GiftEase Privacy Policy

Last updated: June 30, 2026

Draft notice: This document is a product-specific draft prepared for GiftEase. It is not legal advice. Have a licensed attorney review and approve this Privacy Policy before you rely on it for a public launch.

This Privacy Policy explains how William Locklier ("GiftEase," "we," "us," or "our") collects, uses, shares, and protects personal information when you use the GiftEase website, business dashboard, embeddable widget, hosted purchase pages, APIs, and related services (collectively, the "Service").

1. Who we are

GiftEase is operated by William Locklier, a sole proprietorship based in the United States.

Contact for privacy questions:
William Locklier
Email: WilliamLocklier27@gmail.com

2. Scope of this policy

This Privacy Policy applies to personal information we process through:

• Our marketing website and account pages (for example, signup and login);
• The business dashboard used by merchants;
• Hosted purchase pages (for example, /buy/[business-id]);
• The embeddable purchase widget on merchant websites; and
• APIs and backend systems that fulfill purchases and deliveries.

This policy is intended for a United States audience. The Service is not directed at children outside the United States.

3. Our role: controller vs. processor

GiftEase interacts with two main groups of people:

| Who | Our role | Summary | |-----|----------|---------| | Business users (spa owners, salon operators, etc.) who create a GiftEase account | Controller | We decide how to collect and use account and business profile information to operate the Service. | | Gift purchasers and recipients whose information is collected during checkout or delivery | Processor / service provider (on the merchant's behalf) | Merchants are the sellers of gift cards and vouchers. They determine why customer data is collected for those sales. We process that information to provide the Service to the merchant. |

If you are a gift purchaser or recipient, the merchant (the business whose gift card or voucher you bought) is primarily responsible for your customer relationship. For questions about redemption, refunds, or how the merchant uses your information, contact that business directly. You may also contact GiftEase using the information in Section 13 for platform privacy requests described below.

4. Information we collect

4.1 Business account information

When a merchant signs up for or uses the dashboard, we collect:

• Account credentials — email address and password (passwords are handled by our authentication provider; we do not store plaintext passwords);
• Business profile — business name, business email, URL slug, branding settings (for example, primary color, theme, logo URL);
• Product settings — whether gift cards and/or service vouchers are enabled, voucher catalog entries, voucher expiration settings;
• Payment onboarding status — Stripe Connect account identifier and onboarding completion status; and
• Support communications — information you send us when you contact support.

4.2 Gift purchaser and recipient information

When someone buys a gift card or service voucher through the Service, we may collect:

• Purchaser information — name and email address (purchaser email may be collected by Stripe during checkout even if not entered in the widget);
• Recipient information — optional recipient name, email address, and personal message;
• Purchase details — product type (gift card or voucher), amount or service selected, theme/branding selection, and transaction metadata;
• Issued product data — unique gift card or voucher codes, balances or redemption status, issue date, and expiration date (if applicable); and
• Delivery records — confirmation that email/PDF delivery was attempted.

We do not collect or store full payment card numbers. Payments are processed by Stripe.

4.3 Redemption and operations data

When a merchant redeems a gift card or voucher through the dashboard, we may collect:

• Redemption details — amount redeemed, redemption type (full or partial for gift cards), timestamp; and
• Optional staff notes — internal notes or booking references entered by the merchant.

4.4 Technical and usage information

We automatically collect limited technical information necessary to operate and secure the Service, such as:

• Device and browser information — IP address, browser type, and general device characteristics in server logs;
• Authentication cookies — session cookies used to keep business users signed in (see Section 7); and
• Error and security logs — diagnostic information when something fails or when we detect abuse.

At this time, GiftEase does not use advertising cookies or third-party marketing analytics on the Service.

5. How we use information

We use personal information to:

• Provide the Service — create and manage accounts, process purchases, issue codes, deliver emails and PDFs, and support redemption;
• Process payments — facilitate checkout and platform fees through Stripe Connect;
• Communicate with you — send account confirmations, purchase receipts (where applicable), delivery emails, and service-related notices;
• Secure the Service — authenticate users, enforce multi-tenant data isolation, detect fraud or abuse, and troubleshoot errors;
• Comply with law — respond to lawful requests and meet legal, tax, and accounting obligations; and
• Improve the Service — understand usage in aggregate and fix bugs (without using advertising trackers).

We do not sell personal information. We do not use purchaser or recipient information for third-party advertising.

