Product & Platform Privacy Notice
Last updated: June 4, 2026
1. About this Notice
This Product & Platform Privacy Notice explains how Giftagram Inc. and Giftagram USA, Inc. collect, use, disclose, retain, and otherwise process personal information in connection with Giftagram's B2B corporate gifting platform, GiftCenter, enterprise gifting workflows, bulk gifting, client campaigns, API or integration-supported gifting, corporate recipient landing pages, client administration, customer support, and related business services (collectively, the "Platform Services").
This Notice is intended for corporate clients, client administrators, campaign managers, authorized platform users, employees, customers, prospects, recipients, nominees, gift senders, approvers, finance users, and other individuals whose information is processed in connection with the Platform Services.
This Notice does not govern Giftagram's consumer ecommerce website, retail mobile app, personal gifting, or consumer storefronts, which are covered by the Consumer Privacy Policy.
2. Our Roles
Giftagram may process personal information in different roles depending on the context.
Where a business client provides recipient, employee, customer, prospect, or campaign data to Giftagram and instructs Giftagram to use that information to provide gifting services, Giftagram generally acts as a service provider or processor on behalf of that client. The client is responsible for determining the purposes and means of processing, providing required notices, obtaining required consents or other legal bases, and instructing Giftagram.
Giftagram may also act as an independent organization, business, or controller for certain purposes, including account administration, billing, sales, client relationship management, security, fraud prevention, legal compliance, service analytics, de-identified or aggregated reporting, support, product improvement, and business operations.
3. Who We Are and Contact
Giftagram Inc. is a Canadian company. Giftagram USA, Inc. supports certain United States operations. Our public mailing address is 487 Adelaide St. W., Suite 203, Toronto, ON M5V 1T4, Canada.
For privacy questions, privacy rights requests, or complaints, contact us at legal@giftagram.com. If your request relates to data we process on behalf of a business client, we may direct you to that client or work with that client to respond.
4. Categories of Personal Information We Process
Depending on the Platform Services used by a client, we may process the following categories of personal information.
Client administrator and business contact information
Name, business email, business phone number, employer, title, account role, permissions, login details, billing contacts, support communications, and CRM records.
Recipient and campaign information
Recipient name, email, phone number, address, employer or client affiliation, campaign eligibility, gift link, recipient ID or client-provided identifier, gift selected, redemption status, delivery status, engagement information, thank-you notes, and support information.
Gift and fulfillment information
Gift selected, order details, shipping address, phone number, delivery instructions, fulfillment status, substitutions, returns, refunds, and logistics records.
Preference and user-generated information
Gift messages, thank-you messages, survey responses, reviews, product preferences, dietary preferences, clothing sizes, and other information submitted by recipients or users.
Technical and usage information
IP address, device identifiers, browser and operating system, approximate location, login activity, access logs, page views, clicks, email opens, link clicks, session data, heatmaps or behavioral analytics from time to time, and security logs.
Sensitive or regulated information
Age or eligibility information for alcohol or age-restricted gifts where required; dietary or preference information where voluntarily provided or needed for fulfillment; other sensitive information only where necessary and permitted.
5. Sources of Personal Information
We may receive personal information from business clients, HRIS/HRM systems or client systems, authorized client users, gift senders, recipients, nominees, integration partners, ecommerce and fulfillment partners, logistics providers, payment and fraud-prevention providers, email delivery platforms, CRM and customer support systems, analytics providers, and individuals who interact directly with Giftagram.
6. How Platform Data Flows
A typical enterprise gifting workflow may involve the following: a client uploads or provides recipient, employee, customer, or campaign data; Giftagram creates or supports a gift campaign, gift link, email, landing page, or recipient experience; the recipient opens, clicks, selects, accepts, or redeems a gift; the recipient may provide shipping, preference, or contact details; Giftagram shares only the information reasonably needed with fulfillment, warehouse, brand, merchant, courier, or logistics providers; and Giftagram reports campaign, redemption, delivery, engagement, and other standard industry reporting back to the client.
7. How We Use Personal Information
We use personal information to provide and improve the Platform Services, follow client instructions, and operate our business.
Providing the Platform Services
Create and manage campaigns, administer GiftCenter, process bulk gifting, generate links, send notifications, support redemption, fulfill physical and digital gifts, and provide client support.
Client reporting
Provide redemption status, gift selected, delivery status, engagement data, thank-you notes, campaign performance, and other standard industry reporting to clients.
Security and compliance
Authenticate users, manage access, monitor systems, prevent fraud, investigate misuse, comply with legal obligations, and enforce agreements.
Identifiers and contact information
Depending on how you interact with the Consumer Services, we may collect the following categories of personal information.
Support and operations
Respond to support requests, troubleshoot issues, manage billing, coordinate fulfillment, handle substitutions, returns, refunds, and service administration.
Analytics and improvement
Create de-identified or anonymized analytics, improve platform features, understand operational performance, benchmark service usage, and plan product improvements.
Business relationship management
Manage client accounts, sales, customer success, renewals, marketing, finance, legal, insurance, and administrative activities.
