Privacy Policy

Operator

Legal name

Mikita Antonau

Trading name

congrat.io

NIP (tax ID)

5273066696

REGON

525901142

Registered address

ul. Stanisława Worcella 3B lok. 19, 01-250 Warszawa, Poland

Country

Poland

Contact email

support@congrat.io

Registry

Sole proprietorship (jednoosobowa działalność gospodarcza)

1. Who is responsible for your data

The controller of your personal data is the operator of congrat.io identified in the Operator section above, a sole proprietor registered in Poland. For payment data, our reseller acts as an independent controller (see section 5).

2. What data we process

• Account data: email address, a unique account identifier and, if you sign in with Google, the basic profile information Google shares with us. We do not store a plain-text password: password sign-in is handled by our authentication provider.
• Content you create: wishlists, wishes (titles, notes, links, prices, occasion dates, cover choices) and images you upload.
• Reservations and activity: which wishes you reserved or marked as given, with timestamps, and your reminder choices.
• Secret Santa data: events you organise or join, display names you choose, participant lists, preferences and wishes shared inside an event, and the assignment of who gives to whom (visible only to the people it concerns).
• Settings and notifications: language, time zone, notification and reminder preferences, whether you opted in to product-update notifications (and when), and in-app notifications.
• Purchase data (once paid plans are available): plan, status, amounts, dates and identifiers from our reseller. We do not receive your full card number.
• Technical data: IP address, device and browser information and request logs generated by our hosting and infrastructure providers for security, abuse prevention and reliability.
• Messages you send us when you contact us, including through the in-app help form (the page you were on, your language and the app version are attached to help us reproduce problems).

Product links you add to a wish are stored as you entered them. We do not fetch or analyse the linked store pages to build your wishlist.

Public wishlists and their contents can be viewed by anyone who has the link, including people without an account.

3. Why we process data and on what legal basis

• To provide the Service — create your account, store and show your wishlists, handle reservations and Secret Santa events, send requested reminders and service emails: performance of a contract (Art. 6(1)(b) GDPR).
• To keep the Service secure and reliable, prevent abuse and fraud, apply usage limits and fix problems: our legitimate interests (Art. 6(1)(f) GDPR). If we introduce aggregated, privacy-respecting analytics, it will also rest on legitimate interests or consent where the law requires consent.
• To send optional product-update notifications: your consent (Art. 6(1)(a) GDPR), which is off by default and which you can withdraw at any time in your notification settings.
• To measure which Google ads bring people to congrat.io (advertising measurement via Google Ads), only if you accept it in the cookie banner: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via “Cookie settings” in the footer.
• To process purchases and comply with tax and accounting obligations (once paid plans are available): performance of a contract and legal obligations (Art. 6(1)(b) and (c) GDPR).
• To respond to your messages and to establish, exercise or defend legal claims: legitimate interests and, where applicable, contract (Art. 6(1)(f) and (b) GDPR).

We do not sell personal data and we do not use it for automated decisions with legal or similarly significant effects.

4. Who we share data with

We use the following service providers (processors) that process personal data on our behalf:

• Supabase — authentication (email magic link, Google sign-in, password), the PostgreSQL database and file storage for images.
• Vercel — hosting of the website (frontend).
• Render — hosting of the application server (backend/API).
• Our email delivery provider — sends reminder and service emails to your account email address.
• Telegram — delivers an instant notification of your in-app support message (with your account email) to the operator.
• Google Ireland Limited (Google Ads) — receives data from Google’s tag on our marketing pages to measure ad conversions. Google processes this data under its own terms, as described in How Google uses information from sites or apps that use its services.
• Google — only if you choose “Continue with Google”; Google is then an independent controller of its own sign-in service and shares basic profile data with us.

Where Secret Santa or a public wishlist is shared, other participants or visitors see the information you choose to show them (for example your display name and your wishes). We may also disclose data where required by law or to protect rights and security.

5. Payments and our reseller

The payment provider named at checkout and on your receipt sells our paid plans as our reseller and Merchant of Record. It collects and processes your payment and billing details (including card or other payment method data, name, billing address, tax details and IP address) for its own purposes, such as processing the payment, fraud prevention, tax and legal compliance, as an independent controller. We never receive your full card details. The reseller's privacy notice is linked at checkout.

