Privacy Policy
Effective 8 September 2026
Giftling (“we”, “us”) — operated by EYO Consulting LLC-FZ, trading as Giftling — is a South African service that lets parents create a gift registry and giving page for their child. Because the people our service describes are children, we hold ourselves to a higher bar than the law requires — and the law, the Protection of Personal Information Act (POPIA), already sets a high one.
What we collect
- From parents: your name and email address (via Google sign-in or the email you sign in with). If you subscribe, payment is processed by Stripe: your card number goes to Stripe, never to us — we keep only your subscription status, plan and payment history.
- About your child, entered by you: first name, birth date, gender, city, and the registry you build — gifts, experience plans, and any account details you choose to show to givers.
- From gift-givers: the name and message they choose to leave, what they gave, and any ticket or voucher they upload for the child. If a giver leaves an email address, we use it so the family can thank them — and for nothing else unless the giver ticks the box asking us to remind them about that child’s Christmas cut-off.
- Your child’s email address, if you set one: used only to deliver an experience or ticket that a giver has bought for them. It is never used for marketing, never shared, and never added to any list.
What we do with it
- Run the service: show the registry to people you share the link with, and keep the record of giving for your child.
- Suggest age- and city-appropriate gifts and experiences. Where AI is used for suggestions, only age, gender and city are sent — never a name.
- Take payment for parent plans through Stripe, our payment processor. We never process giver transfers — givers pay retailers or families directly, and no gift money passes through Giftling.
- Send the emails you ask us to send — for example a gifted experience delivered to the address you set for your child.
We do not sell personal information, show advertising, or share your family’s information with anyone except the service providers below — and then only what they need to do their job.
Emails we send
There are two kinds, and the difference matters.
- Emails we owe you. Anything about your trial, your plan, a payment, a refund window or the card on file. These are part of the service you asked for, so they are sent whatever your preferences say — we would rather you never learned about a charge from your bank statement. They carry no unsubscribe link because they are not a mailing list.
- Emails you choose. Notices when someone gives to your child, Christmas posting-deadline reminders, and occasional Giftling news. Every one of these can be switched on or off, from your dashboard or from the unsubscribe link at the bottom of any of them, without signing in.
Giftling news is opt-in: we ask when you sign up and we do not send it unless you say yes. Reminders to gift-givers are opt-in too — a giver only hears from us if they ticked the box on the page where they left their address.
We keep a record of every email we send or decline to send, so we can show what went where and when.
Who can see a child’s page
A child’s page is private by default. It is only reachable by its share code, is blocked from search engines, and shows only what you chose to put on it. Anyone you give the code to can see the page, so share it the way you would share a family photo.
Our service providers
- Supabase — database and authentication hosting.
- Vercel — website hosting.
- Stripe — subscription payments (card details never reach Giftling).
- Resend — sending the emails described above.
- Google — one of the two parent sign-in doors (the other is an emailed sign-in link, handled by Supabase and Resend above).
- Anthropic — AI gift suggestions (age, gender and city only).
Some of these providers store data outside South Africa. We only use providers whose safeguards meet the standard POPIA requires for cross-border transfers.
How long we keep it
A Giftling profile is meant to be a lifelong record, so we keep it for as long as you keep your account. If you stop paying, nothing is deleted: the record stays visible on the free plan, or you can take the Keepsake and keep the archive for good.
If you leave entirely, your data goes with you. Deleting a child’s profile removes the profile, its registry, its record of gifts and any uploaded files. Deleting your account (Dashboard → Account → Delete my account) removes every child, every record, every file and your own details from our systems within 30 days; only the billing records the law requires us to keep (invoices and payment history) are retained, for five years. Email notifications stop immediately.
Cookies
Giftling sets only the cookies it needs to work: a session cookie that keeps you signed in, a short-lived one that remembers your consent choice between the sign-in page and your inbox, and one that notices a long spell of inactivity so a forgotten session on a shared computer signs itself out. There are no advertising cookies and no analytics trackers, and nothing follows you to other sites.
If a share code leaks
A code is a key, and keys get forwarded. Anyone holding it sees only what the page shows: your child’s first name, age, region and avatar, the registry, and the payment details you chose to publish. It never shows a surname, a birth date, a photograph or an address. If a code has gone further than you meant, replace it from the child’s To confirm tab: the old link stops working for everyone the moment you do, and nothing already given is lost.
Your rights
Under POPIA you may ask us what we hold about you or your child, ask us to correct it, ask us to delete it, or object to receiving direct marketing at any time. Email hello@giftling.co.za and we will respond within a reasonable time, at no charge. You may also lodge a complaint with the Information Regulator of South Africa.
Changes
If we change this policy in a way that matters, we will say so on this page and, for significant changes, email parents directly.