Privacy Policy
Last updated
In short
- We collect your name, email address and what you buy, so we can deliver codes and help when something goes wrong.
- Your codes are encrypted. Only you can open them, and we never send them by email.
- We don’t sell your data. It’s shared only with the companies that run sign-in, our database, the cards and the payments.
- Ask us any time for a copy of your data or to delete your account.
What we collect
When you create an account we collect your first name, last name and email address. If you sign in with Google we also get the name and profile picture on your Google account.
When you buy, we keep the order: which cards, the prices, how you paid, the last four digits of an EcoCash number, and the codes themselves (encrypted).
We also keep technical details that help us spot fraud: your IP address, roughly when you signed in, and the region you chose. When the jewellery store opens we will also keep delivery addresses, phone numbers and recipient names for the parcels you order.
Why we collect it
- To deliver your codes and keep them in your Loot Vault.
- To take payment and to refund you when something fails.
- To answer support tickets and check a code with the supplier.
- To stop fraud and card theft, which protects everyone’s prices.
- To send deal emails, only if you turn them on in your settings.
Who else handles it
We use a small number of companies to run the store. They only get what they need:
- Google Firebase: sign-in and account security.
- MongoDB Atlas: our database, hosted in Cape Town.
- Zendit and Reloadly: the suppliers the gift cards come from.
- Our payment provider: takes the payment. Card numbers never reach our servers.
- Our email provider: sends receipts and account emails.
- Vercel: hosts the website.
When the jewellery store opens, a courier and an SMS provider will also receive the delivery details for your parcel.
How your codes are protected
Gift card codes are encrypted before they are stored, and decrypted only when you open one. We ask you to sign in again before showing an older code. Every time a code is opened it is written to our audit log. We never put a code in an email or a message.
How long we keep it
Orders and the money side of them are kept for seven years, because we have to account for them. Support tickets are kept for two years. If you delete your account we remove your name and email and keep only what the accounts require, which can no longer identify you.
Your data, your call
You can see and change your name, regions and email settings in your account. Ask us and we’ll send you a copy of everything we hold about you, or delete your account for you.
Email privacy@gemworks.gift or use the contact form. We answer within five working days.
Age
Gemworks is for people aged 18 and over. If you’re younger, ask a parent or guardian to buy for you.