8. Disclosures and Subprocessors
We may disclose personal information to subprocessors, service providers, vendors, and other third parties as needed to provide the Platform Services and operate our business. These may include cloud hosting, AWS infrastructure, ecommerce and Shopify infrastructure, email delivery, CRM, analytics, payment processing, fraud prevention, warehouse, logistics, courier, customer support, security, accounting, legal, insurance, and related providers.
For physical gifts and fulfillment, we may disclose limited recipient-level information to brand, merchant, warehouse, courier, or delivery partners, such as recipient name, delivery address, phone number, order details, and delivery instructions.
We maintain information about our subprocessors and make it available to enterprise clients on request. We require appropriate contractual, confidentiality, privacy, and security commitments from key vendors where appropriate.
9. Client Responsibilities
Business clients are responsible for ensuring they have the right to provide personal information to Giftagram and to instruct Giftagram to process it. This includes providing appropriate notices, obtaining consents or other legal bases where required, limiting data provided to what is necessary, honoring internal privacy commitments, and responding to privacy requests where the client controls the data.
Clients should not provide sensitive personal information unless it is necessary for the applicable gifting workflow, permitted by law, and covered by appropriate notices and safeguards.
10. Recipient and User Choices
Recipients may choose whether to accept, redeem, or provide information in connection with a gift, although some information may be required to deliver or fulfill a gift. Where Giftagram processes information on behalf of a client, privacy rights requests should generally be directed to the client. You may also contact Giftagram at legal@giftagram.com, and we will either respond where we are responsible for the processing or assist the relevant client as appropriate.
11. Aggregated, De-Identified, and Anonymized Information
Giftagram may create, use, retain, and disclose aggregated, de-identified, or anonymized information for analytics, reporting, benchmarking, product improvement, business planning, and service development. We do not use client recipient personal information to train internal or third-party AI models. We do not currently make automated decisions that produce legal or similarly significant effects based on recipient data.
12. Cross-Border Processing
Giftagram operates in Canada and the United States. Personal information may be processed in Canada, the United States, and other jurisdictions where our service providers operate. Personal information may be subject to the laws of those jurisdictions and may be accessible to courts, law enforcement, regulators, or government authorities in accordance with applicable law.
13. Retention, Deletion, and Anonymization
We retain personal information for as long as reasonably necessary to provide the Platform Services, follow client instructions, maintain accurate business and transaction records, support customer service, comply with tax, accounting, legal, fraud-prevention, audit, and regulatory obligations, resolve disputes, enforce agreements, and protect our rights.
As a general operational target, Giftagram aims to delete or anonymize recipient personal information when it is no longer reasonably required for the applicable business, legal, service, or client purpose, and in many cases within approximately one year after the relevant campaign, redemption, delivery, or support need has ended, unless a longer period is required or permitted by law, contract, fraud prevention, dispute, audit, tax, accounting, backup, security, or legitimate business requirements.
Upon a valid client request, we can delete or anonymize personal information where feasible, subject to legal, contractual, accounting, audit, fraud-prevention, backup, and security exceptions. De-identified, anonymized, or aggregated information may be retained indefinitely.
14. Security
Giftagram uses reasonable administrative, technical, and physical safeguards designed to protect personal information. These may include reputable cloud and commerce infrastructure providers, including AWS and Shopify, access controls, multi-factor authentication where appropriate, encryption where appropriate, logging, least-privilege access, vendor review, third-party penetration testing, remediation based on severity and risk, and incident response procedures.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
15. Security Incidents
Giftagram maintains incident response processes designed to identify, investigate, contain, remediate, and provide legally or contractually required notices regarding security incidents involving personal information. Where Giftagram acts as a processor or service provider, we will notify affected clients in accordance with the applicable agreement. For key enterprise clients, contractual notice timelines may be as short as 24 hours after confirmation or determination of a notifiable incident, depending on the applicable contract.
Where required by law, Giftagram or the applicable client will provide notices to individuals, regulators, or other parties as required.
16. Privacy Rights
Depending on your jurisdiction and the context of processing, you may have rights to request access, correction, deletion, portability, withdrawal of consent, restriction, objection, or opt-out of certain processing. If Giftagram processes your information on behalf of a client, we may need to refer your request to that client or coordinate with that client.
To submit a request to Giftagram, contact legal@giftagram.com. We may verify your identity and the authority of any authorized agent before acting on a request. Giftagram's operational target is to acknowledge privacy requests within one business day where reasonably practicable, although legal response deadlines may vary by jurisdiction.
17. Marketing and Client Communications
Giftagram may process business contact information for sales, account management, customer success, product updates, events, newsletters, and other B2B communications. You may unsubscribe from promotional communications using the unsubscribe link in those messages or by contacting us. We may still send transactional, administrative, security, support, or service-related communications
18. Changes to this Notice
We may update this Notice from time to time. When we do, we will post the updated version and update the "Last Updated" date. We may provide additional notice to clients where changes are material or where required by contract.
19. Contact Us
Giftagram Inc. / Giftagram USA, Inc.
487 Adelaide St. W., Suite 203
Toronto, ON M5V 1T4, Canada
Email: legal@giftagram.com