Privacy Policy

01Who we are

GiftFare is operated by L8ER Ventures LLC, based in the United States ("we", "us"). We are the controller of the personal data described in this policy.

02What we collect

We do not intentionally collect sensitive data such as health information, precise GPS location, or government ID numbers.

Your photos

• Only you can see them. Photos you upload are private to your account. We do not show them to other users or make them public.
• We only access what you choose. GiftFare asks your permission before using your camera or photo library, and only uploads the photos you select. You can change this permission at any time in your device settings.
• We remove location data. Photos often contain hidden details such as where they were taken. We remove location information from photos when you upload them.
• We use them only to run the app. We do not use your photos for face recognition, advertising or training AI models, and we do not sell them.
• You can delete them. Deleting a photo, or your account, removes it from our storage.

03How we use it

For people in the EU and UK, we list the legal basis for each use in brackets.

• Run your account and the app, including sign-in, saving your data and syncing across devices. [Contract]
• Verify purchases and unlock what you paid for, including subscriptions. [Contract; legal obligation for tax records]
• Improve the app by understanding which features people use and fixing crashes. [Legitimate interests]
• Keep the app safe by detecting fraud, abuse and security incidents. [Legitimate interests]
• Contact you about your account, security notices and changes to our terms. [Contract; legitimate interests]
• Send marketing, only if you opt in. You can unsubscribe at any time. [Consent]
• Meet legal requirements and respond to lawful requests. [Legal obligation]

04Who we share it with

We do not sell your personal data. We share it only with these groups:

Service providers

Companies that process data on our behalf under contract, including:

• Authentication and backend hosting: Supabase, Inc., which handles sign-in and stores account data, app data and your photos on our behalf in its Canada (Central) data center (ca-central-1). See Supabase's privacy policy.
• Payment processing: Apple, through the App Store. Apple's privacy policy governs the payment details you give it.

Others

• Authorities, when required by law or to protect someone's safety.
• A buyer or successor if we are involved in a merger, acquisition or sale of assets. We will tell you before your data becomes subject to a different policy.

05Ads and tracking

GiftFare does not show ads. We do not use your data for advertising, and we do not track you across other companies' apps or websites. We do not access your device's advertising identifier.

If we add ads in the future, we will update this policy and ask for your permission where the law or your device requires it before any ad-related data is collected.

06How long we keep it

• Account data: while your account is open, then deleted within [30] days of account deletion.
• Photos: until you delete them or your account, then removed from storage within [30] days.
• Usage and device data: up to [24] months, then deleted or aggregated so it no longer identifies you.
• Payment records: as long as tax and accounting law requires, typically [7] years.
• Backups: overwritten within [35] days.

07International transfers

Our database is hosted in Canada. The European Commission recognizes Canada as providing adequate data protection. We and our providers may also process data in the United States and other countries whose data protection laws differ from yours. When we transfer data out of the EU, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK Addendum, or the EU–US Data Privacy Framework where the recipient is certified.

08Your rights

Depending on where you live, you may have the right to:

• Access a copy of your personal data
• Correct data that is wrong or incomplete
• Delete your data and account
• Receive your data in a portable format
• Object to or restrict certain processing, including processing based on legitimate interests
• Withdraw consent at any time, without affecting earlier processing
• Complain to your local data protection authority

You can delete your account in [Settings › Account › Delete account]. For anything else, email us at the address in Contact us. We respond within 30 days and may need to verify your identity first. We will not treat you differently for using these rights.

09California residents

Under the CCPA as amended by the CPRA, in the last 12 months we collected the categories in section 02: identifiers, commercial information, internet or network activity, and approximate geolocation.

We do not sell or share personal information, as California law defines those terms, and we have not done so in the last 12 months.

We do not use sensitive personal information to infer characteristics about you. You may use an authorized agent to make requests on your behalf.

10Children

GiftFare is not directed to children under 13, or under 16 in the EU and UK, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

11Security

We encrypt data in transit with TLS, encrypt stored data at rest, hash passwords, and limit staff access to people who need it. No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authorities as the law requires.

12Changes

We will post any changes here and update the effective date. For significant changes, we will also notify you in the app or by email before they take effect.

13Contact us