Policies · Updated 8 October 2026
Privacy Policy
DRAFT FOR LEGAL REVIEW: this document is a working draft and has not yet been reviewed by counsel. Bracketed items will be completed before launch.
Data we collect
- Order details: your email; optionally your name; the recipient's name; gift message and dedication; occasion and design choices.
- Recipient email (optional): if you choose to have us email the gift, the recipient's address and delivery date. We use it only to deliver that gift and never add it to marketing lists.
- Marketing consent (optional): if you tick the box or sign up for reminders, we store your email, where you signed up and when. Every marketing email has a one-click unsubscribe link.
- Payment: handled entirely by Stripe. We never see or store full card numbers. We receive a payment confirmation and a reference ID.
- Technical data: IP address (used briefly for rate limiting and fraud prevention) and basic server logs.
How we use it
To produce and deliver your order, send delivery and support emails, show your registry page if you enable it, prevent fraud, and meet legal and accounting obligations. We do not sell personal data. We don't send marketing email unless you opt in.
Processors
Stripe (payments), [EMAIL PROVIDER, e.g. Resend] (transactional email), [HOSTING / STORAGE PROVIDER] (hosting and file storage). Each processes data only on our instructions.
Retention
Order records are kept for [7] years for tax and accounting purposes. Generated files are kept for [24] months so you can download them again, then deleted. You can ask for earlier deletion of your files and registry page at any time.
Your rights
Depending on where you live (for example under the GDPR or CCPA), you may have the right to access, correct, delete or export your data, and to object to certain processing. Email [PRIVACY EMAIL]. You may also complain to your local data protection authority.
Cookies
We use only essential storage (for example, to remember a draft of your gift on your own device). No advertising cookies are set. If analytics are added, we'll ask for consent where the law requires it.