v2026.10.28 Giftpack provides software and related services for incentive programs, gifting, rewards, sourcing, recipient workflows, fulfillment coordination, impact allocation, and related operations. This Privacy Policy explains how Giftpack collects, uses, discloses, and protects personal data when you visit our website, use our platform, interact with our services, approve campaigns, receive gifts, participate in impact options, or otherwise interact with Giftpack.
SECTION 1
Who This Policy Covers
This Privacy Policy applies to the Giftpack website, platform, and related services. It is a public notice and does not replace more specific privacy, data processing, or security terms that may apply under a separate agreement, order form, or Data Processing Addendum.
This Privacy Policy also covers Giftpack connections to supported third-party AI applications, including ChatGPT through the Model Context Protocol (MCP). Section 14 explains how these connections handle personal data and how the applicable customer agreement, Data Processing Addendum and security information relate to that processing.
SECTION 2
Personal Data We Collect
Depending on the relationship and service context, Giftpack may collect:
- Contact and profile information.
- Account and business information.
- Recipient names, emails, phone numbers, addresses, gift messages, preferences, redemption details, and campaign data.
- Transaction, order, payment metadata, fulfillment, shipping, and delivery information.
- Support and communications data.
- Device, log, cookie, analytics, and usage information.
- Compliance, fraud prevention, sanctions screening, business verification, and platform integrity information.
- Donation, impact allocation, beneficiary, receipt, and remittance-related metadata where impact features are used.
SECTION 3
Where Personal Data Comes From
Giftpack may collect personal data directly from users, customers, customer administrators, authorized users, recipients, purchasers, donors, beneficiaries, service providers, integrations, analytics providers, payment processors, logistics providers, suppliers, and publicly or commercially available sources where permitted by law.
SECTION 4
How We Use Personal Data
Giftpack may process personal data to provide and administer accounts and workspaces, authenticate users, provide the website/platform/services, process orders and redemptions, support gifting workflows and fulfillment, support recipient engagement and communications, process impact allocation and donation workflows, provide customer support, process billing and payment support, secure the platform, prevent fraud and abuse, comply with legal/regulatory/tax/sanctions/contractual obligations, conduct analytics and product improvement, troubleshoot and measure service performance, and send service or marketing communications where permitted.
For information exchanged through an AI application connection, the integration-specific purposes and limits in Section 14 also apply. General references to analytics, service improvement or marketing do not expand the permitted use of requests received through ChatGPT.
SECTION 5
Our Data Protection Roles
Giftpack processes personal data in different roles depending on context. When customers provide recipient, employee, campaign, or end-user data for Giftpack to process on their behalf, the customer may act as controller or business and Giftpack may act as processor, service provider, contractor, or similar role. In those contexts, Giftpack’s Data Processing Addendum at https://giftpack.ai/dpa/ may apply unless a signed agreement states otherwise.
Giftpack may also process personal data as an independent controller or business for security, fraud prevention, analytics, service improvement, legal compliance, billing, account management, and internal business operations.
SECTION 6
How We Share Personal Data
Giftpack may share personal data with service providers and subprocessors that support hosting, cloud infrastructure, data storage, backup, communications, email delivery, analytics, payment processing, billing, customer support, sourcing, manufacturing coordination, logistics coordination, fulfillment, donation or impact remittance support, security, fraud prevention, compliance, and professional services.
Giftpack may also disclose personal data within its corporate group, in connection with corporate transactions, where required by law, to protect rights and safety, or with customer instructions or individual consent.
When you authorize an AI application connection, Giftpack returns the information needed for the authorized request to that application. Section 14 explains this exchange and the distinction between your selected AI application and service providers engaged by Giftpack.
SECTION 7
Cross-Border Data Processing
Giftpack may process personal data in the United States and in other jurisdictions where Giftpack or service providers operate, including Google Cloud Platform infrastructure in Tokyo for disaster recovery purposes. Where required by applicable law, Giftpack implements appropriate safeguards for international transfers.
SECTION 8
How We Protect Personal Data
Giftpack maintains administrative, technical and organizational measures designed to protect personal data. See our Security page for more information and the applicable Data Processing Addendum for customer processing terms. No system is perfectly secure, and Giftpack cannot guarantee absolute security.
SECTION 9
How Long We Keep Data
Giftpack retains personal data for as long as reasonably necessary for the purposes described in this Privacy Policy, the applicable agreement, service delivery, account administration, legal compliance, dispute resolution, tax and accounting records, fraud prevention, security, backup, and legitimate business operations. Retention periods vary based on data type, service context, legal obligations, and customer instructions.
