Your shortlist

    See all your saved gifts

    Privacy policy

    In short

    • You can use GiftExperts without an account and without telling us who you are.
    • An account is optional. If you make one, we keep your email address and what you add to it, only to run the account for you. Names and birthdays of the people you add are stored only for your own use. If you sign in, we also set a sign-in cookie, gfx-u, that keeps you signed in. Details are under Your account.
    • On English lists we set a cookie of our own, gfx-store. For one hour it holds only which Amazon store our shop buttons use for your country, so prices show in that store's currency. If you choose US, UK, Canada or Australia at the foot of an English page, we set gfx-en, which holds only that choice for one year. Our statistics work without cookies.
    • Product pictures load straight from Amazon, so Amazon sees your IP address.
    • Some English pages show ads from Mediavine. Where the law requires it, you are asked for consent before ad cookies are used.
    • If you email us or use the contact form, we use what you send only to answer you. The form also keeps a code made from your IP address for one day, only to stop abuse.
    • If you ask for a reminder email on a list, we keep your email address and the date until you stop it, and email you only about that reminder.
    • If you add a reminder to your calendar instead, nothing is kept: the calendar file is made when you ask for it and not stored. Its link carries the list and an age, never a name or a date. The Google Calendar button sends the event to Google, like any event you add there.
    • If you type a note in the optional box of the Secret Santa gift finder (English pages), it is sent to our AI provider to suggest gifts. We don't store it, and it isn't used to train AI.

    Who is responsible

    Publisher: Peter Mattsson, who is responsible for the content of GiftExperts. He is also the controller for the personal data described here.

    Birger Jarlsgatan 39, 111 45 Stockholm, Sweden. Email: hello@giftexperts.com.

    What we use and why

    What we use and why
    Service What it does and what it sees Legal basis How long Where
    Vercel (hosting) Delivers every page and blocks abusive traffic. Sees your IP address, browser and the page you ask for. Legitimate interests: a safe, working site Short-lived logs, as set by Vercel USA
    Plausible (statistics) Counts visits and clicks on shop buttons without cookies. Your IP address is turned into a daily changing code and not stored. Legitimate interests: knowing, in total, how the site is used Totals only, kept as site history EU
    Our click counter Counts clicks on shop buttons: the pick, list, position, language and store, with a code made from your IP address and browser that changes every day. Your IP address is not stored. We also count which cards were on screen, per page view, without cookies; those rows are deleted after 90 days. When you use the site search, we also keep the words you searched for (with email addresses, links and long numbers removed), the results we showed and the one you picked, without cookies; those rows are deleted after 90 days too. Legitimate interests: knowing which picks help readers Kept as site history USA
    Sentry (error reports) Tells us when something breaks on our servers. Reports may hold the page address, never your IP address. Legitimate interests: fixing faults A limited period, as set in Sentry USA
    Amazon Shows product pictures on our pages and takes over when you follow a shop link. Legitimate interests: showing the products Set by Amazon Set by Amazon
    YouTube (Google), only after you press play on a LEGO video on our LEGO Christmas page Plays the video in YouTube's privacy-enhanced player (youtube-nocookie.com). Nothing loads from YouTube until you press play; then YouTube sees your IP address and browser and may store data on your device. Consent: your click on the video Set by Google USA
    Anthropic (AI provider, only for the gift finder's optional note box and the Secret Santa lists' question box, on English pages) Reads the note you type, to suggest gifts. We first remove email addresses, phone numbers, links and long numbers. It receives the note from our server, never your IP address, and returns only gift categories. It does not use the note to train AI. Legitimate interests: suggesting the gifts you ask for We don't store or log the note. Anthropic doesn't keep it either. Our host's (Vercel) request logs may briefly record text sent from the question box, for security and operations, then delete it USA
    Mediavine and its ad partners (English pages only) Show ads. With your consent, they use cookies and similar tools to personalise ads. Consent for ad cookies and personalised ads; legitimate interests for other ads and for asking your consent Set by Mediavine and each partner USA and elsewhere
    Google Analytics (via Mediavine, for ad reporting; English pages that can show ads) Counts visits so Mediavine can report on its ads. Sees your IP address, browser and the pages you view. In the EU, the UK and Switzerland it uses cookies only if you agree in Mediavine's consent tool; elsewhere it sets its own cookies. Consent where the law requires it; legitimate interests elsewhere: ad reporting As set in Google Analytics USA
    Email Your address, any name you give and your message. Mail to our addresses passes through Cloudflare Email Routing, which forwards it to our inbox on our behalf. Legitimate interests: answering you As long as we need to deal with your message EU; Cloudflare in the USA
    Contact form Your name, email address, the topic you choose, your message, and a code made from your IP address, used only to stop abuse. We are notified without the message content. Legitimate interests: answering you and preventing abuse 12 months, then deleted; the IP code after one day USA (our database host, under the EU standard contractual clauses)
    Reminder emails (only if you ask for one on a list) Your email address, the list, the occasion, its month and day if you give them, how many weeks ahead to write, and on a children’s list the age and gender the list is for. Never a child’s name. A code made from your IP address, used only to stop abuse. When you sign up and when you confirm, the time, the exact wording shown and a second, keyed code of your IP address are kept as proof of your consent. No reminders are sent until you confirm through the first email; each reminder has a link to stop it. Consent, given by submitting the form and confirmed by email Until you stop the reminder: the address is then deleted 24 hours later (so a stop tapped by mistake can be undone); no email is sent in between. Unconfirmed sign-ups are erased after 30 days. The IP code is erased after one day. The proof of consent is kept while the reminder exists and for 3 years after it ends, without your email address. An address that bounces or reports spam is kept only as a one-way code, so it is never emailed again USA (our database host; Resend, Inc. (a US company, EU region in Ireland) for sending), under the EU standard contractual clauses
    Your account (only if you make one) Your email address, language, country and time zone; the gifts you save (our own card numbers and the list they came from); the people, dates, gift ideas and wrapping plan you add, with every name and idea you type stored encrypted; and, for each device you sign in on, a sign-in cookie (gfx-u) and the browser type. A code made from your IP address, changed daily and erased after one day, is used only to stop abuse. Nothing from Amazon is stored in your account. Contract: running the account you asked for (Article 6(1)(b) GDPR); legitimate interests for abuse protection Until you delete it, or a person, date or gift in it. An account unused for 30 months gets one email, and is deleted 30 days later if you don't sign in USA (our database host, under the EU standard contractual clauses)
    Sign-in codes Your email address and a 6-digit code, sent by Resend. We store the code only in encrypted form. Contract (Article 6(1)(b) GDPR) The code expires after 10 minutes; Resend keeps its sending logs as set by Resend USA; Resend, Inc. (EU region in Ireland)
    Reminders from your account (only for dates you switch on) An email before each date whose reminder you switched on, with a link to the matching list. When you switch one on, the time, the exact wording shown and a keyed code of your IP address are kept as proof of your consent. Consent, given date by date with the "Email me reminders" button Until you stop the reminder or delete the account. The proof of consent is kept without your email address, only with a one-way code of it, for as long as we may need to show that you agreed USA; Resend, Inc. (EU region in Ireland) for sending, under the EU standard contractual clauses

