Privacy Policy
Mind The Gift helps you find gift ideas using the answers you give us. This policy explains what information we use, who helps us run the service and the choices you have.
1. Who we are
Mind The Gift Ltd is responsible for deciding how personal information is used on mindthegift.co.uk and app.mindthegift.co.uk. In data protection law, we are the controller.
We are registered in England and Wales, company number 17314078. Our registered office is 50 Princes Street, Ipswich, IP1 1RJ. Our ICO registration number is ZC248186.
For privacy questions, requests or complaints, email privacy@mindthegift.co.uk. For other questions, email hello@mindthegift.co.uk.
2. What information we use
You do not need an account to use the gift search. Saved dates and reminder emails are not offered as part of the guest gift search. An account is not needed for the gift search and we no longer offer a sign-up route on this site. A small number of accounts exist from earlier testing, and our sign-in service, Clerk, may still allow an account to be created directly through its own hosted pages. If you hold an account, Clerk processes the email address and any name associated with it in order to sign you in. Accounts do not currently unlock any additional feature. To have an account deleted, email privacy@mindthegift.co.uk. We do not take payment for gifts; you buy from the retailer.
| Information | What it includes and where it comes from |
|---|---|
| Your search answers | The answers you choose in the quiz, such as your optional age band and gender, your self-rating as a gift buyer, the reaction you hope for, occasion, relationship to the recipient, recipient age band or age in years for an under-18, boldness setting, interests, things to avoid, budget and delivery needs. This also includes any optional text you submit, preferences derived from your answers and the recommendations returned. We also use your preference for UK-made gifts and independent retailers if selected. Emergency Mode asks who the gift is for, the budget and a short description of what the recipient loves, and can use an occasion selected in the journey. |
| Technical and security information | Information sent by your browser, including IP address, browser and device details, request times and information about errors or suspected misuse. We use technical identifiers where necessary to keep the service secure and limit excessive requests. |
| Analytics information | If you accept analytics, information about use of the service, such as pages viewed, interactions, device type and approximate location. Our Cookie Policy explains the technologies involved. |
| Affiliate information | Information from our affiliate partners about referrals and transactions, used to check and account for commission. The information we receive is: the advertiser, a transaction reference, the click and transaction dates, the validation date, payment progress, the time between click and transaction, a device category, the click reference and destination URL we sent, the sale amount and the commission due. These reports do not include names, email addresses or postal addresses. |
| Messages and feedback | Your contact details, the content of messages or feedback you send us, and the information needed to deal with your request. |
With analytics consent, gift-link click events can include the product identifier, retailer, gift-character category, position in the recommendations, affiliate-network category and whether the link was a fallback. Google Analytics can associate these events with its browser identifiers. We do not keep a separate record of these clicks on our own servers.
Where your answers describe someone you are buying for, that information comes from you rather than directly from the recipient. Please use broad preferences and avoid details that identify them. Information can still be personal even without a name if it can reasonably be linked to a person.
You are not legally required to use the service or provide search answers. The quiz marks any answers needed to produce recommendations. If you leave those unanswered, we may be unable to complete the search. Optional answers are your choice.
3. Keep personal and sensitive details out of gift searches
If you use the optional text boxes for interests, things the recipient loves or things to avoid, the text is sent for AI processing as described in section 5. Please describe general gift preferences only. We keep these boxes because a sentence in your own words produces better suggestions than a tick list. What you type is sent to our AI provider to interpret, so treat them as you would a message to a stranger: describe what someone enjoys, not who they are.
We do not need names, contact details or information about health, disability, religion, ethnicity, political views, sexual orientation, sex life or criminal history to suggest gifts. Please do not provide those details about yourself or anyone else.
If you think you have submitted information you should not have, contact privacy@mindthegift.co.uk. Do not repeat the sensitive details in your first message. Tell us roughly when you used the service so we can explain what we can do.
4. Why we use information
| Purpose | Lawful basis |
|---|---|
| Provide your gift search | Contract, where using your personal information is necessary to provide the search you request under our Terms of Use. |
| Use ordinary information about a gift recipient | Legitimate interests, where the information is personal data: helping an adult user find relevant gifts while limiting the information used about the recipient. This does not authorise us to use sensitive information without a separate legal condition. |
| Understand use of the service through optional analytics | Your consent. You can change your choice through Cookie settings. |
| Protect the service and prevent abuse | Legitimate interests: maintaining security, preventing misuse and keeping the service available. |
| Check referrals and commission | Legitimate interests: checking that referrals are credited correctly and resolving commission queries. Where consent is required for tracking technology, we obtain it separately. |
| Answer ordinary enquiries and use feedback | Legitimate interests: helping people who contact us and improving the service. |
| Handle data rights, privacy complaints and required financial records | Legal obligation, where the law requires us to handle a request or keep a record. |
| Handle legal disputes | Legitimate interests: establishing, exercising or defending legal claims. |
We do not sell your personal information. Contacting us does not subscribe you to marketing emails.