Retention of AI Connection Records
The schedule below describes retention for records created or stored in connection with supported AI applications. Existing Giftpack account, workspace, campaign and order records remain subject to the applicable service and data-processing terms. Disconnecting an AI application does not by itself delete those existing records.
| Record category | Retention period and starting point | Deletion and exceptions |
|---|---|---|
| Tool requests, results and temporary copies | Automatically deleted after 90 consecutive days without user activity on the data. The period starts from the last user activity on that data. | You may request immediate deletion by contacting privacy@giftpack.ai; you do not need to wait for the 90-day period. |
| Operational, diagnostic and security logs | Automatically deleted after 90 consecutive days without user activity on the data. The period starts from the last user activity on that data. | You may request immediate deletion by contacting privacy@giftpack.ai; you do not need to wait for the 90-day period. |
| Connection authorizations and associated records | Automatically deleted after 90 consecutive days without user activity on the data. The period starts from the last user activity on that data. | You may request immediate deletion by contacting privacy@giftpack.ai; you do not need to wait for the 90-day period. |
| Backup copies of connection-related records | Automatically deleted after 90 consecutive days without user activity on the data. The period starts from the last user activity on that data. | You may request immediate deletion by contacting privacy@giftpack.ai; you do not need to wait for the 90-day period. |
If a legal obligation or a specific dispute or security matter requires a record to be kept beyond its ordinary period, we limit the retained information to that purpose, restrict its use and delete it when the additional retention is no longer required. The applicable customer agreement and Data Processing Addendum govern Customer Personal Data.
SECTION 10
Your Privacy Rights and Choices
Depending on your jurisdiction and relationship with Giftpack, you may have rights to access, correct, delete, restrict, object to, or receive a copy of certain personal data, and to opt out of certain processing. Where Giftpack processes personal data on behalf of a customer, Giftpack may refer your request to that customer.
For requests concerning an AI application connection, contact privacy@giftpack.ai. Identify the connected application and the relevant Giftpack account or workspace, without sending passwords, access keys or verification codes. We may verify your identity and authority. Where we process data on a customer's behalf, we may refer your request to that customer or assist the customer in responding. Section 14 explains the difference between revoking a connection and deleting data.
SECTION 11
Cookies and Analytics
Giftpack uses cookies and similar technologies as described in the Cookie Policy. You may manage cookies through browser settings and available privacy choices.
SECTION 12
Contact Our Privacy Team
For privacy questions or requests, contact Giftpack at privacy@giftpack.ai or through the contact channels provided on Giftpack’s website.
SECTION 13
Updates to This Policy
Giftpack may update this Privacy Policy from time to time. The updated version will be posted with a new effective date or version date. Continued use of the services after an update means the updated policy applies, subject to any separate written agreement.
SECTION 14
Privacy When Using ChatGPT and AI Tools
A supported AI application can send structured requests to Giftpack and receive information from the accounts and workspaces you are authorized to access. The information exchanged depends on the available tool, your request and your permissions. This section supplements the rest of this Privacy Policy and the applicable customer processing terms.
What Data the Connection Uses
Depending on the tool and task, the connection processes the following categories:
- Task-specific text, questions, search terms, filters and record references supplied in a tool request.
- Account and workspace identifiers, the connected user's authorization context and information needed to enforce access permissions.
- Relevant workspace and member records; recipient and gift-selection information; campaign, redemption, order and delivery records; transaction, credit and wallet records; and selected support messages, feedback or questionnaire responses.
- Connection events, tool execution status and diagnostic or security information needed to operate and protect the connection.
We limit the information exchanged to what the requested task needs. The connection does not grant Giftpack general access to unrelated conversations or your entire chat history. However, text or other content that the AI application includes in a tool request is received by Giftpack as part of that request.
How We Use Connection Data
Giftpack uses connection data to authenticate access, enforce permissions and carry out the authorized request. For requests received through ChatGPT, our handling is limited to what is needed to fulfill the request or meet legal duties. We do not repurpose those requests for unrelated advertising or marketing. General-purpose provisions elsewhere in this Policy or the DPA do not authorize broader use of ChatGPT requests.
Your AI Provider and Our Service Providers
Requested results are sent to the AI application you connect, including OpenAI when you use ChatGPT. That application's handling of the information is governed by the terms, privacy notice and applicable account or workspace controls for your use of that service. Enabling the ChatGPT connection does not make OpenAI a processor acting on Giftpack's behalf. Providers separately engaged by Giftpack to support its services are addressed under the applicable service-provider and data-processing arrangements.
Disconnecting and Deleting Data
You may request revocation of a connection or deletion of personal data held by Giftpack by contacting privacy@giftpack.ai. Where the connected application or your Giftpack workspace provides connection controls, you may also use those controls. Revocation prevents further authorized access through that connection once it takes effect. It does not itself delete existing Giftpack records or content already delivered to the AI application. The retention schedule in Section 9 applies to Giftpack's connection-related records. Use the AI provider's own controls for information it retains.
Protecting Sensitive Information
Use Giftpack's approved sign-in process. Do not put passwords, API keys, one-time verification codes, payment-card data, government identifiers or protected health information as defined by HIPAA into chat messages or tool inputs for this connection. Share only relevant records you are authorized to use, including when selecting free-text messages, feedback or questionnaire responses.
Related Terms and Privacy Controls
Where Giftpack processes personal data on a customer's behalf, the applicable Data Processing Addendum or signed processing agreement governs that relationship. This notice does not replace those agreements or permit processing prohibited by law or the connected platform's terms. Our Security page describes supporting safeguards. Website cookie preferences are explained separately in our Cookie Policy and Privacy Choices.