Privacy Policy

This policy explains what personal data Gift Ideas AI (giftideasai.com) processes, why we process it, who helps us run the service, and how you can delete your account. It applies to the website, the gift finder, and the signed-in gift planning app.

Who is responsible

Gift Ideas AI is operated by FV Ventures UG (haftungsbeschränkt), Berlin, Germany. We are the controller for the personal data described here. You can reach us using the contact details at the end of this page.

Data we process

Your account

Profile: email address, first and last name, and the profile picture you upload (optional).
Sign-in: if you sign in with an email link, we store a short-lived verification token. If you sign in with Google, we receive your name, email address, profile picture, and Google account ID from Google, and we store the sign-in tokens Google issues for your account.
Sessions: a session record for each signed-in browser, including the IP address and browser user agent at sign-in.
Account status: your role (for example admin) and whether an account has been suspended.

Information you add about other people

Gift planning means storing information about the people you buy for. Depending on what you enter, this includes:

People: names, email addresses, relationship to you, birthday (day and month), notes, and photos.
Occasions: dates such as birthdays, anniversaries, and holidays, whether they repeat, and notes.
Wishlists and gifts: gift ideas, product links and images, prices, voucher details (merchant, code, amount, expiry), uploaded files such as vouchers and receipts, reservations, co-givers, and gifts you received.
Setup answers: the country of your gift space and the choices you make during setup.

Please only add what the people involved would reasonably expect you to keep for gift planning, and keep sensitive details (for example about health) out of notes.

Gift spaces, members, and invitations

A gift space is a shared planning area. We store its name, icon, and country, its members and their roles, and invitations (the invited email address, role, the person who invited them, status, and expiry date). When you invite someone, we email them on your behalf. When they accept or decline, we email the person who invited them.

Members of a gift space can see the people, occasions, and lists shared with that gift space. Lists you keep private are visible only to you.

Gift finder

When you use the AI gift finder, we send the answers from the form (gender, age range, relationship, price range, gift type, occasion, and interests) to the Google Gemini API to generate suggestions. We do not send your name, email address, or account details. To show matching products, we search Amazon for the suggested gift titles, either through our own product search service or through the Amazon Product Advertising API. Only the gift titles are used for that search.

Emails

We send transactional emails only: sign-in links, a welcome email, gift space invitations and responses, and account deletion confirmations. We do not send marketing newsletters.

Usage analytics

We use Rybbit, an analytics tool we host ourselves, to understand how the site and app are used. It records page views and interactions (for example which buttons are clicked) together with details such as the referring page, browser, operating system, device type, and an approximate location derived from your IP address. When you are signed in, we link these events to your account ID, name, and email address. We do not use third-party advertising or cross-site tracking tools.

Technical logs

Our servers and Cloudflare process IP addresses and request details to deliver pages and protect the service. Application logs record errors and request metadata, including account and gift space IDs, to help us fix problems.

Cookies and similar technologies

We only use cookies that are needed to run the service:

Session cookies set by our sign-in system (for example better-auth.session_token, plus a short-lived signed session cache) keep you signed in. On HTTPS their names may start with __Secure-.
Sign-in cookies hold temporary state while you sign in with Google.
Language cookie (NEXT_LOCALE) remembers which language version of the site you use.

We do not set advertising cookies. When you follow an affiliate link to amazon.com, Amazon sets its own cookies on its website under its own privacy notice.

Service providers and infrastructure

We use these providers to run Gift Ideas AI. They process personal data on our behalf or, where noted, as independent controllers.

Hetzner Online GmbH (Germany): servers in Germany that run our application, database, analytics, and product search service. We manage them with Coolify, which we host ourselves.
Cloudflare, Inc.: DNS, content delivery, and the tunnel that connects visitors to our servers, so all traffic passes through Cloudflare. Cloudflare R2 stores uploaded files (profile pictures, gift space icons, photos of people, and gift attachments).
Google: Sign in with Google, if you choose it, and the Gemini API for gift finder suggestions (only the form answers listed above).
Plunk: delivery of transactional emails. Plunk receives the recipient email address, name, and email content.
Amazon (Amazon Associates program): product links to amazon.com include our affiliate tag, so Amazon can tell that you came from Gift Ideas AI. Amazon also receives gift titles when we look up matching products.

Uploaded files are stored under long, random links. Anyone who has the exact link can open the file, so avoid uploading highly sensitive documents.

Some of these providers are based in the United States. Where data leaves the EU/EEA, transfers rely on the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

Admin access and support

The operator's administrators can see a directory of accounts (names, email addresses, roles, number of gift spaces, last sign-in) and a list of gift spaces. For support, security, or abuse investigations, an administrator can temporarily sign in as a user ("impersonation"). Impersonation sessions are time-limited and recorded with the administrator who started them. Administrators can also suspend accounts that break our terms. We only use this access when it is needed for these purposes.

Legal bases

Contract (Art. 6(1)(b) GDPR): creating your account, signing you in, storing your gift plans, running gift spaces and invitations, and sending the related emails.
Legitimate interests (Art. 6(1)(f) GDPR): keeping the service secure and preventing abuse, support through admin access, self-hosted usage analytics to improve the product, and affiliate links. Storing information about the people you plan gifts for is based on your and our legitimate interest in gift planning.
Legal obligations (Art. 6(1)(c) GDPR): where we must keep or disclose data by law.

How long we keep data

Account and gift planning data: for as long as your account exists. It is deleted when you delete your account or remove the individual items.
Sessions: a session expires after 7 days without use.
Sign-in and confirmation links: email sign-in links expire after a few minutes, account deletion links after 1 hour, and gift space invitations after 48 hours.
Analytics, logs, and backups: kept only as long as needed for their purpose and then deleted or overwritten.

Deleting your account

You can delete your account yourself under Account → Delete account. We email you a confirmation link that is valid for 1 hour. Open it in the browser where you are signed in to finish the deletion.

If you own a gift space that still has other members, transfer ownership (Gift space → Members) or remove the other members first.

When your account is deleted, we remove:

your profile, profile picture, sign-in methods, and sessions,
gift spaces where you are the only member, with everything in them, including uploaded files,
in gift spaces you share with others: your private lists, received gifts, reminders, the files attached to them, and your membership,
invitations you sent.

People, occasions, lists shared with the whole space, and gift ideas on those lists that you added to a gift space you share with others move to that space's owner, because the other members rely on them. Everything that moves was already visible to the whole space.

Some data stays after deletion: the shared content that moved to a space owner, content other members created in shared gift spaces (including entries they made about you), shared gift plans you coordinated (without your name), analytics events, logs, and backups until they expire. If you want any of this removed, contact us.

Your rights

Under the GDPR you have the right to:

access your data and get a copy of it,
correct inaccurate data,
have your data deleted,
restrict processing,
receive your data in a portable format,
object to processing based on legitimate interests,
withdraw consent where processing is based on consent.

You can also lodge a complaint with a data protection supervisory authority, for example the one where you live or the one responsible for us in Berlin.

Children

Gift Ideas AI is not intended for children under 16, and we do not knowingly create accounts for them.

Changes to this policy

When we change this policy, we publish the new version on this page and update its date.

Contact