- Buy Now, Book Later
- Premium Gift Pack
- Free Returns & Exchanges
- Instant Delivery
English
Last updated: July 20, 2026. Thrill Gifts, 215 East Bay St, Charleston, SC 29401 · hello@thrillgifts.com.
Buyer details (name, email, billing); recipient details (name, email, phone, mailing address); personal messages and video greetings; payment information (processed by Stripe — we receive a token, not your full card number); and usage/device data, including cookie identifiers, IP address, browser/device type, and pages viewed (see §5).
When you buy a gift, you provide us with the recipient’s details. This means we obtain the recipient’s personal data from you, a third party, rather than from the recipient directly. We inform recipients of this Policy and their rights at the point we first contact them — for example, in the gift-delivery email, which links here. Recipients are data subjects in their own right and may exercise the rights in Section 7.
We use your data to process orders, deliver and personalise gifts, enable redemption and booking, provide support, prevent fraud, and (with consent) send service messages and measure site usage. Where the GDPR/UK GDPR applies, our legal bases are: performance of a contract (processing and delivering your order); legal obligation (tax and financial records); consent (SMS delivery, and analytics/marketing cookies); and legitimate interests (fraud prevention, securing and improving the service).
We share only what’s needed with service providers (sub-processors): experience providers (to fulfil a booking); Stripe (payments); Twilio (SMS); Plain (support); and, for site analytics and marketing measurement, Google Analytics, Microsoft Clarity, and WickedReports (see §5). We do not “sell” personal information for monetary consideration. However, “sale” and “sharing” under California law are broader than an exchange for money, and our use of certain analytics and advertising cookies (for example, WickedReports) may constitute a “sale” or “sharing” of personal information under that definition. You can opt out (see §7).
Text delivery is sent only with consent; one-time, no recurring marketing. STOP to opt out, HELP for help; message and data rates may apply; US mobile numbers only. See the SMS / text message delivery section of our Terms of Service for full terms.
We use cookies and similar technologies in three categories:
Non-essential (Analytics and Marketing) cookies load only after you accept them in our cookie consent banner; you can change your choice at any time. We honour Global Privacy Control (GPC) browser signals as an opt-out.
We keep personal data only as long as needed for the purposes above or as the law requires. Indicative periods: order/transaction records ~7 years (tax); recipient details until the gift is redeemed or expires + ~24 months; for Direct Channel Experience Gifts, which do not expire, recipient personal data is deleted or anonymised no later than 5 years after issuance or last account activity, whichever is later — this does not affect the ongoing validity of the gift itself; personal messages/video greetings ~12 months after redemption; support records ~24 months; SMS consent records ~5 years; analytics data up to ~14 months. Payment data is held by Stripe (PCI-compliant). Our internal retention schedule sets the detail; data is then deleted or anonymised.
EU/UK (GDPR/UK GDPR): you may request access, rectification, erasure, restriction, portability, and object to processing, and withdraw consent at any time; you may also lodge a complaint with your local supervisory authority.
California (CCPA/CPRA): you may request to know, delete, and correct your information, and opt out of the “sale” or “sharing” of personal information via the “Do Not Sell or Share My Personal Information” link / our cookie banner; we honour GPC signals.
These rights are available to buyers and to gift recipients alike. To exercise any right, email hello@thrillgifts.com. We verify your identity and respond within about one month (GDPR) or 45 days (CCPA/CPRA), extendable where permitted.
We are US-based and process data in the US, with support data also processed by our sub-processor Plain in the United Kingdom. If you provide data to us directly from outside the US, that direct collection is generally not an international “transfer” requiring additional safeguards.
GDPR / UK GDPR applicability. Because we accept purchases from buyers located in the EU and UK as an ordinary part of our business, GDPR and UK GDPR apply to those buyers’ personal data, even though the Experience itself is delivered in the US.
Where we share data with our US-based service providers (Stripe, Twilio, Google, Microsoft, WickedReports), those transfers are covered by the providers’ EU-US Data Privacy Framework certification and/or Standard Contractual Clauses (SCCs / UK IDTA); a copy of the relevant safeguards is available on request. Our support sub-processor Plain (Not Just Tickets Ltd) is based in the United Kingdom; transfers of EU/UK personal data to Plain are covered by the UK’s adequacy status — the European Commission renewed its EU–UK adequacy decision on 19 December 2025, in force until 27 December 2031 — with SCCs / the UK IDTA applying as a fallback under our data processing agreement.
We do not make decisions producing legal or similarly significant effects about you based solely on automated processing.
The service is not directed to children. We do not knowingly collect data from children under 16 in the EU (or the lower age set by your country, down to 13) or under 13 in the US.
We apply reasonable technical and organisational safeguards. Payment data is handled by Stripe (PCI-compliant).
We may update this Policy; material changes will be posted with a new “last updated” date. Questions or requests: hello@thrillgifts.com · (854) 226-1600.
.png){kind=icon}
