Privacy Policy

Markus Zimmermann

Walter-Jasper-Str. 4

48282 Emsdetten

Germany

Email: hallo@nefoli.de

nefoliGIFT follows the principle of data minimisation and aims to avoid collecting unnecessary data. However, operating the service necessarily involves processing account, wishlist, group-gift, event, notification and technical data. We do not use third-party analytics or tracking systems for general usage analytics. This is separate from possible tracking mechanisms used by the relevant affiliate network when a labelled affiliate link is clicked.

When the website is accessed, technically necessary connection data such as IP address, date and time, and user agent is processed to provide and secure the service (Art. 6(1)(f) GDPR). We use technical services from Lovable Cloud and Supabase for the database, authentication, storage and application backend. According to the technically verified status, the infrastructure used is located in AWS region eu-west-2 in London, United Kingdom. The specific processing takes place within the infrastructure we use and under the respective data-processing and terms-of-use arrangements. Other possible recipients are Google when optional Google Login is used, the nefoli email infrastructure at notify.nefoli.de, nefoliFEEDBACK, external shop websites when a product page is retrieved, affiliate networks when an affiliate link is clicked, and an external MCP or AI client expressly authorised by the user.

For an account, we process the email address, display name and profile information as well as authentication and session information. Passwords and other credentials are processed by the Supabase/Lovable Cloud authentication system. Google Login can optionally be used; in that case, OAuth identity information provided for sign-in is processed. This policy does not claim any specific OAuth scopes. Processing to provide the account and app functions is based on Art. 6(1)(b) GDPR; technically necessary security processing is based on Art. 6(1)(f) GDPR. To protect the platform against abuse, administrators can suspend or block an account temporarily or permanently. For this we store the account status, an optional brief reason, an optional end date and a log of status changes (time, acting administrator, previous and new status). The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). This data is deleted together with the account.

Wishlists may contain a title, description, occasion or custom occasion, visibility, share token, handover date, notification preferences and account association. Wishlist items may contain a title, description, notes, category, price, priority, status, original product URL, affiliate URL, product image URL, guest-suggestion information and reservation information. Reservations may include a guest name, anonymous device identifier and timestamp. Comments may contain an author name, free text and a user ID or anonymous device identifier and may be associated with another user's list. Group gifts may contain a title, description, public token, deadlines, handover date and configuration. Recipient information may include a name, description and an image stored in application storage. Gift ideas may contain a title, price, currency, merchant, image, description, comment, creator name, user ID or anonymous device identifier, purchase status and product URL; where affiliate processing applies, the stored URL may be the resolved affiliate URL. Money pools may contain the target and current amount, payment method, IBAN, account holder, payment reference, payment link and notes, as well as a contributor's name, amount and note and their user ID or anonymous device identifier. nefoliGIFT does not itself process payments. Personal events may contain a person's name, event type, date, yearly recurrence and reminder, email and in-app settings. Reminder records include the event reference, occurrence date, reminder timing, and delivery and read status. Recently viewed wishlist and group-gift data may include list information, title, share token and owner name; these records are limited by count, not by a fixed period. Through public links, people without an account can contribute ideas, comments, votes, reservations or participation commitments. The supplied name and a randomly generated anonymous device identifier may be processed for attribution and abuse prevention.

When a product URL is provided, nefoliGIFT may retrieve the external product page server-side by HTTP to validate the URL and extract product data such as title, description, image, price, currency, merchant, availability and product identifier. User cookies or other user-specific data are not intentionally sent to the shop. The original URL may be processed for validation, extraction and affiliate handling. For supported shops, configured rules may convert the URL into an affiliate link. Examples of potentially configured networks include Awin, Tradedoubler, Webgains, financeAds, Belboon and Zenaps; not every network is necessarily active at all times. Affiliate URLs may be stored. Affiliate logs contain the original and resolved affiliate URL but no user ID. When a link is clicked, the relevant network may receive its own technical tracking information; this is not general usage tracking by nefoliGIFT. Authentication, wishlist, event-reminder and other application emails may be sent through notify.nefoli.de. This may involve the recipient address, subject and rendered content. Available notification preferences can be controlled in the app. Feedback may be sent to the separate nefoliFEEDBACK service at https://feedback.nefoli.de/api/public/feedback and may include category, subject, message, rating, browser/platform information, current URL and, where available, user ID. Name and email are included only when a reply is requested. nefoliGIFT also provides an optional MCP interface. Only after successful OAuth authentication and authorisation can an external MCP-compatible client or AI agent act for the signed-in user to read, create or modify wishlists, items, group gifts and events, add items to group gifts, and assign group gifts to events. nefoliGIFT does not automatically send all data to OpenAI or other AI providers. After authorised disclosure, the external provider determines its further processing; users should therefore also consult that provider's privacy policy.

nefoliGIFT uses cookies or browser storage for necessary functions. These may contain an anonymous device ID, anonymous or guest name, session information managed by the authentication system, theme preference, reservation markers, information about dismissed participation notices and temporary UI state. A feedback retry queue may temporarily retain an unsent message together with a name and email in the browser. These storage operations support the requested function, sign-in, presentation or abuse prevention. No third-party analytics or tracking cookies are used for general usage analytics; possible affiliate tracking after clicking a partner link is described in section 6.

Data is retained for as long as necessary for its respective purpose. No general fixed deletion period has been technically verified. When an account is deleted, the account and associated primary data are deleted where technically possible. Data connected to other users' content, required for record integrity or held in technical logs may remain or be anonymised. This may include anonymised comments on other users' lists, contributions to other users' money pools, reservations on other users' wishlists, affiliate logs, certain notification records and recipient images remaining in storage. Recent views are limited by count; no fixed automatic deletion period has been verified for affiliate logs, notification events or certain reminder records. Statutory retention obligations remain unaffected. Under GDPR, where the applicable requirements are met, you have the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent with effect for the future where processing is based on consent
• Complaint to a supervisory authority (Art. 77 GDPR)

For inquiries about your data, please contact: datenschutz@nefoli.de.