Last updated: October 22, 2026. Thrill Gifts, 215 East Bay St, Charleston, SC 29401 · hello@thrillgifts.com · (854) 226-1600.
Buyer details (name, email, billing); recipient details (name, email, phone, mailing address); personal messages, photos, and video — including a video greeting recorded by a buyer and a reaction video recorded by a gift recipient; payment information (processed by Stripe — we receive a token, not your full card number); and usage/device data, including cookie identifiers, IP address, browser/device type, and pages viewed (see §5).
A message, photo, or video may show or identify people other than you. By uploading it you confirm you have their permission — see §13.2 of our Terms of Service, which sets out what you are agreeing to when you upload content.
When you buy a gift, you provide us with the recipient’s details. This means we obtain the recipient’s personal data from you, a third party, rather than from the recipient directly. We inform recipients of this Policy and their rights at the point we first contact them — for example, in the gift-delivery email, which links here. Recipients are data subjects in their own right and may exercise the rights in Section 7.
We use your data to process orders, deliver and personalise gifts, enable redemption and booking, provide support, prevent fraud, and (with consent) send service messages and measure site usage.
Content you upload — a message, photo, or video — is used to deliver it to the person it was meant for and to display it on that gift’s own page. We do not use it in advertising or marketing unless you have separately and affirmatively opted in for that specific content. That opt-in is never bundled with accepting these terms or with completing a purchase, is never the default, and can be withdrawn at any time (§7).
Where the GDPR/UK GDPR applies, our legal bases are: performance of a contract (processing and delivering your order, including delivering the content you uploaded to its recipient); legal obligation (tax and financial records); consent (SMS delivery and experience/story texts, analytics/marketing cookies, and any marketing or promotional use of content you have uploaded); and legitimate interests (fraud prevention, securing and improving the service, and using AI assistance to answer support requests faster).
We share only what’s needed with service providers (sub-processors): experience providers (to fulfil a booking); Stripe (payments); Diamond Fulfillment Solutions (printing and shipping physical gift boxes — the recipient's name and mailing address, the gift code and redemption link, and the personal message and sender name); Twilio (SMS); Plain (support); OpenAI (AI-assisted support, engaged by Plain — see below); and, for site analytics and marketing measurement, Google Analytics, Microsoft Clarity, and WickedReports (see §5). We do not “sell” personal information for monetary consideration. However, “sale” and “sharing” under California law are broader than an exchange for money, and our use of certain analytics and advertising cookies (for example, WickedReports) may constitute a “sale” or “sharing” of personal information under that definition. You can opt out (see §7).
AI-assisted support. Our help centre and support inbox use an AI assistant provided within Plain, which processes the content of your support message through OpenAI in order to find the relevant help-centre article and draft a reply. Only the support conversation and our published help-centre content are processed this way — not your payment details, and not your order history unless you include it in your message. Your support messages are not used to train OpenAI’s models. You can ask for a human at any time, and a member of our team can take over any conversation.
We send texts only with consent: a transactional gift-delivery text when the buyer chooses text delivery, and — only if you separately opt in — experience and story texts (reminders, follow-ups, story invitations, sweepstakes, and anniversaries). Message frequency varies — typically up to 4 texts around each experience and up to 2 per year after. Message and data rates may apply. Reply STOP to opt out, START to opt back in, or HELP for help. US mobile numbers only. We do not share or sell mobile numbers or SMS opt-in consent with third parties or affiliates for their marketing or promotional purposes; we share them only with Twilio, which delivers our texts. See §8.3 of our Terms of Service for full terms.
We use cookies and similar technologies in three categories:
Non-essential (Analytics and Marketing) cookies load only after you accept them in our cookie consent banner; you can change your choice at any time. We honour Global Privacy Control (GPC) browser signals as an opt-out.
