Privacy Policy

When you create an account we collect your first name, last name and email address. If you sign in with Google we also get the name and profile picture on your Google account.

When you buy, we keep the order: which cards, the prices you paid, how you paid, and the codes themselves, encrypted. For an EcoCash payment we keep the last four digits of the number, and a one-way fingerprint of the full number — a scrambled value we can match against other orders but cannot turn back into a phone number.

We keep technical details that help us spot fraud: your IP address, when you signed in, the account region you chose, and the risk score an order was given along with the reasons for it.

Depending on what you use, we may also hold:

• Store credit: your balance, and a line for every movement — top-ups, purchases, refunds, referral rewards and any adjustment we make — with the reason and the order it belongs to.
• Jewellery orders: the delivery address, a phone number for the courier, the recipient’s name, and any engraving text you ask for.
• Reviews: your rating and what you wrote, published under your first name and last initial once we have checked it.
• Your cart, wishlist and recently viewed cards, so the shop remembers where you were.
• Referrals: if you were invited, we record which account invited you, so the reward can be paid.
• Notifications: if you allow them, a registration code for that browser and the browser’s own description of itself.
• Support tickets: what you wrote to us, and the order it is about.

If you send a card as a gift, you give us the recipient’s name and email address and the message you want them to read. We use them to deliver that gift and nothing else. Please only send details you have permission to share — and tell the recipient it was you, because we can’t.

The same goes for a jewellery order going to someone else: their name, address and phone number reach us, and the courier, only so the parcel arrives.

• To deliver your codes and keep them in your Loot Vault.
• To take payment, hold your store credit, and refund you when something fails.
• To answer support tickets and check a code with the supplier.
• To stop fraud and card theft, which protects everyone’s prices.
• To keep our own accounts and meet the record-keeping the law asks of us.
• To send deal emails and notifications, only if you turn them on.

Gift card codes are encrypted before they are stored, and decrypted only when you open one. We ask you to sign in again before showing an older code. Every time a code is opened it is written to our audit log. We never put a code in an email or a message.

We use a small number of companies to run the store. They only get what they need:

• Google Firebase: sign-in and account security, and the notifications you opt into.
• MongoDB Atlas: our database, running on Amazon Web Services in Northern Virginia, in the United States.
• Our card suppliers: the wholesalers the gift cards come from. They receive a reference number for the order and, when a card needs a name on it, a first and last name. They never receive your email address or anything about your payment.
• CyberPay: takes EcoCash and card payments. Card details are entered on their own page, so card numbers never reach our servers.
• Google AdSense: shows the ads on our home page, and only if you accept all cookies.
• Our courier: for jewellery, receives the delivery address and a contact number.

Receipts and account emails are sent from our own mail server, so no separate email company handles them. We keep a record of each message we send you — who it went to, when, and which template — but never the codes.

We don’t sell your data, and we don’t share it for anyone else’s advertising.

The website runs on a server in the south of England, in the United Kingdom. The database it talks to is hosted by MongoDB Atlas on Amazon Web Services in Northern Virginia, in the United States. Sign-in is handled by Google.

So although we sell in Zimbabwe, your data is stored outside it, and using the store means sending your details to those countries. We chose established hosting companies that publish their own security and data-protection terms, and we keep the data we send them to what the shop actually needs.

• Codes are encrypted at rest, and opening one needs a fresh sign-in.
• Card numbers are never entered on our site, so we have none to lose.
• We store a fingerprint of an EcoCash number rather than the number itself, outside the last four digits.
• Every staff action on your account or order — a refund, a credit adjustment, a status change — is written to an audit log with who did it.
• Only a few staff accounts can reach admin tools, and each is tied to a named person.

Essential cookies keep you signed in, remember your account region and hold your cart. They can’t be turned off, because the store can’t work without them.

Advertising cookies come from Google AdSense and load only after you choose “Accept all” in the banner. Choose “Essential only” and no advertising script is loaded at all. We don’t currently run any analytics cookies; if that changes, it will be under the same choice and this page will say so.

You can change your mind any time with “Cookie settings” in the footer.

Receipts, code deliveries and anything about an order you placed are part of the service, so they are always sent. Deal emails and browser notifications are separate and off until you turn them on in your account settings.

You can turn them off again in the same place, or use the unsubscribe link on any deal email. Turning off notifications in your browser also stops them.

Orders and the money side of them are kept for seven years, because we have to account for them. Support tickets are kept for two years. Published reviews stay up until you ask us to take yours down. A notification registration drops off as soon as you revoke permission or clear your browser data.

If you delete your account we remove your name and email and keep only what the accounts require, which can no longer identify you.

You can see and change your name, regions and email settings in your account. You can also ask us to:

• send you a copy of everything we hold about you;
• correct anything that’s wrong;
• delete your account;
• stop using your details for deals and notifications.

Email privacy@gemworks.gift or use the contact form. We answer within five working days. If we’ve got something wrong and can’t put it right for you, tell us and we’ll explain why, so you can take it further.

Gemworks is for people aged 18 and over. If you’re younger, ask a parent or guardian to buy for you.

When what we do with your data changes, we update this page and the date at the top. If a change matters to you — a new company handling your details, or data moving somewhere new — we’ll make it clear on the site rather than quietly editing the text.