Privacy Policy

Last Updated: September 23, 2026

1. Introduction and Our Two Roles

GiftSpatch ("GiftSpatch," "we," "us," or "our"), a product of Doron Ventures LLC, is primarily a business-to-business gifting platform, used mainly by businesses to send personalized and branded items to their customers and employees, and also usable to send gifts personally. This Privacy Policy explains how we handle personal information in connection with the website https://giftspatch.io (the "Website") and the GiftSpatch web application (together, the "Services").

It applies to visitors to our Website, account holders, members of a business account, and the gift recipients, employees, and customer contacts whose details are entered or imported by our business users.

We act in two different roles, and the difference matters. For our own account holders and Website visitors, we are the controller (the "business") and this policy describes what we do and why. For the recipients, employees, and customer records that our business users enter or import, we are only a processor (a "service provider") acting on that business's instructions — that business decides who receives a gift and what information to give us, and its own privacy policy governs. Section 4 explains this in detail.

By using GiftSpatch, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

Information you provide directly:

• Account email address and display name (Google sign-in, or email and password)
• Company name, address, and the team members you invite
• Designs, logos, and artwork you upload to brand your gifts
• Recipient details you enter to send a gift (see Section 4)
• Recipient email address or phone number, when you send a gift link rather than shipping to an address
• Employee records you enter into your company directory: name, address, email address, phone number, birthday, hire date, and any notes or custom fields you add
• Billing information for your subscription plan and any gifts you purchase, processed by our payment processor; we do not store full payment card numbers — we keep only a card summary (brand, last four digits, expiry month and year) returned to us by the processor
• Your email address if you submit it on our Website, together with the page you were on when you submitted it
• Communications you send to our support team, and feedback you submit

Information collected automatically:

• Browser type, version, language, operating system, and device type
• IP address, and from it an approximate location, the network provider, and whether the connection appears to use a VPN or proxy
• Device and browser characteristics and recent IP addresses on your account, used to recognize your sign-ins and detect suspicious access
• Sign-in security details from our authentication provider, such as whether your email is verified and which sign-in methods you use
• Pages visited, features used, session duration, and timestamps
• If you send us your email address through a form on our Website, we link that record of pages visited to your enquiry, so that the person who replies to you can see what you were reading. Visitors who do not contact us are not identified this way.
• Delivery and engagement data for emails we send you, such as whether a message was delivered, opened, or its links followed
• Error logs and diagnostic data, including the page where an error happened and your browser type

Information from other sources: accounting or CRM software you choose to connect (see Section 5), and our payment processor, which tells us the outcome of a payment, a card summary, and any dispute.

What we do not collect. We do not collect government identification numbers, financial account numbers, precise GPS location, biometric data, health data, or information about your race, religion, political opinions, sexual orientation, or union membership. We do not knowingly collect information from children (see Section 13).

3. How We Use Information

We use personal information to:

• Provide and maintain the Services
• Authenticate you and the team members you grant access, and enforce permissions
• Produce and fulfill the gift orders placed through your account, including sharing the necessary recipient and design details with our fulfillment providers and shipping carriers
• Take payment, calculate applicable sales tax, maintain your account balance, and keep financial records
• Send service-related communications, such as account notifications, order alerts, security notices, and critical product updates
• Respond to your support requests and act on feedback
• Detect, prevent, and investigate fraud, abuse, unauthorized access, and violations of our Terms of Service
• Improve the Services and develop new features based on usage patterns and feedback
• Comply with legal, tax, and accounting obligations, and establish, exercise, or defend legal claims

Marketing. We may send marketing messages about GiftSpatch to our own account holders and to people who give us their email address on our Website. Every marketing message has an unsubscribe link, and unsubscribing does not stop service-related messages you need in order to use your account. We never market to the recipients, employees, or customer contacts that our business users enter.

Automated processing. Gift automations run on rules our business users configure, and our security tooling scores sign-in activity for risk. Neither produces legal effects concerning you or similarly significant effects, and neither replaces a human decision about your access to the Services.

We do not sell personal information, and we never sell or rent recipient, employee, or customer-contact information. We use third-party advertising tools to measure our ads and to show GiftSpatch ads to people who visited our Website, which some state laws treat as “sharing”; you can opt out at any time (Section 8).

