Privacy Policy

Information we collect

• Profile and account information, such as name, email, phone, company, title, website, social links, profile photos, logos, and other content you ask us to publish on a Gibbor Connect profile.
• Order and fulfillment information, such as Shopify order IDs, line item IDs, product selections, cardholder name, title, company, gift status, gift message, setup recipient email, customization notes, shipping details, production status, and support messages.
• Card and device information, such as hardware IDs, public profile URLs, QR codes, and NFC programming status.
• Usage and scan information, such as NFC taps, QR scans, the page that referred a scan, browser type, user agent, timestamps, and a hashed IP address.
• Store and checkout information processed through Shopify when you place an order, such as payment, billing, and shipping details.
• Storefront, Shop Channel, and analytics information, such as product views, cart activity, checkout starts, referral URLs, UTM parameters, click identifiers, marketing preferences, Shop app activity, payment-method interactions, and consent choices when analytics or personalization is allowed.
• Artwork and file information, such as uploaded card designs, logos, image files, PDFs, file names, Shopify File IDs, and file URLs when you use a custom design product.

How we use information

• To create, host, update, and display digital profiles connected to NFC cards and QR codes.
• To fulfill orders, program cards, generate QR codes, manage production, ship products, and provide support.
• To send transactional emails about your account and orders, such as account setup links and order status updates.
• To generate vCards that visitors can choose to save to their own device.
• To measure basic engagement, such as how often a card or profile is scanned.
• To support Shopify-powered store features, including checkout, Shop Channel, Shop app experiences, payment-method presentation, fraud prevention, customer privacy controls, and campaign or personalization features when enabled.
• To prevent abuse, protect the service, troubleshoot errors, comply with legal obligations, and improve Gibbor Connect.

Legal bases for processing

• Where applicable data protection laws require a legal basis, we rely on the following. We process account, order, profile, and card data to perform our contract with you and deliver the product you bought.
• We rely on your consent for optional analytics, which you can give or withdraw at any time through the cookie banner.
• We rely on our legitimate interests to secure accounts, prevent abuse and fraud, troubleshoot, and improve Gibbor Connect, balanced against your rights.
• We process some data to comply with legal obligations, such as record-keeping and responding to lawful requests.

Public profile content

• Digital profile information is meant to be shared. If a profile is public, anyone with the link, QR code, or NFC card may be able to view the profile.
• If card-only access is enabled, the profile is still accessible through the card-specific NFC or QR URL. Do not add private information to a public profile unless you are comfortable sharing it.
• The profile owner controls what contact fields are shown publicly and what fields are included in the vCard when supported by the product.

How we share information

• We may share information with service providers that help us operate the product, including hosting, database, image storage (Cloudinary), email delivery (Resend), product analytics (PostHog), printing, shipping, and ecommerce providers.
• Shopify processes store, checkout, payment, shipping, fraud-prevention, customer privacy, Shop Channel, Shop app, payment-optimization, personalization, advertising, and campaign information when you buy from us or interact with Shopify-powered services. Shopify's processing is also governed by Shopify's own privacy terms and additional services terms.
• Customer artwork and profile images may be stored with Cloudinary or Shopify Files so we can prepare, display, review, or produce the product.
• We may share information if required by law, to protect our rights, to prevent fraud or abuse, or as part of a business transfer.
• We do not sell your personal information for money. We do not use PostHog analytics data for targeted advertising. If Shopify-powered services such as Shop Channel, Shopify Network Intelligence, Shop Campaigns, or similar features are enabled, Shopify may use customer and store data for personalization, advertising, payment optimization, fraud prevention, analytics, and service improvement as described by Shopify.

Cookies

• We use a session cookie to keep you signed in, store your cookie choice in your browser's local storage, and keep server logs to operate the site and protect accounts.
• If you choose to allow analytics, we use PostHog to understand store and site usage and improve Gibbor Connect. Analytics is optional and is not used for advertising.
• Shopify-powered features, including Shop Channel and Shopify Network Intelligence, may use cookies or similar technologies for personalization, advertising, payment optimization, fraud prevention, analytics, and service improvement where allowed by law and your consent choices.
• If you choose essential cookies only or if Shopify Customer Privacy indicates analytics is not allowed, PostHog tracking and analytics storage remain disabled in your browser.
• If your browser sends Global Privacy Control, we treat it as a request to keep optional analytics off where our code can detect it. Shopify storefront consent must also be configured in Shopify.

Your choices

• You may request access, correction, or deletion of personal information we hold about you, subject to legal, security, fraud prevention, and operational limits.
• Profile owners may request updates to profile content, QR destinations, public-link visibility, and vCard fields.
• You can choose essential cookies only or allow analytics from the cookie banner or the Privacy Choices page.
• You may use Shopify's cookie banner or privacy controls, where available, to manage storefront analytics consent.
• You may use Shopify's data sharing opt-out page, where available, to opt out of certain sharing or targeted advertising uses covered by applicable US state privacy laws.
• We send transactional emails related to your account and orders, such as account setup and order status. If we enable email, SMS, Shop, or campaign marketing, we will use the consent and unsubscribe tools required by the channel. To raise a question about the emails we send, contact us.

Your data protection rights

• Depending on where you live, you may have rights under laws such as US state privacy laws, Canada's PIPEDA, and other applicable data protection laws.
• These rights may include access to your data, correction, deletion, restriction or objection to processing, data portability, and the right to withdraw consent at any time without affecting earlier processing.
• If your region provides a supervisory or data protection authority, you also have the right to lodge a complaint with it.
• To exercise any of these rights, contact us at support@gibborconnect.com. We will respond as required by applicable law and may need to verify your identity first.

International data transfers

• Gibbor Connect is operated from the United States, and our service providers may process data in the United States, Canada, and other countries.
• If you access Gibbor Connect from outside your home country, your information may be transferred to and processed in the United States, which may have different data protection laws than where you live.
• Where required by applicable law, we rely on appropriate safeguards for these transfers, such as Standard Contractual Clauses or equivalent mechanisms offered by our providers.

Security and retention

• We use reasonable administrative, technical, and organizational measures to protect personal information.
• No internet service is perfectly secure. Account sessions expire, setup tokens expire after a limited period, and profile data is kept while the account or card remains active.
• If you delete your account, we delete or anonymize profile data, scan events tied to your profiles, setup tokens tied to your email, and personal order fields on device records where operationally possible. We may retain limited order, production, tax, fraud-prevention, chargeback, and legal records when required.
• We avoid collecting sensitive personal information that is not needed for the product.

Children

• Gibbor Connect is not intended for children under 13 (or the minimum age required by your local law), and we do not knowingly collect their personal information.
• If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

Contact

For privacy requests or questions, contact Gibbor Technologies at support@gibborconnect.com. You can also manage optional analytics on the Privacy Choices page.