Privacy Policy

Effective 11 October 2026

This policy explains exactly what GIFTIT stores, where it lives, who can see it, and how to get rid of it.

Who is responsible for your data (the "data controller"): Iam The Protagonist Ltd, trading as GIFTIT and The It Group, a private limited company registered in England and Wales, company number 16842280, registered office 60 Hay Lane, London, NW9 0NB. Registered with the Information Commissioner's Office, registration number ZC272634. Email: theitgroupapps@gmail.com.

What GIFTIT stores

Your account

When you sign in, GIFTIT keeps your email address and the name you give it. You may also choose a username and upload a profile picture. If you sign in with Apple and choose to hide your email, GIFTIT only ever receives Apple's private relay address, never your real one.

The people you add

For each person on your list, GIFTIT stores whatever you enter about them: their name, how they're related to you, their birthday, their interests, clothing or shoe sizes, a photo, your private notes, which occasions you keep for them, and any budget you set.

These details are about other people, and you're the one entering them. Only add what you'd be comfortable keeping in a notebook.

Gift ideas

For each idea: its title, your notes, a price, a web link, a photo, how important it is, whether it's still an idea or bought, wrapped or given, and which occasion it's for.

Sharing a list

If you invite somebody to help plan for a person, GIFTIT stores the email address or username you invited and whether they accepted. Everyone on that list can see the ideas on it and can claim one so nobody buys the same thing. Nobody you haven't invited can see anything.

Wishlists, Secret Santa, chipping in and Couples

If you make a wishlist, GIFTIT stores its title and each wish — name, link, note, price, photo and whether you'd love it. Anyone you give the wishlist's link to can see it and claim a wish; a claim is stored against the person who made it and is never shown to you, so the surprise survives.

In a Secret Santa, GIFTIT stores the group, its members' display names, who draws whom, any "never draw" pairs, and the anonymous messages between a giver and their receiver. In a chip-in, it stores what's being bought, the target, the organiser's own payment note, and each member's display name, pledge and whether they say they've paid — which every member of that chip-in can see. In Couples, it stores the pairing and the hints and notes the two of you share. Only the members of each group see what's in it.

Notifications and invitations

If you turn notifications on, GIFTIT stores your device's push token (an address Apple or Google gives the app so it can be sent a notification), the platform, and the notifications it has sent you. Invite and referral links are stored with the code and who made them.

Purchases

Everything you can buy — the AI gift-ideas unlock, spark packs, the Secret Santa upgrades and the Autopilot subscription — is bought through Apple or Google. They handle the payment; GIFTIT never sees your card, your address or your Apple or Google account. All GIFTIT keeps is a note of what you own and the store's transaction reference, so it can be restored on a new phone.

Ordering a printed poster

The star-map poster is a real object that has to be printed and posted, so it works differently from everything else you can buy. The payment is taken by Stripe, who collect your card details and the address it is going to — GIFTIT never sees the card. Your name and that delivery address are then passed to Printful, the printing company, along with the picture, because somebody has to put it in an envelope.

GIFTIT keeps a record that the order exists and what happened to it. The address is not kept in your account; it lives with Stripe and Printful, who need it.

How often you use the AI

GIFTIT counts how many times a month you ask for gift ideas, purely to apply the monthly limit. It's a number, not a record of what you asked.

When information leaves the app

Asking for gift ideas

When you tap Summon gift ideas, GIFTIT sends that one person's details — their name, how they're related to you, their interests, sizes, your notes, the occasion and the budget — to Anthropic, the company behind Claude, so it can write suggestions back.

This only happens when you press that button, and only for the person you pressed it on. Anthropic does not use anything sent through GIFTIT to train its models. Nothing else in your account is ever sent — not your other people, not your account details.

If you subscribe to Autopilot, the same details for a person with an occasion coming up are sent to Claude on a schedule, so the ideas are waiting for you without you having to ask. That is the whole point of the subscription, and it stops the moment you cancel it.

Link previews

When you paste a shop link into a gift idea, GIFTIT fetches that page to pull out its title and picture. The shop sees a request for their own page, and nothing about you.

Some shops refuse that request. When one does, the address is passed to Jina, a reading service that fetches the page instead and hands back the text. Jina sees the address of the shop page you pasted, and nothing else — not who you are, not what you were saving it for.

Meta

GIFTIT includes Meta's software kit, which is what lets the app be advertised on Facebook and Instagram and lets us tell whether those adverts worked. It reports two things: that the app was opened, and the amount of a purchase when one is made. Those reports do not carry your device's advertising identifier — GIFTIT switches that off, which is why the app never asks for permission to track you. No name, no email, nothing about the people on your lists, and nothing you have written into the app.

