We collect only what’s necessary to deliver GiftGuard Authorise and to provide an auditable Gifts & Hospitality compliance flow. This notice explains what we collect, how we use it, and your rights.
We keep the footprint intentionally small (“data minimalism”). Depending on your organisation’s configuration, we may process:
Retention is configurable per client policy. By default we retain submission and audit data in the tenant’s namespace for the duration of the subscription plus a short administrative buffer (typically up to 90 days) unless you instruct deletion sooner.
We run on Cloudflare infrastructure. Submission records are stored in Cloudflare KV under a tenant-specific key (or namespace). This uses edge replication for performance and resilience. We do not sell or monetise your data.
We share data only with service providers essential to operate the Service (e.g. Cloudflare for edge compute/storage). These providers act as data processors under contract and are limited to the minimum necessary processing. We do not share personal data with third parties for marketing.
Cloudflare may replicate data internationally to provide edge performance and availability. Transfers are covered by standard contractual clauses and Cloudflare’s security certifications and commitments.
You can exercise the following rights by contacting us. Where we act as processor for your employer, please contact your employer’s admin first.
We don’t use advertising cookies or third-party tracking pixels. Operational cookies may be used strictly for authentication/security.
The Service is for business use only and not directed to children.
We may update this notice if our processing changes. We’ll post the new version here and update the date below.
Version: 1.1 • Updated: 13 Nov 2025 • Contact: [email protected]