Privacy policy

Who we are

Gioy is run by CML IT SRL, Str. Izvor nr. 20, Codlea, județul Brașov, România (CUI 37569243, J08/1168/2017). Contact: [email protected].

For the shop owners who install Gioy (merchants), we are the controller of their account and billing data. For the shoppers, gift recipients and wishlist users of a shop, the shop is the controller and Gioy processes their data on the shop’s behalf, under the shop’s instructions.

What we collect

Merchants: the shop’s name, domain, country, contact email, language and currency, the settings chosen in Gioy, and the plan and billing status (Shopify bills; we never see card details).

People who give a gift: the names and message they write, their email (for their copy of the gift link), the order reference and the products chosen.

Gift recipients: the name given by the sender, an email or phone number if the sender gave one to send the gift, and what happens on the gift page (opened, size chosen, checkout started, orders paid with the gift card), with a device type and a shortened IP address, kept as evidence for the shop.

Wishlists: the owner’s name and email, their customer account in the shop if they are logged in, the event and its date, the products on the list and the names of the friends who gave.

Gift ideas and message help: the text typed into the chat or the message helper.

Usage statistics for the shop: gift button clicks and gift orders, counted with a random number for the browser session, only where the visitor’s cookie choices allow it.

Copies of the shop’s orders that Shopify sends us (they may contain the customer’s contact details), kept for a short time to check payments.

Gift card codes are stored encrypted and are never written to logs or put in web addresses. Gift links are stored only as secure fingerprints (hashes) or encrypted.

For security and to stop abuse, we count requests per IP address and email, storing only a keyed fingerprint of them.

Why we use it

To provide Gioy: create and deliver gifts, gift cards, emails and wishlists (contract with the merchant).

To keep gifts and payments safe and prevent fraud and abuse (legitimate interest).

To bill merchants through Shopify and to meet legal and accounting duties (legal obligation).

We do not sell personal data and we do not use it for advertising.

Cookies and browser storage

Gioy uses only cookies needed for it to work: one that keeps a gift page open for the person who has its link (up to 180 days) or a wishlist editable for its owner (up to 120 days), and Shopify’s session for merchants in the Shopify admin. No advertising or tracking cookies, and no third-party scripts on gift pages. Our security provider may set a short-lived cookie to tell people from bots.

In the shop, Gioy keeps a few things in the visitor’s own browser so they are not lost: the gifts being prepared and the gift ideas chat (7 days), the email for the copy of the gift link (30 days) and the link to edit one’s wishlist. A “remove my data from this device” option clears them.

The random number used for usage statistics lasts for the browser session and is used only when the visitor’s cookie choices in the shop allow statistics.

Who we share it with

Shopify (the platform the shop runs on), DigitalOcean (our servers and database, in Frankfurt, Germany), Cloudflare (domain, security and protection against bots), Resend (sending the gift emails), and OpenAI (only when someone asks Gioy for gift ideas or help with a message: the text they typed, which may include a first name or a description of the person, and product details are sent, without email addresses).

Each of them processes data for us under a data processing agreement. Where data leaves the European Economic Area, it is protected by the European Commission’s standard contractual clauses or an adequacy decision.

How long we keep it

Wishlists are deleted 30 days after their event.

Gift records are kept while the shop uses Gioy, because gift cards stay valid and the shop needs the history for orders, returns and disputes. Checkouts started but never paid are deleted after 30 days.

Addresses and contents of emails we sent are removed after 90 days; the fact that an email was sent stays with the gift.

Copies of orders Shopify sends us are deleted after 30 days. Usage statistics are deleted after 13 months.

When a shop uninstalls Gioy, Shopify asks us to delete the shop’s data 48 hours later, and we delete it. We keep only a fingerprint of the shop’s address and the date of its free trial, so the trial is not given twice. When a shop asks us to erase a customer, we remove that person’s names, contact details, messages, device and network details from their gifts and delete their wishlists.

Request counts kept for security are deleted after two days. Backups of our database are kept by our hosting provider for up to 7 days.

Your rights

You can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. If you used Gioy in a shop, contact that shop first: it decides about your data and we help it answer. You can also write to us at [email protected].

You may complain to the Romanian data protection authority (ANSPDCP, dataprotection.ro) or the authority where you live.

Security

Data travels encrypted (HTTPS). Gift card codes and access keys are encrypted at rest, links are stored as hashes or encrypted, every shop’s data is kept apart from the others, and access is limited to what each part of Gioy needs.

Children

Gioy is not meant for children under 16, and we do not knowingly collect their data.

Changes

If we change this policy, we update the date at the top. Important changes are announced to merchants in the Gioy admin or by email.