GiveItPoints
Last updated: March 2026
This privacy notice explains how GiveItPoints collects, uses, stores, and protects your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
The data controller for your personal information is:
We collect the following categories of personal data:
We process your personal data under the following legal bases:
| Legal Basis | Purpose |
|---|---|
| Contract Performance Art. 6(1)(b) |
Account management, team features, voting sessions, subscription services |
| Legitimate Interest Art. 6(1)(f) |
Security and fraud prevention, service improvement, admin audit logging |
| Consent Art. 6(1)(a) |
Analytics cookies (Google Analytics), marketing communications |
| Legal Obligation Art. 6(1)(c) |
Retention of financial and payment records for tax and legal compliance |
We share data with the following third-party processors, each operating under a data processing agreement:
| Processor | Purpose | Data Shared |
|---|---|---|
| Stripe stripe.com |
Payment processing | Email address, subscription data, payment details |
| Google Analytics analytics.google.com |
Website analytics | Anonymized usage data (requires your consent) |
| Mailgun mailgun.com |
Email delivery | Email address, email content |
| Google reCAPTCHA google.com/recaptcha |
Bot protection (when enabled) | IP address, browser data |
| Cookie / Mechanism | Type | Purpose | Consent Required |
|---|---|---|---|
| Session cookie | Essential | Maintains your authenticated session (12-hour expiry) | No |
| CSRF token cookie | Essential | Protects against cross-site request forgery attacks | No |
| Guest token cookie | Essential | Identifies guest users for team participation | No |
| Google Analytics cookies | Analytics | Collects anonymized page views and usage patterns | Yes — explicit opt-in |
Email tracking: We do not track email opens or link clicks. Service emails are delivered via Mailgun without open or click tracking enabled.
| Data Category | Retention Period |
|---|---|
| Active accounts | Retained while the account remains active |
| Inactive accounts | Retained indefinitely until the user requests deletion. You can delete your account at any time from your account settings. |
| Teams | Retained while the team remains active |
| Payment records | Retained as required for legal and tax obligations |
| Admin audit logs | Retained for security and compliance purposes |
As a data subject, you have the following rights regarding your personal data:
| Right | Description | How to Exercise |
|---|---|---|
| Access Art. 15 |
View all personal data we hold about you | View your data (requires login) |
| Erasure Art. 17 |
Delete your account and all associated data, including team memberships, support tickets, notifications, and organization memberships | Delete your account (requires login) |
| Rectification Art. 16 |
Correct inaccurate personal data | Update your profile in account settings |
| Data Portability Art. 20 |
Download your data in a machine-readable format (JSON) | Download your data (requires login) |
| Object Art. 21 |
Object to processing based on legitimate interest | Contact support@giveitpoints.com |
| Restriction Art. 18 |
Restrict processing of your data | Contact support@giveitpoints.com |
| Withdraw Consent Art. 7(3) |
Withdraw previously given consent at any time without affecting prior processing | Manage cookie preferences via the consent banner |
| Lodge a Complaint Art. 77 |
File a complaint with a supervisory authority if you believe your rights have been violated | Contact your local data protection authority |
We implement appropriate technical and organizational measures to protect your personal data:
Your data may be processed in the United States by our third-party processors, including Stripe, Google, and Mailgun. Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.
GiveItPoints is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us at support@giveitpoints.com and we will promptly delete the data.
We may update this privacy notice from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this notice periodically.
Last updated: March 2026
You can exercise most of your rights directly through our self-service tools:
If you are unable to use the self-service tools or wish to make a formal data subject access request, contact us at support@giveitpoints.com. We will verify your identity and respond to all requests within 30 days as required by GDPR Article 12.
If you have questions about this privacy notice or how we handle your personal data, please contact us:
You also have the right to lodge a complaint with your local data protection supervisory authority if you believe your personal data has been processed in violation of applicable data protection laws.