Privacy Policy

We collect the details you provide when you create an account or place an order — your name, email, phone number, shipping address, and the photos or text you upload for customisation. We also collect basic technical data (such as your IP address and browser) to keep the site secure and working well.

• To create, fulfil and ship your order.
• To contact you about your order, previews and delivery.
• To provide customer support and respond to enquiries.
• To improve our products, website and service.

The photos you upload are used only to design and produce your gift. We do not sell them, and we do not use them in our marketing unless you have given us permission for that specific photo.

How they are stored:

• Your photos are kept outside the public part of our website, so they cannot be found by guessing a web address or by a search engine. They are shown only to you, when you are signed in, and to our team while making your gift.
• When you upload a photo, we strip the hidden information cameras and phones attach to it — including the GPS location where it was taken — before storing it.

How long we keep them: we keep the photos for an order for 12 months after that order is completed (delivered, cancelled or refunded). After that we delete them automatically. Photos uploaded to a basket that was never turned into an order are deleted within 48 hours.

Orders that are still open are never included in this — we will not delete the photo for a gift we are still making.

Online payments are handled by our payment partner (Razorpay). Your card and banking details are processed securely by them and are never stored on our servers.

We share information only with the partners needed to fulfil your order (such as couriers and payment processors), or when required by law. We never sell your personal data.

• Your photos: 12 months after the order is completed. See section 3.
• Photos on an abandoned basket: deleted automatically after 48 hours.
• Your account details: kept until you ask us to delete them.
• Order records: kept indefinitely. These are business and tax records, and we are required to retain them. If you ask us to delete your data, we remove your personal details from these records rather than deleting the record itself — the order is left with no name, email, phone or address attached to it.

When we delete a photo, we overwrite the file before removing it, so it cannot simply be undeleted. We want to be straightforward about the limits of this: on modern storage hardware, the way drives manage themselves internally means we cannot promise that every last trace is physically destroyed. What we can tell you honestly is that the file is removed, is no longer reachable through our website or our systems, and is overwritten as we do so.

There is one more thing worth knowing. We take regular encrypted backups so that a technical failure cannot lose your order. If you ask us to delete your data, we remove it from our live systems straight away — but a copy may remain inside an existing backup until that backup expires and is replaced in the normal cycle. Those backups are encrypted, are not used for day-to-day business, and are only ever opened to recover from a failure. If we ever do restore one, we re-apply every deletion request that was made before the restore, so data you asked us to delete does not quietly come back.

You can ask us to show you the personal data we hold about you, correct it, or delete it. Email giftfift.in@gmail.com from the address on your account and tell us what you would like us to do.

When you ask for deletion, we remove your account, your addresses and your photos, and we strip your personal details from your past orders as described in section 6.