Meta uses that to measure adverts and may match it to a Facebook account. Their handling of it is covered by Meta's own privacy policy. Apart from Autopilot, which you switch on yourself, this is the only place GIFTIT sends anything without you pressing something.

Email

Sign-in codes and invitations are sent through Brevo, an email service. They handle the delivery of that one message and nothing more.

Why we use it — the legal basis

• Contract — your account, your people, gift ideas, lists, groups, purchases and printed orders: that's what the app is for.
• Consent — push notifications, your camera and photos, and Autopilot sending details to Claude on a schedule. You can withdraw it at any time in your device settings or by cancelling.
• Legitimate interests — measuring whether our adverts work (Meta), keeping the app secure, and answering support emails.
• Legal obligation — keeping records of payments for tax.

Who else handles it

We use other companies to run GIFTIT. Each gets only what it needs for its job, under a contract that stops it using your data for anything else.

• Supabase — the database, photos and server functions. London, United Kingdom.
• Anthropic — writes gift ideas when you ask, or on Autopilot. United States.
• Apple and Google — sign-in, push notifications, app distribution and in-app billing. United States.
• Expo — relays push notifications to Apple and Google. United States.
• Brevo — sends sign-in codes, invitations and order emails. France (EU).
• Stripe — takes payment for printed posters; it is the controller for card data under its own policy. United States and EU.
• Printful — prints and posts posters. Fulfilled in the United Kingdom; the company is in the United States and EU.
• Jina — reads a shop page when the shop refuses GIFTIT's own request. Sees only the page address.
• Meta — advert measurement, as described above. United States.
• Vercel — hosts the giftitapp.uk website. United States, with servers worldwide.

Where a provider is outside the UK, the transfer is covered by the UK International Data Transfer Addendum, or by the UK's adequacy regulations for that country. We'll share data if the law requires it — a court order, a lawful request from the police or a regulator — and to protect someone's safety.

Where it's kept

Everything is stored on Supabase servers in London, United Kingdom. Access is locked at the database itself: the rules only ever return rows belonging to the person asking, or rows on a list or group they belong to. Photos live in the same place under the same rules. Data is encrypted in transit and at rest. No system is perfect; if we ever have a breach that puts you at risk we'll tell you and the ICO as the law requires.

How long we keep it

• Your account and everything in it: until you delete it, then removed immediately.
• Payment records: kept by Apple, Google and Stripe under their own policies, which tax law requires. GIFTIT's own note of a purchase or printed order is removed when you delete your account.
• Notifications we've sent you: until you delete your account.
• Hosting backups: deleted data drops out of them within 30 days.
• Support emails: up to 2 years after the conversation ends.

What GIFTIT does not do

• No adverts inside the app, ever.
• No selling or renting of your information to anybody.
• Nothing you write — no person, no gift idea, no note, no photo — is ever sent to Meta or to any other advertiser.
• No location tracking. GIFTIT never asks for your location.
• No reading your contacts, your calendar, or the rest of your photo library.

Your camera and photos

GIFTIT asks for your photo library and camera only so you can attach a picture to a person or a gift idea. It reads the one picture you pick. It cannot browse the rest of your library, and it takes nothing in the background.

Deleting everything

Open the You tab and choose Delete account. Your account, your people, every gift idea, your photos, your invitations and your purchase record are removed immediately and for good. There is no waiting period and no recovery — so be sure.

Your rights

Under UK data-protection law you can ask us to show you what we hold about you, correct it, delete it, give you a copy to take elsewhere, stop using it for a particular purpose or object to our legitimate-interests uses, and withdraw any consent you've given. Email theitgroupapps@gmail.com and we'll reply within one month.

Children

GIFTIT isn't intended for children under 13, and accounts aren't knowingly created for them. If you believe a child has an account, write to the address below and it will be removed.

Cookies and tracking

The app sets no cookies, and the giftitapp.uk website sets none for tracking or analytics. The only measurement is the Meta report described above, which carries no advertising identifier — that's why GIFTIT never asks for permission to track you across other companies' apps.

Changes to this policy

If how we handle data changes, this page is updated first and the effective date at the top changes. For anything significant we'll tell you in the app or by email.

Complaints

Write to us first and we'll put it right if we can. If you're not happy with how we handle it, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Contact

Iam The Protagonist Ltd, trading as GIFTIT and The It Group
Registered in England and Wales, company number 16842280
60 Hay Lane, London, NW9 0NB, United Kingdom
theitgroupapps@gmail.com