Privacy

Data controller

CODCAS SOLUTIONS, EURL au capital de 500 €, RCS Bordeaux 109 370 148, TVA intracommunautaire FR02109370148, 15 rue Joliot-Curie, 33150 Cenon, France. Contact: hello@giftmelater.com.

If you reserve a gift

We keep your first name, your email address and your reservation. Your email is only used to manage your reservations: a confirmation with your personal link, reminders before the event, and messages if the gift changes or is no longer on the list. Never a newsletter or advertising by email without your explicit consent.

This data is erased 90 days after your last reservation is closed (cancelled, expired, list closed or gift received).

Your first name is never shown to the person who created the list.

If you create a list

We keep your name, your email address, your lists, your wishes and their photos for as long as your account exists. If you sign in with Google, we only receive your name and email address.

Deleting your account (“My account”) erases your lists, wishes, photos and payment data on our side within minutes. Invoices stay with Stripe, which must keep them.

Why we use it

To provide the service you ask for (creating a list, reserving, managing a subscription): performance of the contract. For personalised advertising: only with your consent. For security (limits against abuse): our legitimate interest.

Also for security, the server keeps a technical log of requests (IP address, page requested, date and time). This log rotates: the oldest entries are erased as soon as it reaches 100 MB. An IP address attacking the site may be blocked for a few hours.

Audience measurement

On the home page and the legal pages, and only there, we count visits with Plausible, installed on another of our servers, with the same host: the address of the page viewed, the site you came from, your type of device, browser and operating system, your country (derived from your IP address, which is not kept), and clicks on “Make your list”. We only draw aggregate statistics from it.

No cookie, nothing stored on your device, no tracking from one site to another. To count visitors without recognising them, Plausible computes a fingerprint of your IP address and browser, renewed every day and never kept longer. Lists, reservations and your account are not part of it: those pages send nothing. Legal basis: our legitimate interest in knowing how people find the site.

Advertising and cookies

Without your consent, no personalised advertising and no advertising trackers. You choose in the “Ad” box (“Accept” or “Decline”), and you can change your mind at any time with “My choices” or below.

Your choice is kept for 6 months on your device (cookie “gml_ad_consent”), then asked again.

Other cookies, needed for the service: the sign-in session (30 days), and a marker that recognises the device of a list’s creator to warn them before they see their own list as a guest (“gml_device”, 13 months). On the home page and pages like this one, if you pick a language, that choice is remembered (“gml_lang”, 12 months). When you reserve a gift, the app also remembers it on this device, to show it as “Reserved by you” on your next visit: a signed cookie pointing to your guest record, without your name or email (“gml_guest”, 13 months), and your browser’s local storage (never sent).

Who else processes it

The servers’ host (Layer7 Networks GmbH, Germany), Brevo (sending emails, France), Cloudflare (encrypted backups, European Union), CrowdSec (protection against attacks, France: only the IP address of a malicious request), and Google if you use it to sign in. Each only accesses what it needs.

Stripe, the seller of the paid plans, processes payment data as a separate data controller, under its own privacy policy.

Stripe and Google are based in the United States: these transfers are covered by the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.

Encrypted backups rotate over 12 months at most: erased data disappears from backups at the end of that period.

Your rights

You can access, correct or erase your data, object to its processing or ask for a copy by writing to hello@giftmelater.com. You can also complain to the CNIL (cnil.fr), the French data protection authority.