4. Recipient and Employee Information

To send a gift, our business users enter information about the recipient: typically a name and shipping address, and sometimes an email address, phone number, or a short message. Where a business sends a gift link rather than shipping directly, we use the recipient's email address or phone number to deliver that link. A business may also store records about its own employees in order to send them gifts, including home address, phone number, birthday, hire date, and notes.

Who is responsible. When a business uses GiftSpatch, that business decides to send the gift and provides the details. That business is the controller (the "business" under U.S. state privacy laws) and is responsible for any notices and consents required before sharing that information with us. GiftSpatch acts as its processor and service provider, only on its instructions. We do not decide on our own to contact recipients or employees, and we do not use their information for our own purposes.

• Used only for fulfillment. Details are used to produce, personalize, and ship the gift, to deliver a gift link where instructed, and for related customer service. They are never used to market to that person.
• Isolated per business account. Data belonging to one business account is not mixed with, aggregated with, or exposed to any other account.
• Shared only as needed. Recipient name, address, and the chosen design are shared with the fulfillment provider producing and shipping that order, and with shipping carriers.
• We do not enrich it. We do not append data from outside sources to a recipient, employee, or customer record.

If you are a recipient or an employee and want to know who sent you something, object to receiving gifts, or have your information corrected or removed, email us at Email us. Because we act on the sending business's instructions, we will identify that business to you, pass your request to them, and act on it ourselves where we are permitted to do so. We will not charge you and will respond within the time the law allows.

5. Connected Accounting and CRM Software

What we connect to. Currently QuickBooks Online and Jobber. The same terms apply to any integration we add; the live list is shown in your account settings.

How access works. If you connect a supported service, you authorize us to access certain data from that account through the provider's secure API. Connecting is optional.

What we read. Only what is needed to detect the events you configure to trigger a gift, such as a paid invoice or a new customer. In QuickBooks Online that means customer, invoice, estimate, payment, customer-type, and recurring-transaction records; in Jobber, client, property, job, and invoice records. Access is read-only.

What we never do. We never create, modify, or delete anything in your connected account, and we never access banking, payroll, tax filings, or stored payment data.

Disconnecting. You can disconnect at any time from your account settings or from within the connected service. That stops the sync and deletes the stored credentials. Data already synced stays in your account until you delete it or close your account (see Section 9).

6. Sharing Information

We share personal information only in these limited circumstances:

• With service providers who help us operate the Services, under contracts limiting them to our instructions (see Section 7)
• With the business that sent a gift, where you are a recipient or employee and contact us about it
• To comply with legal obligations, such as a subpoena, court order, tax requirement, or other lawful request
• To protect rights and safety, including to enforce our Terms of Service, investigate fraud or abuse, or protect against harm
• In connection with a business transaction, such as a merger, acquisition, financing, or sale of assets, with notice before your information becomes subject to a different privacy policy
• With your direction or consent, such as when you connect a third-party service

GiftSpatch does not serve third-party advertising on its pages and does not share your data with data brokers. We share limited browsing data with our advertising partners (listed in Section 7) for our own advertising, as described in Section 8.

7. Service Providers and Subprocessors

GiftSpatch relies on a small number of third-party providers, each bound by contract to use your data only to provide services to us. We remain responsible for their handling of personal information we entrust to them, and we require each of them to protect it on terms at least as protective as this policy.

We do not publicly identify our fulfillment and delivery providers, because supplier relationships are confidential business information. They are bound by contract to use recipient information only to produce and deliver the orders you place.

8. Cookies, Analytics, and Session Recording

We use cookies and similar technologies for:

• Authentication: to keep you signed in and protect your session
• Preferences: to remember settings such as display or theme preferences
• Security: to detect and prevent unauthorized access
• Analytics: to understand usage so we can improve the Services

We use Google Analytics and Microsoft Clarity on our Website and inside the GiftSpatch application. These tools show us how pages are used — clicks, scrolling, and where people get stuck — so we can improve them.

Our own measurement. We also measure use of our Website and application ourselves, using a first-party cookie kept for up to 400 days. We record the pages you view, what you do on them, the site that linked to us, your device type, and an approximate location taken from your IP address, which we do not keep. We do not record what you type into a form, except the free-sample form, which saves each field as you fill it in so we can follow up. This data is never shared or sold, is kept for up to 25 months, and can be prevented by blocking cookies for our sites.

