This Privacy Policy explains how Gifty, 2261 Market St, San Francisco, CA 94114 ("Gifty", "we") handles personal information in Gifty for Shopify, an app that lets shoppers send a gift from a Shopify store without knowing the recipient's address. It covers merchants who install the app, givers who send gifts, and recipients who receive them.
1. Who is responsible for your data
For gift data about givers and recipients, the merchant whose store sells the item is the seller of record and the controller. Gifty acts as a processor (a "service provider" under the CCPA) on the merchant's instructions. For merchant account data, Gifty is the controller. If you are a giver or recipient and want to exercise a privacy right, you can contact us or the merchant. We will help either way.
2. Information we collect
From merchants:
- Shop domain and app settings.
- The Shopify session and access token that lets the app work with the store.
- Shop name and contact emails. After an uninstall we keep these only briefly, to send the notices described below.
From givers:
- Name and email address.
- Gift message.
- Billing address, only if the giver replaces the placeholder address at checkout.
From recipients:
- Name, and email address if the giver provides one.
- After the recipient claims the gift: full shipping address and phone number.
Payment card details are handled by Shopify at checkout. Gifty never sees them.
3. Where the information comes from
Most of it comes from Shopify, in the form of orders for gifts placed through the app. The rest is what givers and recipients type into Gifty pages.
4. How we use information
We use information to:
- Create the gift order and the recipient's link.
- Email the recipient their link, and email givers and merchants about the gift.
- Update the order with the recipient's real address and release the fulfillment hold.
- Refund tax differences, cancel unclaimed gifts and restock items.
- Calculate and bill our fee through Shopify Billing.
- Provide support, keep the service secure, and meet legal obligations.
We do not use personal information for advertising and we do not sell it.
5. Cookies
Gifty does not use advertising or analytics cookies on gift pages. We do not set tracking cookies of our own on storefront pages. Shopify may set cookies on the merchant's store and in the Shopify admin under its own policies.
6. How we share information
We share information only as needed to run the service:
- With the merchant, who needs the shipping address to fulfill the order.
- With our subprocessors: Google Cloud Platform (hosting and database, United States) and Resend (transactional email).
- With Shopify, which is the platform the app runs on.
- If required by law, or to protect rights and safety.
We do not sell personal information and we do not share it for cross-context behavioral advertising.
7. Retention
- Addresses on a gift are deleted 90 days after the gift ends, meaning it has shipped or has been refunded or cancelled.
- When a merchant uninstalls, Shopify sends us a shop redaction request 48 hours later, and we then delete all of that shop's data.
- After an uninstall we keep shop name and contact emails only briefly, to send the uninstall notices.
- Customer erasure requests received through Shopify's customers/redact webhook, or by email, are carried out as the law requires.
8. Uninstalls
Shopify revokes our access when the app is uninstalled, so we cannot refund or cancel orders afterwards and open gift links stop working. A day after the uninstall we email the givers, any recipients we emailed, and the merchant, who gets a list of held orders to release or refund. Reinstalling within that day cancels those emails.
9. Security
We use encryption in transit, access controls and hosting on Google Cloud Platform. No system is perfectly secure, but we work to protect your information and will notify affected merchants of a breach as the law requires.
10. Your rights
Depending on where you live, including under the GDPR, UK GDPR and the CCPA, you may have the right to access, correct, delete or port your personal information, to object to or restrict certain processing, and to not be discriminated against for exercising these rights. California residents may also ask what categories of information we collect and disclose.
11. How to exercise your rights
Email privacy@teamgifty.com. We answer access requests within 30 days. We may need to verify who you are, and for gift data we may refer you to the merchant who controls it. You can also complain to your local data protection authority.
12. Children
Gifty for Shopify is not directed at children under 16 and we do not knowingly collect their information. Contact us if you believe a child has given us information and we will delete it.
13. International transfers
Gifty is based in the United States and our subprocessors store data in the United States. If you are outside the United States, your information will be transferred there. Where required we rely on appropriate safeguards for those transfers.
14. Changes
We may update this policy. We will post the new version here with a new effective date, and for material changes we will notify merchants.
15. Contact
Privacy questions and requests: privacy@teamgifty.com. General support: contact@teamgifty.com. Gifty, 2261 Market St, San Francisco, CA 94114.