Privacy policy

Who is responsible

Gjafalisti is operated by DEC ehf., kt. 471119-1720, Iceland, which is the controller of the personal data processed on gjafalisti.is.

What we keep

About list owners: email address (or an identifier from Google or Apple), an encrypted password, language, and the lists themselves – names, date, greeting, gifts and, if you choose, bank details for cash gifts.

About guests: the name a guest types when reserving a gift, which gift and how many. Nothing else. Guests need no account.

Technical data: cookies that keep you signed in, remember your language, and remember which gifts you reserved so you can undo it. We use no advertising or tracking cookies.

Who sees what

Anyone with a list's link can see the list, the names of guests who reserved gifts, and bank details if the owner entered them. Lists are kept out of search engines.

List owners cannot see who reserved which gift until they choose to reveal it themselves.

Product details and photos

When a product link is pasted we read the name, price and photo from the shop's page. Photos are shown directly from the shop and belong to it. Shops that do not want their products shown can contact us and we will act immediately.

Processors

Data is hosted inside the EEA: database and sign-in with Supabase (Ireland), the website with Vercel (Dublin). If a photo is used to identify a product it is sent to Anthropic for analysis and used for nothing else.

How long

Lists and accounts are kept until you delete them. You can delete a list in its settings and your account under “My account”. Deletion is final and immediate.

Your rights

You have the right to access, correct or erase your data, and to complain to the Icelandic Data Protection Authority (personuvernd.is). Guests who want their name removed from a list can cancel the reservation or contact us.

Contact: hallo@gjafalisti.is

Children

People under 13 may not create an account. A parent or guardian can create and look after a list on their behalf.