Privacy Policy

This Privacy Policy explains how we collect, use, share, and protect personal data when you visit BdaySurprise, create an account, purchase PartyCoins, build and publish a birthday surprise, or contact support.

If you are in the EEA/UK, this notice complies with the GDPR/UK GDPR.

• person
  Identity & contact data: Email address and display name (derived from your email at registration).
• manage_accounts
  Account & order data: Encrypted password, PartyCoins balance, purchase history, published surprises, and draft content (recipient name, messages, theme, GIF selection, gift options).
• payments
  Payment data: Payment method details are processed by Stripe. We do not store full credit card numbers.
• devices
  Device & usage data: Operational logs contain timestamps and route patterns without IP address, user-agent, query data, or user content. With analytics consent, providers may process page and device usage; our first-party demo flow stores only an opaque ID and demo/preview timestamps.
• language
  Language & coarse country data: A language you choose is stored only in your browser. When no choice exists, country and browser language may select a temporary page language. For accounts, we retain the first country observed at registration or first successful login; for new orders, we retain the country used to select the price. These are two-letter country codes, not precise location or billing country. We do not retain last/current country or timezone.
• cookie
  Cookies & similar tech: Session cookies (essential) and analytics cookies (only with your consent). See section 6 below.
• block
  No special categories: We do not intentionally collect sensitive data such as health data, sexual orientation, or religious beliefs.

We process personal data only where a legal basis applies:

We do not sell or trade your personal data. We share it only with trusted third parties as needed:

We may also share data with authorities if required by law to protect rights, property, or safety.

We use essential cookies to maintain your login session and analytics storage (only with your consent) to understand how visitors use the platform. Consented demo analytics use a random flow ID that may be linked to a newly created account; no draft content, email, IP address, or user-agent is stored in that flow record. You can change your preferences at any time:

If we transfer EEA/UK personal data to providers outside the EEA/UK (e.g., Stripe or Google), we rely on legal safeguards such as adequacy decisions or Standard Contractual Clauses (SCCs) to ensure your data remains protected.

We store data only as long as necessary:

Upon verified request, we will delete your personal data without undue delay, subject to legal retention requirements.

Under GDPR, you have the right to:

• visibility Access — obtain a copy of the personal data we hold about you.
• edit Rectification — correct inaccurate or incomplete data.
• delete Erasure — request deletion of your personal data ("right to be forgotten").
• pause_circle Restriction — ask us to pause processing of your data in certain circumstances.
• download Portability — receive your data in a structured, machine-readable format.
• do_not_disturb Objection — object to processing based on legitimate interests.

We do not perform automated decision-making or profiling as defined in GDPR Article 22. To exercise any of your rights, contact us at [email protected]. We will respond within one month of receiving your request.

You also have the right to lodge a complaint with the Czech supervisory authority: Úřad pro ochranu osobních údajů (UOOU), Pplk. Sochora 27, 170 00 Prague 7.