Privacy Policy

Thawtfull Inc. (“Thawtfull,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect information when you use our websites, applications, and related services (collectively, the “Service”). Use of the Service is also subject to our Terms of Service.

By using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service. Where required by law, we will obtain your consent for certain processing activities.

2.1 Account and identity

When you register or sign in, we may collect your name, email address, password (stored using strong one-way hashing), organization affiliation, role, and similar account details.

2.2 Gifting profiles and preferences

The Service is designed to capture preferences and context that make gifting thoughtful (for example, likes and boundaries, dietary or experience preferences, values, visibility choices, and optional profile fields you choose to provide). You control much of this content; some fields may be visible to teammates or event organizers as described in the product and your settings.

2.3 Organization and collaboration data

For company accounts, we process information about teams, invites, groups, events, and member activity needed to run those features (for example, who invited whom, event metadata, and admin actions).

2.4 Usage and technical data

We automatically collect certain technical information, such as device type, browser, IP address, approximate location derived from IP, timestamps, pages viewed, and diagnostic logs. We use this to secure the Service, fix bugs, and understand aggregate usage.

2.5 Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember preferences, and measure performance. You can control cookies through your browser settings; blocking essential cookies may affect Service functionality.

We use information to:

• Provide, maintain, and improve the Service;
• Authenticate users, prevent fraud and abuse, and enforce our Terms;
• Send transactional messages (e.g., invites, password resets, security notices) and, where permitted, product updates you can opt out of;
• Generate in-product insights, summaries, or recommendations where offered;
• Comply with legal obligations and respond to lawful requests;
• Analyze usage in aggregate or de-identified form to improve UX and reliability.

Where GDPR or similar laws apply, we rely on one or more of the following: performance of a contract with you; legitimate interests (such as securing the Service and improving features), balanced against your rights; consent, where required; and legal obligations.

We may share information:

• With your direction: for example, showing parts of your profile to colleagues or event organizers when you or your Organization enables that.
• With service providers who assist us (hosting, email delivery, analytics, security) under contracts that limit their use of data.
• For legal reasons: if we believe disclosure is required by law, regulation, or legal process, or to protect rights, safety, and security.
• In a business transfer: such as a merger or acquisition, subject to appropriate safeguards.

We do not sell your personal information as “sale” is defined under applicable U.S. state privacy laws, and we do not share it for cross-context behavioral advertising except as you may allow through optional features and settings.

We retain information for as long as your account is active and as needed to provide the Service, comply with law, resolve disputes, and enforce agreements. Profile and organization data may be retained for a period after account closure where necessary for backups, legal holds, or legitimate business purposes; we will delete or anonymize data when no longer needed, subject to law.

We implement technical and organizational measures designed to protect information, including encryption in transit and access controls. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

Depending on where you live, you may have rights to access, correct, delete, or export your personal information; object to or restrict certain processing; withdraw consent where processing is consent-based; and lodge a complaint with a supervisory authority.

To exercise these rights, contact privacy@thawtfull.com. We may need to verify your request. If you are part of an Organization, some requests may need to be routed through your admin where the data is under their control.

The Service is not directed to children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have collected such information, contact us and we will delete it promptly.

We may process and store information in the United States and other countries where we or our providers operate. Where required, we use appropriate safeguards (such as standard contractual clauses) for cross-border transfers.

California residents may have additional rights under the CCPA/CPRA, including to know, delete, and correct personal information, and to opt out of certain sharing. We do not “sell” or “share” personal information for cross-context behavioral advertising as a core part of the Service. To submit a request, email privacy@thawtfull.com.

We may update this Privacy Policy from time to time. We will post the updated version on the Service and revise the “Effective” date. If changes are material, we will provide additional notice as required by law.

Privacy questions and requests: privacy@thawtfull.com

General support: support@thawtfull.com

Thawtfull Inc. — mailing address available upon request for legal correspondence.