Privacy
We collect an email address, a hashed IP, a country code and your order details. That is all we need to deliver a code and answer a support question. We never store a raw IP address, and delivered codes are encrypted and deleted 60 days after delivery.
What we collect
- Your email address — the only way to deliver your code and the only contact we hold.
- A hashed IP address — salted and truncated, used for rate limiting and fraud checks. The raw address is never written to our database.
- A two-letter country code — for sanctions screening and to know which markets to write guides for.
- Order details — product, denomination, amounts, payment status, and a frozen snapshot of what you bought.
- The delivered code — encrypted at rest with AES-256-GCM, and deleted 60 days after delivery.
No account is created. There is no tracking pixel, no advertising network, no cross-site profile, and no cookie is required to browse or to buy.
Who processes it
- Supabase — database hosting for orders.
- NOWPayments — crypto payment processing. They see the payment, not your code.
- Resend — transactional email delivery.
- Vercel — application hosting and request logs.
How long we keep it
Delivered codes: 60 days, then permanently deleted. Order records: retained for five years, because tax and accounting rules require it. Rate-limit data: minutes.
Your rights
Email support@giftclaude.com to ask what we hold about you, to correct it, or to have it deleted. We will delete everything we are not legally required to keep. Include the order number so we can find it.
Security
Codes are encrypted before they touch the database. Admin access is password-gated and limited to the operator. We do not ask for, store, or want your vendor account credentials — no legitimate seller ever needs them.