Privacy policy

Hadiyah Card is a trading name of Burhan Ali Ltd, a company registered in England and Wales. In this notice, "we" and "us" mean Hadiyah Card. We are the data controller for the personal information described here.

For any privacy question, or to exercise the rights below, email hello@hadiyahcard.com.

When you buy or send a card: your name, email, billing address, the recipient's name and email (or delivery address if physical), the amount, any personal message, and payment metadata returned by our payment provider. We never see or store your full card number - that stays with Stripe.

When a recipient checks a balance or spends a card: the card code, the transaction, and the merchant. We do not require the recipient to create an account.

When you apply as a partner or join the waitlist: the details you type into that form.

Automatically when you use the site: standard technical data (IP address, browser, pages visited, timestamps) and any cookies you allow - see our Cookie notice.

To fulfil your order and deliver the card to the recipient (contract).

To let recipients check balances and spend at partners (contract).

To send transactional emails - order confirmations, receipts, expiry reminders - and to answer support questions (contract, legitimate interest).

To detect and prevent fraud, chargebacks, and abuse of gift-card codes (legitimate interest, legal obligation).

To keep accounting, tax, and consumer-law records for as long as the law requires (legal obligation).

For product analytics on aggregate patterns (legitimate interest) - we do not sell personal data and do not use it for advertising.

For marketing, only if you opt in - you can unsubscribe from any marketing email at any time.

Payment processing: Stripe (payments, fraud checks). Card data goes directly to Stripe - we only see the last four digits and payment metadata.

Email delivery: our transactional email provider, used to send order confirmations, receipts, and expiry reminders.

Hosting and infrastructure: our cloud hosting provider (currently Cloudflare and Supabase), used to run the website and store the ledger.

Fulfilment: for physical cards, the printer and postal carrier we use to send the card.

Partners: the redeeming merchant sees the card code, the amount, and the time - nothing about the buyer or recipient's identity.

Law and safety: authorities where legally required, or to protect our rights, our users, or the public.

We do not sell your personal data. We do not share it for third-party advertising.

Order and ledger records: for at least six years after the transaction, in line with UK accounting and tax law.

Card records: for the life of the card plus six years, so we can resolve disputes about expired balances.

Marketing preferences and waitlist entries: until you unsubscribe or ask to be removed.

Support emails and enquiries: for up to three years after the last contact.

Some of our providers process data outside the UK. When that happens we rely on the UK's approved safeguards - usually adequacy decisions or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

You have the right to access the personal data we hold about you, to correct it, to have it deleted where we no longer need it, to restrict or object to processing, and to receive a copy in a portable format. You can also complain to the UK Information Commissioner (ico.org.uk).

To exercise any of these, email hello@hadiyahcard.com. We may need to verify your identity before we act on a request.

We may update this notice as the service evolves. The current version always lives on this page, with the last-updated date below.