Advertising. We use advertising tags from the partners in Section 7, in the browser and from our servers, to measure our ads and show GiftSpatch ads to people who have visited. They may receive your activity on our pages, the ad you clicked, and your IP address and browser type. When you give us your email address, sign up, or pay, they may also receive hashed (unreadable) contact details of the account holder (email, phone, name, and business city, state and ZIP code), used only to match the action to an ad. We never send them information about your gift recipients, customers, or employees. To opt out, use the Your Privacy Choices link in the footer of our Website or on the application sign-in page and press Opt out; we also honor the Global Privacy Control signal. Opting out stops the advertising tools only.

You can configure your browser to refuse cookies, to alert you when one is set, or to block these tools entirely, and you may use our Website with them blocked. Disabling cookies may limit functionality, including the ability to stay signed in.

9. Retention and Deletion

We keep personal information only as long as we need it for the purpose we collected it, or as long as the law requires.

When you delete your account, we remove your personal information from our active systems within 30 days, except for the records above that we are required or permitted to retain. Those retained records are kept only for the stated purpose, are not used to market to anyone, and are deleted when the retention period ends.

10. Your Rights and Choices

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and know how we use it
• Correct inaccurate or incomplete information
• Delete your account and associated personal data
• Export your data in a structured, machine-readable format
• Object to or restrict certain processing
• Opt out of marketing email, of any sale or sharing of personal information, and of profiling with legal or similarly significant effects
• Withdraw consent where we rely on consent
• Appeal a decision we make on your request

To exercise any of these rights, email Email us. We will acknowledge within 10 days and respond within 45 days, extendable once where the law allows, and we may ask you to verify your identity first. An authorized agent may submit a request with written proof of authority. We will not discriminate against you for exercising a privacy right — no denial of service, different pricing, or reduced quality.

If your information was given to us by one of our business customers, we will refer your request to that business as described in Section 4, because they decide what happens to it.

11. U.S. State Privacy Rights

California. If you are a California resident, you have rights under the California Consumer Privacy Act as amended by the CPRA, including the right to know, access, correct, delete, and port your personal information, the right to opt out of the sale or sharing of personal information, the right to limit the use of sensitive personal information, and the right to non-discrimination.

• We do not sell personal information. We share limited browsing data with our advertising partners as described in Section 8, and you may opt out of that sharing through the Your Privacy Choices link at the bottom of every page of our website and on the app’s sign-in page, or with the Global Privacy Control signal. We do not knowingly share the personal information of anyone under 16.
• We do not collect sensitive personal information as that term is defined, so there is nothing to limit.
• The categories we collect, our purposes, and the categories we disclose to service providers are set out in Sections 2, 3, and 7 of this policy.
• When we act as a service provider to one of our business customers (Section 4), we are contractually prohibited from retaining, using, or disclosing that personal information for any purpose other than performing the services, from selling or sharing it, and from combining it with other data, and we certify that we understand and will comply with these restrictions.

Other states. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have comparable rights of access, correction, deletion, portability, and opt-out, together with a right to appeal a refusal. Use the same contact address; we apply the same process to everyone regardless of where they live.

Nevada. We do not sell personal information as defined by Nevada law.

12. Information Security

We use safeguards appropriate to the sensitivity of the data, including encryption in transit and at rest, access controls that keep each account’s data separate, limited staff access, and regular encrypted backups. Full payment card numbers never reach our systems — they go directly to our payment processor.

No system can be made completely secure, and no method of transmission or storage is perfectly safe. If a breach affects your personal information, we will notify you and the relevant authorities as required by law.

13. Children’s Privacy

The Services are intended for users who are at least 18 years of age. We do not knowingly collect personal information from children under 18, and we do not direct any part of the Services to children. If you believe a child has provided us information, contact Email us and we will delete it promptly.

14. United States Only

GiftSpatch is operated from the United States, and all personal data is stored and processed on servers located in the United States.

The Services are offered only in the United States. They are not offered, marketed, or directed to individuals or businesses in the European Economic Area, the United Kingdom, or Switzerland, we do not knowingly accept accounts from those regions, and we take steps to limit access to our Website from them. If you reach the Services from outside the United States you do so on your own initiative, and your information will be transferred to, stored in, and processed in the United States under United States law.

15. Changes to This Policy

We may update this Privacy Policy. When we make material changes we will notify you by email and/or by a notice within the Services before they take effect, and the Last Updated date at the top will change. We will not apply a materially different use to information already collected without giving you the choice the law requires.

16. Contact Us

GiftSpatch, a product of Doron Ventures LLC
Privacy & general inquiries: Email us