Privacy Notice

Updated 15 September 2026

We use information to run your gift lists, control access and provide optional suggestions. There are no public profiles or advertising trackers added by this application.

Who is responsible?

The operator above is the controller of personal data processed to run this service. Mondroid is the operator’s software brand; it is not a separate data controller. Contact office@mondroid.pl about privacy or your rights.

Information and purposes

• List titles, optional recipient names and event dates, gifts, budgets, shop links, participant names or nicknames, assignments and reservations let us provide the list features you request. We rely on performance of our service contract (GDPR Article 6(1)(b)) for users' necessary service data, and legitimate interests (Article 6(1)(f)) in coordinating invited participants for information supplied about other people.
• Access tokens, owner authentication, request metadata and security records protect lists and prevent abuse. We rely on legitimate interests (Article 6(1)(f)) in securing and maintaining the service.
• Support messages and complaint records allow us to respond, resolve problems and meet legal obligations. We use contractual necessity (Article 6(1)(b)) for service support, legitimate interests (Article 6(1)(f)) for resolving disputes and legal obligation (Article 6(1)(c)) for handling statutory data-protection requests.

Providing a name or nickname is needed to distinguish a participant. AI details are optional. We receive participant information from the organiser or from the participant joining a list. We do not require an exact date of birth.

Optional AI processing requested by a service user is used to provide that requested feature (Article 6(1)(b)), to the extent it involves personal data necessary for that purpose. This does not authorise uploading another person’s sensitive information. We do not rely on accepting this notice as blanket consent.

Support access

Administrators do not automatically own your lists. To handle a support request, an administrator can open a separate read-only view using a list identifier and an access reason. We record the administrator, time, list identifier, reason and support action. The access log does not contain a copy of your list or its private keys. Logs older than 90 days are removed when the support dashboard is loaded; restricted backups may retain older records temporarily.

Optional calendar export

At your request, an all-day event contains the list title, event date and your list link. Downloading an .ics file generates it in your browser. Choosing Google Calendar sends this information to Google in the event form. Personal invitation links allow access to the list: keep exported files and calendar entries private. No calendar access permission is requested. Events are one-time copies, not synchronised subscriptions.

Aggregate usage statistics

We count list creation, first gifts, sharing actions, recipient opens, reservations, shop clicks and AI requests in daily totals. Statistics contain only the event type, day, selected shopping country, interface language and a predefined shop category. The analytics table contains no list or person identifiers, IP addresses, gift contents or full URLs. We do not set analytics cookies or create visitor profiles. Totals are kept for up to 90 days and cleaned up when statistics are recorded. Hosting security logs are separate. Administrator activity and marked test lists are excluded from future counts.

Private management links

At the organiser’s request, we store a hash and an encrypted copy of a private management key for one list. Anyone holding that link can manage that list. Opening it sets an essential HttpOnly access cookie for up to 30 days. Replacing or revoking the link invalidates access obtained through it. Organiser planning tasks include the private link and a warning; Google receives it if you choose to save that task to Google Tasks. Do not put it in shared task lists. We process this information to provide the access and export you request (Article 6(1)(b)).

Who can see a list?

The organiser can see participants and manage their links. A participant's view depends on the list's sharing settings. Anyone holding a link can use its access, so send personal links only to their intended recipient. Shared access is not the same as a publicly searchable profile.

Optional AI suggestions

When the organiser selects Show gift ideas, we send the entered interests, optional recipient age range, additional information, budget, currency and selected interface language to OpenAI. We do not include the list title, participant directory or access links in that request. Do not enter names, contact details, health information or other sensitive personal information.

The application does not save the suggestion form or unselected suggestions to its database. Ideas you add become ordinary list items. Daily usage records contain request and token counts; per-list counters also contain the list ID.

We request that OpenAI does not store the response as application history. This is not Zero Data Retention: OpenAI may retain content in abuse-monitoring logs for up to 30 days by default, with exceptions for legal or safety needs, and may temporarily cache prompts. API content is not used for training by default. See OpenAI data controls.

