Privacy Policy

Controller

The controller within the meaning of the GDPR is Smart Soft Solution OÜ, Laeva 7, 10151 Tallinn, Estonia (registry code 17531612). Further details are in the imprint.

For data protection questions, contact us at [email protected] or via the details in the imprint. We have not appointed a data protection officer, as the legal conditions for doing so are not met.

Data we collect

When you use Recogift, we process the following categories of data:

• Server logs: IP address, timestamp, browser type, device type, and pages accessed — collected via Azure Application Insights and retained for up to 90 days.
• Gift plan data: your categorical questionnaire answers (recipient relationship, occasion, budget, interests and constraints) are sent to our server to generate recommendations. The resulting plan is stored as pseudonymised JSON without direct identifiers unless you save it to a signed-in account.
• Click logs: catalog-product redirects record the product identifier and timestamp plus keyed HMAC-SHA-256 values derived from IP address and user-agent for fraud prevention. Offer redirects instead record the timestamp, click reference, offer and report references, affiliate network, market and slot data without storing IP address, user-agent or an account identifier.
• Local browser storage: questionnaire progress, shortlists, consent choices and optional comfort settings are stored in localStorage. If you sign in, Supabase also stores the necessary Recogift authentication session, including access and refresh tokens, in this browser.
• Contact communications: if you email us, we process the data you include solely to respond to your inquiry.
• Account data (only if you register): if you create an optional user account, we process your email address, optional profile details (display name, country, language preference), and your marketing-email preference. Registration is voluntary — the gift finder works without an account.
• Acquisition data: when you arrive through a gift guide or campaign, we may attach the guide slug, referring host, entry path, and UTM source, medium and campaign values to the report you submit. We do not use this data for cross-site tracking.
• Error-monitoring data: in production, Sentry may receive error messages and stack traces, the page URL without its query string, and browser, device and connection metadata. Default personal-data collection, performance tracing and session replay are disabled.
• Audience-measurement data: when Umami analytics is enabled, we process normalized page paths, normalized referrer and campaign parameters, browser, operating system, device type, screen resolution, language setting, approximate location, event names and selected event properties. Shared-link identifiers, report identifiers, account data and questionnaire answers are not sent.
• Product-interest identifiers: for saves, comparisons and offer-click events, we send the stable catalog or offer identifier. We do not send product titles, merchant URLs or redirect signatures.

Purposes and legal bases

We process your data to provide the gift finder and generate recommendations through automated matching and scoring (Art. 6(1)(b) GDPR — performance of a service at your request), to maintain system security and stability, including error monitoring (Art. 6(1)(f) GDPR — legitimate interests), to evaluate which guides and campaigns lead to completed reports (Art. 6(1)(f) GDPR), and to respond to inquiries (Art. 6(1)(b) or (f) GDPR). The matching does not produce legal or similarly significant effects. We do not use your data for behavioural advertising or sell it to third parties. Matching and scoring follow fixed rules, not an AI model. We do not send your questionnaire answers to AI services, and we do not use them to train AI models. Some of the processors named in this policy, for example Umami, use AI providers as sub-processors for their own services. That concerns the data described for each of them, not your questionnaire answers.

If you create an account, we process your account data to provide and manage the account (Art. 6(1)(b) GDPR). We currently do not send marketing emails. If you consent to marketing emails, that consent is stored; should we send marketing emails in future, we will do so solely on the basis of your explicit, freely revocable consent (Art. 6(1)(a) GDPR), and every email will contain an unsubscribe link.

Local storage

The gift finder stores questionnaire progress (gc_phase1_wizard_state_v1), your shortlist (recogift_saved_ideas_v1), and your consent record (recogift_consent_v2) in localStorage. If you sign in, the strictly necessary authentication session (recogift.auth.session), including access and refresh tokens, remains until you sign out, the session is ended, or you clear site data. Only with your "Comfort & memory" consent do we additionally store recent recommendations and your preferred comparison view. Questionnaire data is sent when you submit the form; account-session data is exchanged with Supabase to authenticate you. If you object to audience measurement we store that as umami.disabled; an earlier objection under plausible_ignore is still read (see the audience-measurement section). You can clear local data in your browser settings or withdraw optional consent via the footer link "Privacy settings".

