Privacy policy

Who is responsible

Gjafalisti is operated by DEC ehf., kt. 471119-1720, Iceland, which is the controller of the personal data processed on gjafalisti.is.

What we keep

About list owners: email address (or an identifier from Google or Apple), an encrypted password, language, and the lists themselves – names, date, greeting, gifts and, if you choose, bank details for cash gifts.

About guests: the name a guest types when reserving a gift, which gift and how many. If a guest gives an email address we send one confirmation with a link to change the reservation; list owners never see the address. Nothing else. Guests need no account.

Technical data: cookies that keep you signed in, remember your language, and remember which gifts you reserved so you can undo it. We use no advertising or tracking cookies.

Statistics: we count how often a list is opened and how often a link to a shop is clicked. These are plain counts; nothing about the viewer is stored and no cookie is used for it. We also compile totals about gifts by shop, such as the value reserved from a given shop in a month, and may share those with shops. Such totals never include names, lists or guests.

Where lists come from: when a list is created we note with it whether that happened in the iPhone app, the Android app or a browser, which website sent you to us (only the site's name, such as google.com, never the page), any campaign tag the link carried, and whether you had looked at someone else's list. Until then this is kept only in your browser for the visit, not in a cookie, and is gone when the tab closes. We use it only to learn where new lists come from.

Who sees what

Anyone with a list's link can see the list, the names of guests who reserved gifts, and bank details if the owner entered them. Lists are kept out of search engines.

List owners cannot see who reserved which gift until they choose to reveal it themselves.

Product details and photos

When a product link is pasted we read the name, price and photo from the shop's page. Photos are shown directly from the shop and belong to it. Shops that do not want their products shown can contact us and we will act immediately.

Processors

Data is hosted inside the EEA: database and sign-in with Supabase (Ireland), the website with Vercel (Dublin). Email is sent through Resend (Ireland).

How long

Lists and accounts are kept until you delete them. You can delete a list in its settings and your account under “My account”. Deletion is final and immediate.

Your rights

You have the right to access, correct or erase your data, and to complain to the Icelandic Data Protection Authority (personuvernd.is). Guests who want their name removed from a list can cancel the reservation or contact us.

Contact: hallo@gjafalisti.is

Children

People under 13 may not create an account. A parent or guardian can create and look after a list on their behalf.