Privacy
Who is responsible
TheGiftQuest is operated by [to confirm: full registered legal name], a registered sole trader in Latvia, at [to confirm: business postal address], [to confirm: registration number and VAT number, if applicable]. He is responsible for the personal data described here. Contact him at [to confirm: verified support email].
What we use and why
To sign you in and manage your purchases: performance of our agreement with you. Necessary security checks: our legitimate interest in protecting accounts and gifts.
To provide and support your purchase: contract. Records required by accounting law: legal obligation. Lemon Squeezy handles payment details; we do not receive card numbers. Refund and withdrawal requests include a reason field, optional for withdrawal of an unopened gift within 14 days. The owner uses the request and whether the quest was opened to review and approve refunds in admin.
To deliver the private gift experience: our and the sender's legitimate interests in providing a requested gift to its recipient, subject to the recipient's rights and particular care for children.
To operate the link, protect it and tell the sender when it is first revealed. Recipient-related processing uses the same assessed legitimate interests. The sender sees that the gift was opened, not your individual answers or detailed play history.
To send the note you ask us to send to the buyer, once per gift: legitimate interests in fulfilling your request. The note is optional.
To keep the service working and prevent misuse: legitimate interests, using limited data for limited periods.
To confirm your signup and send the one launch announcement you requested: consent. You can unsubscribe at any time. Buying a quest or signing in does not subscribe you.
To understand visits and measure advertising: your separate consent. Rejecting these choices does not stop you using the service.
To help with your purchase: contract; other enquiries and protecting recipients: legitimate interests. An AI assistant may help answer you; you can ask for Elvijs.
We need a verified buyer email to take payment and send service messages. You can choose Google sign-in instead of an email code or magic link. Google sign-in information: [to confirm: Google information received and stored identifiers or tokens]. Recipients do not need an account or an email address. Our internal administrators can see order and gift status and record support actions; their panel does not show decrypted gift text.
A note for recipients and parents
The sender supplied your name and gift details. The sender receives a message when you first reveal the gift. If you choose to send a thank-you note, the sender receives what you write. Do not put private information in it. You can always choose Open my gift without playing.
Parents or guardians can contact [to confirm: verified support email] about a child's information.
Cookies and measurement
Necessary sign-in cookies are restricted to the buyer website. Optional buyer analytics use PostHog's EU service. Advertising measurement, if enabled, uses Meta on the buyer website only, after marketing consent. You can change your choices at Cookie settings in the footer.
We do not send optional gameplay analytics from the recipient game to PostHog. The game does not load Meta, advertising trackers or session recordings. We still process the information needed to show the gift and operate its link.
Service providers and transfers
We use Vercel for hosting, Neon for our database in Frankfurt, [to confirm: managed or self-hosted Better Auth setup] for buyer sign-in, and Lemon Squeezy as the seller and merchant of record for payments.
Email: We use Resend (Plus Five Five, Inc.) to send email. Email addresses, message contents, delivery logs and webhook data are processed and stored in the United States, including by its service providers. An EU sending region does not change that. Our data-processing agreement includes EU Standard Contractual Clauses. You can ask us for information about those safeguards. Resend says it participates in the EU–US Data Privacy Framework; we rely on that mechanism only while its relevant certification is verified as active.
Emails can include names, private gift or management links, and a thank-you note you choose to send. We avoid including the underlying gift code or gift details.
AI support: [to confirm: AI support provider, data received, processing countries, DPA/transfer mechanism, training controls, retention and human escalation].
How long we keep information
- Unpaid drafts: seven days.
- Gift content and messages: until 30 days after the link's 90-day validity ends. The expiry date is shown with the gift.
- Unconfirmed launch signups: seven days after the confirmation email is sent. The launch list and its sending queue are deleted on 31 January 2027.
- Buyer accounts: until you delete the account. Deleting an account does not erase records we must keep by law.
- Accounting records: [to confirm: accountant-approved retention schedule]; Latvian law generally requires at least five years for other supporting documents and ten years for accounting registers. We keep required transaction evidence separately from gift content.
Your choices and rights
Contact [to confirm: verified support email] to ask for access, correction, deletion, restriction, applicable portability, or to object to processing based on legitimate interests. You can withdraw consent without affecting the lawfulness of earlier processing. We usually respond within one month; if a permitted extension is needed, we explain it within that month. We may need limited information to verify your request and protect another person's gift.
You can complain to Latvia's Datu valsts inspekcija (opens in a new tab), or your competent supervisory authority. You can ask Elvijs to review a support answer or refund decision.
We will show changes here and notify affected people when required.