Privacy & Data Policy

You don't need an account to create a GiftFeels gift. We don't sell your data. We don't post your gifts publicly. Short summary of what's below:

• No signup required to create a gift — so for most visitors we don't know who you are.
• Gifts are private by default. They're accessible only through a unique, unguessable link you choose to share.
• We never sell or rent personal data.
• You have rights to access, correct, delete, or port your data — anywhere in the world.
• Questions or requests? Email info@giftfeels.in.

"GiftFeels" ("we", "us", "our") operates the website giftfeels.in and related digital gift products (including the "Memoryverse", "Will You Be My Valentine?", and "Love Letter" templates). We are the data controller for personal data processed through the service, unless this policy says otherwise.

For data protection queries, contact us at info@giftfeels.in.

We try to collect as little as possible. Here's everything we might process, grouped by category:

We do not knowingly collect: biometric data, government IDs, precise GPS location, or special-category data (health, religion, sexuality, political views) unless you voluntarily put it in your own gift content.

We use the data above to:

• Provide the service — render your gift, host your uploaded photos, generate the private link.
• Keep it secure — detect abuse, prevent spam, block malicious uploads, and investigate incidents.
• Improve the product — understand which templates are popular, where users drop off, and what to build next. This uses aggregated, de-identified data wherever possible.
• Process payments — if you buy a paid feature, we pass the necessary data to our payment processor.
• Respond to you — answer support emails, handle legal requests, send transactional notices.
• Comply with the law — tax records, fraud prevention, responding to lawful requests.

We do not use your gift content or uploaded photos to train machine-learning models, and we do not use them for advertising or promotional purposes.

If you are in the EU, UK, EEA, or Switzerland, we process personal data on these legal bases under Article 6 of the GDPR:

• Contract performance — to deliver the gift creation service you requested.
• Legitimate interests — to keep the service secure, prevent fraud, improve the product, and run aggregate analytics. We balance these interests against your rights.
• Consent — for non-essential cookies and for optional marketing emails. You can withdraw consent at any time.
• Legal obligation — to comply with accounting, tax, and fraud-prevention laws.

We never sell personal data. We only share it with a small number of vendors that help us operate the service. Each one is bound by a written data-processing agreement and is required to use your data only for the purpose we asked them to.

• Hosting & infrastructure — cloud providers that store gift content and run our servers.
• Analytics — privacy-respecting analytics to understand aggregate usage.
• Payment processors — to handle paid features. They receive only what's needed to complete the transaction.
• Transactional email — to send you order confirmations or support replies.
• Law enforcement / courts — when we receive a valid legal request. We resist overly-broad requests where possible.

Every gift you create gets a unique, unguessable URL. Anyone with that URL can open the gift. We treat the link itself as a "password": if someone shares or leaks the link, they may view the gift — so only share it with people you trust.

Your gifts are not indexed by search engines and are not listed in any public directory on our site. However, please do not include sensitive personal data in a gift (such as IDs, financial details, or third-party private information without their consent).

You can request deletion of any gift you created by emailing info@giftfeels.in with the gift URL.

We only keep personal data as long as we have a clear reason to:

• Gift content — kept as long as the gift is live, so the recipient can open it. If you delete a gift, we remove it from active storage within 30 days. Backups are rotated out within a further 90 days.
• Support correspondence — up to 3 years after the last contact.
• Billing records — up to 7 years, as required by tax and accounting law.
• Server logs — up to 90 days for security and debugging.

We use industry-standard safeguards, including TLS encryption in transit, encryption at rest for stored files, access control with the principle of least privilege, security monitoring, and periodic review of our vendor list.

No system is ever 100% secure. If we ever experience a breach that affects your personal data, we'll notify you and the appropriate regulator within the timelines required by law (for example, 72 hours under GDPR).

GiftFeels is available worldwide and our infrastructure may process data outside your country of residence. When we transfer personal data out of the EU/EEA, UK, or Switzerland, we rely on mechanisms recognized by law — including the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the UK IDTA addendum.

Depending on where you live, you have some or all of the following rights over your personal data:

• Access — get a copy of the data we hold about you.
• Correction — fix inaccurate or incomplete data.
• Deletion ("right to be forgotten") — ask us to erase your data, subject to legal retention obligations.
• Restriction — ask us to pause processing while we investigate a dispute.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests, including profiling.
• Withdraw consent — where we rely on your consent, you can withdraw it at any time.
• Lodge a complaint — with a supervisory authority in your country.

To exercise any of these, email info@giftfeels.in. We'll verify your identity and respond within 30 days (or sooner where required by law).

If you're a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know what personal information we collect.
• Right to delete personal information we hold about you.
• Right to correct inaccurate personal information.
• Right to opt out of the "sale" or "sharing" of personal information (we don't sell, but you can still exercise this right).
• Right to limit use of sensitive personal information.
• Right to non-discrimination for exercising these rights.

To exercise them, email info@giftfeels.in with the subject line "California Privacy Rights".

If you're in India, you have rights under the Digital Personal Data Protection Act, 2023 ("DPDP Act") including:

• Right to access a summary of personal data processed.
• Right to correction and erasure.
• Right to grievance redressal.
• Right to nominate another person to exercise rights.

To exercise these, email info@giftfeels.in. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.

GiftFeels is not directed at and not intended for use by children under 13 years of age (or the minimum digital consent age in your country — e.g. 16 in some EU countries). If you believe a child has provided us with personal data, email info@giftfeels.in and we'll delete it promptly.

We may update this policy to reflect new features, legal requirements, or infrastructure changes. When we do, we'll update the "Last updated" date at the top of this page. For material changes that affect your rights, we'll make a reasonable effort to notify you (for example, a banner on the site or an email to known contacts).