Privacy Policy

Back to Privacy Policy

US State Privacy Rights Addendum

This addendum supplements the eGifter Global Privacy Policy and applies to residents of US states that have enacted comprehensive consumer privacy laws. It provides information about your state-specific rights and how to exercise them.

This addendum should be read together with the eGifter Global Privacy Policy, which describes our general data practices, categories of personal information, and sources of data.

Last Updated: July 9, 2026

1. States Covered by This Addendum

This addendum applies to residents of the following states, including as applicable: California, Virginia, Colorado, Connecticut, Texas, Delaware, Iowa, Montana, Oregon, Tennessee, Minnesota, Maryland, Nebraska, New Hampshire, New Jersey, Kentucky, Indiana, Rhode Island, and Utah. As additional states enact comprehensive privacy laws, this addendum will be updated accordingly.

2. Your Rights

Depending on your state, you may have some or all of the following rights:

  • Right to Know / Access: request confirmation that we process your personal data and obtain a copy of the personal data we hold about you
  • Right to Correct: request correction of inaccurate personal data
  • Right to Delete: request deletion of personal data we have collected from you, subject to certain exceptions
  • Right to Data Portability: receive a copy of your personal data in a portable, readily usable format
  • Right to Opt Out of Sale or Sharing: opt out of the sale of your personal data or its sharing for targeted advertising purposes
  • Right to Opt Out of Profiling: opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, where applicable under state law
  • Right to Limit Sensitive Data Use: limit the use and disclosure of sensitive personal information (California)
  • Right to Appeal: if we decline to act on your request, appeal that decision (where provided by state law, including Virginia, Colorado, Connecticut, Texas, and others as applicable)
  • Right to Non-Discrimination: we will not discriminate against you for exercising any privacy rights

3. California Residents (CCPA / CPRA)

California residents have the most comprehensive rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). In addition to the rights listed above, California residents have the following:

Categories of Personal Information Collected

In the preceding 12 months, eGifter has collected the following categories of personal information:

  • Identifiers: name, email address, postal address, phone number, IP address
  • Commercial information: gift cards purchased, order history, products or services considered
  • Internet or network activity: browsing history on our platform, interactions with our Services
  • Geolocation data: general location derived from IP address
  • Financial information: payment card information and transaction details processed to fulfill gift card purchases (handled by our payment processors)

In the preceding 12 months, we have disclosed the categories of personal information listed above for the business purposes described in the eGifter Global Privacy Policy.

Business Purposes for Collection

We collect personal information for the following business purposes: fulfilling gift card orders, processing payments, fraud prevention, customer support, marketing (where consented), platform improvement, and legal compliance.

Sale and Sharing of Personal Information

eGifter does not sell personal information as defined under applicable law. However, certain disclosures to advertising and analytics partners may constitute "sharing" of personal information for targeted advertising purposes under the CPRA. California residents have the right to opt out of such sharing through legally recognized opt-out signals, including the Global Privacy Control (GPC), as described in the eGifter Global Privacy Policy. We treat Global Privacy Control (GPC) signals as a valid request to opt out of the sale or sharing of personal information where required by applicable law.

Sensitive Personal Information

eGifter does not knowingly collect sensitive personal information (as defined under the CPRA) in the ordinary course of providing our Services. To the extent we receive sensitive personal information incidentally (for example, government identifiers submitted for fraud verification), we do not use or disclose it for purposes other than those permitted by CPRA §1798.121 and its implementing regulations, and we do not use it to infer characteristics about you. Because we do not use sensitive personal information beyond these permitted purposes, the right to limit use and disclosure of sensitive personal information does not apply to our processing.

Automated Decision-Making

We use automated processes to help detect, prevent, and investigate fraud and other unlawful or unauthorized activities, and to protect the security and integrity of our Services. These automated processes are designed to support necessary business and legal functions.

Where required by applicable law, we will provide individuals with information about certain automated decision-making technologies used to make significant decisions and applicable rights related to such processing.

Retention

We retain each category of personal information for as long as reasonably necessary for the business purpose for which it was collected, and no longer than permitted by applicable law.

4. How to Exercise Your Rights

To submit a privacy request, you may:

  • Email us at privacy@egifter.com
  • Contact us via the support link on the Platform Service

Because we operate exclusively online and have a direct relationship with the consumers from whom we collect personal information, we provide an email address for submitting requests in lieu of a toll-free telephone number, as permitted by CCPA §1798.130(a)(1)(A).

We will respond to verified requests within the timeframes required by applicable state law. If we require additional time, we will notify you. We may need to verify your identity before processing your request. You may designate an authorized agent to submit a request on your behalf.

5. Global Privacy Control

Our handling of Global Privacy Control (GPC) signals is described in the eGifter Global Privacy Policy.

6. Contact

For US state privacy requests: privacy@egifter.com