Privacy Policy

This Privacy Policy explains how LuxGift Corp. ("LuxGift," "we," "us," or "our"), a Delaware corporation, collects, uses, shares, and protects personal data when you use the LuxGift platform, including our website and mobile applications (the "Service"). It also describes the rights and choices available to you.

LuxGift is the controller of the personal data described in this Policy. If you do not agree with this Policy, do not use the Service.

1. Who This Policy Covers

This Policy applies to everyone who uses the Service, including:

• Fans — people who buy gifts and paid interactions for creators, and who may purchase Credits or a LuxGift Plus membership.
• Creators — people who maintain a public wishlist, receive gifts, and may earn and be paid commission.

Some sections apply only to users in specific regions. See Section 12 (United States / California) and Section 13 (United Arab Emirates).

2. Personal Data We Collect

We collect the following categories of personal data.

Account and authentication data. Your email address, first and last name, password (stored only in hashed form), the sign-in method you use, and, if you sign in with Google or Apple, the identifier that provider gives us. We also store account status, security flags such as failed-login and lockout state, and timestamps (created, updated, last login).

Profile data. Your display name, username, bio, avatar, and, for creators, social links and activation status. If you do not upload an avatar, we generate a fallback image using your display name (see Section 5).

Order and gift data. When a gift is sent, we record a snapshot of the order: the fan's and creator's display names and avatars at the time, the delivery address and recipient contact details used for shipping (recipient name, email, street, city, postal code, country, and phone), any gift message you include, the product details, the amount charged, and the currency. Delivery details are the creator's shipping information, captured so the gift can be fulfilled.

Payment data. We store payment references only: a payment-processor customer identifier, a payment-intent identifier, refund status, and the order total. We do not receive or store your full card number or payment-method details; those are held by our payment processor, Stripe.

Credits and membership data. If you buy LuxGift Credits or a LuxGift Plus membership, we record your Credit balance and Credit transaction history, and your subscription and billing status. Payments are processed by Stripe.

Interaction and message data. If you use paid interactions or private conversations with a creator, we store the message content, message history, and read state needed to deliver the conversation.

Creator earnings, payout, and tax data. For creators who earn commission, we store wallet balances and a ledger of earnings, reversals, and payouts; payout records (amounts, method, destination email, status); and payout-profile details including legal name, country of residence, tax classification, tax-form type and status, and only the last four digits of a tax identifier. Uploaded tax documents are stored privately. We do not store full tax identification numbers.

Device and technical data. Session information (session identifiers, device information, user agent, and the IP address used to sign in), and, if you enable notifications, a device push token used to send them.

Logs. A security/audit log of security-relevant events (such as sign-in, account changes, and administrative approvals), which records the actor, IP address, user agent, event type, and time; and a user-facing activity log. Where enabled, we may enrich an IP address to an approximate city/country using a third-party lookup (off by default).

3. How We Use Personal Data

We use personal data to:

• create and secure your account and authenticate you;
• provide the Service: process and fulfill gifts, deliver paid interactions and conversations, maintain wishlists, and operate Credits and Plus memberships;
• process payments, refunds, and creator payouts, and administer tax documentation;
• send transactional communications (order updates, payment and payout notices, security and account messages, and membership notices);
• send push notifications you have enabled;
• maintain security, prevent and investigate fraud and abuse, and keep audit records; and
• comply with our legal obligations.

We describe the legal bases we rely on for users in the UAE in Section 13 and for other regions where required by law.

4. How We Share Personal Data

We share personal data only as described here. We do not sell your personal data.

Service providers (processors). We use third parties to run the Service under contract, permitted to use your data only to provide services to us:

• Stripe — payment and subscription processing. We share payer email, name, amounts, currency, and an internal order identifier; Stripe holds card and payment-method data.
• Resend — transactional email delivery. Email bodies may contain your name and order or account details.
• Azure Blob Storage — file and document storage (avatars, images, and private documents such as tax forms).

Fulfillment providers. To ship a physical gift, we send the delivery address and recipient contact details (recipient name, email, street, city, postal code, country, phone) and the gift message to our fulfillment provider, Nucleus, which forwards the order to the upstream luxury supplier, L2L, that physically ships the goods. This means recipient delivery data leaves LuxGift and travels through Nucleus to L2L for delivery.

Sign-in and notification providers (optional). Where you use them, Google and Apple (sign-in), and Apple Push Notification service and Firebase Cloud Messaging (push notifications on iOS and Android).

Avatar generation (optional). If you have no uploaded avatar, we send your display name only (embedded in an image URL) to a fallback avatar service; no account is created and nothing is stored by that service.

Legal, safety, and business transfers. We may disclose personal data to comply with law, respond to lawful requests, enforce our terms, protect the rights and safety of users and others, and in connection with a merger, acquisition, financing, or sale of assets.

A current list of our sub-processors is available on request.

5. Cross-Border Data Transfers

LuxGift is based in the United States, and our service providers operate in various countries. Your personal data may be transferred to, stored in, and processed in the United States and other locations that may have different data-protection laws than your own. In particular, delivery and recipient data is transferred to our fulfillment chain (Nucleus and L2L) to ship physical gifts.

Where required by law, including for users in the UAE, we put in place appropriate safeguards for these transfers, as described in Section 13.

6. Data Retention and Deletion

We keep personal data for as long as needed to provide the Service and for the purposes described in this Policy, and then delete or anonymize it, except where we must retain it to comply with a legal obligation (for example, tax, accounting, or fraud-prevention records) or to establish, exercise, or defend legal claims.

• Automatically time-limited data: authentication tokens, one-time tokens, and data-export files are deleted on a routine schedule. Audit and activity logs are retained for a defined period and then removed.
• Account deletion: when you request account deletion, we delete or anonymize your personal data as described in Section 7, subject to the legal-retention exceptions above.

Specific retention periods are available on request and may vary by data category and region.

7. Your Rights and Choices

Depending on where you live, you have some or all of the following rights. Region-specific details are in Sections 12 (US/California) and 13 (UAE).

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — ask us to delete your personal data.
• Portability — request certain data in a portable format.
• Objection and restriction — object to or ask us to restrict certain processing, including processing for marketing.
• Withdraw consent — where we rely on consent, withdraw it at any time (this does not affect processing already carried out).

How to exercise your rights. You can manage core account data and deactivate or delete your account in the app. For other requests, contact us at privacy@luxgift.app. We will verify your identity before responding and will respond within the timeframe required by applicable law. You will not be discriminated against for exercising your rights.

A note on data export. Our self-service export currently includes core account and session data. If you need a copy of additional data we hold about you, such as order, payment, or wallet records, contact us at privacy@luxgift.app and we will provide it, subject to identity verification and legal exceptions.

8. Marketing and Notifications

We send transactional messages necessary to operate the Service (for example, order, payment, and security notices); these are not marketing and cannot be opted out of while you have an account. Where we send marketing communications, we do so only as permitted by law, and you can opt out at any time using the unsubscribe link or by contacting us. You can control push notifications in your device settings.

9. Security

We use technical and organizational measures designed to protect personal data, including hashing of passwords and one-time tokens, encryption of specific sensitive credentials at rest, session controls, and access restrictions on private files. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children

The Service is not directed to children, and we do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has provided us personal data, contact us and we will delete it as required by law.

11. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you as required by law, for example, by updating the "Last Updated" date and, where appropriate, by email or in-app notice. Your continued use of the Service after an update takes effect indicates your acceptance, except where your consent is required.

12. Information for United States / California Residents

This section applies to residents of California and describes rights under the California Consumer Privacy Act (CCPA/CPRA).

We do not sell or "share" your personal data as those terms are defined under the CCPA.

Subject to verification and legal exceptions, California residents may request:

• The right to know — the categories and specific pieces of personal data we have collected, the sources, the business purpose, and the categories of third parties with whom we share it.
• The right to delete — deletion of personal data we hold about you.
• The right to correct — correction of inaccurate personal data.
• The right to non-discrimination — you will not be penalized for exercising your rights.

To exercise these rights, contact us at privacy@luxgift.app. You may use an authorized agent, subject to proof of authorization. We will verify your identity before responding.

The categories of personal data we collect, the purposes, and the parties we share with are described in Sections 2, 3, and 4 above.

13. Information for United Arab Emirates Users

This section applies to individuals in the UAE and reflects Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and its implementing regulations.

Legal bases for processing. We process your personal data on one or more of the following bases: your consent; the performance of a contract with you (for example, fulfilling a gift order, a paid interaction, a Credit purchase, or a membership); compliance with a legal obligation; and our legitimate purposes where permitted by the PDPL, in a way that does not override your rights. Where we rely on consent, you may withdraw it at any time.

Your rights under the PDPL. Subject to the conditions and exceptions in the PDPL, you have the right to: obtain information about, and access, your personal data; request correction; request deletion; request restriction of, or object to, processing; request portability of your data; object to processing for direct marketing; and object to decisions based solely on automated processing that produce legal or similarly significant effects. To exercise any of these rights, contact us at privacy@luxgift.app.

Consent. Where processing is based on your consent, we will obtain it clearly and be able to demonstrate that it was given, and you may withdraw it at any time without affecting processing already carried out.

Cross-border transfers. Your personal data may be transferred outside the UAE, including to the United States and to our fulfillment chain (Nucleus and L2L) to deliver physical gifts, and to our processors (Stripe, Resend, Azure). We carry out such transfers in accordance with the PDPL's cross-border transfer requirements and put in place appropriate safeguards.

Data breach. Where a personal-data breach that poses a risk to your privacy or the security of your data occurs, we will notify the UAE Data Office and, where required, affected individuals, in accordance with the PDPL and its implementing regulations.

Supervisory authority. The UAE Data Office is the supervisory authority for the PDPL. You may lodge a complaint with it if you believe your rights have been infringed.

Contact. For any PDPL-related request or question, contact us at privacy@luxgift.app.

14. Contact Us

For questions about this Policy or our data practices, or to exercise your rights, contact us at:

LuxGift Corp.
privacy@luxgift.app