Affiliate links and sponsored-content disclosure

Some product links in our recommendations may be affiliate links. If you click such a link and make a purchase from the retailer, Recogift may receive a small commission — at no extra cost to you. Affiliate commissions do not influence which products appear in your recommendations; our scoring is based solely on fit to your answers. Commercial links are visibly identified and use the rel="sponsored" attribute.

Affiliate networks

Recogift participates as a publisher in the affiliate network operated by AWIN AG, Otto-Ostrowski-Straße 1A, 10249 Berlin, Germany. Appropriately marked product links contain an AWIN affiliate identifier and redirect through an AWIN domain to the merchant. For processing within an AWIN campaign, Smart Soft Solution OÜ and AWIN act as joint controllers under AWIN's GDPR Annex (Art. 26 GDPR). That annex allocates data-protection responsibilities, including for data-subject requests and personal-data breaches; you may exercise your rights against either party.

What happens when you click an affiliate link?

When you follow a product link, Recogift first redirects you through its own server. For catalog-product links, we record the product identifier and timestamp plus keyed HMAC-SHA-256 values derived from the IP address and user-agent. For offer links, we instead record a click reference and the related offer, report, product, network, market and slot data without storing the IP address, user-agent or an account identifier. Recogift sets no cookie during this redirect. Once a marked AWIN link is activated, the subsequent redirect passes through AWIN to the merchant. AWIN may use tracking-domain cookies and comparable technologies, including device fingerprinting, and process pseudonymous technical data such as click time, country, publisher, advertiser, campaign and product identifiers, click or network reference, referrer, truncated or hashed IP address, and device attributes. The merchant may later report limited transaction data to AWIN, such as order value, voucher use, product type and sales channel.

Legal basis and right to object

The Recogift redirect itself does not store or read information on your device. We process the server-side click log and click reference on the basis of our legitimate interests in click validation, attribution and fraud prevention (Art. 6(1)(f) GDPR). HMAC-derived click-log values are deleted after 90 days; click references and their related offer and report identifiers after no more than 400 days. You may object to this processing at any time under Art. 21 GDPR by contacting the address in the imprint. Recogift does not embed AWIN scripts and sets no tracking cookie of its own. Any storing or reading of information on your device can occur only on the AWIN domain, after you have actively clicked a marked link; AWIN is responsible for this. AWIN relies on legitimate interests for its processing of pseudonymous tracking data. You can disable AWIN tracking at any time via the opt-out linked below. AWIN states that it generally retains tracking data for 36 months. You may exercise privacy rights against AWIN at [email protected].

Further information and the option to disable AWIN tracking: AWIN Privacy Policy · Disable AWIN tracking

Hosting and processors

Our website, API, database, authentication, business email communications, production error monitoring and audience measurement use carefully selected processors under data processing agreements (Art. 28 GDPR). Part of our primary infrastructure is configured in the EEA:

• Microsoft Azure — hosting of the API and background jobs, plus operational telemetry (Azure Application Insights), in the Germany (Frankfurt) region.
• Supabase (Supabase, Inc.) — database (our primary data store), authentication and account management in the EU Central (Frankfurt) region; running on infrastructure of the sub-processor Amazon Web Services (AWS, eu-central-1, Frankfurt).
• Cloudflare (Cloudflare, Inc.) — delivery of the website (static hosting/CDN) through a global network. Technical connection and log data may be processed outside the EEA.
• Sentry (Functional Software, Inc., United States) — production error monitoring through Sentry's EU (Germany) ingest infrastructure; error events are retained for 90 days.
• Zoho Mail — provision of our business email mailboxes and processing of contact inquiries. Service data is stored in Zoho's EU data centre.
• Umami Software, Inc., 28 Geary St, Suite 650 #243, San Francisco, California, United States — cookieless, privacy-friendly audience measurement; processed in the provider's EU data region.

Cloudflare, Supabase, Sentry and Umami are US-established or have US parent companies. Zoho Mail stores service data in its EU data centre; in rare cases, technical support may access that data from India. Where personal data is transferred to or accessed from a third country, we rely on the processor's data processing agreement and an applicable Chapter V GDPR safeguard, including EU Standard Contractual Clauses where required. If processors or regions change, we will update this information.

