email delivery (transactional support emails).
Analytics (usage metrics, error tracking).
Payments (billing and fraud screening).
Affiliate platforms (to track clicks and qualify commissions).
Professional services (legal/accounting) when necessary.

We require processors to protect personal data and act only on our instructions.

International data transfers

Some providers may be located outside your country (including outside the EEA). Where required, we use the European Commission’s Standard Contractual Clauses and complementary measures for such transfers.

Data retention

Account data: retained for your account lifetime.
Content: retained until you delete it or your account.
Logs/analytics: typically 12–24 months; backups may persist for additional limited periods.
Billing records: retained as required by tax/accounting laws.

Your rights

Subject to law, you may request: access, rectification, erasure, restriction, objection, and data portability. You may withdraw consent at any time where processing is based on consent.

How to submit a request: email [email protected]. We may need to verify your identity. We aim to respond within 30 days.

You also have the right to lodge a complaint with your local supervisory authority (e.g., in Poland, UODO).

Children

The Service is not directed to individuals under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, contact us to delete it.

Security

We use reasonable technical and organizational measures (encryption in transit/at rest where appropriate, access controls, monitoring). However, no system is completely secure.

Changes

We may update this policy. If we make material changes, we will provide reasonable notice (e.g., via email or in‑app notice) before they take effect.