Privacy notice

GiftLoop is provided by Zizwe IT Limited, a company registered in England and Wales (company number 16803891). We are the controller of the personal data described in this notice and we are registered with the Information Commissioner’s Office (ICO).

You can contact us about anything in this notice at support@zizweit.uk.

Information you give us

• Account details: your email address, which you use to sign in with a one-time code or link (we never ask for a password), and the display name you choose for each exchange.
• Exchange details (organisers): the exchange name, occasion, budget, draw date, gift day and any “should not draw each other” exclusions.
• Your preferences: your answers to the six-question taste quiz and any wishlist items you add (up to 10).
• Messages and cards: anonymous chat messages you send to your giftee or your Secret Santa, the reveal card you write, and whether you have marked your gift as bought.
• Reports: if you report a message, we record the report and the message it relates to.

Information collected automatically

• Sign-in session: a secure cookie that keeps you signed in (see section 7).
• IP address: used briefly, and only in memory, to limit repeated sign-in attempts and protect the service from abuse. We do not store it against your account.
• Technical logs: our hosting provider keeps short-lived server logs (such as request times, IP addresses and error details) for security and reliability.
• Notification subscription: if you choose to turn on push notifications, the address your browser gives us for sending them.
• Anonymous shop click counts: when you use a shop button on a gift idea we record the shop, the gift category, the price band and the search words. This record contains nothing that identifies you, your exchange or your giftee.

We do not ask for and do not want special category data (such as health information). Please do not include it in wishlists, chat or cards.

UK data protection law requires us to have a lawful basis for each use of your data. Ours are:

• To provide GiftLoop (contract): creating your account and signing you in, running exchanges you create or join, carrying out the draw, showing your giftee’s quiz answers and wishlist to you, delivering chat messages and cards, and sending the emails the service depends on (sign-in codes, draw results, reminders, changes to the gift day, cancellations and the reveal).
• To keep GiftLoop safe (legitimate interests): rate limiting, preventing fraud and misuse, investigating reported messages and keeping technical logs. Our interest is a secure, respectful service for everyone using it.
• To improve GiftLoop (legitimate interests): using the anonymous shop click counts to understand which kinds of gift ideas are useful. This uses no personal data.
• Push notifications (consent): only if you allow them in your browser. You can withdraw consent at any time in your browser or device settings.
• Legal obligations: where we must keep or disclose information to comply with the law.

We do not use your data for advertising, we do not build marketing profiles, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The draw is random within the exclusions your organiser sets.

Keeping the draw secret is central to GiftLoop. Before the reveal:

• Nobody, including the organiser, can see who drew whom.
• You see only your own giftee’s name, quiz answers and wishlist. Your giftee does not learn who you are.
• In chat, your identity is hidden: you appear as “Your Secret Santa”. Messages are visible only to the two people in that conversation.
• The organiser can see the names of people who have joined and whether each has finished the quiz or marked their gift bought, so they can send reminders.

When the organiser reveals the exchange (or automatically the day after gift day), everyone in that exchange can see who gave to whom and the cards that were written. Please write cards and messages with that in mind.

If a message is reported, our team may review the reported message and the conversation it belongs to so we can deal with the report.

GiftLoop suggests gift ideas within the exchange budget. To do this we may send your giftee’s quiz answers, their wishlist text and the budget to an AI service provider, Anthropic. We never send names, email addresses, exchange details or any identifiers. Anthropic processes this information on our behalf to return suggestions and does not use it to train its models. If the AI service is unavailable, ideas come from our own curated list instead.

Gift ideas include buttons that search UK retailers such as Amazon, Argos or Currys. Some of these are affiliate links: if you buy something after following one, Zizwe IT may earn a small commission from the retailer, at no extra cost to you. Our affiliate partners include the Amazon Associates programme and the Awin network.

When you follow a shop button, you leave GiftLoop. The retailer and the affiliate network may set their own cookies and collect information under their own privacy policies, which we do not control. We do not pass your name, email address or any exchange information to them.

GiftLoop uses only what it needs to work. We use no advertising, analytics or social media cookies.

• Sign-in cookies (strictly necessary): keep you securely signed in. Without them you would have to sign in on every page.
• Device storage (strictly necessary): small settings saved in your browser, for example to remember that you have already seen the launch screen or the install prompt.
• Offline support: if you install GiftLoop on your phone, your browser stores the app’s files so it opens quickly and can show an offline screen.

Because these are strictly necessary for the service you have asked for, they do not require consent under the Privacy and Electronic Communications Regulations. You can clear them at any time in your browser settings, though you will then be signed out.

We share personal data only with service providers that help us run GiftLoop. They act on our instructions under written contracts that require them to protect your data and use it only to provide their services to us.

• Supabase – database and sign-in.
• Vercel – website hosting (our servers run in the European Union).
• Resend – sending sign-in and service emails.
• Anthropic – generating gift ideas from non-identifying quiz answers and wishlist text.
• Browser push services (such as those run by Apple, Google and Mozilla) – delivering notifications, only if you turn them on.

Within an exchange, other participants see your display name and, after the reveal, your card and who you gave to. We may also disclose information if required by law, to protect the safety of any person, or as part of a sale or reorganisation of our business (in which case this notice would continue to apply).

We do not sell or rent your personal data to anyone.

We aim to keep your data in the UK and European Economic Area. Some of our providers are based in, or may access data from, the United States. Where personal data is transferred outside the UK, we make sure it is protected by an approved safeguard, such as the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”) or the ICO’s International Data Transfer Addendum to the EU Standard Contractual Clauses.

• Exchanges and everything in them (participants, quiz answers, wishlists, the draw, chat messages, reports and cards) are deleted automatically 90 days after the gift day, or straight away if the organiser cancels the exchange.
• Your account (email address and profile) is kept while you use GiftLoop so you can sign back in and join future exchanges. You can ask us to delete it at any time.
• Push notification subscriptions are kept until you turn notifications off or the subscription expires.
• Hosting logs are kept for a short period by our hosting provider, then deleted.
• Shop click counts contain no personal data and may be kept as statistics.

We protect your data with measures appropriate to the risk, including encryption in transit (HTTPS), password-free sign-in with single-use codes, database access rules that restrict each person to the data they are allowed to see, server-side checks on every action, rate limits against abuse, and limited, logged access for our own team. No online service can be completely secure, but if a data breach affecting you occurs we will tell you and the ICO where the law requires it.

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you (access);
• ask us to correct data that is inaccurate or incomplete (rectification);
• ask us to delete your data (erasure);
• ask us to limit how we use your data (restriction);
• object to our use of your data where we rely on legitimate interests;
• receive data you gave us in a portable format (portability); and
• withdraw consent at any time, where we rely on consent.

To use any of these rights, email support@zizweit.uk from the address you use to sign in. We will respond within one month and there is normally no charge. We may need to confirm your identity first. Deleting your account removes you from any exchange that has not yet been drawn; if an exchange has already been drawn, we will explain how removal would affect the other participants.

GiftLoop is intended for people aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has given us their information, please contact us and we will delete it.

We may update this notice from time to time, for example when we add new features. The date at the top shows when it last changed. If we make significant changes we will tell you by email or in the app before they take effect.

If you have a question or concern about how we handle your data, please contact us first at support@zizweit.uk and we will do our best to help.

You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator, at ico.org.uk/make-a-complaint or by phone on 0303 123 1113.

See also our Terms of use.