We receive limited information from the reseller, such as transaction and subscription identifiers, plan, status, amount, currency and dates, so that we can activate paid features and keep records.

6. International transfers

Some of our providers are established in or may access data from outside the European Economic Area, including the United States. Where personal data is transferred outside the EEA, such transfers must be covered by a transfer mechanism recognised by the GDPR, such as an adequacy decision (for example, the EU-US Data Privacy Framework for certified providers) or the European Commission's Standard Contractual Clauses. You can contact us for more information about these safeguards.

Google may transfer data collected through its tag to the United States and other countries, relying on the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

7. How long we keep data

• Account and content data: for as long as your account exists. When you delete your account or content, we delete or anonymise it within a reasonable period, except for data we must keep.
• Billing and transaction records: for the period required by tax and accounting law.
• Technical logs: for a limited period needed for security and operations, then deleted or aggregated.
• Google Ads cookies: typically up to 90 days, and they exist only if you accepted them. Your cookie choice stored on your device: 12 months, after which we ask again.
• Backups: kept for a limited period and overwritten in the normal backup cycle.
• Messages you send us: for as long as needed to handle your request and any follow-up, and to improve the service.

8. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to processing (including processing based on legitimate interests), to receive your data in a portable format, and to withdraw consent at any time without affecting earlier processing. To exercise your rights, contact us at support@congrat.io. We may need to verify your identity first. You can edit or delete much of your data directly in the Service.

9. Complaints

You have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl). You may also complain to the authority in the EU/EEA country where you live or work.

10. Cookies and local storage

Strictly necessary cookies and similar technologies do not require consent:

• Authentication session cookies set by our authentication provider (Supabase) to keep you signed in.
• A language cookie (wishlist-locale) that remembers your language for up to one year.
• Browser local storage for interface preferences: colour theme, the wishlist view you chose and whether you dismissed the getting-started checklist for a wishlist. These stay on your device.
• A local-storage record (congrat-consent-v1) of your cookie choice, so we remember it for 12 months and do not ask again on every visit.

Advertising cookies (Google Ads). Only if you click “Accept” in the cookie banner, Google’s tag may set advertising cookies such as _gcl_au and _gcl_aw, which help us measure which Google ads lead people to congrat.io. The tag is loaded only on our public marketing pages (home, Secret Santa and Secret Santa for work, occasion and guide pages, pricing, about) and on the Secret Santa organiser page; it is not loaded on invitations, shared wishlists, sign-in or other account pages. If you go from one of those pages to another page of the Service, the page is reloaded without the tag. These cookies are off by default for every visitor in every country, and the banner offers “Accept” and “Reject” with equal prominence.

While you have not given consent, Google’s tag may still send cookieless measurement signals to Google without advertising identifiers (Google Consent Mode). As with any resource loaded from a third party, your browser also sends technical data such as your IP address to Google when the tag loads.

You can change or withdraw your choice at any time, as easily as you gave it, via “Cookie settings” in the footer of our pages. Rejecting or withdrawing stops further use of Google Ads cookies and we remove the ones we can delete.

An analytics integration (Vercel Analytics) is present in the code but its collection is switched off; if we enable it in the future we will update this policy and ask for consent where the law requires it.

11. Children

The Service is not directed at children under 16, and you must be at least 16 to create an account. If you believe a child has provided personal data to us, please contact us and we will delete it.

12. Security

We use technical and organisational measures appropriate to the risk, such as encrypted connections, access controls and per-user authorisation checks on the server. No system is completely secure, so please choose a strong sign-in method and keep it private.

13. Changes to this policy

We may update this policy from time to time. The date at the top shows the latest version, and we will announce material changes on this page and, where appropriate, by email or in the Service.

14. Contact

For privacy questions or to exercise your rights, contact us at support@congrat.io.

15. Languages

This policy is provided in English, Russian and Belarusian. In case of any discrepancy between the language versions, the English version prevails.