Privacy Policy

Last updated: 10 October 2026

This policy explains what data the GiftDial Shopify app processes, why, and how it is protected. For the data of a store's customers, the merchant is the data controller and GiftDial is the data processor acting on the merchant's instructions.

What we collect

• Store data: the shop domain, shop name, the owner and contact email Shopify provides, store currency and market currencies, time zone, your GiftDial settings, design and texts, and your plan.
• Gift card purchases: amount and currency, order number and id, the buyer's email (from the Shopify order), and what the buyer types into the gift card form: recipient name and email, sender name, message and delivery date. For gift cards the merchant creates in the app (for example a company order), the same fields as the merchant enters or uploads them.
• Gift card codes: stored only encrypted (AES-256-GCM). The last four characters are kept in plain text so you can recognise a card in the admin. Codes never appear in logs or error reports.
• Delivery records: when each email was sent, and whether the recipient's mail server refused it (bounce).
• Abuse protection: a keyed, non-reversible hash of the network address a purchase request came from, used only for rate limiting and deleted after 30 days.
• Storefront diagnostics: if the gift card form fails to load or work, an anonymous report with the theme name and version, page template and path, screen size, device type (mobile or desktop), layout measurements of the form and a short error code. It never includes what a shopper typed, cart contents or cookies.
• Access records: when the merchant opens purchase details, downloads gift card codes or PDFs, and when the app sends a gift card, recorded by purchase id only (no names or emails), to meet Shopify's data-protection requirements.

We do not collect addresses, phone numbers or payment details. Payments happen in Shopify's checkout; we never see card data.

Why we process it

Solely to provide the app: issuing the gift card the shopper paid for, delivering it by email with a PDF and a gift card page, showing purchases to the merchant, preventing abuse, and fixing problems. We do not sell data, profile shoppers, or use data for advertising.

How long we keep it

• Purchase records are kept while the app is installed so the merchant can resend, check and void cards. Personal fields (emails, names, message) are erased automatically 3 years after the purchase; amounts, dates and order numbers stay for the merchant's accounting.
• Purchases that were never paid lose their personal fields when they expire, 48 hours after the checkout was created.
• Storefront diagnostics are deleted after 90 days; access records after 12 months; delivery records after 3 years.
• All store data is deleted when Shopify sends the shop data-removal request, 48 hours after the app is uninstalled. Gift cards already issued remain valid in Shopify.
• When Shopify forwards a customer's erasure request, that customer's personal fields are erased.

Security

Data is encrypted in transit (TLS) and at rest; gift card codes additionally with application-level encryption. Access is limited to what the app needs to operate. Error reports are scrubbed of personal data, codes and links to gift card pages.

Subprocessors

• Shopify: the platform the app runs on, the checkout and the gift cards themselves.
• Railway: application hosting and database (EU region, Netherlands).
• Resend: delivery of gift card emails and receipts.
• Cloudflare: DNS and inbound email routing for giftdial.app.
• Sentry: error monitoring, scrubbed as described above.
• Google: the support mailbox (support@giftdial.app is forwarded to Gmail).

Some providers are based outside the EU (for example Resend, Sentry and Google in the United States). Transfers rely on the providers' Standard Contractual Clauses or the EU–US Data Privacy Framework.

Your rights and contact

Merchants and their customers may request access to, correction or deletion of data we process. Requests Shopify forwards to us are handled automatically or within 30 days. Customers of a store can also contact the store directly. For anything else, write to support@giftdial.app.