    Legitimate interests means Article 6(1)(f) GDPR, and consent means Article 6(1)(a) GDPR. You never have to give us personal data; without a name and email address we cannot answer your message.

    The AI and data services we use for our lists work only with product data, never with data about you. The one exception is the gift finder's optional note box and the question box on our Secret Santa lists: what you type there goes to our AI provider (see Anthropic above), so please don't include names or other personal details. We make no automated decisions about you that have legal or similar effects.

    Shop links

    A shop button takes you to the store, which sees that you came from GiftExperts. The store uses its own cookies to credit us, under its own privacy policy, such as Amazon.com's privacy notice.

    Third parties, including Amazon and other advertisers, may serve content and advertisements, collect information directly from visitors, and place or recognize cookies on visitors' browsers.

    Ads on English pages

    Visitors in the EU, the UK and Switzerland see Mediavine's consent tool before any ad cookies are used. You can change or withdraw your choice at any time through its privacy settings link on English pages. If you say no, you may still see ads, but they are not based on a profile of you.

    We decide to show Mediavine ads, so we share responsibility with Mediavine for collecting data on those pages and passing it to Mediavine. What Mediavine and its partners do after that is their responsibility. Details, including its ad partners, are in Mediavine's privacy center.

    We don't sell personal data.

    Mediavine Programmatic Advertising (Ver 1.1)

    The Website works with Mediavine to manage third-party interest-based advertising appearing on the Website. Mediavine serves content and advertisements when you visit the Website, which may use first and third-party cookies. A cookie is a small text file which is sent to your computer or mobile device (referred to in this policy as a “device”) by the web server so that a website can remember some information about your browsing activity on the Website.

    First party cookies are created by the website that you are visiting. A third-party cookie is frequently used in behavioral advertising and analytics and is created by a domain other than the website you are visiting. Third-party cookies, tags, pixels, beacons and other similar technologies (collectively, “Tags”) may be placed on the Website to monitor interaction with advertising content and to target and optimize advertising. Each internet browser has functionality so that you can block both first and third-party cookies and clear your browser’s cache. The "help" feature of the menu bar on most browsers will tell you how to stop accepting new cookies, how to receive notification of new cookies, how to disable existing cookies and how to clear your browser’s cache. For more information about cookies and how to disable them, you can consult the information at All About Cookies.

