Privacy Policy
Last updated: October 13, 2026
The short version
- We store what you put in your gift so we can show it to the person you send it to.
- Stripe handles payment. We never see your card number.
- No ads, no analytics, no tracking cookies. We don't sell your data, and we never will.
- Email [email protected] any time to see or delete your data.
1. Who is responsible
LoveIOU is run by X Ma, an individual based in Italy, who is the data controller for the information described here. Contact: [email protected].
2. What we collect
Your gift
The recipient's name or nickname, your name, the occasion, your message, your coupons, the theme and expiry date you choose, and an optional cover photo. We need these to build and show your gift. Please only add a photo that you have the right to share.
The recipient's progress
When the recipient draws and redeems coupons, we save which coupons they drew and when each was redeemed. That way their gift stays the same in their browser and on their home screen. The same information is also kept in their browser's local storage.
Payment
Stripe and its Link service process your payment and collect your card details, name and billing address, which they need to charge you and calculate tax. Stripe sends us only the email address you entered at checkout, a checkout reference and whether the payment succeeded. Right after you pay, we use it to email you your gift link and a private link for editing your gift. We also use it to help you if you lose your link or ask for a refund. We don't send marketing emails.
Technical data
Our hosting provider, Cloudflare, processes your IP address and basic request information to deliver the site and protect it from abuse. We don't use this to track or profile you.
To stop automated abuse, each unpaid draft stores a scrambled code made from your IP address with a secret key. We use it only to limit how many drafts one connection can start per day. It's erased when you pay, or deleted along with the draft.
Stored in your browser
- While you build a gift, your draft and a secret edit code are kept in that browser tab (session storage), so you can return from checkout and keep editing. They're cleared when the tab closes. On our server, we only keep a scrambled (hashed) version of the edit code.
- A short list of the gifts you've made (link code and recipient name) is kept on your device (local storage), so you can find them again.
- The recipient's browser keeps their coupon progress in local storage.
All of these are needed for the site to work. They're never used for tracking, so we don't show a cookie banner.
3. Why we use it (legal bases)
- To provide the gift you bought: storing and showing your gift, saving the recipient's progress, handling your payment, emailing you your links. This is necessary to perform our contract with you.
- To give support and keep LoveIOU safe: finding a lost link, handling refunds, preventing abuse and fraud. This is our legitimate interest in running a reliable service.
- To meet legal obligations: keeping payment records as tax and accounting law requires.
4. Who we share it with
We use a small number of service providers. They only process data to provide their service to us:
| Provider | What for | Data |
|---|---|---|
| Cloudflare, Inc. | Website hosting and database | Gift content, recipient progress, checkout email, IP addresses |
| Stripe (including Link) | Payment processing and reseller of your purchase (merchant of record), tax and fraud prevention | Payment and billing details you give at checkout. See Stripe's privacy policy. |
| Resend (Plus Five Five, Inc.) | Sending the email with your gift link after you pay | Your checkout email, the recipient's name, and your gift and edit links. Opens and clicks are not tracked. |
| Google (Google Fonts) | Loading the typeface on our main page | Your IP address and browser information when the page loads |
Some of these providers are based in the United States. Where data leaves the EU, it's protected by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
Anyone who has a gift link can see that gift's content. That's how gifts work, so share your link with care.
We don't sell or rent personal information, and we don't share it for advertising.
5. How long we keep it
- Unpaid drafts are deleted automatically 3 days after they were last edited.
- Paid gifts and their progress are kept so the link keeps working for as long as the gift is in use. You (or the recipient) can ask us to delete a gift at any time.
- Payment records are kept for as long as tax law requires (in Italy, generally 10 years). Stripe keeps its own records under its own policy.
6. Your rights
Wherever you live, you can ask us to show you, correct, or delete your data. If you're in the EU or UK, you also have the rights to restrict or object to processing and to receive your data in a portable format. Email [email protected]. We'll reply within 30 days, and usually much sooner.
If you're in the EU, you can also complain to a data protection authority. In Italy, that's the Garante per la protezione dei dati personali.
California and other US residents: we don't sell personal information or share it for cross-context behavioral advertising, and we don't use it to profile you. You can request access or deletion at the email above. We won't treat you differently for doing so.
7. If you received a gift
Someone who loves you entered your name (or nickname) to make your gift. If you'd like your gift or your redemption history deleted, email us with the gift link and we'll take care of it.
8. Security
Everything is sent over HTTPS. Gift links use long random codes that can't realistically be guessed, and edit codes are stored only in hashed form. No system is perfectly secure, but we keep what we collect to a minimum.
9. Children
LoveIOU isn't aimed at children under 16, and we don't knowingly collect their data. If you think a child has given us personal information, email us and we'll delete it.
10. Changes
If we change this policy, we'll update the date at the top. If a change significantly affects how we use your data, we'll explain it on this page before it takes effect.