This Privacy Policy explains how Gifty.AI collects, uses, shares, retains, and protects information when merchants install or use the Gifty.AI Shopify application, when shoppers use Gifty features on a merchant’s storefront, and when visitors use our public website or support services.
Our role
For personal information that a merchant or shopper provides through a Shopify store, the merchant determines why and how that information is used. Gifty.AI processes that information on the merchant’s behalf to provide the service.
For information used to administer merchant accounts, provide support, secure the service, and operate our business, Gifty.AI may act as the party responsible for that processing.
Information we collect
Shopify store and merchant information
When a merchant installs or uses Gifty.AI, we receive information from Shopify that can include:
- the store name, Shopify domain, currency, time zone, installation status, and permissions granted to Gifty.AI;
- merchant user and session details supplied by Shopify, such as a user identifier, name, email address, locale, and account role; and
- authentication credentials and access tokens required to connect the app securely to Shopify.
Store configuration and product information
We process information a merchant configures in Gifty.AI, including widget settings and labels, selected gift products and variants, product titles, images and prices, theme identifiers, theme fingerprints, placement settings, setup instructions, and publication status.
Order and gifting information
To identify and manage orders that use gifting features, we process a limited set of Shopify order and line-item information, including order and line-item identifiers, order name, status, tags, product title, quantity, product image, selected add-ons, and gifting status.
Gift information can include a gift message and sender or recipient text entered by a shopper. Merchants should configure their storefront and notices so shoppers understand how this information is used. Gifty.AI does not request customer postal addresses, telephone numbers, payment card details, or other payment credentials for its gifting functionality.
Subscription and billing information
Shopify manages app subscriptions and payment processing. We receive subscription identifiers, plan, status, billing period, trial dates, and related entitlement information. We do not receive payment card numbers.
Integrations, support, and technical information
If a merchant configures an outbound integration, we store its name, destination URL, selected events, encrypted signing secret, and limited delivery results. Information sent to a merchant-configured destination is governed by the merchant and the destination’s terms and privacy practices.
When someone contacts support, we receive the information included in the request. We also create limited operational records such as timestamps, event identifiers, error codes, retry status, and sanitized logs needed to secure, troubleshoot, and maintain the service.
The public Gifty.AI marketing website does not include forms, analytics scripts, advertising trackers, or marketing cookies.
How we use information
We use information to:
- authenticate merchants and maintain their app sessions;
- configure, display, and publish gifting features;
- identify and manage orders containing gift options;
- provide subscription entitlements and confirm Shopify billing status;
- deliver merchant-configured integrations;
- provide support, diagnose errors, prevent abuse, and protect the service;
- meet legal, security, and Shopify platform obligations; and
- produce aggregated or de-identified operational information that does not identify a merchant or shopper.
We do not sell personal information, use it for behavioral advertising, or use it to make automated decisions that have legal or similarly significant effects on individuals.
How we share information
We share information only as needed to operate the service:
- Shopify: to authenticate merchants, receive platform events, access approved store resources, manage app billing, and support storefront functionality.
- Infrastructure and service providers: to host, secure, deliver, back up, monitor, and support Gifty.AI. These providers may process information only for the services they provide to us.
- Merchant-configured destinations: when a merchant enables an outbound webhook or another integration.
- Legal and safety purposes: when reasonably necessary to comply with law, enforce our agreements, or protect merchants, shoppers, Gifty.AI, or others.
- Business transfers: as part of a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality and legal protections.
We do not share information with data brokers.
Retention and deletion
Gift-order records are retained for no longer than 365 days after processing unless a shorter period is required by a valid deletion request or a longer period is required by law.
Store settings, subscription records, integration configuration, and related operational records are generally retained while the app remains installed and as needed to provide the service. When Shopify sends a valid customer or shop redaction request, Gifty.AI deletes the relevant records in accordance with Shopify’s required process. Residual copies in protected backups expire according to the applicable backup schedule.
We may retain limited records when required to establish, exercise, or defend legal claims, meet financial obligations, prevent fraud, or demonstrate compliance.
Security
We use administrative, technical, and organizational safeguards designed to protect information. These include encryption in transit, restricted service access, separation of production and development environments, protected backups, encryption of sensitive integration secrets, and sanitized operational logging.
No method of transmission or storage can be guaranteed to be completely secure. Merchants are responsible for protecting their Shopify accounts, controlling staff access, and keeping their integration credentials confidential.
International processing
Gifty.AI and its service providers may process information in countries other than the country where a merchant or shopper is located. Where required, we use appropriate safeguards for international transfers and require service providers to protect information consistently with applicable law.
Privacy rights and requests
Depending on location, individuals may have rights to access, correct, delete, restrict, or object to processing of their personal information, or to receive a portable copy.
Shoppers should first contact the Shopify merchant whose store collected their information. Merchants can submit requests through Shopify’s privacy tools or contact us through the Gifty.AI Help Center. We may need to verify a request and may retain information where permitted or required by law.
Children
Gifty.AI is a business service for Shopify merchants and is not directed to children. We do not knowingly collect personal information directly from children through the public website.
Changes to this policy
We may update this Privacy Policy to reflect changes to the service, our practices, or applicable requirements. We will post the revised policy here and update the date above. If a change materially affects how merchant or shopper information is handled, we will provide additional notice where appropriate.
Contact
Questions or requests about this policy can be submitted through the Gifty.AI Help Center.