Privacy Notice

Updated 15 September 2026

We use information to run your gift lists, control access and provide optional suggestions. There are no public profiles or advertising trackers added by this application.

Who is responsible?

The operator above is the controller of personal data processed to run this service. Mondroid is the operator’s software brand; it is not a separate data controller. Contact office@mondroid.pl about privacy or your rights.

Information and purposes

• List titles, optional recipient names and event dates, gifts, budgets, shop links, participant names or nicknames, assignments and reservations let us provide the list features you request. We rely on performance of our service contract (GDPR Article 6(1)(b)) for users' necessary service data, and legitimate interests (Article 6(1)(f)) in coordinating invited participants for information supplied about other people.
• Access tokens, owner authentication, request metadata and security records protect lists and prevent abuse. We rely on legitimate interests (Article 6(1)(f)) in securing and maintaining the service.
• Support messages and complaint records allow us to respond, resolve problems and meet legal obligations. We use contractual necessity (Article 6(1)(b)) for service support, legitimate interests (Article 6(1)(f)) for resolving disputes and legal obligation (Article 6(1)(c)) for handling statutory data-protection requests.

Providing a name or nickname is needed to distinguish a participant. AI details are optional. We receive participant information from the organiser or from the participant joining a list. We do not require an exact date of birth.

Optional AI processing requested by a service user is used to provide that requested feature (Article 6(1)(b)), to the extent it involves personal data necessary for that purpose. This does not authorise uploading another person’s sensitive information. We do not rely on accepting this notice as blanket consent.

Aggregate usage statistics

We count list creation, first gifts, sharing actions, recipient opens, reservations, shop clicks and AI requests in daily totals. Statistics contain only the event type, day, selected shopping country, interface language and a predefined shop category. The analytics table contains no list or person identifiers, IP addresses, gift contents or full URLs. We do not set analytics cookies or create visitor profiles. Totals are kept for up to 90 days and cleaned up when statistics are recorded. Hosting security logs are separate. Administrator activity and marked test lists are excluded from future counts.

Who can see a list?

The organiser can see participants and manage their links. A participant's view depends on the list's sharing settings. Anyone holding a link can use its access, so send personal links only to their intended recipient. Shared access is not the same as a publicly searchable profile.

Optional AI suggestions

When the organiser selects Show gift ideas, we send the entered interests, optional recipient age range, additional information, budget, currency and selected interface language to OpenAI. We do not include the list title, participant directory or access links in that request. Do not enter names, contact details, health information or other sensitive personal information.

The application does not save the suggestion form or unselected suggestions to its database. Ideas you add become ordinary list items. Daily usage records contain request and token counts; per-list counters also contain the list ID.

We request that OpenAI does not store the response as application history. This is not Zero Data Retention: OpenAI may retain content in abuse-monitoring logs for up to 30 days by default, with exceptions for legal or safety needs, and may temporarily cache prompts. API content is not used for training by default. See OpenAI data controls.

Optional Google sign-in

At your request, Google supplies your verified email address and account identifier. We store the email, a derived identifier, account creation date and hashed session tokens to provide account access (Article 6(1)(b)). Existing anonymous lists from your browser are attached to this account when you sign in. We do not request contacts, Gmail or Tasks permission for sign-in. Google tokens are verified on the server and are not retained. Account records remain while you use the account, until deletion is requested and completed, subject to necessary legal retention and restricted backups. Request account and list deletion at office@mondroid.pl. Sign-out ends the current session but does not delete the account. Google processes sign-in data under its privacy policy; this may involve processing outside the EEA. The rights and transfer safeguards described in this notice also apply.

Optional Google Tasks

When you choose Connect Google Tasks, your browser loads Google’s connection software. After you grant Google Tasks permission and choose to add a task, your browser sends the task name, optional date and your list link directly to Google. Personal links give access to a list, so only add them to an account you trust. Google requests permission to manage tasks; our integration only creates the task you request and does not read your other tasks or contacts. We do not save Google access tokens in our database or browser storage. The task remains in your Google account until you change or delete it there. List changes do not synchronise to Google. This optional processing is necessary to perform the task creation you request (Article 6(1)(b)). Google processes your account and task data under its own privacy terms. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Google Privacy Policy · Google API Services User Data Policy

Service providers and external links

SEOHOST provides hosting. OpenAI processes AI requests when that feature is used. We may disclose information where legally required or necessary to address abuse. Opening a shop, search or messenger link takes you to another provider with its own privacy terms. We do not upload your address book.

AI processing may take place outside Poland, the EEA or the UK. Applicable transfer safeguards must cover such processing, including adequacy decisions or appropriate contractual safeguards. Contact us for information about the safeguards applicable to your data.

How long information is kept

While a list is active, list information is kept while the list is in use. You can request deletion at office@mondroid.pl. We review whether pilot records remain necessary when a list is closed or the pilot ends. AI form entries are not retained in the application database. Security and support records are retained only while needed to investigate issues, handle requests or meet applicable legal obligations. Backups can temporarily retain removed information and are restricted to recovery use.

Your choices and rights

You may object to processing based on legitimate interests for reasons relating to your particular situation. We will stop that processing unless we demonstrate compelling legitimate grounds overriding your interests and rights, or need it for legal claims.

You can use the list without requesting AI suggestions. Depending on the circumstances, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. Contact us to exercise these rights. Requests are normally free. We respond without undue delay and within one month; if complexity or the number of requests permits a legal extension, we explain it within that first month. We may request only proportionate information needed to verify your identity.

You may complain to the Polish data protection authority, UODO, the ICO in the UK, or a competent authority in the EU country where you live, work or consider an infringement to have occurred. AI suggestions do not make decisions producing legal or similarly significant effects about you.

Young people

This is a general-purpose gift-list service. The recipient age range helps choose gifts; it is not a check of the user's age. We keep AI access limited to the organiser for each list. Please use general preferences and nicknames, and avoid entering identifiable information about children into AI fields.