Cookies, browser storage, and audience measurement

Simply visiting Recogift does not place AWIN tracking cookies. Under Article 5(3) of the ePrivacy Directive and applicable national implementations, consent is not required for browser storage strictly necessary to provide a feature you request. This covers questionnaire progress, the shortlist, the consent record and, when you sign in, the authentication session. Related personal-data processing relies on Art. 6(1)(b) or (f) GDPR as described above. Optional "Comfort & memory" storage is used only with your consent, which you may withdraw at any time through "Privacy settings" (Art. 7(3) GDPR). When you click a marked AWIN affiliate link, AWIN may store or read tracking information on your device on its own domain. See Section 05 for details.

Audience measurement with Umami: when enabled, Umami (Umami Software, Inc., San Francisco, USA; processed in the provider's EU data region) receives privacy-normalized page paths and referrers, campaign values, event names and selected low-cardinality properties, together with browser, operating system, device type, screen resolution, language setting and approximate location information. Umami sets no analytics cookies and creates no cross-device profile. Your IP address is processed only transiently — to derive the approximate location and as an input to a session identifier — and is not stored; that session identifier is a hash of technical values (including website identifier, IP address and user-agent) combined with a server-side random value that rotates monthly. We measure page visits, questionnaire start and submission, errors, saves, comparisons, section expansion, successful shares and offer clicks. Shared-link identifiers, report identifiers, account data and questionnaire answers are not sent, and share identifiers are stripped from the referrer before transmission. The legal basis is our legitimate interest in privacy-friendly audience measurement (Art. 6(1)(f) GDPR). Because the provider is US-established, any third-country transfer is based on the data processing agreement including the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can object at any time by turning off "Anonymous usage analytics" in the footer's "Privacy settings". This stores umami.disabled=1 only to remember your choice for this browser and domain; removing browser data resets it. An objection recorded earlier under the key plausible_ignore (from the audience measurement we used previously) is still read and honoured; it is removed as soon as you switch usage analytics back on.

Your rights

Under the GDPR, you have the following rights regarding your personal data. To exercise any of them, please contact us via the email in the imprint:

• Right of access (Art. 15 GDPR) — you can request a copy of the personal data we hold about you.
• Right to rectification (Art. 16 GDPR) — you can ask us to correct inaccurate data.
• Right to erasure (Art. 17 GDPR) — you can request deletion of your data where no overriding legal basis applies.
• Right to restriction of processing (Art. 18 GDPR) — you can ask us to restrict how we use your data.
• Right to data portability (Art. 20 GDPR) — you can request your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR) to processing based on legitimate interests, and the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee); you may also contact the authority in your country of residence.
• Right to withdraw consent (Art. 7(3) GDPR) — you can withdraw any consent you have given (e.g. "Comfort & memory") at any time via the footer link "Privacy settings". The lawfulness of processing carried out before withdrawal remains unaffected.

Retention periods

Server logs (operational telemetry via Azure Application Insights) are retained for up to 90 days. Gift plan data in our database is retained for up to 30 days; acquisition data attached to a report follows that report's retention period. Shared reports and shortlists expire after 90 days. HMAC-derived click-log values are retained for 90 days, and click references with related offer and report identifiers for up to 400 days. Sentry error events are retained for 90 days. We delete contact inquiries and the related correspondence once the inquiry is resolved, and no later than 12 months after the last contact, unless statutory retention obligations or the establishment, exercise or defence of legal claims require longer storage. Reports saved to a signed-in account and account data remain until you delete them or delete the account. The authentication session remains in browser storage until you sign out, the session is ended, or you clear site data; other local storage remains until you clear it.

The retention period for analytics data is set by our Umami plan and is currently six months. We review that necessity at least annually and delete the site statistics or the account when they are no longer required.

Security

We use TLS encryption for data in transit and access controls for production systems. We do not collect payment data. Recogift itself stores no passwords; sign-in is handled by Supabase. Anonymous plans are stored without direct identifiers. Sentry is configured without default PII, query strings, performance traces or session replay.

Changes to this policy

We may update this privacy policy when our services change materially. The date at the top of this page will be updated accordingly. The version applicable at the time of processing always governs; for material changes affecting data-subject rights we will, where required, obtain renewed consent. We do not infer consent to disadvantageous changes from continued use alone.