Privacy Policy

1. Scope and our role

This policy describes uWarmly's United States service, including its website, applications, personal and professional workspaces, Company workspaces, group pools, Cloud messages, and Human Operations fulfillment. A Company workspace may provide employee information and control how that workspace uses it; in those cases, employees may also need to contact their employer about employer-controlled records.

2. Information we collect

• Account and workspace information: name, email, timezone, authentication and session identifiers, preferences, workspace type, membership, role, plan, and billing status.
• Contacts, relationships, and dates: names, relationship labels, phone numbers or email addresses, birthdays, anniversaries, custom dates, notes, social links, and contact updates you choose to add or import.
• Company and employees data: employee identifiers, work contact details, departments, roles, status, relevant celebration dates, policy choices, approvals, budgets, and audit records supplied by a workspace administrator or integration.
• Recipient and contributor information: recipient profiles, delivery addresses, gift wishes, pool invitations, contributor names or contact details, contribution messages, and anonymous-display choices.
• Consent, message, and delivery information: channel-specific consent or revocation evidence, suppression status, drafts and edits, send mode, scheduled time, provider identifiers, segment counts, delivery state, and feedback.
• Gift, order, and payment information: selected gifts, frozen quotes, pool allocations, order status, delivery instructions, Stripe customer, Checkout, payment, charge, and refund identifiers. Payment-card details are collected by the payment processor rather than stored as full card numbers by uWarmly.
• Manual Operations evidence: sourcing notes, organizer-approved substitutions, receipts, invoices, assembly and quality checks, shipment and tracking records, delivery proof, exception notes, and restricted gift-card fulfillment evidence.
• Device, security, and usage information: device and browser details, IP-derived security information, push tokens, request and audit records, diagnostics, and interactions needed to protect and operate the service.

3. Where information comes from

We receive information from account holders, workspace administrators, employees, recipients, contributors, connected Company systems, devices, and service providers acting on a transaction or delivery. Mobile contact import sends only contacts the user selects for import; device permission and selection remain under the user's control.

4. How we use information

• create accounts and workspaces; remember people, dates, rules, and preferences;
• prepare and deliver approved greetings through Cloud delivery, or support a premium user-operated device send;
• record consent, honor revocation, suppress messages, and investigate delivery exceptions;
• quote, collect, allocate, source, assemble, ship, refund, and reconcile one-time gifts and order-scoped pools;
• administer subscriptions, Company policies, approvals, budgets, integrations, and audit history;
• secure, troubleshoot, support, improve, and comply with legal obligations.

5. AI, Cloud delivery, and Human Operations

When a user requests a draft, gift suggestion, group-card text, or wishlist question, relevant prompt details are sent to the configured AI provider. Users must review generated content. Cloud messaging providers process phone numbers, message content, and delivery metadata to send approved messages. Human Operations staff and authorized contractors may review the minimum order, recipient, consent, and evidence information needed to source, assemble, ship, support, and reconcile fulfillment.

6. Service providers and disclosures

Verified product integrations include Stripe for billing and payments, Twilio for Cloud SMS, Resend for transactional email, Expo services for mobile push delivery, Google or Apple for authentication when chosen, and Anthropic or an OpenAI-compatible provider for configured AI requests. Infrastructure, database, file-storage, retailers, shipping carriers, support, security, and professional advisers may process information as needed for their services. We may also disclose information to comply with law, protect people or the service, or complete a business transaction subject to appropriate safeguards.

7. Sale, analytics, and advertising choices

We do not sell personal information. Optional Google analytics and Google Ads conversion measurement are off unless you make the relevant consent choice. Analytics and Advertising are separate choices: Analytics helps us understand product journeys, while Advertising permits conversion measurement and associated advertising storage and identifiers. You can reject both, choose either one, or change your choices later. Declining or revoking optional measurement does not disable core service functions.

Google measurement also remains disabled when its deployment identifiers are not configured, and Google Ads spend remains off behind a separate launch gate. Enhanced conversions are not enabled, and uWarmly does not send email addresses, phone numbers, or other customer data with these conversion events.

8. Privacy requests and California notice

Where applicable, privacy law may provide rights to know or access, correct, delete, obtain a portable copy, opt out of sale or sharing, limit certain uses of sensitive information, and receive equal service for exercising a right. California law applies only when its coverage requirements are met. Whether or not a particular statute requires it, uWarmly will voluntarily receive access, correction, deletion, and copy requests at privacy@uwarmly.com and respond after reasonable identity and authority verification. Legal, security, fraud-prevention, accounting, dispute, and transaction-record exceptions may require retention or limit a response.

9. Retention and security

We retain information for as long as reasonably needed to provide the service, maintain consent and suppression records, complete and reconcile transactions, meet legal or accounting duties, resolve disputes, and protect the service. Retention varies by record and context. We use administrative, technical, and physical safeguards designed for the nature of the information, but no system can guarantee absolute security.

10. Children and changes

uWarmly is not directed to children under 16, and we do not knowingly create accounts for them. We may update this policy as the service or law changes. The effective date above identifies the current public draft, and material changes will be communicated by a reasonable method.