Privacy Policy

1. Introduction

GIVAA LLC ("GIVAA," "we," "our," or "us") operates the GIVAA mobile application and the website at givaa.app (collectively, the "Platform"). The Platform helps people send and receive cash gifts, create shared gift experiences, schedule delivery, and use related features where supported.

This Privacy Policy explains what personal information we collect, how and why we use it, when we disclose it, how long we keep it, and the choices available to you. It applies to the Platform in the United States and Canada, where supported. Feature, payment-method, and payout availability may vary by country, province, state, device, and service provider.

Please read this Privacy Policy together with any just-in-time notice presented when you use a particular feature. Where applicable law requires consent, we will request it separately. This Privacy Policy does not govern a third party's independent handling of information on its own service, such as Stripe's handling of information you provide on a Stripe-hosted page.

2. Information We Collect

2.1 Account, Profile, and Support Information

• Your display name, mobile phone number, email address, authentication information, and optional profile photo
• Profile settings, contact-discoverability choice, and notification preferences
• Information you provide when you contact support, exercise a privacy right, report a problem, or otherwise communicate with us

2.2 Gifts, Recipients, Groups, Events, and Scheduling

• Sender and recipient identifiers and routing details, including the name, phone number, account match, QR code, or private recipient link you select or use to address a gift or invitation
• Gift amount, currency, occasion, message, note, signature, selected design, photos, collage settings, QR or invitation link, and delivery or reveal status
• Group-gift and event information, such as organizer and participant details, contribution and payment status, goal information, and content contributed to a shared gift
• Scheduled-delivery information, including the selected date and time, device or selected time zone, local wall-clock time, and delivery status

2.3 Payments, Payouts, and Identity Verification

• Transaction information, such as gift principal, fees, funding method or payment rail, payment and payout status, refunds, disputes, cash-out activity, and provider transaction identifiers
• Payment card information collected and tokenized directly by Stripe. GIVAA receives tokens, limited card descriptors, and transaction status where made available, but does not store full card numbers or security codes
• Bank-account and payout credentials collected directly by Stripe Connect. GIVAA receives a connected-account identifier and onboarding, payout-readiness, transfer, and payout status, but does not store full routing or account numbers
• Identity, business, tax, address, date-of-birth, and other verification information that Stripe may request based on payout, risk, or legal requirements. GIVAA may receive verification status and limited related information from Stripe, rather than the full documents or credentials you submit to Stripe

2.4 Contacts, Camera, and Photos

• If you grant contacts permission, the app may read names and phone numbers from your device so you can choose a recipient and discover contacts who use GIVAA
• For contact discovery, the app normalizes and cryptographically hashes eligible phone numbers on your device and uploads the hashes—not the raw address-book names or numbers—to GIVAA's systems for matching. A selected recipient's name or contact destination may be sent separately when you address a gift or invitation
• If contact discoverability is enabled for your account, a person who has your phone number in their synced contacts may see your GIVAA display name, profile photo or avatar, and limited account information such as whether you recently joined. You can manage discoverability in Profile settings
• If you grant camera or photo-library permission, the app processes the QR code you scan or the images you select. We may process basic file information, such as image format and dimensions, to resize, render, privately store, and deliver selected media

2.5 Information Collected Automatically

• App, browser, and device information used to operate and troubleshoot the Platform, such as platform, app version or build, device type, language, and basic request information
• Crash, error, and limited performance diagnostics. Our current Sentry configuration is designed to reduce personal information, disables session replay and profiling, and does not intentionally attach your account ID, email address, phone number, or profile data to error reports
• Push-notification tokens and notification-delivery records, such as channel, destination, provider response, status, delivery time, and error information
• Internet Protocol address and related network information processed by hosting, security, and service providers. For certain anonymous abuse controls, GIVAA uses a keyed hash derived from a trusted IP address and stores rate-limit counters rather than retaining the raw IP address in the application database
• Authentication/session data, cookies or similar browser storage, locally cached preferences, and interactions needed to maintain your session, resume a flow, secure the Platform, and understand whether important features are functioning

