Privacy Policy
Last updated: 10 October 2026
Giftlist (gifts.firstwebdev.co.uk) is run by First Impressions App Development Ltd (“we”, “us”, “our”), a company registered in England and Wales, company number 13708714, registered office 82A James Carter Road, Mildenhall, IP28 7DE. We are the data controller for the personal data described here. You can contact us about privacy at russ.a.sherwood@gmail.com.
What we collect
- Your account: your name, email address, chosen currency, and your password, which we store only in a scrambled (hashed) form we can’t read.
- Your gift lists: the people you add (names, budgets, notes), and the gift ideas you log for them (item names, links, prices, statuses and pictures).
- Payments: if you buy Premium, our payment provider Stripe collects your payment details. We never see or store your full card number. We keep only your Stripe customer and subscription references, your subscription status and renewal date.
- Technical information: a login cookie (see “Cookies” below), and the IP address and browser details that every website receives. We use your IP address briefly to limit repeated login attempts, and our host keeps standard server logs.
Information about other people
Your lists contain details about the people you buy for. Please keep this to what you need for gift planning (names, sizes, likes and dislikes). Don’t add sensitive information, such as health details, about them. We only use this information to show it back to you. We never contact the people on your list.
How we use it, and our legal basis
- To provide Giftlist (your account, your lists, Premium, password reset emails): necessary to perform our contract with you (UK GDPR Article 6(1)(b)).
- To keep the service secure and prevent abuse: our legitimate interests (Article 6(1)(f)).
- To keep financial records of payments: our legal obligations (Article 6(1)(c)).
We don’t sell your data, show you adverts, or use your data for marketing. We don’t make automated decisions about you.
Product pictures
When you add a gift with a link, our server visits that page to find a product picture. The shop sees a request from our server, not from you, and we don’t send it any of your details. If no picture is found, we generate one from the item name instead.
Who we share it with
- Krystal Hosting Ltd (UK) hosts the website, its database and our email, on our behalf.
- Stripe processes Premium payments. Stripe is also responsible in its own right for the payment data it collects. See Stripe’s privacy policy. Stripe may transfer data outside the UK using approved safeguards.
We will also share information if the law requires it.
Cookies
We use one cookie, gt_session, to keep you logged in. It is strictly necessary for the service to work, lasts up to 30 days, and is deleted when you log out. We don’t use analytics, advertising or tracking cookies. Stripe’s checkout and billing pages set their own cookies; see Stripe’s policy.
How long we keep it
- Your account and lists: until you delete your account (Account → Delete account). Deletion is immediate and permanent.
- Password reset links: one hour. Login sessions: up to 30 days.
- Payment and invoice records held by Stripe: for as long as UK tax law requires (normally six years).
- Server logs: for the short period our host keeps them.
Your rights
Under UK GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. You can see, change and delete everything yourself from inside Giftlist. For anything else, email russ.a.sherwood@gmail.com and we’ll respond within one month.
If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We’d appreciate the chance to put things right first.
Security
Passwords are hashed, the site runs over HTTPS, and each account can only see its own data. No system is perfectly secure. If a breach affects your data, we’ll tell you, and the ICO, as the law requires.
Children
Giftlist is for adults. You must be 18 or over to create an account.
Changes
If we change this policy we’ll update the date above, and we’ll email you about significant changes.