5. AI and automated recommendations
We use Claude models supplied by Anthropic to help interpret interests and write short explanations for gift suggestions. Our matching rules use the answers and interest tags to select and order products. AI-derived tags can therefore affect the matches, even though our own rules rank the catalogue.
To interpret preferences, we send the optional text about interests and things the recipient loves, together with the relationship, occasion, budget band and whether the search is urgent. Text about things to avoid is processed separately for exclusions.
To write explanations, we send the relationship, buyer age band, budget band, occasion, desired outcome, boldness setting, interest tags, optional interests and exclusion text, urgency, things the recipient loves, and details of the shortlisted products.
We use Anthropic’s commercial API. Anthropic’s published standard policy provides for deletion of API inputs and outputs within 30 days, with exceptions including legal requirements, enforcement of its usage rules, features with longer storage and separately agreed arrangements. Its commercial training policy excludes customer content from model training by default, but allows explicit opt-ins and submitted feedback. We have not agreed any separate retention arrangement with Anthropic, so its published standard policy is what applies to our use.
We use automated processing to personalise suggestions. The result is a set of gift ideas, not a decision about your legal rights or access to an essential service. On this service, we do not make solely automated decisions that have legal or similarly significant effects on you. You decide whether to buy anything.
AI explanations can be wrong. Check product details, suitability and delivery with the retailer. Our Recommendations and AI Notice explains this further.
6. Who receives information
| Provider | What they help us do |
|---|---|
| Replit | Host and operate the website and app, including the database and supporting infrastructure. |
| Anthropic | Provide the AI processing described above through the Anthropic Messages API. The application server sends the requests directly to Anthropic. |
| Google Analytics | Provide analytics when you accept analytics cookies. |
| IONOS | Provide domain, DNS, email forwarding and email storage for our business correspondence, including privacy enquiries. |
Where a supplier processes information on our behalf, it does so under data protection terms and our instructions. A supplier may also process limited information for its own purposes where its role and applicable law allow it; we do not describe every supplier activity as processing solely on our instructions.
Our affiliate arrangements include Awin, Rakuten Advertising, Adtraction and a direct retailer programme using UpPromote. Clicking a gift link may pass through a network before reaching the retailer. The organisations involved can receive referral and technical information and, when you purchase, transaction information.
The relevant privacy information is available from Awin (see the end-user section), Rakuten Advertising, Adtraction and UpPromote. Also read the retailer’s privacy notice before purchasing. UpPromote describes itself as a processor for merchant-customer information. Rakuten’s corporate policy distinguishes its own controller activities from advertising services carried out as a processor for clients; that corporate policy is not a complete notice for your purchase or referral. The role each network plays differs by programme and we are confirming this with each partner. Where a network or retailer acts for its own purposes, its own privacy notice governs that processing.
We may also share necessary information with professional advisers, where legally required, or in connection with a proposed business sale or reorganisation, subject to appropriate safeguards and applicable data protection law.
7. Information processed outside the UK
Some of our suppliers and their service providers process information outside the UK. The arrangements that apply to this service are:
| Provider or service | Countries and transfer safeguard |
|---|---|
| Hosting, database and backups | Replit hosts our application, database and supporting infrastructure primarily in Google Cloud Platform data centres in the United States. Transfers outside the UK rely on the UK International Data Transfer Agreement, or on the EU Standard Contractual Clauses together with the UK Addendum, as set out in Replit's Data Processing Agreement. |
| AI processing | Anthropic may route requests to selected countries in the United States, Europe, Asia and Australia, and stores data in the United States. Transfers outside the UK rely on the EU Standard Contractual Clauses together with the UK Addendum, as set out in Anthropic's Data Processing Addendum. |
| Analytics | Google collects analytics data from UK and EU devices through domains and servers based in the UK, Switzerland or the EU, and performs the location lookup on those servers before passing the traffic on for processing. Google does not log or store individual IP addresses of UK, EU or Swiss users. Google processes analytics data in other countries, including the United States, through its affiliates and support providers. Google states that transfers to the United States rely on the UK Extension to the EU-US Data Privacy Framework, and that it may also rely on the Standard Contractual Clauses. |
| Email and other relevant services | IONOS hosts our company email under a contract with 1&1 IONOS Limited, governed by the law of England and Wales. Email is processed in Germany by IONOS and its named subprocessors. Transfers to the European Economic Area are covered by the UK adequacy regulations, so no additional safeguard is required. Clerk, which provides sign-in for the small number of existing accounts, hosts data in the United States and does not offer a UK or EU option; transfers rely on Clerk's certification under the UK Extension to the EU-US Data Privacy Framework, with the EU Standard Contractual Clauses and the UK Addendum as an alternative safeguard. |
You can ask for information about these safeguards, including a copy where applicable, by emailing privacy@mindthegift.co.uk. We may redact information where necessary to protect confidential information or security.
