Privacy policy

Who we are

Givumi is operated by Natasha Weston trading as Givumi, a sole trader based in the United Kingdom. Natasha Weston is the data controller responsible for the personal information described in this policy.

Natasha Weston trading as Givumi — sole trader, United Kingdom.

Email: givumihelp@gmail.com

Effective date: 18 October 2026.

What we collect

• Your account: your email address and authentication information for email/password sign-in, password resets or Google sign-in. Google sign-in supplies the account information needed to authenticate you.
• People you buy for: names or nicknames, relationships, age bands, audience preferences, interests, likes, dislikes, owned items, gift preferences, exclusions, budgets, notes and descriptions. We also store occasions and dates you enter.
• Gift activity: saved, dismissed, never-give and purchased gifts, product snapshots, and saved Brainstorm ideas and generations.
• Retailer links: opening a product shop link records your account identifier, product identifier, recipient identifier if supplied, destination link and the click time. This operational record is separate from optional Google Analytics. Retailers and affiliate networks receive your visit when you open their links.
• Subscriptions: Stripe processes payment and billing details. Givumi receives customer and subscription identifiers, plan/price, billing country, subscription and payment-period dates, cancellation status and relevant payment, refund or dispute events. Givumi does not receive full payment-card details.
• Contact messages: the name, email and message you submit using our contact form or send by email.
• Optional analytics: Google Analytics receives browser/device and visit information, cookie identifiers and general usage measurements after you agree. This is not anonymous data. See our Cookie Policy.

How we use information and our lawful bases

• Contract: providing the account holder's requested account, gift discovery and planning service, including requested AI tools, and managing Premium subscriptions.
• Legal obligations: keeping applicable financial and accounting records.
• Legitimate interests: proportionate security and misuse prevention. For information about recipients, our proposed legitimate interest is helping account holders privately organise gifts for people they know, balanced against those people's rights and reasonable expectations. The account holder's contract does not automatically provide a lawful basis for recipients' information.
• Consent: optional analytics, which you can refuse or withdraw through Cookie settings.

We do not sell personal information or use it for advertising.

Information about recipients and AI processing

Recipient information is supplied by account holders, not by the recipients themselves. Use nicknames and the minimum details needed. Add only information they would reasonably expect you to know; do not enter sensitive information such as health, religion or sexuality. Profiles are private to your account.

Our AI tools use OpenAI's configured model through the Lovable AI Gateway. Understanding a description sends the name or nickname you supply and your description. Brainstorm sends the occasion, budget and relevant profile information, including name/nickname, relationship, age band, audience preference, interests, likes, dislikes, owned items, gift preferences, exclusions, notes and description, plus relevant saved-gift decisions. Background profile understanding sends age band, audience preference, descriptions, notes and profile interests and preferences.

These details are used to propose profile additions, understand preferences and generate gift ideas. You approve proposed profile additions; saved Brainstorm results can be reopened without a new AI request. AI can make mistakes. Our requests disable response storage using the API's store setting, but this is not a guarantee about all provider logs, retention or training practices.

Lovable's published training-data guidance states that app end-user data held in project databases and storage is not used to train its models. This is separate from the recipient information our AI tools transmit through the AI Gateway: the precise gateway and model-provider logging, retention, training restrictions and processing locations applicable to those requests still need confirmation. It is also separate from development prompts and project content used to build Givumi.

Who processes information

• Lovable: website hosting, Lovable Cloud database, authentication and storage, managed authentication email delivery, and the AI Gateway. Lovable Cloud uses Supabase's technology.
• OpenAI: the configured AI model service reached through Lovable.
• Stripe: payment processing and subscription management. Stripe acts as a processor or an independent controller depending on the purpose. Its standard UK Services Agreement incorporates its Data Processing Agreement and Data Transfers Addendum. Stripe processes information internationally, including in the United States; this is not UK-only processing. See Stripe's Privacy Policy and Data Processing Agreement.
• Google: Google sign-in if chosen, Google Fonts delivered remotely, and Tag Manager/Analytics only after analytics consent.
• Retailers and affiliate networks: when you follow their links; purchases are under their own privacy arrangements. See our affiliate disclosure.
• Our support email service: messages sent to givumihelp@gmail.com are handled by Google's Gmail service.

Still to be confirmed: the applicable processing locations, international-transfer arrangements and safeguards for these services, and the precise gateway/model logging, retention and training terms. This draft does not assert that these arrangements have been verified.

Stripe's international processing and published agreements are described above. For Lovable Cloud and AI Gateway, we still need written confirmation of the data-processing agreement and UK transfer safeguards covering Givumi's end-user personal data on its Pro subscription. Lovable's public DPA page expressly includes Business and Enterprise; it does not establish coverage for this Pro subscription.

Retention and deleting your account

We keep account and gift-planning information while your account is open. Delete my account on the Account page first attempts to cancel subscriptions that could still charge; if a required cancellation fails, deletion stops. Once that succeeds, it deletes your planning data and login. Subscription records and Stripe billing history are retained for applicable financial-record requirements.

Deletion from the active service does not mean immediate deletion from backups or providers' records. Lovable documents daily database backups retained for up to roughly 14 days; storage files are not included in those database snapshots. Givumi's actual backup inventory has not been independently checked.

Givumi's owner has checked that Google Analytics 4 event and user data retention is set to 14 months. This setting does not determine retention for standard aggregated reporting, which can be retained differently. It is also separate from browser-cookie expiry. Stripe retains records according to its applicable legal obligations and processing purposes; deleting your Givumi account does not immediately delete Stripe's records.

Retention periods still to be confirmed: billing and payment-event records, contact-form and support-email messages, operational click/security records, email/AI provider logs and any additional provider backup retention. We will update this draft once the applicable periods have been established.

Your rights

Depending on the circumstances, you can ask to access, correct or erase information, restrict its use, object to processing based on legitimate interests, or receive portable information. Consent can be withdrawn at any time without affecting processing already carried out. Some rights have legal exceptions, including necessary financial records.

Account holders can edit profiles and delete their account. Both account holders and recipients can contact givumihelp@gmail.com about their information or exercise their rights; we may need proportionate information to verify identity and locate the relevant record. You can complain to the Information Commissioner's Office.

Changes and cookie choices

We will update this policy when our processing changes. See the effective date above and our Cookie Policy for cookie choices.