Legal
Giftay privacy policy
Giftay knows where you are when you look for somewhere nearby, and it knows which shops you go back to. This explains what happens to both.
Who we are
Neirfeno Limited is the data controller for the personal data described in this policy.
| Who runs Giftay | Neirfeno Limited |
|---|---|
| Company number | SC514019, registered in Scotland |
| Registered office | 7 Thorter Way, Dundee, DD1 3DF |
| Support and data protection | support@giftay.co.uk |
| ICO registration | ZB673603 |
This policy covers the Giftay mobile app on iOS and Android, and this website. Read it alongside our terms and conditions.
Two kinds of user
Giftay has members, who collect stamps and rewards at independent businesses, and businesses, which run those loyalty schemes. This policy covers both, and says which parts apply to which.
Where a business you have visited sees your activity at its own shop, it becomes a controller of that information for its own purposes. What it then does with it is governed by its privacy notice, not this one. We are controller of the Giftay account and the underlying record.
What we collect
Your account
You sign in with Google, Apple or Facebook. We receive an account identifier and, normally, your email address and display name. If you use Sign in with Apple and choose to hide your email, we receive Apple's relay address and that is all we ever see.
If you sign in with Facebook, see signing in with Facebook below — it has consequences the other two do not.
Where you are
Giftay's whole purpose is showing what is near you, so with your permission the app reads your device's location and uses it to sort and filter the shops it shows you, and to place them on a map.
- We ask for location only while you are using the app. Giftay does not track you in the background and does not build a history of your movements.
- We use your location to answer the query in front of you. We do not store a log of the positions your device has reported.
- You can refuse, and you can withdraw the permission at any time in your phone's settings. The app still works — you will need to search by area rather than have it find you.
Your stamps and rewards
When you collect a stamp, redeem a reward or take part in a scheme, we record which business it was, when, and what happened. This builds a record of which independent shops you use and how often.
Scanning a code with the camera happens on your device. The camera image is not sent to us or stored — only the result of the scan is.
If you run a business on Giftay
We hold your business's name, address, contact details, opening hours, category and description; the logo, banner and card images you upload; the details of the schemes you run; and the identity and role of the people you give access to.
Most of this is meant to be public — a directory that hides its shops is no use to anyone — so treat what you enter as published. Do not put a home address or a personal mobile number in a public field unless you are content for it to be seen.
Purchases
Where you buy something in the app, the payment is taken by Apple or Google through their in-app purchase systems, not by us. We never see or hold your card number. We receive confirmation that a purchase was made and what it was for, so we can give you what you paid for.
Your device
If you turn on notifications, we hold a push token so we can send you one. You can turn this off in your phone's settings.
We collect technical information through Google Analytics for Firebase: app version, device model, operating system version, language, approximate location derived from your IP address at country or city level, a randomly generated app instance identifier, and which screens and features are used. Your consent governs this — see your device and your consent.
When you contact us
If you email support@giftay.co.uk we hold your address, what you wrote, and anything you include.
Why we use it, and our legal basis
| What we do | Data | Legal basis |
|---|---|---|
| Run your account | Account | Performance of a contract |
| Show you what is nearby and put it on a map | Location | Consent, given through your device's permission prompt |
| Record your stamps and let you redeem rewards | Stamp and reward activity | Performance of a contract |
| List a business and its schemes | Business details, images | Performance of a contract with that business |
| Give a business the record of activity at its own shop | Stamp activity at that shop | Performance of a contract, and our legitimate interest in operating a loyalty scheme that works for both sides |
| Provide what you bought | Purchase confirmation | Performance of a contract |
| Send you a notification | Push token | Consent |
| Keep the service secure and prevent fraudulent stamping | Account, activity, technical | Legitimate interests — protecting the service, its members and the businesses on it |
| Answer your support email | Your correspondence | Legitimate interests |
| Understand which features are used, and fix what is broken | Analytics | Consent |
| Meet legal obligations and defend legal claims | Whatever is relevant | Legal obligation, and legitimate interests |
Your device and your consent
Analytics, in-app messaging and the Facebook SDK all involve storing and reading information on your device. Under the Privacy and Electronic Communications Regulations that needs your consent, because none of it is necessary to deliver Giftay. We ask, and you can decline without losing the app.
You can withdraw consent at any time in the app's settings, or by removing the relevant permission in your phone. Withdrawing stops further collection; ask us if you want what was already collected deleted too.
We do not use Giftay to serve you third-party advertising.
Signing in with Facebook
This deserves saying plainly. If you choose to sign in with Facebook, Giftay uses Meta's software development kit. That means:
- Meta learns you use Giftay. It receives information about the sign-in and about your device, as a controller in its own right, and uses it under its own privacy policy — which we neither write nor control.
- Data goes to the United States. Meta processes it there. That transfer relies on the safeguards in Meta's own terms, including the UK Addendum to the standard contractual clauses.
- You do not have to. Google and Apple sign-in do the same job. Sign in with Apple, with the option to hide your email, shares the least.