6. What we do not collect

GiftEase does not:

• Store raw credit or debit card numbers, CVV codes, or full payment credentials; or
• Knowingly collect personal information from children under 13 (see Section 12).

Payment card data is entered directly into Stripe Checkout and handled under Stripe's privacy policy and security standards.

7. Cookies and similar technologies

GiftEase uses essential cookies only:

• Authentication session cookies — set by our authentication provider (Supabase) to keep business users signed in to the dashboard.

We do not currently set advertising, retargeting, or third-party analytics cookies on the Service.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from staying signed in to the dashboard.

8. How we share information

We share personal information only as described below.

8.1 Service providers (subprocessors)

We use trusted vendors to operate the Service. They process information on our instructions and subject to contractual protections:

| Provider | Purpose | Privacy information | |----------|---------|---------------------| | Stripe | Payment processing, Stripe Connect onboarding, checkout | stripe.com/privacy | | Supabase | Database, authentication, row-level security | supabase.com/privacy | | Resend | Transactional email delivery | resend.com/legal/privacy-policy | | Vercel | Application hosting and infrastructure | vercel.com/legal/privacy-policy |

8.2 Merchants and their customers

• Information entered during a purchase (for example, recipient email) is used to fulfill delivery on behalf of the merchant selling the gift card or voucher.
• Merchants can view gift card, voucher, and redemption data for their own business through the dashboard.

8.3 Legal and safety

We may disclose information if we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, legal process, or governmental request;
• Enforce our Terms of Service or protect the rights, property, or safety of GiftEase, our users, or others; or
• Detect, prevent, or address fraud, security, or technical issues.

8.4 Business transfers

If GiftEase is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, subject to this Privacy Policy (or a successor policy with notice).

9. Data retention

We retain personal information for as long as necessary to:

• Provide the Service and maintain your account;
• Fulfill purchases and maintain audit trails for gift cards, vouchers, and redemptions;
• Comply with legal, tax, and accounting obligations; and
• Resolve disputes and enforce our agreements.

When a business account is closed, we may retain certain transaction and gift card/voucher records for a reasonable period as required by law or legitimate business needs (for example, fraud prevention and financial recordkeeping).

You may request deletion as described in Section 11, subject to exceptions required by law or ongoing legitimate needs (for example, outstanding gift card liability records).

10. Security

We implement reasonable technical and organizational measures designed to protect personal information, including:

• HTTPS encryption in transit;
• Multi-tenant data isolation using database row-level security so each merchant can access only their own data;
• Stripe for payment processing (we never handle raw card data); and
• Access controls limiting administrative access to production systems.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security.

11. Your privacy rights and choices

11.1 All users

Depending on where you live, you may have the right to:

• Access personal information we hold about you;
• Correct inaccurate information;
• Delete certain information, subject to legal exceptions;
• Obtain a copy of certain information in a portable format; and
• Opt out of certain processing where applicable.

To exercise these rights, email WilliamLocklier27@gmail.com with enough information for us to verify your request. We will respond within the time required by applicable law.

11.2 California residents (CCPA / CPRA)

If you are a California resident, you may have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including:

• The right to know what personal information we collect, use, and disclose;
• The right to delete personal information, subject to exceptions;
• The right to correct inaccurate personal information;
• The right to opt out of the sale or sharing of personal information for cross-context behavioral advertising; and
• The right not to receive discriminatory treatment for exercising privacy rights.

We do not sell or share personal information for cross-context behavioral advertising.

To submit a request, email WilliamLocklier27@gmail.com. We may verify your identity before fulfilling a request.

You may designate an authorized agent to make a request on your behalf where permitted by law.

11.3 Gift purchasers and recipients

If you purchased or received a gift card or voucher:

• For redemption, refunds, or merchant-specific privacy questions, contact the merchant that issued the product.
• For platform privacy requests (for example, asking what delivery information GiftEase processed on behalf of a merchant), contact WilliamLocklier27@gmail.com.

12. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, contact WilliamLocklier27@gmail.com and we will take appropriate steps to delete it.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice (for example, by email, dashboard notice, or updating the "Last updated" date) before the changes take effect, unless a shorter period is required by law.

Your continued use of the Service after the effective date of an updated Privacy Policy constitutes acceptance of the changes.

14. Contact us

William Locklier
Email: WilliamLocklier27@gmail.com

For merchant account privacy requests, include the email address associated with your GiftEase account. For purchaser/recipient requests, include the merchant name and approximate purchase date if known.