8. How long information is kept
| Information | Retention |
|---|---|
| Guest answers, optional text, derived preferences and results | Your answers and the text you type are used to produce the search you are running and are not kept as a search history. Records held by our AI provider are covered by its own retention, explained in section 5. |
| Technical and security logs | Normally up to 30 days. Where records are needed as evidence of a specific incident or claim, we keep those records separately for as long as that matter is being handled. |
| Records used to limit requests | Deleted within 24 hours, except where information is kept separately to investigate identified misuse. |
| Google Analytics event and user data | Our Google Analytics settings retain event data for two months and user data for 14 months. The user-data period restarts when new activity is recorded from that user. These settings do not govern most standard aggregated reports. Cookie lifetimes are separate. |
| Enquiries and ordinary feedback | Normally two years after the last meaningful contact, unless a shorter period is appropriate or a longer period is needed for a legal obligation or claim. |
| Privacy requests and complaints | Normally two years after the case is closed. We keep records longer where needed for a legal obligation, an investigation or a specific claim. |
| Affiliate referral records | Kept until commission is settled and the relevant dispute period has ended. We then remove unnecessary personal detail and keep only what is needed for accounting, a legal obligation or an outstanding dispute. |
| Required accounting and tax records | Normally six years from the end of the company financial year they relate to, or longer where required by law. This does not mean that every search or click is kept for six years. |
| Backups | Backups are held by our hosting provider under its own schedule. Where we delete information at your request, we will also arrange for it to be removed from, or not restored from, backups, and we will tell you when that will take effect. |
The AI provider's retention is explained in section 5. Deleting a record from our systems does not necessarily delete it immediately from a provider's systems. We will explain the applicable arrangements when dealing with a request.
Where information is needed for an actual legal claim or investigation, we may retain the necessary records for longer, with access restricted. We keep genuinely anonymous statistics only where they cannot reasonably be linked back to individuals.
9. Your choices and rights
Depending on the circumstances, you can ask to access, correct or erase your personal information, restrict its use, or receive a portable copy where that right applies. These rights have conditions and exceptions.
Your right to object
You can object to processing based on legitimate interests, including relevant profiling, for reasons relating to your circumstances. We will consider the objection and explain our response. You can object to direct marketing at any time.
Withdrawing consent
You can withdraw analytics consent using Cookie settings. Withdrawal does not affect processing that was lawful before you withdrew consent.
Email privacy@mindthegift.co.uk to make a request. We normally respond without undue delay and within one month. If the law permits an extension or a pause, we will explain why and the relevant timing. Requests are normally free.
We may need proportionate information to confirm your identity or locate a record. Because searches do not require an account, we may be unable to identify a particular search. If that is the case, or we no longer hold the information, we will explain. Please do not send identity documents unless we ask for them.
10. Privacy complaints
You can make a privacy complaint by emailing privacy@mindthegift.co.uk or writing to our registered office. Tell us what happened and the outcome you are seeking. You do not need to use a particular form or mention a legal provision.
We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed as appropriate and explain the outcome and any action we take.
You also have the right to complain to the Information Commissioner's Office. Visit ico.org.uk/make-a-complaint or call 0303 123 1113.
11. Adults using the service and gifts for children
The service is intended for people aged 18 and over. An adult may use it to look for a gift for a child. The quiz asks for the recipient’s age band and, if the recipient is under 18, their age in years to help assess age suitability. Please do not enter a child's name, exact date of birth, school, address or other identifying or sensitive details.
If you believe a child has used the service or that identifying information about a child has been submitted, contact us at privacy@mindthegift.co.uk so we can investigate and take appropriate action.
12. Security and updates
We use technical and organisational measures designed to protect information against unauthorised access, loss and misuse. No online service can be guaranteed completely secure. Where a personal data breach occurs, we assess it and notify affected people and the regulator when the law requires.
We update this policy when our processing changes. The date at the top shows when this version took effect. Where a change needs a further notice or consent, we will provide it before the relevant new use.