Privacy policy

1. Data controller

My Gift Partner is a service from Min Gavepartner ApS, Danish company registration number (CVR) 46712994, Østerbæksvej 21, 2. th., 5230 Odense M, Denmark. The company is the data controller for the information we process about you and about your gift recipients.

Contact us at support@mingavepartner.com or by phone +45 25 71 71 98.

2. What information we process

About you as a customer: name, email, phone number, language, your budgets and your payment history. Your card details are held by our payment provider Stripe, never by us.

When you tick the boxes and sign up, we store alongside your acceptance: the time, the exact version of the text you agreed to, the IP address your connection came from, and which browser you used. The last two are there for one reason. An agreement made by ticking a box has no signature, and if anyone were one day to dispute who ticked it, that is what we have to hold it up against. We never use them for anything else, neither to measure you nor for marketing.

If you give your partner access to your shared gift plan, we also process information about your partner as a user: email address, language, login and the time of invitation and acceptance, as well as their own payment method if they add a surprise card. You share one account, but neither of you can see the gifts you add for each other: everything that concerns you is hidden from you, and the other way round. That also covers reminders, receipts and the data export each of you can download.

About your gift recipients: name, relation to you, age, interests, occasions and whatever you choose to tell us about them. This is information about people who have not signed up themselves, and we treat it with particular care.

If the recipient is a child, we keep as little as possible: first name or nickname, age, relation and interests. We never ask for more about a child than about an adult, and the information is only used to choose the gift.

You may choose to add a photo of a recipient in your account. It is entirely optional, it is only used to show the person to you, and neither our system, our AI nor any third party uses it to choose the gift. The photo is stored in our database in the EU, never at a public address, and it is cleared along with the rest of the profile. You can remove it again with one tap.

Please don't write sensitive information about your recipients, for example about health, religion or sexuality. We don't ask for it, and it won't make the gifts any better. If you write it anyway, we keep it as you wrote it. Before the profile is used by the AI tool we choose gifts with, we look for words like these, and any field where we find them is left out.

3. Why, and on what basis

We process your own information to deliver the agreement you have made with us. We process information about your recipients on the basis of our legitimate interest in delivering the service you have asked for: finding and delivering good gifts for them.

The gift is chosen automatically. Our system looks for the gift based on what you have told us about the person, among products from the shops we have an agreement with, and AI chooses the one that fits best. Because we then buy the gift in your name and charge the amount, this is an automated decision under Article 22 of the General Data Protection Regulation. It is necessary to deliver the agreement you have made with us (Article 22(2)(a)).

You always have the final say. With pre-approval you see the suggestions before we buy, and you can pick a different one, tell us why none of them is right, or skip the gift. You can also write to us at any time to ask for a person to look at the choice, to give your view, or to object to it. If the gift has already been bought, we will help you exchange it or send it back.

The gift choice is not based on sensitive information, and we never use it to assess you as a person, only to find the gift. Before we started choosing gifts automatically, we carried out an impact assessment of what it means for you and your recipients. You can always ask to see it.

We do not contact your recipients to tell them that we hold information about them. It would give the gift away and spoil the very thing you asked us for, and for most people an unexpected message from a company they do not know would feel more intrusive than the information itself. So we say it openly here instead, so anyone can read what we keep and why. We never put information about your recipients on display anywhere. The assessment behind this is written down, and you or a recipient can always ask to see it.

We use your mobile number only when you need to do something before a deadline. That happens in three situations: when we have found the gifts and you can choose one yourself, when the gift is waiting for you at a parcel shop, and when a payment for a gift does not go through or your bank wants you to approve it. Then we send you a text message. The reason is that an email can sit unread or land in spam while the deadline runs out. The text always comes on top of an email, never instead of one, and only during the day. We never send marketing by text.

Marketing, for example newsletters, is only sent if you have said yes to it separately, and you can always withdraw your consent.

4. How long we keep it

A gift plan you do not finish is deleted automatically after 30 days. If you join the waiting list because we are not open in your country yet, we keep your gift plan and contact details until we open for you, for two years at most, and only use them to let you know when we are ready. Your customer information is kept for as long as you have an account with us. Payment records are kept for 5 years after the end of the financial year, as the Danish Bookkeeping Act requires.

Your acceptance of the terms, the power of attorney and the payment mandate belongs to those records, and it is kept just as long, with the time, the text version, the IP address and the browser. It is the record of the agreement we have with you, and it must be possible to find for as long as that agreement can matter.

If you remove a recipient from the plan, we stop everything going forward straight away. 30 days later we remove the profile information about them: interests, personality, notes, year of birth and past gifts. The 30 days are there so you have time to change your mind. The name stays on gifts that have already been delivered, because they belong to your receipts and your own history.

