1. Who we are
Giftmu is run by Giftmu (nama badan usaha belum diisi) as the personal data controller under Indonesia's Personal Data Protection Law (Law No. 27 of 2022).
2. Data we collect
- Gift content entered by the sender: sender and recipient names, messages, photos, song links, wrapping choice, and the lock answer.
- Order data: template, plan, price, promo code, time, payment status, and an email for the receipt and gift link (required for paid plans, optional for free gifts). The name and WhatsApp number you enter when paying are passed straight to Mayar to create an invoice in your name and are not stored by us; at Mayar they are handled by Mayar as the payment processor.
- Interactions with the gift: how many times and when the gift was opened, and replies (name & message) written by the recipient, so the sender can see them on the sender page.
- Technical data such as IP address and device type in server logs, for security (for example, limiting lock guesses).
- Visit statistics: the number of visits per page per day, the referring site's name (e.g. instagram.com), and the campaign code in a link. Counted without cookies, without IP addresses, and without any visitor identifier, so they can't be tied to anyone. Nothing is counted if your browser sends a Global Privacy Control or Do Not Track signal.
- Gift drafts and the “My gifts” list are stored in your own browser (local storage). Photos you choose in the editor are uploaded to our storage right away so drafts stay small; they are private and can only be fetched through random addresses.
3. How we use it
- to show the gift to the recipient who holds the link (and the lock answer);
- to process payment, publish the link, and email it to you if you provide an address;
- to understand which pages and templates are visited most, from the visit statistics above;
- to keep the service secure and handle abuse reports.
We do not sell data, do not use it for ads, and do not read gift content unless needed to handle a report of a violation.
4. Where data is stored & who processes it
- Supabase (database & photo storage, Singapore region) and Cloudflare (site servers).
- Mayar (payment processing; receives your name, email, and WhatsApp number for the invoice).
- Resend (sending the gift link by email, only if you enter an email).
- Photos in published gifts are stored privately and can only be fetched through random, hard-to-guess addresses. A locked gift's content is only sent to the recipient's device after the lock is answered correctly.
5. How long we keep data
Gift content (including photos and replies) is kept for the plan's active period, then deleted no later than 30 days after it ends. Photos replaced when a gift is edited are deleted too, and photos uploaded in the editor but never published are deleted 7 days after upload. Order data (plan, price, time, status) may be kept longer where required for accounting and tax purposes, but the copy of the gift content inside it is deleted a day after the gift is published, and the content and email of unpaid orders are deleted a day after the payment deadline.
This cleanup runs automatically every night. Visit statistics contain no personal data and are kept as daily totals.
6. Your rights
You can ask for a copy, correction, or deletion of the gift data you created. A recipient can also ask for a gift about them to be deactivated. Send your request to halo@giftmu.id (belum aktif) with the gift link; we respond within 3 working days.
7. Children
This service is meant for users aged 17 and over, or younger users with a parent or guardian.
8. Changes
This policy may be updated; the latest version is always on this page. If this English version differs from the Indonesian one, the Indonesian version prevails. See also our Terms of Service.