Privacy policy

The short version

We hold as little as the site can function on. You can search, discover and build a list without giving us anything. If you give us an email address it is used to send you the thing you asked for and nothing else, and you can delete everything at any time.

We do not sell personal data and we do not share it for advertising. Everything runs from inside the European Union.

Who is responsible

Symergo CommV, enterprise number and VAT number BE0566975391, registered at Schoonzichtlaan 13A, 3012 Leuven, Belgium, is the controller for the personal data described here. We are established in Belgium and this notice is written under the GDPR (Regulation (EU) 2016/679).

For anything about your data, write to privacy@giftcoves.com. You do not need to explain why you are asking.

We are not required to appoint a Data Protection Officer: we are a small operation, we do not process data on a large scale, and we process no special categories of data. privacy@giftcoves.com reaches the person who decides these things.

What we process, and on what basis

Every row below names the Article 6 basis. Where it says legitimate interests, you have the right to object, and section Your rights explains how.

What	Why	Legal basis
Visitor cookie (random value)	So a list works before you have an account	Necessary for a service you asked for (Art. 6(1)(b))
Interaction log: click-outs, scans, gift requests, reactions	Operating and improving the site, spotting abuse	Legitimate interests (Art. 6(1)(f))
Search terms, aggregated hourly	Deciding which Coves to write	Legitimate interests (Art. 6(1)(f))
Server logs: IP, browser, page	Security and debugging	Legitimate interests (Art. 6(1)(f))
Account email, and name and picture if you use Google	Signing you in	Contract (Art. 6(1)(b))
Lists, saved items, recipients you enter	Providing the list you asked for	Contract (Art. 6(1)(b))
Price and stock alerts	Sending the alert you asked for	Contract (Art. 6(1)(b))
Daily email address, confirmation date, signup IP	Sending the email, and proving consent	Consent (Art. 6(1)(a))

A note on the visitor cookie

It does two jobs and we would rather say so than let one hide behind the other.

Its necessary job is your list: without it, "save this" would require a signup. Its second job is that interactions get recorded against it, so we can see that a feature is used or that a form is being abused. That second use rests on legitimate interests rather than necessity, it is never used to build a profile or to target advertising, the log is deleted after 90 days, and you can object to it at privacy@giftcoves.com.

Recipients

If you build a list for someone else, we store whatever you enter about them: a name, a note, sometimes a birthday. That is personal data about a person who is not you and who has not agreed to anything. For that data you are acting on your own account, so please keep it to what you need. It is deleted with your account.

No automated decision-making

Nothing here makes a decision that produces legal effects for you or similarly significantly affects you (Art. 22). Ranking and recommendations decide which products you are shown, not anything about you.

Where your data goes

Our processors, and what leaves the EEA:

Who	What for	Where
OVH	Hosting the site and its database	Frankfurt, Germany (EU)
Resend	Sending sign-in links, alerts and the daily email	United States
Anthropic	Generating editorial text	United States

Transfers outside the EEA are covered by the European Commission's standard contractual clauses, and where the provider is certified, by the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards at privacy@giftcoves.com.

Anthropic receives no personal data. Only product information goes into a prompt: titles, prices, categories. Generation runs on a schedule rather than in response to anything you do, so nothing you type reaches a model.

Shops and affiliate networks. When you click through to a shop, that shop and the network between us receive the fact that a visit came from GiftCoves, normally as a parameter in the link, and they set their own tracking so a purchase can be attributed. That happens on their domain under their privacy policy, not this one. We never send them your email address, your account or your lists.

What we do not do

• No advertising trackers. No Meta pixel, no Google Analytics, no advertising cookies, no data broker.
• No profile building. We do not construct an interest profile from your browsing and we do not sell one.
• No selling data. Not to shops, not to networks, not to anyone.

How long we keep it

Visitor cookie	1 year from your last visit
Interaction log	90 days
Search terms	12 months, aggregated and unlinked from the start
Account, lists, recipients	Until you delete them
Price history	90 days
Newsletter subscription	Until you unsubscribe
Unconfirmed subscription	Deleted after 30 days
Server logs	30 days

These are enforced by a job that runs every night, not by intention.

Your rights

Under the GDPR you can:

• see what we hold (Art. 15);
• correct it (Art. 16);
• delete it (Art. 17);
• restrict what we do with it (Art. 18);
• take it with you in a portable format (Art. 20);
• object to anything we do on the basis of legitimate interests (Art. 21), which covers the interaction log and the aggregated search terms;
• withdraw consent for the daily email at any time (Art. 7(3)). Unsubscribing is exactly that, and every message carries a one-click link that works permanently.

Write to privacy@giftcoves.com. We answer within one month, free of charge, and we will not ask you to justify the request.

Deleting your account removes your lists, your recipients, your alerts and your notifications. It is immediate and it is not reversible.

If you think we have handled your data badly you can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be. You may also complain to the authority in the EU country where you live.

Cookies

Four, and all of them are necessary for something you asked for:

• Session: keeps you signed in.
• Visitor identifier: lets a list work before you have an account. See the note above about its second use.
• Market: remembers which country and language you chose.
• CSRF token: stops another site submitting forms as you.

There is no cookie banner because there is nothing here that needs consent to be stored. Article 5(3) of the ePrivacy Directive requires consent for cookies that are not strictly necessary, and we set none: no analytics cookie, no advertising cookie, no third-party cookie.

Children

GiftCoves is not aimed at children and we do not knowingly hold data about anyone under 16. If you believe we do, write to privacy@giftcoves.com and it will be deleted.

Changes

If this policy changes in a way that affects you, the date at the top changes and anyone subscribed to the daily email is told in it. Older versions are available on request.