Privacy Policy

Last Updated: September 11, 2026

1. Introduction and Our Two Roles

GiftSpatch ("GiftSpatch," "we," "us," or "our"), a product of Doron Ventures LLC, is primarily a business-to-business gifting platform, used mainly by businesses to send personalized and branded items to their customers and employees, and also usable to send gifts personally. This Privacy Policy explains how we handle personal information in connection with the website https://giftspatch.io (the "Website") and the GiftSpatch web application (together, the "Services").

It applies to visitors to our Website, account holders, members of a business account, and the gift recipients, employees, and customer contacts whose details are entered or imported by our business users.

We act in two different roles, and the difference matters. For our own account holders and Website visitors, we are the controller (the "business") and this policy describes what we do and why. For the recipients, employees, and customer records that our business users enter or import, we are only a processor (a "service provider") acting on that business's instructions — that business decides who receives a gift and what information to give us, and its own privacy policy governs. Section 4 explains this in detail.

By using GiftSpatch, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

Information you provide directly:

• Account email address and display name (Google sign-in, or email and password)
• Company name, address, and the team members you invite
• Designs, logos, and artwork you upload to brand your gifts
• Recipient details you enter to send a gift (see Section 4)
• Recipient email address or phone number, when you send a gift link rather than shipping to an address
• Employee records you enter into your company directory: name, address, email address, phone number, birthday, hire date, and any notes or custom fields you add
• Billing information for your subscription plan and any gifts you purchase, processed by our payment processor; we do not store full payment card numbers — we keep only a card summary (brand, last four digits, expiry month and year) returned to us by the processor
• Your email address if you submit it on our Website, together with the page you were on when you submitted it
• Communications you send to our support team, and feedback you submit

Information collected automatically:

• Browser type, version, language, operating system, and device type
• IP address, and from it an approximate location (city, region, country, and approximate coordinates), the internet provider or network operator, and whether the connection appears to use a VPN or proxy
• Device and browser characteristics used to recognize your sign-ins, and a short history of the recent IP addresses used on your account, which we use to detect suspicious access
• Sign-in security details reported by our authentication provider, such as whether your email is verified, which sign-in methods you use, whether multi-factor authentication is enrolled, and when the account was created and last used
• Pages visited, features used, session duration, and timestamps
• Delivery and engagement data for emails we send you, such as whether a message was delivered, opened, or its links followed, which we use to confirm notices reached you and to diagnose delivery problems
• Error logs and diagnostic data, including the error message, the technical stack trace, the page path where it happened, and your user agent

Information from other sources: accounting or CRM software you choose to connect (see Section 5), and our payment processor, which tells us the outcome of a payment, a card summary, and any dispute.

What we do not collect. We do not collect government identification numbers, financial account numbers, precise GPS location, biometric data, health data, or information about your race, religion, political opinions, sexual orientation, or union membership. We do not knowingly collect information from children (see Section 13).

3. How We Use Information

We use personal information to:

• Provide and maintain the Services, including the catalog, gift designer, contacts, campaigns, bulk sending, store links, order placement, and order history
• Authenticate you and the team members you grant access, and enforce permissions
• Produce and fulfill the gift orders placed through your account, including sharing the necessary recipient and design details with our fulfillment providers and shipping carriers
• Take payment, calculate applicable sales tax, maintain your account balance, and keep financial records
• Send service-related communications, such as account notifications, order alerts, security notices, and critical product updates
• Respond to your support requests and act on feedback
• Detect, prevent, and investigate fraud, abuse, unauthorized access, and violations of our Terms of Service
• Improve the Services and develop new features based on usage patterns and feedback
• Comply with legal, tax, and accounting obligations, and establish, exercise, or defend legal claims

Marketing. We may send marketing messages about GiftSpatch to our own account holders and to people who give us their email address on our Website. Every marketing message has an unsubscribe link, and unsubscribing does not stop service-related messages you need in order to use your account. We never market to the recipients, employees, or customer contacts that our business users enter.

Automated processing. Gift automations run on rules our business users configure, and our security tooling scores sign-in activity for risk. Neither produces legal effects concerning you or similarly significant effects, and neither replaces a human decision about your access to the Services.

We do not sell personal information, and we never sell or rent recipient, employee, or customer-contact information. We use third-party advertising tools to measure our ads and to show GiftSpatch ads to people who visited our Website, which some state laws treat as “sharing”; you can opt out at any time (Section 8).

