Privacy Policy

Last Updated: June 25, 2026

1. Introduction

GiftSpatch ("GiftSpatch," "we," "us," or "our") is a business-to-business gifting platform that helps businesses send personalized and branded items to their customers. This Privacy Policy explains how we handle personal information in connection with the website https://giftspatch.io (the "Website") and the GiftSpatch web application (together, the "Services").

It applies to visitors to our Website, account holders, members of a business account, and the gift recipients whose addresses are entered by our business users. By using GiftSpatch, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

Information you provide directly:

• Account email address and display name (via Google sign-in)
• Company name and the team members you invite
• Designs and logo files you upload to brand your gifts
• Recipient details you enter to send a gift (see Section 4)
• Billing information, if and when paid plans are introduced (processed by our payment processor; we do not store full payment card numbers)
• Communications you send to our support team

Information collected automatically:

• Browser type, version, language, operating system, and device type
• IP address and approximate location (city/region only)
• Pages visited, features used, session duration, and timestamps
• Error logs and diagnostic data

Information from connected accounting or CRM software (e.g., QuickBooks Online). If you choose to connect a third-party accounting or CRM service such as QuickBooks Online (Intuit), you authorize us to access certain data from that account through the provider’s secure API using OAuth. For QuickBooks Online, we access your customer records and invoices on a read-only basis to detect the events you configure to trigger a gift (for example, a paid or sent invoice). We only read this information — we never create, modify, or delete anything in your QuickBooks account, and we do not access your banking, payroll, or tax data. Connecting is entirely optional. You can disconnect at any time from your account settings or from within QuickBooks; disconnecting immediately stops the sync and deletes the stored connection credentials (see Section 8).

3. How We Use Information

We use personal information to:

• Provide and maintain the Services, including the catalog, gift designer, order placement, and order history
• Authenticate you and the team members you grant access
• Produce and fulfill the gift orders you place, including sharing the necessary recipient and design details with our fulfillment providers
• Send service-related communications (account notifications, order alerts, critical product updates)
• Respond to your support requests
• Detect, prevent, and investigate fraud, abuse, and violations of our Terms of Service
• Improve the Services and develop new features based on usage patterns and feedback
• Comply with legal obligations and enforce our agreements

We do not sell your personal information, and we never sell or share recipient information for marketing purposes.

4. Recipient Information

To send a gift, our business users enter information about the recipient: typically a name and shipping address, and sometimes a short message. We process this recipient information only to fulfill the order it relates to.

Who is responsible for recipient data. When a business uses GiftSpatch to send a gift, that business decides to send the gift and provides the recipient's details. As between that business and GiftSpatch, the business is the controller of the recipient's information and is responsible for having a valid lawful basis and for obtaining any consents or providing any notices required to share that information with us (see our Terms of Service). GiftSpatch acts as the business's service provider, processing recipient information only on that business's instructions to fulfill the order. We do not decide on our own to contact recipients, and we do not use recipient information for our own marketing or sell it.

• Used only for fulfillment. Recipient details are used to produce and ship the gift, and for related customer service. They are never used to market to recipients.
• Isolated per business account. Recipient and order data belonging to one business account is not mixed with, aggregated with, or exposed to any other account.
• Shared only as needed. Recipient name, address, and the chosen design are shared with the fulfillment provider responsible for producing and shipping that order, and with shipping carriers.

If you are a gift recipient and would like your information removed, contact us at hello@giftspatch.io and we will work with the sending business to address your request.

5. Sharing Information

We share personal information only in these limited circumstances:

• With service providers who help us operate the Services (see Section 6)
• To comply with legal obligations, such as a subpoena, court order, or other lawful request
• To protect rights and safety, including to enforce our Terms of Service or investigate fraud
• In connection with a business transaction, such as a merger, acquisition, or sale of assets, with notice before your information becomes subject to a different privacy policy

6. Service Providers

GiftSpatch relies on a small number of third-party providers, each bound by their own privacy commitments and permitted to use your data only to provide services to us.

GiftSpatch does not serve third-party advertising and does not share your data with advertising networks.

7. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Services and understand how users interact with our Website. We use them for:

• Authentication: to keep you signed in and protect your session
• Preferences: to remember settings such as display or theme preferences
• Security: to detect and prevent unauthorized access
• Analytics: to understand usage so we can improve the Services

You can configure your browser to refuse cookies or alert you when one is set. Disabling cookies may limit functionality, including the ability to stay signed in.

8. Retention and Deletion

• Active account data: retained while your account is active
• Connected-software credentials (e.g., QuickBooks OAuth tokens): stored only while the integration is connected, and deleted immediately when you disconnect (from your account settings or from within QuickBooks)
• Recipient and order data: retained as long as needed to provide the Services and meet legal and accounting obligations; recipient personal information is removed from active systems within 30 days of a deletion request, subject to any required retention
• Financial and transaction records: retained for up to seven (7) years where required by tax and accounting obligations
• Website analytics: retained for up to 26 months

When you delete your account, we remove your personal information from our active systems within 30 days, subject to legal or regulatory retention requirements.

9. Your Rights and Choices

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete information
• Delete your account and associated personal data
• Export your data in a structured, machine-readable format
• Object to or restrict certain processing
• Withdraw consent where we rely on consent

To exercise any of these rights, email hello@giftspatch.io. We will respond within 30 days and may ask you to verify your identity first.

10. California Residents

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA, including the right to know, access, correct, and delete your personal information, the right to opt out of the sale or sharing of personal information (GiftSpatch does not sell or share personal information for cross-context behavioral advertising), and the right to non-discrimination for exercising these rights. To exercise them, email hello@giftspatch.io.

11. Information Security

We use industry-standard safeguards to protect your information, including encryption in transit and at rest, and access controls that limit who can reach production data. No system can be made completely secure. If a breach affects your personal information, we will notify you and the relevant authorities as required by law.

12. Children’s Privacy

The Services are business tools intended for users who are at least 18 years of age. We do not knowingly collect personal information from children under 18. If you believe we have, contact hello@giftspatch.io and we will take steps to delete it.

13. International Users

GiftSpatch is operated from the United States, and your personal data is stored on servers located in the United States. If you access the Services from outside the United States, you acknowledge that your data will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

14. Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will notify you by email and/or by posting a notice within the Services. The "Last Updated" date reflects the most recent revision. Your continued use of the Services after changes take effect constitutes acceptance.

15. Contact Us

GiftSpatch, a product of Doron Ventures LLC
Privacy & general inquiries: hello@giftspatch.io
Location: Lancaster, PA, USA