Privacy
Policy

Who we are

Prezz.io is operated by ADEXO Ltd, a company registered in England and Wales. We are the data controller for the personal information we process in connection with the Prezz.io app and website.

Our service is hosted on infrastructure located in the Republic of Ireland (EU). As a UK-registered company processing data on EU infrastructure, we comply with both UK GDPR and EU GDPR.

If you have any questions about how we handle your data, contact us at privacy@prezz.io.

What we collect

We collect information in two ways: what you give us directly, and what we gather automatically when you use our service.

Information you provide:

• Your email address when you create an account
• Your full name and phone number, used on gifts you send and your delivery address
• A username (handle) of your choosing, which is public and used to identify you on the platform
• Payment information when you purchase a gift (processed securely by our payment provider — we never store card details)
• A gift message, if you choose to include one
• A delivery address, when you claim a gift as a recipient
• Your date of birth, if you choose to provide it (optional — used for birthday reminders)
• Nicknames, notes, and birthday dates you add to your personal contacts

Information collected automatically:

• Basic usage data (features used, screens visited) to help us improve the product
• Device type, operating system, and push notification token (for delivering notifications)
• Your country, captured when you provide a delivery address
• Approximate location (country/region level only) via IP address

How we use your information

We process your personal data on the following lawful bases under UK/EU GDPR:

• Contract — to fulfil gift orders you place or receive, process payments, and deliver redemption codes
• Legitimate interests — to improve the product, detect fraud, and send transactional notifications about your orders
• Consent — to send birthday reminders (only when you or the recipient has opted in), and to send push notifications (requires device permission)
• Legal obligation — to comply with applicable laws and respond to lawful requests

We do not use your data to serve you advertising. We do not build profiles for sale to third parties. We do not send you marketing without your explicit consent.

Gift senders & recipients

Prezz.io is designed to protect the privacy of both parties in a gift transaction. You can send a gift without knowing the recipient's address — they provide it themselves when they claim the gift.

Code-based sends: When you purchase a gift and share a redemption code, we do not know who the recipient is until they claim it. At the point of claim, the recipient provides their delivery address directly to us. That address is passed to our fulfilment partner and is not shared with you as the sender.

Handle-based sends: When you send a gift directly to a Prezz.io user by their handle, we link the gift to their account. The recipient's real name and address are never shown to you. Only their public handle is visible on your sent gifts.

The sender's name may appear on a gift card message if you include one. No other personal information is shared between sender and recipient beyond what is necessary to fulfil the order.

Your contacts & address book

Prezz.io includes a private address book feature. When you send a gift to someone via their handle, they are automatically added to your contacts. You can also add contacts manually.

Your contacts are entirely private to you — they are never visible to the people you have saved, and they are never used for any purpose other than helping you send gifts. Specifically:

• Nicknames you assign to contacts are your own private labels and are never shown to the contact
• Notes you add to a contact are private and visible only to you
• Adding someone to your contacts does not notify them
• We do not share your contact list with third parties

Contact data is stored securely and protected by row-level security — only you can access your own contacts.

Birthday data

Birthday information on Prezz.io exists in two forms:

Your profile birthday: You may optionally add your date of birth to your profile. This is used to send you birthday reminders and is not shared with anyone by default. You can enable a setting — "Share my birthday with people who gift me" — which allows people who have sent you gifts to see your birthday and receive a reminder around that time. You can turn this off at any time.

Contact birthdays: You may add a birthday for people in your contacts. This is your own private record, like a phone address book. It is never shared with the contact or anyone else. If the contact has enabled birthday sharing on their profile, their birthday may automatically appear in your contact record for them.

We never share your date of birth with third parties. The lawful basis for processing birthday data is consent — you provide it voluntarily and can remove it at any time.

Push notifications

With your permission, we send push notifications to your device. These include:

• Notifications when someone claims a gift you sent
• Notifications when you receive a gift
• Notifications when a gift you sent has been delivered
• Birthday reminders for contacts whose birthdays are coming up (where birthday data is available)

To send notifications, we store a push token associated with your device and account. This token is deleted when you sign out. You can disable individual notification types within the app at any time, or revoke permission entirely through your device settings.