We keep personal data only as long as needed for the purposes above or as the law requires. Indicative periods: order/transaction records ~7 years (tax); recipient details until the gift is redeemed or expires + ~24 months; for Direct Channel Experience Gifts, which do not expire, recipient personal data is deleted or anonymised no later than 5 years after issuance — this does not affect the ongoing validity of the gift itself; personal messages, photos, video greetings and reaction videos ~12 months after redemption; support records ~24 months; SMS consent records ~5 years; analytics data up to ~14 months. Payment data is held by Stripe (PCI-compliant). Our internal retention schedule sets the detail; data is then deleted or anonymised.
Content under a marketing permission. Where you have opted in to marketing use of a specific message, photo, or video, we keep that content for as long as the permission stands rather than deleting it at the 12-month point, because it is in active use. If you withdraw the permission, or ask us to delete the content, we stop using it in marketing straight away and delete or anonymise it within 30 days. Records of the permission itself (who gave it, for what, when, and under which version of this Policy) are kept for ~5 years, as with SMS consent, so we can show what was agreed.
EU/UK (GDPR/UK GDPR): you may request access, rectification, erasure, restriction, portability, and object to processing, and withdraw consent at any time; you may also lodge a complaint with your local supervisory authority.
California (CCPA/CPRA): you may request to know, delete, and correct your information, and opt out of the “sale” or “sharing” of personal information via the “Do Not Sell or Share My Personal Information” link / our cookie banner; we honour GPC signals.
Withdrawing a marketing permission for your content. If you have allowed us to use a message, photo, or video in our marketing, you can withdraw that permission at any time — by emailing hello@thrillgifts.com, or through the setting shown on that gift’s own page. Withdrawal takes effect for all future use and for anything still in circulation that we control. It does not undo use that has already happened, and we cannot recall material already printed, mailed, or published by a third party — for example a printed card, or a post already shared onward by someone else. Withdrawing a marketing permission never affects the gift itself, and never removes the content from the private gift page it was made for.
These rights are available to buyers and to gift recipients alike. To exercise any right, email hello@thrillgifts.com. We verify your identity and respond within about one month (GDPR) or 45 days (CCPA/CPRA), extendable where permitted.
We are US-based and process data in the US, with support data also processed by our sub-processor Plain in the United Kingdom. If you provide data to us directly from outside the US, that direct collection is generally not an international “transfer” requiring additional safeguards.
GDPR / UK GDPR applicability. Because we accept purchases from buyers located in the EU and UK as an ordinary part of our business, GDPR and UK GDPR apply to those buyers’ personal data, even though the Experience itself is delivered in the US.
Where we share data with our US-based service providers (Stripe, Diamond Fulfillment Solutions, Twilio, Google, Microsoft, WickedReports, OpenAI), those transfers are covered by the providers’ EU-US Data Privacy Framework certification and/or Standard Contractual Clauses (SCCs / UK IDTA); a copy of the relevant safeguards is available on request. Our support sub-processor Plain (Not Just Tickets Ltd) is based in the United Kingdom; transfers of EU/UK personal data to Plain are covered by the UK’s adequacy status — the European Commission renewed its EU–UK adequacy decision on 19 December 2025, in force until 27 December 2031 — with SCCs / the UK IDTA applying as a fallback under our data processing agreement. OpenAI is engaged by Plain as its own sub-processor for the AI-assisted support described in §3, and processes that data in the United States under the safeguards named above.
We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. The AI assistant described in §3 answers support questions and drafts replies; it does not decide entitlements, refunds, cancellations or eligibility. Those remain human decisions, and you can ask for a person at any point.
The service is not directed to children. We do not knowingly collect data from children under 16 in the EU (or the lower age set by your country, down to 13) or under 13 in the US.
We never use content showing a child in marketing. A message, photo, or video that shows or identifies anyone under 18 is not eligible for the marketing permission described in §2, whatever anyone has ticked. Do not upload content of a child unless you are that child’s parent or legal guardian.
We apply reasonable technical and organisational safeguards. Payment data is handled by Stripe (PCI-compliant).
We may update this Policy; material changes will be posted with a new “last updated” date. Questions or requests: hello@thrillgifts.com · (854) 226-1600.
.png){kind=icon}
