Privacy notice

Gift on Cue is operated by Stride World LTD, company number 16865108. Our registered office is 5th Floor 167-169 Great Portland Street, London, England, W1W 5PF. Contact us about privacy at privacy@giftoncue.com.

This notice explains how we use personal information when you visit our website, contact us, use an account, or send or receive a gift. We serve business and personal customers aged 18 or over and adult gift recipients.

We are responsible for deciding how information is used for our accounts, customer support, commerce, security and legal obligations. When we store a business customer's contacts or carry out agreed gifting tasks solely on its instructions, that customer is the controller and we act as its processor. Our standard Data Processing Agreement covers that work.

Depending on how you use the service, we collect:

• Your name, email and account details, and any company or workspace information you provide.
• Contact details you add to Contacts, including names, companies, roles, email addresses, phone numbers, authorised delivery addresses and occasion dates. Birthday reminders use the day and month, without a birth year.
• Gift choices, messages, recipient details, invitations, claim responses, delivery instructions and order history.
• Logos, artwork and designs you upload or save, including anything personal within them.
• Payment references, balances, transactions and limited saved-card details, such as the card brand, last four digits and expiry date. Payment providers handle full card details.
• Enquiries and support conversations, including the information you choose to send us.
• Technical information needed to run and protect the service, such as request records, device or browser information and security checks.

Some details are needed to sign you in, take payment or deliver a gift. If you do not provide them, we may be unable to complete that part of the service. Saved contacts, birthday reminders and our marketing emails are optional.

We receive information from you, the person sending a gift, and providers supporting payment, checkout and delivery.

Where we use Stride intelligence, we may also use relevant public professional information and business-data providers to help verify recipient details and suggest suitable gifts. This can include professional roles, company information and public business contact details. You can ask us which sources were used for your information and tell us if anything is wrong.

Where we act as a processor, we follow the business customer's documented instructions. That customer is responsible for its own lawful basis and notices; we remain responsible for our duties as a processor.

Your recipient lists, delivery details, messages and gift preferences are kept separate from Stride's wider business-intelligence data. We use them to provide and support your gifting service.

You can save details and delivery addresses in Contacts for future gifts. Only save information you are authorised to provide. An address a recipient gives us privately when claiming a gift stays separate from the sender's saved contacts and is shared with the partners who need it to fulfil the gift.

The sender supplies your details, or gives you a link through which you can provide them yourself. You choose whether to claim an invitation. If you do not want the gift, leave it unclaimed or email hello@giftoncue.com to request cancellation. We use the information needed to handle your response and, if you claim, arrange delivery and provide updates.

The sender can receive gift progress information, such as whether an invitation was claimed. We do not share a private reason you give us for declining a gift. Receiving a gift does not subscribe you to our marketing.

We may use AI to help draft messages, prepare artwork and suggest gifts. Message-writing help processes the occasion, tone, sign-off and notes you provide. Those notes may contain personal information, so only include what is needed.

We do not use recipient details, private gift messages or uploaded artwork to train AI models, and require the same protection from AI providers handling this information for us. Processing information to provide the service is separate from using it for training.

Suggestions are drafts for the sender to review. The sender approves the gift and message before sending; recommendations do not authorise autonomous sending or payment.

We share information with the technology, payment and delivery partners needed to provide your chosen service. These include Amazon Web Services (AWS), Shopify, Stripe, Printful and Brandfetch, as well as gift suppliers, packing partners and delivery carriers. We share only what they need.

We also share information with professional advisers or authorities where needed for legal obligations or claims. We do not sell your personal information.

Some partners use information under their own privacy notices, including Shopify. For relevant business services, our DPA provider list applies. Contact privacy@giftoncue.com if you would like more information.

Our main application storage uses AWS in Ireland. Some providers process information in other countries, including Canada and the United States.

Where a transfer needs legal safeguards, we use the applicable adequacy arrangements or approved contractual safeguards, including the UK transfer addendum or agreement and EU Standard Contractual Clauses where appropriate. Contact privacy@giftoncue.com for details or a copy of the relevant safeguards, with confidential details removed where necessary.

We keep only the information needed for a continuing legal or dispute purpose. Deletion from active systems may precede deletion from restricted recovery backups. Our current database recovery window is 35 days; older versions of private artwork are normally removed after 30 days. Current saved artwork follows its own retention purpose rather than automatically expiring after 30 days. We restrict recovery copies and must prevent deleted information from returning to ordinary use when restoring data. Information saved in your browser remains subject to your browser's storage controls, as described below.

We use cookies and similar storage to keep you signed in, remember your cart, maintain guest customisation and securely let you view an order. Our application also saves cart and design information in your browser so you can continue later. You can clear this through your browser settings, although doing so may remove saved progress.

Our application uses essential cookies to provide the features you request. Where optional measurement is enabled, we ask separately for analytics, advertising and session-replay consent. Google Analytics measures visits, product interactions, account registrations, enquiries and purchases. Google Ads, and advertising tools connected to our Shopify checkout, measure which ads lead to visits and purchases and may use this to show you relevant ads. With a separate session-replay choice, Microsoft Clarity captures clicks, scrolling and page interactions across browsing, signed-in account, cart and personalisation journeys to produce recordings and heatmaps. It uses _clck and _clsk cookies. We mask personal details, recipient information, private messages, payment details and personalised artwork while keeping the surrounding controls visible. Query parameters do not prevent recording; we remove their values and private identifiers from URLs sent to Clarity. Claim links, authentication and staff pages are excluded. Microsoft also receives website usage data; advertising use follows the advertising choice. Read Microsoft’s privacy statement at https://privacy.microsoft.com/privacystatement. Rejecting optional cookies does not prevent shopping. Your analytics and advertising choices also apply at our Shopify checkout, so you only choose once: we pass them to Shopify, which records them in its _tracking_consent cookie. Use Cookie settings to change or withdraw your choice for both our website and checkout. We keep your choice for six months; when it expires or you withdraw it, we also withdraw it at Shopify and ask again on your next visit. If checkout could not receive your choice, Shopify may ask you there instead. We do not send recipient details, private messages, artwork, payment credentials or claim links in our measurement events or replay recordings. Shopify checkout also uses its own essential cookies. See Google's information about how it uses data at https://policies.google.com/technologies/partner-sites.

We send our newsletters and offers only if you opt in. Buying or receiving a gift does not automatically subscribe you. Unsubscribe using the email link or contact privacy@giftoncue.com.

Gift invitations and necessary order or delivery updates are handled separately from our newsletters and offers. Business senders must also follow the rules that apply to their invitations and campaigns.

We use technical and organisational safeguards appropriate to the information, including encryption, access controls and secure handling of delivery and payment details.

Depending on the circumstances, you can ask for access, correction, deletion, restriction or a portable copy of your information. You can withdraw marketing consent at any time without affecting earlier lawful use.

You can object to processing based on legitimate interests, including use of your professional information for verification or gift recommendations. You can always object to direct marketing. Contact privacy@giftoncue.com.

We normally respond to rights requests within one month. If the law allows an extension for a complex request, we will explain why and tell you the revised timing. If we process the relevant information for a business customer, we will help that customer handle your request.

You can complain to the Information Commissioner's Office, or another applicable data protection authority. You do not have to contact us first, although we welcome the opportunity to help.

We will keep this notice up to date and show its revision date. We will explain material changes through an appropriate notice.