    Without cookies you may not be able to take full advantage of the Website content and features. Please note that rejecting cookies does not mean that you will no longer see ads when you visit our Site. In the event you opt-out, you will still see non-personalized advertisements on the Website.

    The Website collects the following data using a cookie when serving personalized ads:

    • IP Address
    • Operating System type
    • Operating System version
    • Device Type
    • Language of the website
    • Web browser type
    • Email (in hashed form)

    Mediavine Partners (companies listed below with whom Mediavine shares data) may also use this data to link to other end user information the partner has independently collected to deliver targeted advertisements. Mediavine Partners may also separately collect data about end users from other sources, such as advertising IDs or pixels, and link that data to data collected from Mediavine publishers in order to provide interest-based advertising across your online experience, including devices, browsers and apps. This data includes usage data, cookie information, device information, information about interactions between users and advertisements and websites, geolocation data, traffic data, and information about a visitor’s referral source to a particular website. Mediavine Partners may also create unique IDs to create audience segments, which are used to provide targeted advertising.

    If you would like more information about this practice and to know your choices to opt-in or opt-out of this data collection, please visit National Advertising Initiative opt out page. You may also visit Digital Advertising Alliance website and Network Advertising Initiative website to learn more information about interest-based advertising. You may download the AppChoices app at Digital Advertising Alliance’s AppChoices app to opt out in connection with mobile apps, or use the platform controls on your mobile device to opt out.

    For specific information about Mediavine Partners, the data each collects and their data collection and privacy policies, please visit Mediavine Partners.

    Saved on your device

    Picks you save with the heart button, and Secret Santa draws you choose to keep, stay in your browser's storage and are not sent to us. On English lists, the Amazon store our shop buttons send you to (for example Amazon.com), worked out from your connection's country, is kept there for a day so the budget filter can show that store's price ranges; your country itself is not kept. The Secret Santa tool runs in your browser: names travel only inside the links you send, and anyone with a link can open it. Ad scripts on English pages can technically read this storage. Clear your browser's site data to remove it.

    The Secret Santa gift finder sends your answers (who you drew, a budget band, an age band and interests, all picked from fixed choices) to our server only to choose gifts. They are not stored, logged or linked to you; Vercel's request logs keep your IP address as for any page, but not your answers. The exchange date you enter never leaves your browser. Your shortlist stays in this browser tab and is gone when you close it. The white elephant turn order, with any names you type and the steal counts, also stays in that tab only, so a reload can resume the game. If you copy the link to your list, it holds short codes for your saved gifts only, no names or answers.

    If you are signed in to an account, the gifts you save from then on, including in the gift finder, are kept in your account and sent to us (see Your account).

    Your account

    • An account is free and optional, and it is for adults: by signing up you confirm you are 18 or over.
    • Birthdays and names of people you add are stored only for your own use. We never contact them, show them to anyone or use them for ads. A nickname is fine. Please don't add health or other sensitive details about anyone.
    • We never email you because of a saved gift. You get a sign-in code when you ask for one, and a reminder only before a date whose reminder you switched on. Every reminder has a link to stop it that works without signing in.
    • Shop links work the same with or without an account: when you follow one, the store (Amazon, for example) uses its own cookies under its own privacy notice. We never tell a store who you are, and no store tells us what you bought.
    • You can download everything in your account, or delete a person, a date or the whole account, yourself in Settings. Deleting the account erases it from our database at once. Our database backups are overwritten within 7 days. If we ever restore one, we delete erased accounts again straight away, using a list of erased account numbers we keep for 8 days.
    • Lost access to your email? Download your data, then sign up with your new address. We can't move accounts by hand, because we can't check who owns an address.
    • Sign out on one device or all of them in Settings. Using someone else's phone? Sign out when you're done.

    Transfers outside Europe

    Some services above are based in the USA. Those transfers rely on the EU-US Data Privacy Framework where the company is certified, or on the EU's standard contractual clauses. Ask us if you want details.

    Your rights

    You can ask us for a copy of your data, and ask us to correct or delete it, to limit how we use it, or to send data you gave us in a portable form. You can object to use based on legitimate interests, and withdraw consent at any time. Email hello@giftexperts.com and we will answer within one month. We keep almost no data that identifies visitors, so there is often little or nothing to send.

    You can also complain to the Swedish data protection authority, IMY, or to the authority where you live or work.

    Children

    GiftExperts is written for adults choosing gifts. It is not aimed at children, and we don't knowingly collect data from them. A reminder email never asks for a child’s name: it keeps only the age and gender of the list it was set on.

    Accounts are only for adults. A child's name or birthday that you add to your account is kept only for you, and we never contact the child.

    Changes

    We update this policy when the site changes. The date below shows the current version.

    Last updated: October 9, 2026