2.6 Information from Other Sources

• Payment authorization, settlement, transfer, payout, verification-status, and risk information from Stripe
• Account, authentication, storage, and service-delivery information from Supabase and our other service providers
• Information supplied by another user who sends you a gift, invites you to a group gift or event, enters your contact destination, or contributes content intended for you

3. How We Use Your Information

3.1 To Provide the Service

• Create and administer your account, authenticate you, maintain your profile and preferences, and enable contact discovery
• Address, process, fund, schedule, deliver, reveal, settle, refund, and support individual and group gifts
• Generate and resolve GIVAA QR codes, invitation links, event links, and private-media links
• Compose and deliver user-selected cards, photo treatments, collages, albums, messages, and other gift content
• Enable cash-out and payout onboarding through Stripe Connect where supported

3.2 For Compliance and Safety

• Verify account and payout eligibility, including through Stripe, when required by risk controls, payment-network rules, provider requirements, or applicable law
• Detect, prevent, investigate, and respond to fraud, account misuse, payment disputes, security incidents, spam, and other harmful or unlawful activity
• Apply rate limits, protect invitation and media capabilities, enforce our terms, resolve disputes, and preserve the integrity of financial records
• Meet applicable legal, tax, accounting, audit, reporting, and recordkeeping obligations

3.3 To Improve the Platform

• Monitor service health, diagnose crashes and failed workflows, measure limited performance, and fix technical issues
• Understand feature reliability, develop improvements, and test changes using aggregated, de-identified, or otherwise appropriately protected information where practical

3.4 Communications

• Send authentication codes and service messages by SMS, including gift and invitation notices where enabled
• Send authentication, account, security, gift-invitation, and other transactional emails
• Send push notifications about gifts, scheduled delivery, group activity, settlement, and reminders according to your settings
• Respond to support, privacy, and safety requests and provide legally required notices

3.5 Optional and Future Uses

If and when the relevant feature is offered and you choose to use it, we may use feature-specific information to verify and convert an eligible prepaid card through Gift Card Rescue, administer recurring contributions or goals through GIVAA Nest, recommend or generate an AI-assisted collage, conduct group voting, or send related milestones and results. A roadmap reference in this Privacy Policy does not mean that a feature is currently available or that we collect its information before you use it.

4. How We Share Your Information

We disclose personal information only as described below, at your direction, or as otherwise disclosed when the information is collected. We do not sell personal information to advertisers, and we do not share personal information for cross-context behavioral advertising.

4.1 With Service Providers

We use providers to operate, secure, communicate about, and process transactions on the Platform. Current providers include:

• Stripe, Inc. and Stripe Connect — payment processing, card tokenization, payout onboarding, identity and account verification, transaction-risk controls, transfers, refunds, disputes, and settlement. See stripe.com/privacy
• Supabase — authentication, database, private-file storage, Edge Functions, and related cloud infrastructure
• Linode — website hosting and infrastructure; GIVAA uses Nginx software to serve the website securely
• Cloudflare — Turnstile authentication challenges, bot and abuse prevention, and supporting network or edge security
• Expo, Apple Inc., and Google LLC — push-token registration and push delivery through Expo Push, APNs, and FCM
• Resend — authentication, account, and gift-invitation email delivery
• Sentry — privacy-limited crash reporting, error diagnostics, and performance monitoring
• TextBee and SMSMobileAPI — current delivery of authentication codes and transactional gift or invitation messages by SMS

If and when GIVAA transitions eligible messaging to a registered A2P/10DLC program, SignalHouse and/or SignalWire may process phone numbers, message content, consent or opt-out status, and delivery records for transactional SMS. We may replace or add providers as the Platform evolves and will update this policy when appropriate.

