Draft: not yet reviewed
A working draft covering what the product actually collects today. It is not legal advice. Have counsel review it before launch, especially the retention periods and the state-privacy-rights section.
Privacy Policy
Last updated: [date]
The short version
We collect the least we can: enough to deliver one gift and let a shop honour it. We don't sell personal information, and we don't market to people just because someone sent them a treat.
What we collect
From senders: the name you sign the gift with, and optionally your own contact so we can tell you it was redeemed.
From recipients: the phone number or email the sender gave us, the recipient's first name if provided, and whether the gift was opened and redeemed.
From businesses: shop details, staff names, and redemption records.
Automatically: basic technical and usage data (device type, approximate region, page events) to keep the service working and detect abuse.
Why we have it
To deliver the gift, to let a business verify a code at the counter, to stop fraud and abuse (for example, one person farming the same free promotion), and to show a business aggregate results for their campaign.
What businesses see
A business sees the gifts tied to their own shop: the item, the first name on the gift, and whether it was redeemed. They do not get a recipient's phone number or email, and they cannot export contacts.
Who else touches the data
Service providers only, and only to run the service: [Supabase] for the database, [Vercel] for hosting, [Resend] for email, [Twilio] for text messages once that's live, and [Stripe] for payments. We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.
Text messages
We only text a number that its own owner gave us. When you send a gift you may optionally enter your own mobile number and tick a box asking us to text you about that gift. We record the time you did it and the exact wording you were shown, so we can show you later what you agreed to.
Those messages are transactional: your gift was opened, your gift was redeemed, and one reminder before it expires. No marketing. We do not share mobile numbers with third parties, and we do not share them for marketing purposes. Reply STOP to any message to end them, or HELP for help. Message and data rates may apply, and message frequency varies.
We do not text gift recipients on a number supplied by the sender.
How long we keep it
Recipient contact details for [12 months] after a gift expires or is redeemed, then deleted or de-identified. Redemption and audit records are kept longer for accounting and dispute resolution. [Confirm both periods with counsel.]
Your choices
You can ask us for a copy of your information, ask us to correct it, or ask us to delete it. Email privacy@spreadthelove.app. Residents of [California and other states with privacy laws] have additional rights, described here: [to be completed].
Children
The service isn't directed at children under [13]. If we learn we've collected a child's information, we delete it.
Contact
privacy@spreadthelove.app · [postal address]