When a gift has been delivered and rated, we keep an anonymous record of the outcome: relation, age group, occasion, interests as fixed keywords, budget and price as ranges, the product category, the shop and your rating. It carries no name, no contact details, no date of birth and nothing you have written in your own words, and it has no link back to you or your recipient. It therefore cannot be used to work out who the gift was for. We use it to get better at choosing gifts, and it stays with us, even after the profile information has been removed.

If you leave us, we remove the profile information about your recipients 12 months later. Until then you can come back to your gift plan exactly as you left it, without filling everything in again. The name stays on gifts that have already been delivered, because they belong to your receipts.

If you remove your partner's access to your shared gift plan, we close and anonymise your partner's login immediately and detach any surprise card with Stripe. The people and gifts your partner has added stay on the account, and your partner's acceptances are kept as a record. Gifts your partner has added for you become visible to you again.

5. Who we share it with

We never sell your information, and we never use it for anything other than finding and delivering the gifts. We only share it with those who are needed to run the service, and they may only use the information on our instructions:

Stripe: payments. Your card details are held by them, never by us.

Supabase: database and login. Hosted in the EU (Frankfurt).

Vercel: running the website itself. The server runs in the EU (Frankfurt).

Better Stack: monitoring of our operations. If something breaks while you are using the site, our server or your browser sends them an error report, and they also check from the outside that the site is answering at all. The report is cleaned before it leaves us: no name, email, address, phone number, payment details, cookies, anything you have typed into a field, or your IP address goes with it. What does go with it is the error message, where in the code it happened, which page you were on, and an internal customer number, so we can see whether the error affected one person or many. That number does not in itself say who you are.

Resend: the emails we send you, for example receipts and messages about upcoming gifts. Resend also receives the emails the shop and the courier send about your gift. They arrive at an address we own, and we show them under the gift in your account.

GatewayAPI: the few text messages we send you about your gifts, when you can choose the gift, when it can be collected from a parcel shop, and when a payment did not go through. They receive your mobile number and the message itself, nothing else. The order carries our own GatewayAPI number rather than yours, so the courier's text with the parcel shop and collection code comes to us, and we pass the shop and code on to you by email and text. The messages go through their European platform.

Anthropic: a technical tool, both when we build and in day-to-day operations. We use AI as an aid when we develop and fix bugs, and for the gift choice itself, where AI chooses the gift from what you have told us about the person, as described in section 3. The information involved is pseudonymised: name, address, email, phone number, photo and payment details never go with it, neither yours nor your recipient's.

Meta: only if you have said yes to marketing cookies, and only on our public pages. Meta never receives information about your recipients, and measurement is switched off while you are signed in to your account.

The partner shop, when we buy the gift on your behalf: your name as the buyer, the delivery address you have chosen, and our code or a note on the order, so the shop can see the purchase came from us. The shop receives nothing else about you or your recipient. We never buy through an affiliate link, so there is no third party in between, and when we settle up with the shop, we use only order numbers and amounts.

Address lookups while you type your delivery address: GLS, so we can show parcel shops near you, and the Danish state's address search at the Danish Agency for Climate Data, so we can suggest the full address. If it does not respond, we ask Photon (komoot, Germany) instead. The lookup is sent from our server, and they only receive the address in the field. No name, email, phone number, cookies or IP address goes with it, so they cannot see who is asking.

Tracking, once the gift has been sent: we look up the tracking number with Ship24, so we can see when the parcel has arrived. They receive only the tracking number and the country, never a name, an address or anything else about you or your recipient.

Several of them are US companies, and Better Stack is European but uses US subprocessors. Transfers of information to the US are made under the European Commission's standard contractual clauses or the EU-US Data Privacy Framework, and we have a data processing agreement with each of those who process information on our behalf. The partner shop, the address lookups and the tracking are not processors: the shop is itself responsible for its sale to you, and the address lookups and the tracking receive nothing that links the address or the parcel to you.

6. Your and your recipients' rights

You can always get access to the information we hold about you, have it corrected, have it handed over, or ask us to delete it. The same applies to a recipient who contacts us about information about themselves.

You do not have to ask us for access: in your account you can download all your information as a file straight away, including what we have stored about your recipients.

Write to support@mingavepartner.com and we will help. You can also complain to the Danish Data Protection Agency via datatilsynet.dk, where we are registered as Min Gavepartner ApS, CVR 46712994.

7. Cookies and measurement

We only set what is strictly necessary in your browser to make the site work, for example your language choice and your gift plan in progress. Before we add measurement or marketing cookies, we ask for your consent.

If you say yes, we place Meta's pixel on our public pages so we can see which ads work. It is switched off in your own account and on our internal pages. You can always change your choice at the bottom of the page.