GiftCourier is an app for Shopify stores. It lets a gift-card buyer name the person who should receive the card, write them a message, and choose a delivery date, then delivers the card to that person by email at the chosen time.
This policy describes what data GiftCourier handles and why. It is written to match what the software actually does.
Who the parties are
- The merchant installs GiftCourier on their Shopify store. Under GDPR and UK GDPR the merchant is the data controller.
- We operate GiftCourier as the data processor, acting on the merchant's instructions.
- The buyer purchases a gift card. The recipient is the person the buyer nominates to receive it.
What we access, and why
GiftCourier requests three Shopify scopes and nothing more:
| Scope | Why it is needed |
|---|---|
read_orders |
To detect a paid gift-card purchase and read the recipient details the buyer entered at checkout. |
read_products |
To read each purchased item's product tags. The tag is how a merchant designates which products may become gifts, and it is a security boundary: the recipient fields are filled in by the buyer, so the merchant's tag is the only thing that authorises a line item to become a funded gift card. No product content is stored. |
write_gift_cards |
To create the gift card at delivery time so a live card never exists before it is sent. |
From an order we read:
- Recipient email address, and optionally recipient name
- Sender name and the buyer's gift message, if provided
- The requested delivery date and its timezone offset
- The gift-card line item, its value and currency
- The order's financial status and cancellation state, used to check for a refund or cancellation before creating a card
We do not request or read customer addresses, phone numbers, or payment details. We never receive card or payment data, so GiftCourier is outside PCI scope.
What we store
- The recipient's email address, recipient and sender names, gift message, delivery time, amount and currency, for as long as the merchant has the app installed.
- The gift-card code, encrypted at rest with AES-256-GCM, so a merchant can resend a gift without a second card being created. Only the last four characters are ever displayed in the merchant admin.
- The merchant's shop domain, timezone, email-design settings, their own contact address, and an authentication token for their store.
- Identifiers from Shopify's privacy webhooks (see below).
Personal data is never written to our logs. Log output passes through a redaction layer that masks email addresses, names, tokens and gift-card codes, and this is enforced by an automated test.
Who else sees it
- Shopify, the source of the order data and the system of record for the gift card itself.
- Our email provider (Postmark), which receives the recipient's email address and the message content, solely to deliver the gift email.
- Our hosting provider (Render), which stores the database described above, on servers in the United States (Oregon).
We do not sell personal data, do not share it for advertising, and do not use it to train machine-learning models. No member of staff reads recipient data as part of normal operation; the merchant admin shows a masked address in lists, and the full address only on the single delivery a merchant opens.
How long we keep it
-
Gift delivery records live until the merchant uninstalls the app, at
which point Shopify sends a
shop/redactrequest and we delete the shop's records entirely: deliveries, email designs, sessions, the webhook ledger and stored privacy-request records. -
When Shopify sends a
customers/redactrequest, we erase the recipient's email address, recipient name, sender name and message from the matching deliveries. Any gift still awaiting delivery is cancelled first, because we can no longer deliver it.
Merchants: this one needs you to act. Erasure is irreversible and it takes the recipient's address with it, so a gift cancelled this way cannot be resent, not by you and not by us. If the buyer had paid for a gift that had not yet been delivered, the money is still yours and the recipient will get nothing, so that order is yours to settle: refund it, or arrange the gift another way. Cards already delivered are unaffected and keep working. - Records of privacy requests themselves are reduced to identifiers on receipt (never the raw payload, which contains the very data the request protects) and blanked after 30 days.
Your rights
The merchant is the controller of this data. If you are a buyer or recipient and want a copy of your data or its deletion, contact the store you purchased from; Shopify will relay the request to us and we act on it automatically as described above. You may also contact us at support@giftcourier.app and we will assist the merchant in responding.
Depending on where you live you may have rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your data-protection authority.
Security
- Gift-card codes and stored credentials are encrypted at rest (AES-256-GCM).
- All traffic is over HTTPS.
- Every webhook from Shopify is verified with an HMAC signature using a constant-time comparison before its contents are read, and duplicate deliveries are discarded.
- Access to the merchant's data is scoped to their store; the software refuses cross-store access at the database query, not merely in the interface.
Changes
If this policy changes materially we will update this page and the "last updated" date, and notify merchants through the app.
Contact
DanielsTechShop LLC971 US Highway 202N, Ste N, Branchburg, NJ 08876, USA
support@giftcourier.app