Privacy policy

Who is responsible

Serra GCVC OÜ (Estonian registry code 17183619), Tööstuse 75, 10416 Tallinn, Estonia, is the data controller. Contact: hello@gladyouliked.com.

Where we are today

The site is a preview before launch. There are no customer accounts and no payments yet. When those go live, this page will be updated first.

What we handle and why

• Visiting the site. Our host, Vercel, processes your IP address and standard request logs to serve pages and keep the site secure. We use Vercel's approximate city (from your IP) to suggest the city you are in. That guess is sent to your browser and not stored by us.
• Fonts. Pages load fonts from Google Fonts, and the map loads its code library from unpkg.com. Both receive your IP address when those files load.
• Preview tools (Secret Santa, group gift, surprise, company view). What you type is saved only in your own browser's local storage. It is not sent to us. Clearing your browser data removes it.
• Preferences. Your language and colour choices are saved in local storage and in a small cookie (gyl_kit_ac), only on your device.
• Company quote form (/teams). Your name, email, company and message are emailed to our team through Postmark so we can reply. We keep these emails for up to 24 months.
• Analytics, only if you agree. With your consent (the cookie banner), we use Google Analytics 4 and Microsoft Clarity to see which pages are used and where people get stuck. Clarity records clicks, scrolls and mouse movement on our pages as session replays, with form fields masked. We use Google Search Console for search data about our site, which uses no cookies on your device.
• Marketing, only if you agree. With your consent, Meta Pixel tells Meta (Facebook, Instagram) that you visited or sent a request, so we can measure our ads and show them to similar people.
• Weather on gift pages comes from Open-Meteo using the city's coordinates. No personal data is sent.
• Instagram posts on maker pages. Nothing is sent to Instagram until you tap a post. When you tap, Instagram (Meta) loads its player and processes data under its own policy.
• Connecting Instagram (for makers, once available). If a maker connects their Instagram business or creator account, we receive their username, name, profile picture, the media they choose and an access token. We use it only to show the posts they choose on their listing. We never post, comment or send messages. The data stays until they disconnect; then we delete the token straight away and our copies of their media within 30 days.

Legal bases

Running and securing the site: our legitimate interest (GDPR art. 6(1)(f)). Quote requests: steps before a contract, at your request (art. 6(1)(b)). Analytics, marketing, loading Instagram content and connecting Instagram: your consent (art. 6(1)(a)), which you can withdraw at any time.

Cookies and similar storage

You choose in the banner the first time you visit, and can change it any time with Cookie settings in the footer.

• Necessary (always on): gyl_consent (your choice, 12 months), gyl_kit_ac (colour preference), language and currency in local storage.
• Analytics (consent): Google Analytics _ga, _ga_* (up to 2 years); Microsoft Clarity _clck (1 year), _clsk (1 day), CLID.
• Marketing (consent): Meta Pixel _fbp (3 months) and _fbc when you arrive from a Meta ad.

Who processes data for us

• Vercel Inc. (hosting, United States)
• Postmark / ActiveCampaign (email delivery, United States)
• Google (fonts)
• unpkg.com (delivers the map code library)
• Google Ireland / Google LLC (Google Analytics, only with consent)
• Microsoft Ireland / Microsoft Corp. (Clarity, only with consent)
• Meta Platforms Ireland (Meta Pixel with consent; Instagram when you tap a post or connect)

Transfers outside the EU rely on the European Commission's standard contractual clauses or the EU–US Data Privacy Framework where the provider is certified.

Your rights

You can ask to see, correct or delete your data, to restrict or object to its use, to get a copy, and to withdraw consent. Email hello@gladyouliked.com. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, info@aki.ee) or to the authority where you live.

To delete data linked to an Instagram connection, see Delete my data.

Children

The site is not aimed at children under 16, and we do not knowingly collect their data.

Changes

We will update this page when what we do changes, and change the date at the top.