Your data, handled with care.

Last updated: 16 September 2026

Who runs Giftwise

Giftwise is operated by Coldharbour Tech Limited, a company registered in England and Wales (Company Number 17185625). For the purposes of UK GDPR, Coldharbour Tech Limited is the data controller for personal data processed in connection with the Giftwise app and this website.

For any privacy question, or to exercise your rights (below), email contact@coldharbourtech.com. We do not have a statutory Data Protection Officer; that address reaches the person responsible for data protection.

What data we process, and where it is stored

If you use Giftwise without an account (stored on your device)

Until you sign in, the gift-planning data you enter is kept in your browser's local storage on that device. It is not sent to us. This includes:

• The names, relationships, interests and notes of people you add
• Birthdays, anniversaries and other occasions you record
• Sizes (clothes, shoes, ring) you choose to record
• Gift ideas, prices, links, notes and any photos you attach
• Wishlists you create
• App preferences, and the taste model that learns which suggestions you like

Local storage is bound to that browser on that device. It does not sync to your other devices, other websites cannot read it, and clearing your browser data will delete it. Please see Cookies & storage and back up your data via Settings → Your data → Export backup.

If you create an account (stored on our servers)

Signing in (by email magic-link) lets your data sync across devices and enables shared wishlists. From that point, the data above is stored on our behalf by our database and authentication provider, Supabase, together with:

• Your account email address and sign-in records
• Whether you have opted in to marketing email
• Your learned preferences (the taste model), so suggestions improve and follow you across devices
• Shared-wishlist data: the wishlists you publish, and — for people who view them — a viewer record, any items they claim, and any comments they leave

Data sent to third parties when you use certain features

• Photo recognition ("Snap a gift") — if you photograph a product, the image is sent to our AI provider Anthropic to identify it and suggest similar gifts. Under Anthropic's commercial API terms the image is used only to answer that request, is not used to train models, and is not retained beyond processing. A small thumbnail may be saved with your gift idea (on your device, or your account) so you recognise it later.
• Barcode lookups — when you scan a barcode, the barcode number (not personal data) is sent to product databases — Open Food Facts, Google Books and UPCitemdb — to fetch product details.
• Saving from a link — if you paste a product URL, our server fetches that public page to read its title, price and image. Only the URL you provide is sent.
• Affiliate retailer links — when you click through to a retailer (Amazon, and Awin partners such as Waterstones, Debenhams, Hamleys and others), you go to that retailer's site under their privacy policy. The link may carry a tag identifying Giftwise as the referrer so we can earn a commission.
• Affiliate tracking (Impact) — only if you accept cookies, we load a tag from Impact (impact.com) that sets cookies and records affiliate link clicks so partners can credit referrals to Giftwise. Decline, and this tag is never loaded. See Cookies & storage.
• Newsletter — if you subscribe, we store the email address and consent you provide to send occasional updates. You can unsubscribe at any time.

Shared wishlists

When you share a wishlist, we create a private share link (containing a random identifier) and host that list so recipients can open it, claim items so people don't double up, and leave comments — no account required for them. A person you share a list with sees only that wishlist. They cannot see your other wishlists, the people you buy for, birthdays or private occasions, your notes or preferences, or any internal identifiers. Anyone with the link can view the list, so share it only with people you intend to. You can stop sharing at any time by deleting the list or regenerating its link.

Who we share data with (processors)

We do not sell your data. We use a small number of trusted providers to run the service, each processing data only on our instructions:

• Supabase — database, authentication and hosting for account data
• Cloudflare — website hosting, content delivery and security
• Anthropic — AI photo recognition (only for photos you scan)
• Impact — affiliate click tracking (only if you accept cookies)
• Awin and Amazon — affiliate networks, when you click a retailer link
• Open Food Facts, Google Books, UPCitemdb — barcode product lookups
• Google Fonts — web fonts loaded from Google when the site opens

International transfers

Some of these providers are based outside the UK (for example in the United States or the European Economic Area), so your data may be processed abroad. Where that happens, we rely on an appropriate safeguard — an adequacy decision, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum — so your data receives an equivalent level of protection.

Our lawful bases

• Contract — to provide the account and service you sign up for (storing and syncing your data, shared wishlists, improving your suggestions).
• Consent — for the Impact affiliate tag, marketing email, and AI photo recognition. You can withdraw consent at any time.
• Legitimate interests — to keep the service secure and prevent abuse (for example rate-limiting and spam checks), balanced against your rights.

How long we keep it

• Data on your device — until you delete it or clear your browser.
• Account data — while your account is active. If you ask us to delete your account we remove your data promptly; we may also delete accounts left inactive for a long period after notice.
• Shared-wishlist data — until you delete the wishlist.
• Newsletter email — until you unsubscribe.
• Scanned photos — not retained by us beyond identifying the product (a thumbnail you save stays with that gift idea).

Your rights under UK GDPR

You have the right to:

• Access — a copy of the personal data we hold about you
• Rectification — correct inaccurate data
• Erasure — delete your data ("right to be forgotten")
• Restriction — limit how we process it in certain cases
• Portability — receive your data in a machine-readable format
• Object — object to certain processing
• Withdraw consent — at any time, where we rely on consent

You can exercise much of this yourself in the app:

• Access / Portability: Settings → Your data → Export backup (JSON)
• Rectification: edit any person, occasion or gift directly
• Erasure: Settings → Delete everything from this device for local data; to delete an account and all associated cloud data, email us and we will action it (an in-app account-deletion option is being added)
• Withdraw cookie consent: clear the site's stored choice, or block the tag in your browser

To make any request, email contact@coldharbourtech.com. We respond within one calendar month as required by UK GDPR.

How to complain

If you're unhappy with how we've handled your data, you can complain to the UK's Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

Children

Giftwise is intended for adults and is not directed at children. We do not knowingly collect data from children under 13. If you believe a child has supplied us with personal data, please contact us and we will take appropriate steps.

Changes to this policy

If we change this policy we'll update the "Last updated" date above, and for material changes we'll show a notice in the app on your next visit. Continued use of Giftwise after a change constitutes acceptance of the updated policy.

Contact

Email: contact@coldharbourtech.com
Data Controller: Coldharbour Tech Limited
Registered in: England and Wales
Company Number: 17185625