Privacy Policy

Last updated: July 5, 2026 · Effective immediately

GiftoSwap, LLC, a Texas limited-liability company ("GiftoSwap," "Company," "we," "us," or "our"), is committed to protecting the privacy and security of our users ("you" or "your"). This Privacy Policy describes how we collect, use, store, disclose, and safeguard your personal information when you visit our website, create an account, or use our gift card exchange services. By using our services, you consent to the practices described in this policy.

1. Information We Collect

We collect the following categories of information:

1.1 Information You Provide Directly

  • Account Information: Full legal name, email address, phone number, and password (stored as a secure hash, never in plain text).
  • Payment Information: Payment method details necessary to process your payout, including PayPal email, Cash App tag ($Cashtag), Zelle phone number or email, bank account and routing numbers (for ACH transfers), Google Pay, Apple Pay, Chime, or GreenDot account identifiers.
  • Gift Card Details: Card brand, card number, PIN/security code, card value, card type (physical or e-gift), and card condition. All card numbers and PINs are encrypted at rest using AES-256 encryption.
  • Card Photographs: Front and back images of physical gift cards uploaded during the exchange process.
  • Support Communications: Any messages, emails, or other communications you send to our support team.

1.2 Information Collected Automatically

  • Device & Browser Data: IP address, browser type and version, operating system, device type, and screen resolution.
  • Usage Data: Pages visited, time spent on pages, referral URLs, click patterns, and navigation paths.
  • Session Data: Authentication tokens, session identifiers, and login timestamps.
  • Cookies: Essential session cookies and optional analytics cookies (see Section 7).

1.3 Information from Third Parties

We may receive information from payment processors confirming the status of a payout (e.g., delivered, failed, pending). We do not purchase or acquire personal data from data brokers or third-party sources.

2. How We Use Your Information

We use the information we collect for the following purposes:

  • Service Delivery: To process your gift card exchange transactions, verify card balances, and send payments.
  • Identity Verification: To confirm your identity, prevent fraud, and comply with applicable regulations.
  • Account Management: To create, maintain, and secure your account.
  • Communication: To send transaction confirmations, account notifications, support responses, and service updates. We do not send unsolicited marketing emails.
  • Fraud Prevention: To detect, investigate, and prevent fraudulent transactions, unauthorized access, and other illegal activities.
  • Legal Compliance: To comply with applicable laws, regulations, legal processes, and government requests.
  • Service Improvement: To analyze usage patterns, diagnose technical issues, and improve our website and services.

3. Data Security

We implement industry-standard administrative, technical, and physical security measures to protect your personal information:

  • Encryption at Rest: All sensitive data, including gift card numbers and PINs, is encrypted using AES-256 (Advanced Encryption Standard, 256-bit) encryption before being stored in our database.
  • Encryption in Transit: All data transmitted between your browser and our servers is protected using TLS 1.2+ (Transport Layer Security) with 256-bit encryption. Our website enforces HTTPS on all pages.
  • Password Security: User passwords are salted and hashed using bcrypt with a work factor of 12. We never store passwords in plain text and cannot retrieve your password.
  • Access Controls: Access to personal data is restricted to authorized personnel on a need-to-know basis. Administrative access requires multi-factor authentication.
  • Infrastructure Security: Our application is hosted on enterprise-grade cloud infrastructure with built-in DDoS protection, automated backups, and continuous monitoring.
  • Rate Limiting: We implement rate limiting on authentication and submission endpoints to prevent brute-force attacks.

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to promptly notifying affected users in the event of a data breach.

