What information is collected?
- The order or request email, requested product, region, and information entered in a product-availability request.
- The selected product, price, server-created order reference, protected customer token, hashed payment-page access token, frozen quote, receiving-address snapshot, and order, notification, review, and fulfillment states.
- The selected asset and network, expected amount, token contract where applicable, and any on-chain transaction identifier submitted for review.
- Pseudonymous hashes derived from an email or IP address for short-lived abuse limits.
- Support messages and the order or transaction details you choose to provide.
- Request, device, approximate-location, error, deployment, and security logs produced by hosting and email providers.
The normal order process does not ask for an account password, email password, wallet seed phrase, private key, wallet connection, remote access, or identity document. Do not send those items through checkout, request forms, or support email.
How and why is information used?
AI Gift Pay uses order data to create a frozen quote and private payment page, match and manually verify an on-chain transfer, prevent duplicate transaction use and abuse, send transactional messages, review product eligibility and stock, procure and fulfill or refund an order, answer support requests, keep accounting and dispute records, and meet legal obligations.
Depending on the activity and jurisdiction, processing is based on performance of the requested contract, steps you request before entering it, legitimate interests in fraud prevention and reliable order handling, compliance with legal obligations, or consent where specifically requested. An order or request email is not used for unrelated marketing without a separate choice.
Who processes information?
- Vercel hosts the application and processes request, security, and deployment data. See its privacy notice.
- Upstash stores the server-side order ledger, operational indexes, request records, and abuse counters. See its privacy policy.
- Resend receives recipient addresses, message content, and delivery metadata needed for transactional email. See its data-processing terms.
- Coinbase supplies a public USD exchange-rate feed for volatile-asset quotes. The rate request does not include the customer email, receiving wallet, order reference, or transaction ID. See its privacy policy.
- Email infrastructure used for published support addresses can process support messages and delivery metadata under its own terms.
A provider or product issuer may receive information only when necessary for procurement, activation, eligibility review, or problem resolution. AI Gift Pay does not provide a customer password or wallet credential. Public blockchains permanently expose wallet addresses, amounts, and transaction identifiers; blockchain observers may correlate transfers independently of this site.
Information may also be disclosed when legally required, to investigate abuse or protect users and the service, or in a business transfer subject to appropriate safeguards. Providers may process information in countries different from yours under the transfer mechanisms applicable to their services.
How long is information kept, and how is it protected?
- Checkout and request abuse-limit hashes expire automatically after their short configured window.
- Order, payment-event, audit, review, notification, and fulfillment records expire no later than 400 days after their most recent stored update, unless law or a live dispute requires longer retention.
- Support messages are normally kept for up to 24 months after closure, unless a dispute, fraud concern, tax rule, legal hold, or other legal duty requires longer.
- Provider logs, email records, backups, and public blockchain records follow the relevant provider's retention rules or the permanent nature of the blockchain.
The customer token containing the order email is protected with authenticated encryption. Public order references do not contain a plaintext email address. The private payment page uses a separate high-entropy token whose hash is retained, transaction reuse is blocked, and the merchant order desk requires separate authentication. QR images are generated by this application rather than an external QR service. No online service can promise absolute security.
The AI Gift Pay storefront does not currently use advertising trackers, sell personal information, share it for cross-context behavioral advertising, or set marketing analytics cookies. External sites linked from product pages have their own privacy and cookie practices.
How can I exercise a privacy right?
Email support@aigiftpay.com from the order email when possible and include the order reference. Depending on applicable law, you may request access, correction, deletion, restriction, objection, or portability. AI Gift Pay may verify the requester, protect another person's information, or retain records required for legal, accounting, fraud-prevention, security, or dispute purposes.
You may complain to the privacy or consumer-protection authority that applies where you live. The service is not directed to anyone under 18, and AI Gift Pay does not knowingly accept their orders. Material policy changes will be posted here with a new effective date before governing new orders.