1. Introduction

Welcome to GiftShopper.ai, a service operated by DiversifiedFun LLC ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

By using GiftShopper.ai, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.

2. Information We Collect

Account and Profile Information

When you create an account, we collect your email address and any information you choose to provide. When you use our gift-planning features, you may save profiles for gift recipients ("People") containing: name or nickname, relationship to you, age range, gender, interests, notes, occasion dates (birthdays, anniversaries, and other reminders), gift history, and like/dislike feedback on past suggestions. This information is stored in your account and is used solely to generate personalized gift recommendations for you.

You are responsible for the accuracy of the data you enter about other people and for ensuring you have appropriate permission to store it.

Anonymous Use

You may use a limited number of gift searches without creating an account. Anonymous favorites are stored in your browser's local storage and are not sent to our servers. We use your IP address solely for rate-limiting purposes on anonymous requests; it is not linked to your identity.

Automatically Collected Information

When you access our services, we automatically collect certain information, including:

• Device and browser information
• IP address (used for rate limiting on anonymous requests)
• Usage data and interaction patterns
• Cookies and similar tracking technologies

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Generate personalized gift recommendations
• Send occasion reminders and lifecycle emails (if you have opted in to marketing emails)
• Process transactions and send related transactional information
• Send you technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze trends, usage, and activities
• Detect, investigate, and prevent fraudulent transactions and abuse
• Personalize and improve your experience

4. Email Communications

We send two categories of email:

• Transactional emails: Account confirmations, password resets, and other emails directly related to your account activity. These are sent regardless of your marketing preference.
• Marketing and occasion-reminder emails: Upcoming-occasion reminders, gift ideas, and promotional messages. These are sent only if you have opted in via your notification preferences. You may opt out at any time using the one-click unsubscribe link in any marketing email or by updating your preferences in account settings.

Email is sent through Resend (see Section 9). Your unsubscribe request is recorded and honored promptly.

5. Shared Gift Links

When you share a gift result using the share feature, a publicly accessible page is created at a unique URL (e.g., giftshopper.ai/gift/<slug>). This page displays the recipient's first name or label (as you entered it), the occasion, and the gift suggestions. Anyone with the link can view this page. Do not share links if you do not want the recipient's name and gift ideas to be visible to others.

6. Agent API and Third-Party App Access

GiftShopper.ai offers an API that allows third-party AI agents and applications to act on your behalf. Access is granted via personal API keys (prefixed gs_live_) or via OAuth 2.0 authorization. When you authorize a third-party app:

• The authorized app may read and write your People profiles, occasions, gift history, and favorites, and may trigger gift generation — within the permissions you grant.
• API keys are secrets. Treat them like passwords. Do not share them. If you believe a key has been compromised, revoke it immediately in Settings.
• You are responsible for any actions taken by apps you authorize.
• You can revoke access to any authorized app or API key at any time in Settings.
• The API enforces a rate limit of 60 requests per minute per key.

We are not responsible for the data practices of third-party apps that you choose to authorize.

7. Affiliate Disclosure

Many gift links on GiftShopper.ai are Amazon affiliate links. When you click a gift link and make a purchase on Amazon, GiftShopper.ai may earn a commission at no additional cost to you. This affiliate relationship does not affect which gifts we suggest — recommendations are generated by AI based on the recipient information you provide, not on commission rates.

8. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal data based on the following legal grounds:

• Consent: You have given us permission to process your personal data for specific purposes (e.g., marketing emails)
• Contract: Processing is necessary for the performance of a contract with you
• Legal Obligation: Processing is necessary for compliance with legal obligations
• Legitimate Interests: Processing is necessary for our legitimate interests, provided they are not overridden by your rights

9. Third-Party Processors

We share data with the following categories of third-party processors to operate our service:

• Supabase: Authentication and database hosting. Stores your account data, People profiles, occasions, and gift history.
• Vercel: Frontend hosting and edge delivery.
• Resend: Transactional and marketing email delivery.
• Google (Gemini models): Gift recommendations are generated by sending recipient details and interests you provide to Google's Gemini AI models via the Google AI API. Google processes this data to produce gift suggestions returned to you in the app.
• ScrapingBee: Used to resolve and validate shoppable product links from Amazon.
• PostHog: Product analytics (event tracking, session data).
• Google Analytics (gtag): Web analytics (page views, traffic sources).

Each processor has its own privacy policy governing how they handle data.

10. Cookies

We use cookies and similar tracking technologies. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, some parts of our service may not function correctly.

Types of cookies we use:

• Essential Cookies: Required for authentication and core service operation
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Set by PostHog and Google Analytics to help us understand how visitors interact with our service

11. Your Rights Under GDPR

If you are a resident of the EEA, you have the following data protection rights:

• Right to Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Request limitation of processing
• Right to Data Portability: Request transfer of your data
• Right to Object: Object to processing of your personal data
• Right to Withdraw Consent: Withdraw consent at any time

To exercise any of these rights, please contact us at info@diversifiedfun.com. DiversifiedFun LLC, operator of GiftShopper.ai, is responsible for processing your request.

12. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know / Access: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request that we delete your personal information, subject to certain exceptions (such as legal retention obligations).
• Right to Correct: You may request correction of inaccurate personal information we hold about you.
• Right to Opt Out of Sale/Sharing: We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

To exercise any of these rights, contact us at info@diversifiedfun.com. We will respond within the timeframe required by applicable law. We may need to verify your identity before processing your request.

13. Florida Digital Bill of Rights

If you are a Florida resident, you may have additional rights under the Florida Digital Bill of Rights (FDBR), including rights to access, delete, and correct your personal data, and to opt out of certain processing. To exercise any rights available to you under the FDBR, contact us at info@diversifiedfun.com.

14. Data Retention

We retain your personal information for as long as your account is active and for a reasonable period thereafter as necessary to fulfill the purposes described in this policy, including satisfying legal, accounting, or reporting requirements.

You can delete individual recipient profiles ("People"), occasions, and gift history at any time through the app. You can delete your entire account through account settings or by contacting us at info@diversifiedfun.com. Upon account deletion, we will delete or anonymize your personal data within a reasonable period, except where retention is required by law (for example, transaction records required for tax or financial compliance).

Anonymous session data and aggregated analytics data may be retained longer in a form that cannot identify you.

15. Data Security

We implement appropriate technical and organizational measures to protect your personal information. Specifically:

• Encryption in transit: Data transmitted between your browser and our services is encrypted using TLS/HTTPS.
• Encryption at rest: Your data is stored through Supabase (database) and Vercel (hosting), both of which encrypt data at rest by default.
• Access controls: Access to personal data is restricted to authorized personnel who need it to operate and support the service.

No method of transmission over the internet or electronic storage is 100% secure. While we use industry-standard safeguards, we cannot guarantee absolute security.

16. International Data Transfers

Your information may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ. If you are located outside the United States and choose to provide information to us, please note that we transfer the data to the United States and process it there. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

17. Children's Privacy

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal data from a child under 16 without verification of parental consent, we take steps to remove that information from our servers.

18. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

19. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: info@diversifiedfun.com
• Website: www.diversifiedfun.com