Privacy Policy

This Privacy Policy explains how Gifthycards (“we”, “our”, “us”) collects, uses, discloses, and protects personal information when you visit our website or use our service to purchase digital gift cards and pay with cryptocurrency. It also describes the rights and choices you have regarding your personal information.

The data controller responsible for your personal information is Gifthycards (Pittsburgh, Pennsylvania, United States — the company is historically based in the Pittsburgh area). You can contact the controller about privacy matters at support@gifthycards.com.

By using the Service you agree to the practices described in this policy. If you do not agree, please do not use the Service. This policy is incorporated into our Terms of Service.

We collect information that you provide to us directly and information that is generated automatically when you use the Service:

• Account information. When you register, we collect your email address, an optional name, and a hashed representation of your password. We also record whether your email has been verified.
• Order and transaction information. Items purchased, amounts, order status, the delivery email, and details needed to complete a crypto payment and deliver codes. We do not collect or store your wallet private keys or seed phrases.
• Verification and security tokens. One-time, hashed tokens used for email verification and password reset.
• Usage and device information. We may collect basic information such as IP address, browser type, device type, pages visited, and timestamps for security, troubleshooting, and to understand how the Service is used.

No KYC. Buying with cryptocurrency does not require identity verification. We do not ask for identity documents (such as passports or ID cards) and never collect your wallet keys. We record only the payment outcome needed to complete your order.

• Session — a secure, httpOnly, same-site cookie that keeps you signed in.
• Cart — stores the contents of your cart so you can check out later.
• Theme — remembers your light/dark display preference.

We do not use advertising or cross-site tracking cookies. You can clear cookies and local storage in your browser at any time, though some features may not work correctly without them.

We use personal information for the following purposes:

• To create and manage your account and verify your email.
• To process orders and deliver gift-card codes.
• To send service messages, receipts, and security notices.
• To prevent fraud, abuse, and unauthorized access.
• To maintain, secure, and improve the Service.
• To respond to support requests and exercise or defend legal claims.

Where applicable data-protection law (such as the GDPR or UK GDPR) requires a lawful basis, we process personal information on the basis of contract (to perform our agreement with you), our legitimate interests (security, fraud prevention, and service improvement), legal obligation, or your consent where we ask for it. You are never required to provide personal information; however, some features, such as placing an order, cannot be provided without it.

We do not sell, rent, or trade your personal information. We share it only in the following circumstances:

• Payment processors. Payments are handled by Paymento, a non-custodial crypto gateway. When you check out, you interact with Paymento under its own terms and privacy policy. We receive only the payment outcome needed to complete your order.
• Service providers. Trusted vendors who help us host, operate, secure, and improve the Service, under appropriate confidentiality obligations.
• Legal and safety. When required by law, regulation, or legal process, or when necessary to protect the rights, property, or safety of our users, the public, or ourselves.
• Business transfers. In connection with a merger, sale, or other transfer of all or part of our business, subject to this policy continuing to apply.

Your personal information may be processed in countries other than your own, including where our service providers are located. Where we transfer personal information across borders, we take appropriate safeguards, such as standard contractual clauses or reliance on adequacy decisions, where required by applicable law.

We retain personal information only for as long as necessary to fulfill the purposes described in this policy, to comply with legal and accounting obligations, and to resolve disputes and enforce our agreements. When information is no longer needed, it is deleted or anonymized. Email verification and password-reset tokens are deleted automatically when they expire or are used.

We apply reasonable technical and organizational measures to protect personal information, including: passwords stored as salted bcrypt hashes; session cookies marked httpOnly and same-site; gift-card codes encrypted at rest with AES-256-GCM; and access controls that restrict sensitive data to authorized personnel. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Depending on your location, you may have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — request deletion of your personal information.
• Restriction — ask us to limit how we process your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

If you are in the EEA, UK, or Switzerland, you may also lodge a complaint with your local data-protection authority. If you are a California resident, the California Consumer Privacy Act provides rights to know, access, delete, and opt out of the “sale” or “sharing” of personal information; we do not sell or share personal information.

To exercise any of these rights, contact us at the address below. We may need to verify your identity before processing your request and will respond within the timeframes required by law.

The Service is not directed to children under the age of 13 (or the applicable minimum age in your jurisdiction), and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so that we can delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you by email or through the Service.

If you have questions, concerns, or requests relating to this Privacy Policy or your personal information, please contact us at support@gifthycards.com. We will respond to your request as soon as possible.

Controller: Gifthycards, Pittsburgh, Pennsylvania, United States — the company is historically based in the Pittsburgh area · Email: support@gifthycards.com · More about who we are: Trust Center.