Privacy Policy

When you place an order we collect:

• Your email address — used to deliver your gift card code
• Your IP address — hashed and used for payment security
• Browser/device information — used for payment security
• Payment information — processed by Stripe; we never see or store credit card details

We use your data for:

• Fulfilling your order (delivering your code by email)
• Payment security
• Customer support
• Anonymous analytics to improve the site (no cookies or personal data collected)

We use Cloudflare Web Analytics and Plausible Analytics to understand how visitors use our site. Both tools are cookieless and collect no personal data.

We share data only with the following processors:

• Stripe — payment processing (PCI DSS Level 1)
• Resend — transactional email delivery
• Cloudflare Web Analytics & Plausible Analytics — cookie-less site analytics; no personal data shared
• Trustpilot — review platform; we link to Trustpilot so customers can leave and read reviews. We do not embed Trustpilot widgets on our site.
• Cloudflare Turnstile — bot protection on contact and feedback forms (see section 7)

We do not sell or rent your data to any third party.

Order records are retained for accounting and dispute purposes for up to 7 years. Email addresses are retained for as long as your order record exists. Hashed IP addresses in fraud logs are retained for 90 days.

Depending on your jurisdiction, you may have the right to access, correct, or delete the personal data we hold about you. To exercise these rights, use the contact us form on this site.

For privacy-related inquiries, please contact us via our support page.

This website uses Cloudflare Turnstile, a bot detection service provided by Cloudflare, Inc., to protect our web forms and pages from automated abuse.

What data is collected

When you interact with a page protected by Turnstile, Cloudflare automatically collects certain technical signals including your IP address, TLS fingerprint, User-Agent header, and the sitekey associated with this website. Cloudflare states it cannot directly identify individuals from these signals alone.

How it is used

These signals are processed for two purposes:

• To distinguish human visitors from bots and block malicious automated traffic (on our behalf, as data processor)
• To improve Turnstile's bot detection capabilities (by Cloudflare independently, as data controller)

Legal basis (EU/UK users)

Where these signals constitute personal data under GDPR or UK GDPR, Cloudflare processes them on the basis of legitimate interests — specifically, protecting the security of websites and improving bot detection.

Cookies

Turnstile may set cookies that are strictly necessary for bot detection. For details, see Cloudflare's Cookie Policy.

Further information

For questions about how Cloudflare processes data through Turnstile, you can contact Cloudflare's Data Protection Officer at [email protected], or review the Cloudflare Turnstile Privacy Addendum.