Privacy policy

Last updated: 23 October 2026

Data controller

The controller of your personal data is:

  • Name: Juan José Díaz Rodríguez (NIF 74733599K)
  • Address: Calle Julio Romero de Torres 17, 18194 Churriana de la Vega (Granada), España
  • Email: privacy@giftmethis.app

This policy explains what data we process in GiftMeThis (the mobile app and the giftmethis.app website), what for, for how long, and what rights you have. We comply with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

What data we process

It depends on how you use GiftMeThis.

Parents (people with an account in the app):

  • Email address, display name and language. Sign-in is handled by Firebase Authentication (by Google), with email and password, Google or Apple; we never see your password.
  • Children are added with a nickname and a predefined avatar only. We do not ask for or store photos, surnames, full dates of birth or any other identifying data about minors.
  • Events (name, date and status), gifts (name, notes, priority, approximate price, purchase link and image) and the links used to share each list.
  • Technical app data: crash reports (Firebase Crashlytics), which include the device model, the system and app versions, the Firebase installation identifier and the error trace.

Relatives and friends (people who open a list with a link):

  • They do not need an account. When you reserve a gift, the reservation is stored without a name.
  • The email is optional and only used to send you the link to manage your reservation and to recover your reservations. We process it because you ask to receive that link (Art. 6(1)(b) GDPR, at your request). It is stored encrypted and never shown to the parents: parents cannot tell who reserved what.
  • The reservation management link is stored on your device (local storage of the browser or of the app).
  • When you press a purchase button, the click is counted anonymously, without identifying you.

Support and reports:

  • If you write through the support form (web or app) we process your email, the subject, the message and any screenshots you attach.
  • If you report a list or a gift, we process the reason and the comment you write.

Operational data: our servers keep technical logs (the IP address, date, path and response code of each request) to ensure security, prevent abuse and rate-limit requests (legitimate interest, Art. 6(1)(f) GDPR). We apply measures to avoid recording private links and email addresses in technical logs, and no personal data is stored in metrics.

What we use the data for and the legal basis

  • Creating and maintaining your account, events and lists, and letting your family see them and reserve gifts: performance of the contract, that is, the Terms of use you accept when you sign up or use the service (Art. 6(1)(b) GDPR).
  • Sending you service emails (reservation confirmations, management links, reservation recovery, important notices about your account): performance of the contract (Art. 6(1)(b) GDPR).
  • Answering your support queries and requests to exercise your rights: performance of the contract for users, and legitimate interest in answering anyone who writes to us (Art. 6(1)(b) and 6(1)(f) GDPR).
  • Keeping the service secure, preventing abuse and fraud, and moderating reported content (hiding a gift, suspending an event or blocking an account): legitimate interest in keeping the service safe for families (Art. 6(1)(f) GDPR).
  • Detecting and fixing app failures and counting clicks on purchase links anonymously: legitimate interest in improving the service (Art. 6(1)(f) GDPR).
  • Normalising purchase links and, where applicable, adding the GiftMeThis affiliate ID: performance of the contract and the consent the parent gives when saving the gift, as explained in the Terms of use.

We do not use your data for advertising, we do not sell it, and we do not make automated decisions that significantly affect you.

Who else processes the data (processors)

To provide the service we use providers that process data on our behalf, under a data processing agreement:

  • Google (Firebase Authentication, Firebase Crashlytics and Google Cloud Identity Platform): account sign-in and app crash reports.
  • Mailjet: sending the service emails (for example reservation management links and support replies).
  • Hetzner: hosting of the API server and the database, where accounts, events, gifts, reservations, tickets and images are stored.
  • IONOS: hosting of the public website server and of the admin panel.
  • Cloudflare: DNS only (resolution of the domain name) and routing of emails received at support@giftmethis.app. No app or website traffic goes through its delivery network.
  • Amazon Web Services (AWS S3): storage of the encrypted backups of the database and of the images.

Only authorised staff of the owner access the admin panel, with two-factor authentication. Apart from these providers, we only disclose data when the law requires us to.

International transfers

Hetzner and IONOS provide their services from the European Union. Google and Amazon Web Services (a US company that keeps copies of the data in the EU) may process data in the United States and other countries. Those transfers rely on the European Commission adequacy decision on the EU-US Data Privacy Framework, to which Google and Amazon Web Services are certified, and, additionally, on the European Commission standard contractual clauses.

You can ask us for more information about the safeguards that apply by writing to privacy@giftmethis.app.

Links to stores and other sites

Gifts may carry a purchase link to Amazon or other stores. The link goes straight to the store, without passing through any server of ours. When you leave GiftMeThis, the store processes your data under its own privacy and cookie policies, which we recommend you read.

Some purchase links are affiliate links (see the Affiliate disclosure): the price for you does not change and GiftMeThis may earn a commission from the store. To that end, the API may clean the link and add the GiftMeThis affiliate ID to it.

How long we keep the data

Relative email deleted and reservations anonymised 30 days after the event is archived (or after its date). Archived events deleted after 24 months. Deleted account: full purge after 30 days.

  • While your account is active we keep your account data, events and gifts. An event is archived automatically the day after its date.
  • If you delete your account, it stays pending deletion for 30 days, during which you can restore it by signing up again with the same email. After that period, the children, events, gifts, images, links and reservations of your events are purged, and support tickets are anonymised.
  • Tickets sent through the web form: 30 days after the last update.
  • Server technical logs: up to 30 days. Rate-limit counters: deleted on expiry, within a few hours at most. App crash reports (Crashlytics): 90 days.
  • Backups: data you delete may remain in the encrypted database backups for up to 7 days at most. Those backups are not restored except in a disaster and, if restored, deletions are applied again.
  • If the law requires us to keep some data for longer (for example to handle possible claims), we block it and keep it only for that period.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time by writing to privacy@giftmethis.app from the email you use for the service, and we will reply within one month at most. To delete your account, follow the procedure described on the Delete my account page.

If we process your data on the basis of legitimate interest, you can object to that processing on grounds relating to your particular situation. If you have given consent, you can withdraw it at any time without affecting what was done before.

If you believe we have not processed your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

Cookies and local storage

GiftMeThis only uses technical storage that is essential for it to work (for example saving on your device the management link of a reservation). We do not use third-party cookies, analytics or advertising tools, so we do not show a cookie banner.

Minors

A GiftMeThis account belongs to an adult: minors cannot register. Lists are dedicated to children, but we do not collect identifying data about them: only a nickname and a predefined avatar chosen by the adult, with no photos. If you believe a minor has registered on their own, write to support@giftmethis.app and we will delete the account.

Security and changes to this policy

We apply appropriate technical and organisational measures: encrypted communications, relatives’ emails stored encrypted, unguessable private links, a strict separation between what parents see and the reservations, and restricted, two-factor access to the admin panel.

We may update this policy, for example if providers or regulations change. We will show the date of the last update above and, if the change is significant, we will notify you in the app or by email.