10. Data, Privacy & Security FAQ

What recipient data Giftnote collects, how long it's kept, how GDPR deletion works, where it's hosted, and links to the formal privacy and retailer terms.

Written By Nick Kennedy

Last updated About 1 hour ago

Short answers to the privacy and security questions merchants and their data protection teams ask about Giftnote: what we collect about gift recipients, how long we keep it, where it's stored and how to get it deleted.

Settings → Overview, showing your store's account details.

What data does Giftnote collect about gift recipients?

Only what's needed to deliver the gift:

  • Recipient name
  • Recipient email address and/or mobile number
  • The gift message written by the sender
  • Delivery address, where the gift is a physical product

We collect nothing else about the recipient. Giftnote doesn't enrich recipient records, add third-party data, or build profiles beyond what the sender enters at checkout.

How long is recipient data retained?

Giftnote keeps recipient details with the order for as long as the app is installed on your store, so you can use them for customer service, reconciliation and resends.

Data is removed in three ways:

  1. Automatically, through Shopify. Giftnote listens for Shopify's GDPR deletion requests (customer data request, customer redact, shop redact). When someone raises a deletion request in Shopify, Giftnote redacts the matching records.
  2. On request. Any recipient or merchant can ask us to remove a record using the chat button in the help centre. Merchants can also use the chat button in the app.
  3. When you leave. Under the Retailer Terms, Giftnote returns or securely deletes all personal data within thirty days of uninstall or termination.

One limitation: Giftnote doesn't create a Shopify customer record for a recipient who isn't already your customer. You can't raise a deletion request for those recipients from Shopify admin. Send it to us using the chat button in the help centre or in the app, and we'll delete the record and confirm back to you.

Does Giftnote send marketing to gift recipients?

No. The gift notification is a transactional message: it tells the recipient a gift is on its way and who sent it. Giftnote classifies and sends it as transactional.

Giftnote doesn't send recipients marketing of its own. There's no Giftnote newsletter, no product marketing and no retargeting of recipients.

To market to gift recipients afterwards, you need their opt-in. You capture and own that opt-in in your own email platform or CRM. Giftnote's role ends at the transactional notification.

Is recipient data shared with other merchants?

No. Each store's data is kept separate. Giftnote doesn't share or pool recipient data between merchants, and a recipient of a gift from your store doesn't appear in any other merchant's Giftnote account.

Giftnote never sells recipient data.

Where is recipient data physically stored?

Giftnote runs on Google Cloud (Firebase/Firestore), in our US and Australian regions.

Can our team see the content of gift messages?

Yes. Your staff can see the gift message on each gift order in the Giftnote app.

We see this as the same as reading a printed gift card packed with an order. The sender writes the message knowing the retailer handles it to fulfil the gift.

As a precaution, add one line to your own privacy policy saying you process gift message content to fulfil the gift.

What happens if there is a security incident?

Under the Retailer Terms, Giftnote will tell you without undue delay, and within seventy-two (72) hours at most, after becoming aware of a security breach affecting your data.

What happens to our data if we uninstall the app?

Uninstalling stops all processing. To have your data returned or deleted, chat with us using the chat button in the help centre. Under the Retailer Terms, we return or delete it within thirty days of uninstall or termination.

Where can we read the formal terms?

If your data protection team needs anything not covered here, email support@giftnote.com and we'll answer directly.