4. Recipient and Employee Information

To send a gift, our business users enter information about the recipient: typically a name and shipping address, and sometimes an email address, phone number, or a short message. Where a business sends a gift link rather than shipping directly, we use the recipient's email address or phone number to deliver that link. A business may also store records about its own employees in order to send them gifts, including home address, phone number, birthday, hire date, and notes.

Who is responsible. When a business uses GiftSpatch, that business decides to send the gift and provides the details. As between that business and GiftSpatch, the business is the controller (and the "business" under U.S. state privacy laws) and is responsible for having a valid lawful basis and for giving any notices and obtaining any consents required before sharing that information with us. GiftSpatch acts as that business's processor and service provider, processing the information only on that business's instructions. We do not decide on our own to contact recipients or employees, and we do not use their information for our own purposes.

• Used only for fulfillment. Details are used to produce, personalize, and ship the gift, to deliver a gift link where instructed, and for related customer service. They are never used to market to that person.
• Isolated per business account. Data belonging to one business account is not mixed with, aggregated with, or exposed to any other account.
• Shared only as needed. Recipient name, address, and the chosen design are shared with the fulfillment provider producing and shipping that order, and with shipping carriers.
• We do not enrich it. We do not append data from outside sources to a recipient, employee, or customer record.

If you are a recipient or an employee and want to know who sent you something, object to receiving gifts, or have your information corrected or removed, email us at Email us. Because we act on the sending business's instructions, we will identify that business to you, pass your request to them, and act on it ourselves where we are permitted to do so. We will not charge you and will respond within the time the law allows.

5. Connected Accounting and CRM Software

What we connect to. Currently QuickBooks Online. The same terms apply to any additional accounting or CRM integration we support in the future; the list of live integrations is shown in your account settings.

How access works. If you choose to connect a supported third-party service, you authorize us to access certain data from that account through the provider's secure API, typically using OAuth. Connecting is entirely optional and nothing in the Services requires it.

What we read. For each integration we access only what is needed to detect the events you configure to trigger a gift — for example a completed job, a paid invoice, or a new customer. That generally means customer and contact records, and invoice, estimate, payment, customer-type, and recurring-transaction records, on a read-only basis.

What we never do. We never create, modify, or delete anything in your connected account, and we never access banking, payroll, tax filings, or stored payment data.

Disconnecting. You can disconnect at any time from your account settings or from within the connected service. Disconnecting immediately stops the sync and deletes the stored connection credentials. Data already synced remains in your account until you delete it or close your account (see Section 9).

6. Sharing Information

We share personal information only in these limited circumstances:

• With service providers who help us operate the Services, under contracts limiting them to our instructions (see Section 7)
• With the business that sent a gift, where you are a recipient or employee and contact us about it
• To comply with legal obligations, such as a subpoena, court order, tax requirement, or other lawful request. We review each request, require valid legal process, object to requests that are overbroad, and will notify the affected account unless legally prohibited
• To protect rights and safety, including to enforce our Terms of Service, investigate fraud or abuse, or protect against harm
• In connection with a business transaction, such as a merger, acquisition, financing, or sale of assets, with notice before your information becomes subject to a different privacy policy
• With your direction or consent, such as when you connect a third-party service

GiftSpatch does not serve third-party advertising on its pages and does not share your data with data brokers. We share limited browsing data with our advertising partners (listed in Section 7) for our own advertising, as described in Section 8.

7. Service Providers and Subprocessors

GiftSpatch relies on a small number of third-party providers, each bound by contract to use your data only to provide services to us. We remain responsible for their handling of personal information we entrust to them, and we require each of them to protect it on terms at least as protective as this policy.

We do not publicly identify our fulfillment and delivery providers, because supplier relationships are confidential business information. They are bound by contract to use recipient information only to produce and deliver the orders you place.

8. Cookies, Analytics, and Session Recording

We use cookies and similar technologies for:

• Authentication: to keep you signed in and protect your session
• Preferences: to remember settings such as display or theme preferences
• Security: to detect and prevent unauthorized access
• Analytics: to understand usage so we can improve the Services

We use Google Analytics and Microsoft Clarity on our Website and inside the GiftSpatch application. These tools show us how pages are used — clicks, scrolling, and where people get stuck — so we can improve them.