4.2 With Other Users (Limited)

• A sender or recipient may see the other party's display name, profile image, gift amount and status, message, and gift content as needed to complete and present the gift
• People who scan your personal GIVAA QR code or match you through enabled contact discovery may see your display name, profile photo or avatar, and limited profile information
• Group-gift organizers and participants may see participant names, avatars, participation or payment status, messages, and contributed content. Organizers may see contribution amounts; other contributors generally see their own amount rather than another contributor's amount. Recipients receive the combined gift and contributor content according to the group's delivery settings
• A person who has a valid gift, group, event, QR, or invitation link may see the limited information made available through that link. Treat non-public links as sensitive and share them only with intended recipients
• If future AI-assisted collage, group-voting, Gift Card Rescue, or GIVAA Nest features include additional user-to-user disclosures, those disclosures will be described in the feature or a supplemental notice

4.3 For Legal Compliance

• To comply with applicable law, regulation, legal process, or a valid governmental request
• To protect the rights, property, safety, and security of GIVAA, our users, our providers, or the public
• To detect or address fraud, security, payment, or technical issues; enforce agreements; establish or defend legal claims; or cooperate with lawful investigations

4.4 Business Transfers

We may disclose information in connection with an actual or proposed financing, audit, reorganization, merger, acquisition, sale of assets, insolvency, or similar corporate transaction. Any successor may use the information subject to this Privacy Policy unless you receive notice otherwise.

4.5 Cross-Border Processing

GIVAA is based in the United States, and we and our providers may process information in the United States, Canada, and other jurisdictions where they operate. Privacy laws in those jurisdictions may differ from those where you live. Where required, we use appropriate contractual or other safeguards for cross-border processing.

5. Data Retention

We retain personal information for as long as reasonably necessary for the purpose for which it was collected, including to provide the Platform, preserve gifts and shared memories, complete or reconcile transactions, prevent fraud, maintain security, resolve disputes, and meet legal, tax, accounting, audit, and recordkeeping requirements. Retention depends on the type and sensitivity of the information, the nature of the feature, and applicable obligations; it is not based on a single fixed period.

• Account and profile information: retained while your account is active. Account deletion removes your sign-in identity, profile information, contact-discovery data, and preferences from active systems, subject to the limited financial-record exceptions below
• Gift content and private media: your authored gift messages, photos, signatures, replies, and uploaded files are removed when your account is deleted, including from gift views shared with other people. Direct private reply conversations involving your account are also removed. Other contributors' independently authored content and an active recipient's shared group thank-you remain for the surviving group audience. Private media uses access checks and short-lived links; it is not made publicly readable through the storage service
• Transaction, payout, dispute, and compliance records: retained as needed to complete transactions, maintain an accurate financial ledger, prevent duplicate or improper payments, respond to disputes, and satisfy applicable legal and provider requirements
• Contact-discovery hashes: the stored hash set is replaced on a later synchronization and removed during account deletion
• Security and diagnostic information: retained according to the nature of the event and provider settings. Application abuse-control hashes use short rolling rate-limit windows; backups and provider logs may persist for a limited period before being overwritten or deleted
• Stripe information: Stripe retains payment, payout, and identity-verification information under its own policies and legal obligations

You can request deletion in Profile > Delete account. We save the request even if wallet balances, pending gifts, payments, refunds, disputes, group gifts, transfers, or payouts first need to be resolved. While the request is pending, new gifts, receiving links and new group obligations are paused; existing financial resolution, receipts and cancellation of the deletion request remain available. The app shows the pending action and a tracked help case for exceptional situations. It does not forfeit your money or automatically refund completed gifts. Cancelling an eligible scheduled gift requires a separate confirmation. You can cancel a pending deletion request before personal-data removal begins. Once the financial activity is resolved, deletion continues automatically. We aim to finish within 24 hours after that point; the deletion-status page distinguishes ongoing cleanup from completed deletion and confirms when it finishes. Keep the saved receipt on the device where you requested deletion to check progress after sign-out.

Other people keep their settled money, confirmed claim entitlements and necessary transaction history, with your identity shown as “Deleted account.” A minimal account reference preserves the integrity of those records without preserving an active login or your gift content. These retained financial references are restricted records, not a claim that all information is anonymous. Limited transaction, payment, payout, refund, dispute, and compliance information may remain where required for outstanding financial obligations or applicable legal recordkeeping. We do not retain your shared photos and messages merely to preserve another user's memories.

