Privacy Policy

Unveil is operated by [TODO: Legal entity name], a company registered in England and Wales (registration number TBC), whose registered office is at [TODO: Registered address].

We are the data controller for personal data collected through this website and the gift experiences it powers. If you have any questions about this policy or want to exercise your data rights, contact us at [TODO: privacy@unveilonline.com — confirm once email is set up].

We collect different data depending on whether you are a gift creator or a recipient.

Gift creators

• Email address — collected when you sign in via magic link, used to identify your account.
• Gift content — images, videos, and text you upload or enter when building a gift experience. This content is stored on our servers.
• Payment information — processed by Stripe. We do not store card numbers or full payment details ourselves.

Gift recipients

• IP address — collected automatically by our hosting infrastructure when you open a gift link.
• Email address — only if the creator chose to provide it so we can send the gift link on their behalf.
• Reaction video — if you grant camera access during the scratch-reveal experience, a short video of your reaction is captured in your browser. It is held temporarily in browser memory only and is never uploaded to our servers unless you explicitly choose to share it.

All visitors

• Usage data and logs — standard server logs including IP address, browser type, and pages visited, retained for security and operational purposes.
• Cookies — see section 7 below.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

• Creator accounts and gift records — retained while your account is active and for [TODO: e.g. 12 months] after account closure or the gift's unlock date, whichever is later, to allow for support queries and legal compliance.
• Payment records — retained for 7 years to meet HMRC requirements.
• Server logs — retained for up to 90 days.
• Recipient reaction video — exists only in the recipient's browser memory during their session. We have no copy of it.

We do not sell personal data. We share it only with the following sub-processors, each subject to appropriate data processing agreements:

Where data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place (e.g. Standard Contractual Clauses or the UK International Data Transfer Agreement).

Under UK GDPR and the Data Protection Act 2018, you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data where there is no legitimate reason for us to keep it.
• Restriction — ask us to pause processing while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.

To exercise any right, email [TODO: privacy@unveilonline.com]. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We only use browser storage that is strictly necessary to operate the service. We do not use advertising or tracking cookies. The table below lists everything we store in your browser.

Cookies

No analytics, marketing, or third-party advertising cookies are set. If we add optional analytics in the future, we will ask for your consent before loading any analytics scripts.

Local storage

Local storage is not transmitted to our servers and is stored only in your own browser. You can clear it at any time via your browser's developer tools or privacy settings.

Manage your preferences

You can review or withdraw your cookie consent at any time. Withdrawing consent will not affect the lawfulness of any processing already carried out.

Unveil is not directed at children under the age of 13. We do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal data, please contact us so we can delete it.

We may update this policy from time to time. When we do, we will update the “Last updated” date at the top of the page. For material changes, we will notify creators by email.

For any privacy-related queries or to exercise your rights:

[TODO: Legal entity name]
[TODO: Registered address]
Email: [TODO: privacy@unveilonline.com]