Privacy Policy
Last updated: 8 November 2026 · Version 1.0
1. Who is responsible
The controller of your personal data is Gifticker, tax ID 47907182E, address Passeig dels Arbres 26 bis, 1r 2a, Corbera de Llobregat (Barcelona). Contact: gifticker@gmail.com.
This policy covers the Gifticker website (www.gifticker.com) and the Gifticker mobile app.
2. What data we collect
- Website: the email address you enter in the “Notify me” form, your language, and the date you accepted the consent.
- Account: email, password (stored hashed), name, username, role, and the sign-in provider used (email, Google or Apple).
- Profile (optional): birth date, gender, phone number, avatar photo, height, weight, style preferences, sizes, preferred brands, currency and language.
- Content you create: wishlists and items, connections with other users, events, participants and manual payment records, and in-app notifications.
- Technical data: session tokens stored on your device and, on our servers, your IP address in standard server logs.
3. Why we use it and legal basis
We do not use your data for advertising and we do not sell it.
- To create and run your account and provide the service (contract performance).
- To send you the launch notice if you joined the waiting list (your consent).
- To send verification codes and service emails such as birthday reminders and connection requests; reminders are only sent if you enable email notifications (contract performance / your consent).
- To keep the service secure and prevent abuse, e.g. rate limiting (legitimate interest).
- To comply with legal obligations.
4. Who we share data with
Your wishlists and profile details are visible to the other Gifticker users you connect with, according to the app settings.
We rely on the following providers, who process data on our behalf:
- Google (Firebase Authentication) — sign-in with Google and Apple.
- Cloudflare (R2) — storage of avatar images. Avatar URLs are public to anyone who knows the link.
- Email delivery provider: Brevo (Sendinblue SAS, France) — verification and notification emails.
- Hosting provider: Hetzner Online GmbH, data centre in Helsinki (Finland, European Union).
5. International transfers
Hetzner (Finland) and Brevo (France) process data within the European Union. Google (Firebase Authentication) and Cloudflare may process data in the United States; in that case the transfer relies on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
6. How long we keep it
Account data is kept while your account is active and deleted within 30 days after you delete it, except what we must keep by law (blocked and kept only for legal claims). Backups are overwritten within 90 days. Waiting list emails are kept until we send the launch notice and, at most, 12 months after launch, or until you ask us to remove them.
7. Your rights
You can request access, rectification, erasure, restriction, portability and objection, and withdraw consent at any time, by writing to gifticker@gmail.com. You can unsubscribe from the waiting list the same way.
You may also lodge a complaint with your data protection authority (in Spain, the Agencia Española de Protección de Datos, aepd.es; in Catalonia, the Autoritat Catalana de Protecció de Dades, apdcat.cat).
9. Minors
Gifticker is not intended for children under 14 (or the minimum age in your country). If you believe a minor has registered, contact us and we will delete the account.
10. Security
We apply technical and organisational measures to protect your data, including hashed passwords and encrypted connections. No system is completely secure.
11. Changes to this policy
We may update this policy. The date at the top shows the latest version.