Residual copies in restricted backups, logs, or independent provider systems may remain until their applicable retention period ends. Stripe handles its own payment and identity records under its policies and legal obligations. GIVAA cannot remotely remove screenshots, downloads, or copies another person saved outside the Platform.

6. Your Rights and Choices

6.1 California Residents (CCPA/CPRA)

If California privacy law applies to your information, you may have the following rights, subject to statutory exceptions:

• Right to Know and Access: request information about the categories, sources, purposes, and disclosures of personal information and request the specific pieces we hold about you
• Right to Delete: request deletion of eligible personal information
• Right to Correct: request correction of inaccurate personal information
• Right to Opt Out of Sale or Sharing: GIVAA does not sell personal information or share it for cross-context behavioral advertising
• Right to Non-Discrimination: receive equal service and pricing when you exercise a privacy right

You or an authorized agent may submit a request using the contact details below. We may verify your identity, authority, and request before acting. We respond within the time required by applicable law.

6.2 Canadian Residents

If Canadian privacy law applies to your information, you may request access to or correction of personal information we hold about you and may withdraw consent where processing is based on consent, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may prevent us from providing a feature that requires the information. You may also ask questions or submit a complaint to our Privacy Officer and, where applicable, contact the relevant privacy regulator.

6.3 Choices Available to All Users

• Profile and correction: review and update available profile information and preferences under Profile settings. Contact us if the information cannot be changed in the app
• Contact discovery: manage whether your profile is discoverable to people who have your number in Profile settings. You can also change contact permission in your device settings
• Notifications: manage available notification categories in the app and push permission in your device settings. You may reply STOP to supported SMS programs; authentication or essential service messages may still be sent where permitted and necessary
• Account deletion: use Profile > Delete account to submit and track a request without contacting support. You may also email support@givaa.app with the subject "Account Deletion Request" if you need help. Pending financial activity and the limited records retained after deletion are described in Section 5

To exercise a privacy right or appeal a response where applicable, contact support@givaa.app. We may request information reasonably necessary to verify the request and protect your account.

7. Security

We maintain administrative, technical, and organizational safeguards designed to protect personal information in light of its nature and the risks involved. These measures include, as appropriate:

• HTTPS/TLS encryption for supported data transmitted over public networks
• Authentication, authorization checks, rate limits, security headers, and restricted database and storage access
• Private storage for profile and gift media, with relationship or capability checks and short-lived signed links for authorized access
• Payment-card tokenization and Stripe-hosted collection of full card, bank-account, payout, and identity-verification credentials
• Monitoring, diagnostic controls, data minimization, and access practices intended to limit information to people and providers who need it for an authorized purpose

No security measure, Internet transmission, or storage system is completely secure. We therefore cannot guarantee absolute security. You are responsible for protecting your device, authentication codes, and non-public gift, event, QR, and invitation links.

8. Children's Privacy

The Platform is not directed to people under 18, and we do not knowingly permit a person under 18 to create an account. If you are a parent or guardian and believe a minor has provided personal information to GIVAA, contact us at support@givaa.app. We will review the request and take appropriate action consistent with applicable law, transaction integrity, and necessary recordkeeping.

9. Third-Party Links

The Platform may link or redirect you to third-party websites or services, including Stripe-hosted payment or payout pages. Those services may collect information directly under their own privacy policies and terms. GIVAA is not responsible for an independent third party's privacy practices, and we encourage you to review the notice presented by each service you use.

10. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the Platform, our providers, or applicable requirements. We will post the revised policy at givaa.app/privacy and update the effective or last-updated date. If a change is material, we will provide additional notice through the Platform, email, push notification, or another appropriate channel when required by law. Where required, we will request consent before applying a change to information already collected.

11. Contact Us

For privacy-related questions, requests, or complaints: