Skip to main content
FAQ and troubleshooting

10. Data, Privacy & Security FAQ

Giftnote's status after recent Shopify app security incidents, the access it requests, what recipient data it collects, how deletion works, where data is hosted, and Built for Shopify.

Written By Nick Kennedy

Last updated About 12 hours ago

Short answers to the privacy and security questions merchants and their data protection teams ask about Giftnote: our status after recent Shopify app security incidents, what we collect about gift recipients, how long we keep it, where it's stored and how to get it deleted.

Settings → Overview (General settings), showing your store and plan.

Is Giftnote affected by the recent Shopify app security incidents?

No. Giftnote remains live, in good standing, and is operating as normal. No action is required on your part.

Following reports of security incidents involving Shopify apps, our team reviewed Giftnote's systems, app permissions and access controls. We found no evidence of unauthorised access affecting Giftnote or the merchant data we handle. We continue to monitor our systems to help protect your store and customer information.

What Shopify access does Giftnote request?

Only the access we need. Giftnote requests the Shopify permissions needed to power gift messages, eGift Cards and Multi Gift, and nothing beyond that.

What data does Giftnote collect about gift recipients?

Only what's needed to deliver the gift:

  • Recipient name
  • Recipient email address and/or mobile number
  • The gift message written by the sender
  • Delivery address, where the gift is a physical product

We collect nothing else about the recipient. Giftnote doesn't enrich recipient records, add third-party data, or build profiles beyond what the sender enters at checkout.

How long is recipient data retained?

Giftnote keeps recipient details with the order for as long as the app is installed on your store, so you can use them for customer service, reconciliation and resends.

Data is removed in three ways:

  1. Through Shopify. Giftnote responds to Shopify's GDPR deletion requests (customer data request, customer redact, shop redact). When someone raises a deletion request in Shopify, we record it and our team completes the deletion.
  2. On request. Any recipient or merchant can ask us to remove a record using the chat button in the help centre, or by emailing support@giftnote.com. Merchants can also use the chat button in the app.
  3. When you leave. Under the Retailer Terms, Giftnote returns or securely deletes all personal data within thirty days of uninstall or termination.

One limitation: Giftnote doesn't create a Shopify customer record for a recipient who isn't already your customer. You can't raise a deletion request for those recipients from Shopify admin. Send it to us using the chat button in the help centre or in the app, and we'll delete the record and confirm back to you.

Does Giftnote send marketing to gift recipients?

No. The gift notification is a transactional message: it tells the recipient a gift is on its way and who sent it. Giftnote classifies and sends it as transactional.

Giftnote doesn't send recipients marketing of its own. There's no Giftnote newsletter, no product marketing and no retargeting of recipients.

Recipients are only added to marketing lists when they opt in. You capture and own that opt-in in your own email platform or CRM. Giftnote's role ends at the transactional notification.

Is recipient data shared with other merchants?

No. Each store's data is kept separate. Giftnote doesn't share or pool recipient data between merchants, and a recipient of a gift from your store doesn't appear in any other merchant's Giftnote account.

Giftnote never sells recipient data.

Where is recipient data physically stored?

Giftnote runs on Google Cloud (Firebase/Firestore), in our US and Australian regions.

Can our team see the content of gift messages?

Yes. Your staff can see the gift message on each gift order in the Giftnote app.

We see this as the same as reading a printed gift card packed with an order. The sender writes the message knowing the retailer handles it to fulfil the gift.

As a precaution, add one line to your own privacy policy saying you process gift message content to fulfil the gift.

Does Giftnote handle card or payment details?

No. Every payment happens on Shopify's own checkout. Giftnote never sees or stores card details. Customers reach checkout through a verified button or email link from your storefront.

What content shows on my Multi Gift storefront and in gift emails?

Your product descriptions, branding and email designs are checked and cleaned before they're displayed, so a storefront or email shows only the formatting you meant.

How are gift card codes protected?

Gift card codes are created with secure randomness and are real Shopify gift cards. Balance checks are rate-limited to stop anyone guessing codes.

How do you keep Giftnote secure over time?

We follow Shopify's app security guidance and run Shopify's app security checks. Automated checks run on every change, and the software we rely on is updated on a regular schedule. Before release, security changes get an independent review.

What happens if there is a security incident?

Under the Retailer Terms, Giftnote will tell you without undue delay, and within seventy-two (72) hours at most, after becoming aware of a security breach affecting your data.

What happens to our data if we uninstall the app?

Uninstalling stops all processing. To have your data returned or deleted, chat with us using the chat button in the help centre. Under the Retailer Terms, we return or delete it within thirty days of uninstall or termination.

Is Giftnote Built for Shopify?

Yes. Giftnote has earned Built for Shopify, Shopify's highest recognition for apps that meet its standards for performance, design and integration. For your store, that means:

  • Storefront performance. Built for Shopify apps must meet Shopify's speed requirements.
  • Ongoing quality standards. Shopify reviews Built for Shopify apps every year to check they still meet its requirements.

Where can we read the formal terms?

If your data protection team needs anything not covered here, email support@giftnote.com and we'll answer directly.

Was this helpful?

Still need help? Share an idea