Privacy Policy

Who is responsible for your data

WonderGifts is the data controller for the information described here. For any privacy question or request, contact us at [email protected].

Information we collect

• Account details. When you sign in to plan an event we use Google Sign-In and receive your name and email address.
• Parent/guardian profile. A display name and, optionally, a phone number you provide for event coordination and delivery.
• Children’s event information.To create a birthday event you may provide the child’s first name, age, party date, a delivery address, a favourite character, and an optional photo of the child.
• Orders. Delivery address, contact details, order contents, and payment status needed to fulfil purchases. Card payments, when enabled, are handled by our payment processor — we do not store full card numbers.
• Technical data. Essential first-party cookies (session and signed-in state), plus basic server logs (IP address, browser type) used for security and reliability.

Children's data and parental consent

WonderGifts is intended for use by adults (parents and guardians). Children do not create accounts. By adding a child’s name, age, or photo you confirm that you are the parent or legal guardian, or that you have the guardian’s permission, and that you consent to us processing that information solely to provide the event and delivery features.

Please upload a photo only if you are comfortable doing so — it is never required to create an event.

How we use your information

• Create and manage birthday events and wishlists.
• Process, deliver, and confirm gift orders and party delivery.
• Show a shareable event page to guests you invite via its link.
• Keep the service secure and prevent abuse.
• Respond to your questions and support requests.

We do not sell your personal data, and we do not use it for third-party advertising.

Who can see event information

Each event has a private, shareable link. Anyone with that link can view the event page (child’s first name, age, photo if added, and the wishlist) so they can buy a gift. Only the signed-in host can edit or delete the event. Share the link only with people you trust.

How long we keep data

• Child photos are automatically deleted a set period after the party date (90 days by default), and immediately when you remove the photo or delete the event.
• Event and order records are kept while your account is active and as needed to fulfil orders and meet legal or accounting obligations.
• You can ask us to delete your data at any time (see below).

Third parties we rely on

• Google — sign-in and identity verification.
• Our commerce platform & payment processor — order and payment handling.
• Our hosting provider — servers and storage.

These providers process data on our behalf under their own security terms.

Cookies

We use essential first-party cookies only:

• Session cookie — keeps your browsing session and cart stable across pages.
• Signed-in cookies — after Google sign-in, secure HttpOnly cookies remember that you are the event host (email/name). These cannot be read by JavaScript in the browser.
• OAuth cookie — a short-lived cookie used only during Google sign-in to prevent login CSRF, then cleared.

We do not use advertising or third-party tracking cookies, so no cookie-consent banner is required for these essential cookies.

Your rights

You can request access to, correction of, or deletion of your personal data, and you can withdraw consent for optional data such as a child’s photo. You can update your profile and delete events at any time from the events page, or email [email protected] and we will respond.

Security

We protect data in transit with HTTPS, restrict access to uploads, strip photo location metadata on upload, and follow least-privilege practices. No system is perfectly secure, but we work to keep your information safe.

Changes to this policy

We may update this policy as the service evolves. Material changes will be reflected by the “last updated” date above.

Contact

Questions? Email [email protected].