Privacy Policy

This policy explains what [Legal entity name] (“we”, the data controller) collects when you use Digigift, why, who we share it with, and your choices. It is written to meet India’s Digital Personal Data Protection Act 2023 and the EU/UK GDPR, and it describes your rights under the California CCPA/CPRA and similar laws.

What we collect and why

• Email address — for your receipt, your gift link and sign-in links. Legal basis: performing our contract with you.
• Gift content — names, message, photos, optional audio, cards and password. Treated as private by default and shown only to people who have the link (and password, if set). Legal basis: contract.
• Order records — amount, currency, status, payment reference and the time you accepted our terms. We never receive your card, UPI or bank details. Legal basis: contract and legal obligation (tax and accounting).
• Product events — anonymous funnel events (for example “preview opened”, “gift opened”) and a per-gift open count. No cookies, no recipient identity. Legal basis: legitimate interest in improving the service.
• Analytics cookies — Google Analytics, only if you click “Accept analytics”. Legal basis: consent, which you can withdraw by clearing site data.
• Technical data — error reports and server logs to keep the service working and secure. Legal basis: legitimate interest.

AI writing features

If you use an AI helper (drafting, rewriting, opening lines, timeline or theme suggestions), the text you provide for that request — for example your notes, the current message, the recipient’s and your name and the occasion — is sent to Anthropic, our AI provider, to generate the result. Photos are sent only if you tick the consent box on the timeline helper, and only up to six small thumbnails. We do not use your content to train models, and we keep only usage counts (not the text) for quota and cost tracking. Anthropic processes this data under its own terms as our processor.

Photos and audio

Photos are re-encoded and location/camera metadata (EXIF) is removed before storage. Photos and audio of password-protected gifts are only served after the correct password is entered.

Who we share data with (processors)

Only providers that help us run the service: hosting, database, file storage, email delivery, payment processing (Razorpay for India, Stripe elsewhere), AI (Anthropic), error monitoring (Sentry) and, with consent, analytics (Google). We do not sell or “share” personal data for cross-context advertising and do not use gift content for advertising.

International transfers

Our providers may process data outside your country, including in India, the EU/UK and the United States. Where required, transfers rely on adequacy decisions or standard contractual clauses with those providers.

How long we keep it

Gifts, photos and audio are kept until you delete them; deleting a gift removes its content and disables its link. Order records are kept as long as tax and accounting law require. Unpaid drafts may be deleted after a period of inactivity.

Your rights

Depending on where you live you can: access your data, correct it, delete it, restrict or object to processing, receive a portable copy, withdraw consent, and complain to your data-protection authority (in the EU/UK, your national regulator; in India, the Data Protection Board). California residents can also request to know, delete or correct their data and opt out of sale/sharing — we do neither. Delete gifts or your whole account from your dashboard, or email hello@digigift.ganeshmurali.dev. We respond within 30 days and will not discriminate against you for exercising your rights.

Security

Gift links are random and unlisted; access to your account is by one-time email link; uploads are validated; payment confirmations are cryptographically verified; passwords are stored only as salted hashes. No system is perfectly secure; where the law requires, we will notify affected users and regulators of a breach.

Children

The service is intended for adults. We do not knowingly collect data from children under 18 (or the applicable age of digital consent) without verifiable parental consent.

Contact and grievance officer

[Grievance officer name], [Legal entity name], [Registered address] — hello@digigift.ganeshmurali.dev. EU/UK representative: [to be appointed if required].