We only load the Facebook SDK where you have consented to it.
Who else sees it
We do not sell personal data and we do not share it for anyone else's marketing.
Businesses on Giftay
A business whose scheme you take part in sees your activity at its own shop — that you collected a stamp, when, and what you redeemed — together with the name on your account. It does not see your activity anywhere else, your location, or your email address unless you give it to them.
Service providers
| Provider | What they do for us |
|---|---|
| Google Cloud (Firebase Authentication, Cloud Firestore, Realtime Database, Cloud Functions, Cloud Storage) | Sign-in, the databases, the server logic and image storage |
| Google (Firebase Cloud Messaging, In-App Messaging) | Notifications and in-app messages |
| Google (Analytics for Firebase) | Usage analytics, only where consented |
| Google Maps Platform | Showing shops on a map and looking up addresses |
| Google Workspace | Our support mailbox |
Google, Apple and Meta act as controllers in their own right for the sign-in you choose, and Apple and Google for any purchase you make, under their own policies.
Otherwise we disclose only where legally required — a court order, or a lawful request from a regulator or law enforcement — or to professional advisers under a duty of confidence, or to a buyer if the business is sold, in which case we would tell you first.
Where it is kept
Your account, your stamp record and business listings are stored in the United Kingdom and the European Economic Area.
Two things leave: analytics, processed by Google in the United States, and, if you use it, Facebook sign-in, processed by Meta in the United States. Both rely on the International Data Transfer Addendum to the European Commission's standard contractual clauses, issued by the Information Commissioner under section 119A of the Data Protection Act 2018. Decline analytics and do not use Facebook sign-in, and no data about you goes to either.
How long we keep it
| Data | Kept for |
|---|---|
| Your account | While it is open. Deleted within 30 days of you asking — see deleting your account. |
| Stamp and reward activity | While your account is open, so you keep progress towards a reward. Deleted with the account. |
| Business listings and images | While the business account is open, then 90 days. |
| Purchase records | 6 years, which is how long we must keep records of a transaction for tax purposes. |
| Analytics | Up to 14 months from collection, then deleted automatically. |
| Support correspondence | 24 months from the last message. |
| Encrypted backups | Deleted data persists in backups for up to 90 days before being overwritten. |
We do not keep a log of the locations your device reported, so there is nothing to retain.
Your rights
UK data protection law gives you rights over the personal data we hold about you. They are not all absolute: some apply only in particular circumstances, and some are limited where we have to keep data to meet a legal obligation or to establish, exercise or defend a legal claim.
| Right | What it means |
|---|---|
| Access | Ask for a copy of the personal data we hold about you, and for an explanation of how and why we use it. |
| Rectification | Have inaccurate data corrected, and incomplete data completed. |
| Erasure | Ask us to delete your data — for example where we no longer need it, where you withdraw consent we were relying on, or where you object and we have no overriding grounds to continue. |
| Restriction | Ask us to stop using your data, while keeping it, when you are contesting its accuracy or our grounds for holding it. |
| Objection | Object to processing we carry out on the basis of our legitimate interests. Where we process for direct marketing, your objection is absolute and we must stop. |
| Portability | Receive the data you gave us in a structured, commonly used, machine-readable format, and have it transmitted to another provider where that is technically feasible. |
| Withdraw consent | Withdraw consent at any time where consent is the basis we rely on. This does not affect the lawfulness of processing carried out before you withdrew it. |
| Automated decisions | Not be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. |
To exercise any of these, email support@giftay.co.uk. We may need to confirm your identity before we act, so that we do not disclose your data to somebody else. We respond within one month. We can extend that by a further two months where a request is complex or where you have made several — if we need to, we will tell you within the first month and explain why. There is no charge, unless a request is manifestly unfounded or excessive.
If you are unhappy with how we have handled your data or your request, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would rather you came to us first so we have a chance to put it right, but you do not have to.
A note on erasure: deleting your account removes your stamp record, which means losing progress towards any reward you had not yet claimed. We will say so before we do it, so you can redeem first if you want to.
Security
Data is encrypted in transit and at rest. Our database rules restrict each member to their own records and each business to its own, while shop listings are deliberately public. Access to production systems is restricted and protected by multi-factor authentication.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it, and tell you directly if the risk to you is high.
Children
Giftay is not intended for under-16s and we do not knowingly collect their data. If you believe a child has given us personal data, email support@giftay.co.uk and we will delete it.
Automated decision-making
Giftay ranks shops by distance and by what people have said about them. That is a list put in front of you, not a decision made about you. We do not carry out solely automated decision-making that produces legal effects concerning you or similarly significantly affects you.
Changes to this policy
When we change this policy we publish it with a new version date. Where a change materially affects how we use your data we will tell you in the app or by email before it takes effect, and where a change needs consent we will ask rather than assume.
Contact us
Email support@giftay.co.uk or write to Neirfeno Limited, 7 Thorter Way, Dundee, DD1 3DF.