Advertising. We also use advertising tags from the advertising partners listed in Section 7, and their server-side equivalents, on our Website and application to measure and improve our advertising and to show GiftSpatch ads to people who have visited. They may receive your browsing activity on our pages and, when you sign up or pay, a hashed (unreadable) version of your email address. To opt out, use the Do Not Sell or Share My Personal Information link in the footer of every page of our Website or on the sign-in page of the application. We also honor the Global Privacy Control browser signal automatically. Opting out stops the advertising tools; it does not affect analytics, your account, or the Services.

You can configure your browser to refuse cookies, to alert you when one is set, or to block these tools entirely, and you may use our Website with them blocked. Disabling cookies may limit functionality, including the ability to stay signed in.

9. Retention and Deletion

We keep personal information only as long as we need it for the purpose we collected it, or as long as the law requires.

When you delete your account, we remove your personal information from our active systems within 30 days, except for the records above that we are required or permitted to retain. Those retained records are kept only for the stated purpose, are not used to market to anyone, and are deleted when the retention period ends.

10. Your Rights and Choices

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and know how we use it
• Correct inaccurate or incomplete information
• Delete your account and associated personal data
• Export your data in a structured, machine-readable format
• Object to or restrict certain processing
• Opt out of marketing email, of any sale or sharing of personal information, and of profiling with legal or similarly significant effects
• Withdraw consent where we rely on consent
• Appeal a decision we make on your request

To exercise any of these rights, email Email us. We will acknowledge within 10 days and respond within 45 days, extendable once where the law allows, and we may ask you to verify your identity first. An authorized agent may submit a request with written proof of authority. We will not discriminate against you for exercising a privacy right — no denial of service, different pricing, or reduced quality.

If your information was given to us by one of our business customers, we will refer your request to that business as described in Section 4, because they decide what happens to it.

11. U.S. State Privacy Rights

California. If you are a California resident, you have rights under the California Consumer Privacy Act as amended by the CPRA, including the right to know, access, correct, delete, and port your personal information, the right to opt out of the sale or sharing of personal information, the right to limit the use of sensitive personal information, and the right to non-discrimination.

• We do not sell personal information. We share limited browsing data with our advertising partners as described in Section 8, and you may opt out through the Do Not Sell or Share My Personal Information link or the Global Privacy Control signal. We do not knowingly share the personal information of anyone under 16.
• We do not collect sensitive personal information as that term is defined, so there is nothing to limit.
• The categories we collect, our purposes, and the categories we disclose to service providers are set out in Sections 2, 3, and 7 of this policy.
• When we act as a service provider to one of our business customers (Section 4), we are contractually prohibited from retaining, using, or disclosing that personal information for any purpose other than performing the services, from selling or sharing it, and from combining it with other data, and we certify that we understand and will comply with these restrictions.

Other states. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have comparable rights of access, correction, deletion, portability, and opt-out, together with a right to appeal a refusal. Use the same contact address; we apply the same process to everyone regardless of where they live.

Nevada. We do not sell personal information as defined by Nevada law.

12. Information Security

We use safeguards appropriate to the sensitivity of the data, including encryption in transit and at rest, per-tenant access rules enforced by the database itself, scoped staff permissions, multi-factor authentication on administrative accounts, audit logging of administrative actions, and daily encrypted backups with point-in-time recovery. Full payment card numbers never reach our systems — they go directly to our payment processor.

No system can be made completely secure, and no method of transmission or storage is perfectly safe. If a breach affects your personal information, we will notify you and the relevant authorities without undue delay and as required by law, and will tell you what happened, what data was involved, and what we are doing about it.

13. Children’s Privacy

The Services are intended for users who are at least 18 years of age. We do not knowingly collect personal information from children under 18, and we do not direct any part of the Services to children. If you believe a child has provided us information, contact Email us and we will delete it promptly.

14. United States Only

GiftSpatch is operated from the United States, and all personal data is stored and processed on servers located in the United States.

The Services are offered only in the United States. They are not offered, marketed, or directed to individuals or businesses in the European Economic Area, the United Kingdom, or Switzerland, we do not knowingly accept accounts from those regions, and we take steps to limit access to our Website from them. If you reach the Services from outside the United States you do so on your own initiative, and your information will be transferred to, stored in, and processed in the United States under United States law.

15. Changes to This Policy

We may update this Privacy Policy. When we make material changes we will notify you by email and/or by a notice within the Services before they take effect, and the Last Updated date at the top will change. We will not apply a materially different use to information already collected without giving you the choice the law requires.

16. Contact Us

GiftSpatch, a product of Doron Ventures LLC
Privacy & general inquiries: Email us