Privacy Policy

1. Information we handle

• Account and sign-in information: email address, account identifier, sign-in verification records and sessions. If Google sign-in is offered and you choose it, we receive your verified email, name and Google account identifier. We do not receive your Google password.
• Orders and delivery: recipient name, email address, phone number, street address, city, state, PIN code, purchased items, quantities, prices, delivery preferences, order history, invoice details and shipment or delivery status.
• Payment verification: the transaction reference you submit, order amount and payment verification status. Our current checkout uses manual UPI payment verification. We do not ask for or collect your UPI PIN, banking password or card security code. Your payment app and bank handle the payment under their own policies.
• Shopping activity: page and product views, searches, search results, additions to the shopping bag, clicks to external marketplaces, timestamps and a first-party visitor identifier. We associate the visitor identifier with orders for sales attribution. Please avoid putting personal or sensitive information into product searches.
• Technical information: IP address, request details, browser or app client information and security or error logs processed by our servers and infrastructure providers. Request logs can include requested URLs, including coordinates when you use location lookup.
• Support and seller content: information you choose to send when contacting us. Authorised sellers may upload product photographs and listing content using the system photo picker.

2. Optional location access

When you tap "Use my location" and grant Android permission, the app obtains your available approximate or precise location and sends coordinates to Giftcera to find your delivery PIN code. Our server may send those coordinates to OpenStreetMap's Nominatim reverse-geocoding service. Rounded location lookups may be cached temporarily in server memory for up to 24 hours, and request logs may contain the coordinates.

The app does not continuously track your location in the background. You can deny or revoke location permission in Android settings and enter your PIN code manually instead. Your delivery address is still needed to fulfil an order.

3. How we use information

• Create and authenticate accounts, maintain sessions and restrict seller access.
• Process orders, verify payment references, issue invoices and provide delivery estimates, shipping and order tracking.
• Send login codes, order confirmations and shipping updates, and answer support requests.
• Understand product interest, searches and sales so we can improve our catalogue and shopping experience.
• Prevent abuse and fraud, protect our services, resolve disputes and meet applicable legal, tax and accounting obligations.

4. When information is shared

We do not sell your personal information. Information is available to authorised Giftcera personnel and service providers as needed for the purposes above, including:

• Hosting and database providers: infrastructure including Amazon Web Services and Neon processes information needed to run and store our services.
• Email and sign-in providers: Google/Gmail handles our transactional email delivery; Google handles Google sign-in when enabled and selected.
• Delivery providers: Shiprocket and the assigned courier receive necessary recipient, contact, delivery and order information when arranging or fulfilling shipments. Delivery estimates may involve sharing your PIN code and parcel details.
• Location and PIN code services: OpenStreetMap Nominatim receives coordinates for optional location lookup, and postal PIN lookup services may receive a PIN code.
• Legal and business requirements: information may be disclosed when required by law, to protect rights and safety, or in a business transfer subject to appropriate protections.

If you choose to open WhatsApp support, an editable message may include your shopping items, total and order identifier. You decide whether to send it. External marketplace links, payment apps, WhatsApp and social links take you to services with their own privacy policies; they may receive information when you open or use them.

Service providers may process information outside your state or country. Applicable protections depend on the provider and the service involved.

5. Cookies and information on your device

We use first-party session and visitor cookies or their app equivalents for sign-in, security and shopping analytics. Visitor cookies can remain valid for up to one year. The app also stores information such as your shopping bag, saved PIN code, checkout drafts and cached catalogue data to support shopping and restore your progress. Session cookies and sensitive local records are protected using Android Keystore-backed encryption.

You can sign out and clear app storage or browser data through your device or browser settings. Clearing local data does not delete your server account or order records. Our current app does not include an advertising SDK or use the Android advertising ID.

6. Retention and security

We retain account information while needed to provide your account and services, subject to deletion requests. Order, invoice, payment verification and shipping records may be retained after account deletion where needed for tax and accounting obligations, fulfilment, refunds, disputes, fraud prevention or other legal requirements. Retained records are limited to those purposes.

Login codes expire after five minutes. Expired authentication challenges and sessions are cleaned up during subsequent sign-in activity. Shopping analytics and operational logs currently have no single fixed automatic deletion period; their retention depends on operational needs, applicable obligations and deletion requests. Backups may retain copies until replaced or expired under the backup cycle.

We use HTTPS, access controls and protected authentication and local storage to reduce risk. No storage or transmission method can guarantee absolute security.

7. Request account and data deletion

You can request deletion of your Giftcera account and associated personal data without installing or signing into the app:

1. Email giftcera@gmail.com with the subject Giftcera account deletion.
2. Send the request from your registered email address, or identify the email address used for Giftcera so we can verify ownership. Do not send passwords, OTPs, UPI PINs or bank credentials.
3. We may ask for limited information to confirm ownership before deleting the account and associated data. We will explain any records that must be retained and the applicable reason or retention requirement.

Deletion covers your account profile, sign-in sessions and associated personal data that we are not required to retain. Orders and financial or legal records may be retained as described above. Deleting the account does not itself cancel an existing order or refund a payment; mention any pending order when contacting us. Uninstalling the app alone does not delete an account.

You may also contact us to request access to or correction of your information, or deletion of particular information without closing your account, subject to applicable law and identity verification. To help us locate visitor-based analytics, you may need to provide additional details about the relevant session.

8. Children

Giftcera is a shopping service intended for adults who can place purchases. We do not knowingly collect personal information from children under 18. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

9. Policy updates

We may update this policy when our services or data practices change. The updated policy will be published at this URL with a revised date. Where required, we will provide additional notice or seek consent.