The lawful basis for sending notifications is consent. We do not send notifications for marketing purposes without your explicit opt-in.

When we share data

We share your information only with the third-party partners required to operate our service, and only the minimum necessary to do so. These include:

• Fulfilment partners (Ongoody) — receive the recipient's name and delivery address to process and ship physical gifts. Based in the United States.
• Payment processors (Airwallex) — handle your payment securely. We do not receive or store your full card number. Based in Hong Kong, with global operations.
• Infrastructure (Supabase) — our database and backend provider. Data is stored on servers located in Ireland (EU).
• Push notification providers (Apple APNs, Google FCM) — used to deliver push notifications to your device.

All partners are contractually required to use your data only for the purpose of providing their service to us. We do not sell your personal data. Ever.

We may also disclose information if required by law, or to protect the safety and security of our users or service.

International transfers

Our primary data storage is in Ireland (EU). However, some of our service partners are based outside the UK and EU, which means your data may be transferred internationally:

• Ongoody (US) — recipient delivery details are transferred to the US for fulfilment purposes, protected by contractual safeguards
• Airwallex (HK/global) — payment processing involves international transfer, governed by their own GDPR-compliant data transfer mechanisms
• Apple / Google (US) — push tokens are processed via their respective notification infrastructure

Where data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place in accordance with UK GDPR and EU GDPR, including standard contractual clauses where required.

Cookies & tracking

Our website uses a small number of cookies to keep the service working. The Prezz.io mobile app does not use cookies.

• Essential cookies — required for the site to function (session management, security). These cannot be disabled.
• Analytics cookies — help us understand how people use the site, on an anonymised basis. These do not track you across other sites.

We do not use advertising cookies or third-party tracking pixels. You can control analytics cookies via your browser settings or by contacting us.

Data retention

We keep your data only as long as we need it for the purpose it was collected, or as required by law.

• Order records (excluding payment details) are retained for up to 7 years for legal and accounting purposes
• Delivery addresses provided by recipients are deleted 90 days after the order is fulfilled
• Push notification tokens are deleted when you sign out of the app
• Contact data (your address book) is retained while your account is active and deleted when you close your account
• Birthday data on your profile is deleted when you remove it or close your account
• Account data is retained while your account is active; you may request deletion at any time (see Section 13)

Your rights

Under UK GDPR and EU GDPR, you have the following rights regarding your personal data. We honour these for all users regardless of location:

• Right of access — you can request a copy of the personal data we hold about you
• Right to rectification — you can ask us to correct inaccurate or incomplete information
• Right to erasure — you can ask us to delete your data, subject to legal retention requirements
• Right to restriction — you can ask us to restrict processing of your data in certain circumstances
• Right to portability — you can request a copy of your data in a structured, machine-readable format
• Right to object — you can object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, contact us at privacy@prezz.io. We respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. In Ireland and the EU, this is the Data Protection Commission (DPC) at dataprotection.ie.

Account & data deletion

You can request deletion of your account and personal data at any time. To do so:

• Email us at privacy@prezz.io with the subject line "Account deletion request" and the email address associated with your account
• We will confirm receipt within 5 business days and complete the deletion within 30 days
• We will delete your profile, contacts, birthday data, push tokens, and any other personal data we hold about you
• Order records may be retained for up to 7 years as required by law, but will be anonymised where possible
• Delivery addresses already passed to fulfilment partners cannot be recalled once an order is in progress

In-app account deletion will be available in a future update.

Security

We take reasonable technical and organisational measures to protect your information. These include encrypted connections (HTTPS/TLS), row-level security on our database (meaning each user can only access their own data), access controls limiting who within our team can access personal data, and the use of reputable, security-audited third-party services.

No system is completely secure. If you believe your data has been compromised, please contact us immediately at privacy@prezz.io.

Children

Prezz.io is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted information to us, please contact us and we will delete it promptly.

Contact us

If you have questions about this policy, want to exercise your rights, or want to request account deletion — contact us. We aim to respond to all privacy enquiries within 30 days.