Privacy, thoughtfully handled.
Last updated: 27 September 2026
This notice explains how the operator identified below acts as controller of personal information processed through PartnerPresents. It covers visitors, gift makers and recipients. You can browse and make a draft without creating an account.
What we collect and why
- Accounts: email address, display name, sign-in verification records and session information. We use them to authenticate you, recover purchases and provide saved profiles and templates. The GDPR basis is performance of our contract, with legitimate interests in preventing misuse.
- Profiles and gifts: the names, dates, words, photographs, recordings and links you choose to provide. We store and deliver them at your request. Avoid including sensitive information such as health data, identification documents or information about someone who would not reasonably expect it to be shared.
- Orders: product, price, payment status, checkout and customer identifiers, purchase email, and acceptance of the terms and immediate-delivery request. This supports the purchase contract, fraud prevention, accounting and legal obligations. Stripe processes card and billing information; our app does not receive or store complete card numbers.
- Security and support: limited technical information, session IP/user-agent information, errors and requests you send. Our legitimate interests are operating a secure service and resolving problems. Hosting and payment providers also process operational data.
- Optional measurement: with consent, Google Analytics measures visits to the public shop and Microsoft Clarity records shop interactions such as clicks, scrolling and page layout. We do not load these tools in your editor, account, checkout, preview or personal gift. We do not send gift text, names, recordings, checkout identifiers or email addresses as analytics events.
Your gifts and recipients
New drafts are saved in your browser, not automatically in the cloud. Gift content is uploaded when you publish or start checkout. Earlier online drafts and gifts awaiting publication are restricted to their owner. Published gifts are accessible to anyone who has their unlisted, randomly generated link, unless a secret word or answer is required. Sharing the link may allow others to copy it; this is not end-to-end encrypted messaging. A puzzle reveal is decorative, not access control. You can unpublish or delete a gift in your archive. Recipients can contact the privacy address below about information concerning them without creating an account.
Cookies, consent and browser signals
Optional analytics and heatmaps are off until you choose them. Essential session, security and consent storage remains available. Embedded music requires separate permission before connecting to YouTube or Spotify. We honour Global Privacy Control by keeping analytics and heatmaps off. We do not use advertising personalization or sell personal information for money. Where optional provider disclosures constitute “sharing” under a US state law, rejecting optional tools or enabling GPC opts out.
Service providers and international processing
Cloudflare provides hosting, database, media storage, security and transactional email. Stripe processes payments and billing. Google provides optional analytics, and Microsoft provides optional Clarity measurement. YouTube and Spotify receive data only when you permit and open their embedded players, or visit their sites directly. These providers may process information outside your country, including in the United States. Appropriate contracts and applicable transfer safeguards, such as standard contractual clauses and recognised adequacy mechanisms where available, must cover our use of these services. Contact us for details of the applicable safeguards.
How long information is kept
- Sign-in links expire after 10 minutes. Account sessions last up to seven days; active use can renew a session. Guest ownership cookies expire after 30 days.
- Local drafts remain in this browser until you delete them or clear browser data, subject to browser storage availability. They do not sync across devices. Unpurchased, unpublished online records with no pending payment are deleted after 90 days without an update. Published gifts and saved templates are kept to provide the service until you delete them or the service is ended under the terms. There is no lifetime-storage promise.
- Consent choices and pseudonymous consent receipts expire after six months. Google Analytics cookies are configured for up to six months; provider retention settings must follow the deployment record.
- Deleting an account removes its profile, templates, gifts, uploaded media and active sessions. Payment and dispute records may be retained separately for legal accounting obligations, with a proposed maximum of seven years subject to the operator's applicable law. Provider backups and legally required records may take longer to expire and are not used to restore an active account.
Your EU/EEA and UK rights
Depending on the circumstances you can request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. Download account and gift data, update your profile, or delete your account from your account. For other requests, use the account request form or privacy email below. We normally respond within one month; where an extension is permitted, we explain it. You can complain to your local supervisory authority, including the UK ICO where relevant.
US state privacy rights
Where applicable, state laws may give you rights to know/access, correct, delete, obtain a portable copy, and opt out of sale, sharing, targeted advertising or certain profiling. We do not make decisions with legal or similarly significant effects through automated profiling. You may use an authorised agent, subject to appropriate verification. We do not discriminate for exercising rights. We normally respond to a verified US request within 45 days, with lawful extensions where needed. If we decline a request, you can appeal using the same contact address or the appeal option in your account. Your state regulator may provide further complaint rights.
Children, security and changes
The service is intended for people aged 18 and over. Do not submit children's personal information without appropriate authority and permission. If you believe a child's information was collected improperly, contact us for removal. We use encrypted transport, restricted account access and provider security controls; no service can promise absolute security. Material changes to this notice will be dated and communicated where required. New optional purposes require a new choice.
Provider notices: Cloudflare, Stripe, Google, and Microsoft.
Who operates PartnerPresents?
Zyra Labs Ltd
United Kingdom
Support: hello@partnerpresents.com
Privacy: hello@partnerpresents.com