Who is responsible
The controller responsible for the processing of your personal data on this service is the sole proprietor who operates Taj Gift, based in Germany. The full name and contact details of the controller are set out in the Imprint.
If you have any question about this policy or wish to exercise your rights, please use the contact details in the Imprint.
What data we collect
Account and guest data: when you place an order — with or without an account — we collect your email address and, where you provide it, your name. Guest checkout is available and requires only the information needed to deliver your gift.
Order and personalization content: we process the details of your order and the content you add to a gift, which may include text, uploaded images, and audio or voice recordings.
Payment data: payments are handled by Stripe. Your card details are entered directly with Stripe and never reach our servers; we receive only the payment status and a transaction reference.
Analytics and technical data: with your consent we use analytics to understand how the service is used, and we automatically process limited technical data (such as your IP address and device or browser type) to keep the service secure and to detect and diagnose errors.
Why we process it (legal bases)
Performance of a contract — Art. 6(1)(b) GDPR: to create, personalize and deliver your gift, to process your payment, and to provide customer support.
Consent — Art. 6(1)(a) GDPR: for optional analytics, which load only after you opt in through the cookie-consent banner. You may withdraw your consent at any time with effect for the future.
Legitimate interests — Art. 6(1)(f) GDPR: to keep the service secure, prevent abuse, and monitor and fix errors. We balance these interests against your rights and freedoms.
Processors and recipients
Supabase — database, authentication and media storage, hosted in the EU (region eu-central-1).
Stripe — payment processing; card data is handled entirely by Stripe and does not touch our servers.
Resend — sending the delivery email that carries your gift.
Google Analytics 4 — usage analytics, loaded only after you opt in to cookies.
Sentry — error and performance monitoring to detect and fix faults.
Vercel — hosting and delivery of the website.
Each provider processes data only on our instructions and under a data-processing agreement. We do not sell your personal data.
How gift media is protected
The images, audio and text you add to a gift are stored privately in a dedicated folder for that gift. They are served only through short-lived signed links that are generated on our servers after an ownership check, so the files are not publicly accessible.
Retention
We keep order and gift data for as long as needed to deliver the gift, to allow the recipient to open it, and to meet our legal and tax record-keeping obligations. When data is no longer required it is deleted or anonymised.
International transfers
We host data in the EU where possible. Where a processor transfers data outside the European Economic Area, that transfer is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.
Your rights
Under the GDPR you have the right to access your data, to have it rectified or erased, to restrict or object to its processing, to data portability, and to withdraw any consent you have given without affecting processing already carried out.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your residence or place of the alleged infringement.
To exercise any of these rights, contact us using the details in the Imprint.