Optional Google sign-in

At your request, Google supplies your verified email address and account identifier. We store the email, a derived identifier, account creation date and hashed session tokens to provide account access (Article 6(1)(b)). Existing anonymous lists from your browser are attached to this account when you sign in. If you choose to save an invitation, we also store its list identifier and hashed access key linked to your account to restore participant access. Replacing the invitation link revokes this saved access. We do not request contacts, Gmail or Tasks permission for sign-in. Google tokens are verified on the server and are not retained. Account records remain while you use the account, until deletion is requested and completed, subject to necessary legal retention and restricted backups. Request account and list deletion at office@mondroid.pl. Sign-out ends the current session but does not delete the account. Google processes sign-in data under its privacy policy; this may involve processing outside the EEA. The rights and transfer safeguards described in this notice also apply.

Optional Google Tasks

When you choose Connect Google Tasks, your browser loads Google’s connection software. After you grant Google Tasks permission and choose to add a task, your browser sends the task name, optional date and your list link directly to Google. Personal links give access to a list, so only add them to an account you trust. Google requests permission to manage tasks; our integration only creates the task you request and does not read your other tasks or contacts. We do not save Google access tokens in our database or browser storage. The task remains in your Google account until you change or delete it there. List changes do not synchronise to Google. This optional processing is necessary to perform the task creation you request (Article 6(1)(b)). Google processes your account and task data under its own privacy terms. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Google Privacy Policy · Google API Services User Data Policy

Service providers and external links

SEOHOST provides hosting. OpenAI processes AI requests when that feature is used. We may disclose information where legally required or necessary to address abuse. Opening a shop, search or messenger link takes you to another provider with its own privacy terms. We do not upload your address book.

AI processing may take place outside Poland, the EEA or the UK. Applicable transfer safeguards must cover such processing, including adequacy decisions or appropriate contractual safeguards. Contact us for information about the safeguards applicable to your data.

How long information is kept

While a list is active, list information is kept while the list is in use. You can request deletion at office@mondroid.pl. We review whether pilot records remain necessary when a list is closed or the pilot ends. AI form entries are not retained in the application database. Security and support records are retained only while needed to investigate issues, handle requests or meet applicable legal obligations. Backups can temporarily retain removed information and are restricted to recovery use.

Your choices and rights

You may object to processing based on legitimate interests for reasons relating to your particular situation. We will stop that processing unless we demonstrate compelling legitimate grounds overriding your interests and rights, or need it for legal claims.

You can use the list without requesting AI suggestions. Depending on the circumstances, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. Contact us to exercise these rights. Requests are normally free. We respond without undue delay and within one month; if complexity or the number of requests permits a legal extension, we explain it within that first month. We may request only proportionate information needed to verify your identity.

You may complain to the Polish data protection authority, UODO, the ICO in the UK, or a competent authority in the EU country where you live, work or consider an infringement to have occurred. AI suggestions do not make decisions producing legal or similarly significant effects about you.

Young people

This is a general-purpose gift-list service. The recipient age range helps choose gifts; it is not a check of the user's age. We keep AI access limited to the organiser for each list. Please use general preferences and nicknames, and avoid entering identifiable information about children into AI fields.

Remembered participant access and invitations

When you join a group invitation or open your personal invitation, an essential HttpOnly cookie named giftrilo_participant_ followed by the list identifier remembers participant access for up to 30 days (Secure on HTTPS). It contains a random private key, checked against the current list on each request. Names do not grant access. Clearing cookies removes browser access; your personal link or a saved Google account invitation can restore it until the organiser replaces that personal link or deletes the list. Disabling a group invitation does not revoke existing personal links. Shopping tasks contain the participant’s private link, or the organiser’s private management link, plus a warning not to share it. QR codes are generated locally. Sending an invitation through a messenger or e-mail passes its contents to the chosen provider.