Privacy Policy
Last updated: September 2026
The data controller is the owner of this service (see the Legal Notice). You can contact us about any privacy matter at: legal@surprenda.com
Gift data
Sender and recipient name, sender article (the), personalized messages, color selection, typography and music. You enter this data voluntarily to create the gift.
Email address
The email address you enter in the Stripe payment form. We use it exclusively to send you the purchase confirmation with your links.
Technical data
Internal gift identifiers (random tokens), payment status and the date on which the recipient opened the gift.
Local storage and cookies
We use local storage (localStorage) to temporarily save gift drafts while you create them. We also use technical and security cookies through Stripe to ensure the correct processing of the payment and fraud prevention. These cookies are essential for providing the service and do not require the user's prior consent under article 22.2 of the LSSI. We do not use any own or third-party cookies for tracking or marketing purposes.
Anonymous usage statistics
We measure how the site is used with Umami, anonymously: which pages are visited, which site a visit comes from, the type of device and browser, the country, and steps such as starting to create a gift or completing the payment. It uses no cookies, does not store your IP address, does not identify you or follow you to other sites, and the code in a gift's private links is never recorded. This is audience measurement exempt from consent under article 22.2 of the LSSI and the guidance of the Spanish Data Protection Agency (AEPD), and the data is kept for no longer than 25 months.
Create and personalize the interactive digital gift. (Performance of the contract (art. 6.1.b GDPR))
Process the payment and verify that it has been completed correctly. (Performance of the contract (art. 6.1.b GDPR))
Send the confirmation email with your links. (Performance of the contract (art. 6.1.b GDPR))
Ensure that the gift experience is single-use. (Legitimate interest (art. 6.1.f GDPR))
Measure anonymously how the site is used, in order to improve it. (Legitimate interest (art. 6.1.f GDPR))
Stripe
Payment processing. Stripe collects your email and card details. The service complies with PCI-DSS and the GDPR. Stripe privacy policy.
Supabase
Database where the gifts are stored. Servers in Ireland (EU). Supabase privacy policy.
Brevo
Sending the confirmation email. Brevo privacy policy.
Vercel
Web hosting. Vercel may process log data (IP addresses, HTTP headers) on its servers, which may be located outside the EU. Vercel complies with the GDPR through standard contractual clauses. Vercel privacy policy.
Umami
Anonymous usage statistics, without cookies. It acts as a data processor and does not use the data for its own purposes. Its servers are in the EU and the US; Umami complies with the GDPR through standard contractual clauses. Umami privacy policy.
We do not sell or transfer your data to third parties for commercial purposes.
The gift data (names, messages, colors) is kept while the service remains active to ensure that the experience is accessible. You can request deletion at any time by contacting us.
In accordance with the General Data Protection Regulation (GDPR), you have the right to:
To exercise any of these rights, send an email to legal@surprenda.com indicating the URL of your gift. We will respond within a maximum of 30 days. We remind you that the right of rectification applies to the correction of errors in the data, not to the modification of the content or messages of the gift.
If you consider that the processing is not correct, you can file a complaint with the Spanish Data Protection Agency (AEPD).