Built to be boring about your data.

We store: workspace details (company name, size, admin contact), employee names, work emails, occasion dates (birthday month/day, start date), and the optional preference profile each employee chooses to share (interests, sizes, dietary notes, "don't gift me" items). Gift history stores what was approved, its price, and the recipient's reaction.

• Employees control their own profiles — they choose what to enter and can opt out of occasions entirely.
• No payment cards for gifts — you buy gifts at the retailer of your choice; Giftella never processes or stores gift payment details.
• No sensitive categories collected — we never ask for SSNs, government IDs, health, or financial data. Birth year is optional.
• No data selling. No ads. Ever. Employee data is used for one purpose: better gift suggestions for your team.

• Workspace admins see names, dates, and the preference fields employees chose to share — never employee passwords (authentication is passwordless magic-link).
• Employees see and edit only their own profile.
• Giftella staff access production data only for support, on request, and every access path requires authenticated admin credentials.
• Workspaces are isolated per organization — one org can never query another's data.

Giftella for Teams runs on Google Cloud (Firebase / Cloud Firestore) with application hosting on Vercel. All traffic is encrypted in transit (TLS 1.2+) and all data is encrypted at rest (Google-managed AES-256). Authentication uses Firebase Authentication with passwordless magic links for employees and verified sign-in for admins. Subscription billing is processed by Stripe — card data never touches Giftella servers.

• Export: full workspace export available on request, delivered within 7 days.
• Deletion: full workspace deletion on request — completed within 30 days, confirmed in writing. Individual employees can request removal of their profile at any time.
• DPA: a signed Data Processing Agreement is available for any paying customer — email us and we'll turn it around within 2 business days.
• Retention: data is retained while your workspace is active and deleted on workspace deletion, minus what law requires us to keep (billing records).

We're an early-stage company and we'd rather tell you exactly where we are than wave a badge: formal SOC 2 Type I is on our roadmap as the Teams product scales; today we operate on the controls above — managed infrastructure with provider-level certifications (Google Cloud and Stripe are SOC 2 / ISO 27001 certified), least-privilege access, and encryption everywhere. If your review needs something specific, ask — small company means the person answering your security questionnaire is the founder.