4. Data Sharing & Disclosure

We do not sell, trade, rent, or otherwise monetize your personal information. We may share information only in the following limited circumstances:

  • Payment Processors: We share the minimum information necessary with third-party payment platforms (PayPal, Cash App, Zelle, etc.) to process your payout. Each processor is bound by its own privacy policy.
  • Cloud Service Providers: We use third-party hosting, database, and storage providers to operate our platform. These providers are contractually obligated to protect your data and use it only for the purposes of providing services to us.
  • Law Enforcement & Legal Requirements: We may disclose information when required by law, court order, subpoena, or other legal process, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.
  • Business Transfers: If GiftoSwap, LLC is involved in a merger, acquisition, asset sale, or bankruptcy, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

We do not share your information with third parties for their own marketing or advertising purposes.

5. Data Retention

  • Account Data: Retained for as long as your account is active and for 30 days after account deletion to allow for potential reactivation.
  • Transaction Records: Retained for a minimum of 7 years to comply with financial record-keeping regulations (IRS requirements, anti-money laundering laws).
  • Gift Card Details: Encrypted card numbers and PINs are retained only until the transaction is fully completed and any dispute window has closed (90 days), after which they are permanently deleted from our active systems.
  • Card Photographs: Retained for 90 days after transaction completion for dispute resolution purposes, then permanently deleted.
  • Support Communications: Retained for 2 years after the last interaction.
  • Automatically Collected Data: IP addresses and usage data are retained for up to 12 months.

You may request early deletion of your data by contacting us (see Section 9), subject to our legal retention obligations.

6. Data Storage Location

Your data is stored on servers located in the United States, operated by our cloud infrastructure providers. By using our services from outside the United States, you consent to the transfer of your information to the United States, which may have different data protection laws than your jurisdiction.

7. Cookies & Tracking Technologies

We use the following types of cookies:

  • Essential Cookies (Required): Session cookies that maintain your login state, CSRF tokens for form security, and session identifiers. These are strictly necessary for the website to function and cannot be disabled.
  • Analytics Cookies (Optional): We may use anonymized analytics services (such as Google Analytics or similar) to understand aggregate traffic patterns and improve our website. These cookies do not contain personally identifiable information.

We do not use advertising cookies, retargeting pixels, or cross-site tracking technologies. You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using certain features of the website.

8. Third-Party Links

Our website may contain links to third-party websites (e.g., payment processor sites). We are not responsible for the privacy practices, content, or security of third-party websites. We encourage you to review the privacy policies of any third-party site you visit.

9. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Right to Access: Request a copy of the personal data we hold about you.
  • Right to Correction: Request correction of inaccurate or incomplete data.
  • Right to Deletion: Request deletion of your personal data, subject to our legal retention obligations.
  • Right to Data Portability: Request a machine-readable copy of your data.
  • Right to Opt Out: Opt out of non-essential data processing (we currently do not engage in data sales or targeted advertising).

9.1 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

  • The right to know what personal information we collect, use, disclose, and sell (we do not sell personal information);
  • The right to request deletion of personal information;
  • The right to non-discrimination for exercising your privacy rights;
  • The right to correct inaccurate personal information.

To exercise any of these rights, contact us at support@giftoswap.com or call 469-851-8300. We will verify your identity before processing your request and respond within 45 days.

9.2 Do Not Track Signals

Our website does not currently respond to "Do Not Track" (DNT) browser signals, as there is no industry-wide standard for DNT compliance. However, we do not engage in cross-site tracking.

10. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect, solicit, or maintain personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will delete that information promptly. If you believe a child has provided us with personal information, please contact us at support@giftoswap.com.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. When we make material changes, we will:

  • Update the "Last updated" date at the top of this page;
  • Post a notice on our website;
  • Where appropriate, notify registered users via email.

Your continued use of our services after changes are posted constitutes acceptance of the revised policy. We encourage you to review this page periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact us:

GiftoSwap, LLC
525 South Griffin St, Room 905, Dallas, TX 75202
Phone: 469-851-8300
Email: support@giftoswap.com

For privacy-specific inquiries, please include "Privacy Request" in the subject line of your email. We will acknowledge receipt within 2 business days and provide a substantive response within 30 days.