Gift & Meet

Privacy policy

What we hold, and what we refuse to

Version 1.0 · Last updated 14 September 2026

Two things in this policy are unusual, and they are the two worth reading first: your identity document never reaches us, and your delivery address never reaches us either. Both are deliberate, and both are described below in enough detail to hold us to them.

  1. Who is responsible
  2. What we never collect
  3. What we collect
  4. Why, and on what legal basis
  5. Identity verification
  6. We do not read what you write
  7. Who else sees your data
  8. Where your data goes
  9. How long we keep it
  10. Your rights
  11. Reports
  12. Security
  13. Cookies and this website
  14. Children
  15. Changes and contact

1 · Who is responsible

The controller of your personal data is Gift&Meet LLC, entity ID 20268135579, c/o Northwest Registered Agent LLC, 1500 N Grant St, Ste N, Denver, CO 80203, United States. Write to legal@giftandmeet.com.

We are a United States company and Gift & Meet operates in one city: Dubai. The flowers are delivered by a partner florist there, and the city is a hard filter, so the service is not offered to people located in the European Union. We publish in English and Spanish because both are spoken in Dubai, not to address any European market.

Where the laws of your country give you stronger rights than this policy does, those rights apply. We answer requests from anybody, wherever they are, on the terms in section 10.

PENDIENTE, Y BARATO: limitar la disponibilidad de la ficha a Emiratos en App Store Connect y en Play Console. Por defecto salen en todos los países, y si alguien que está en la UE puede crear cuenta, sí se le está ofreciendo el servicio ahí y el RGPD entra entero.

PENDIENTE PARA LA SEGUNDA CIUDAD: el día que se abra Marbella, Madrid, Milán o cualquier ciudad de la UE, el representante del artículo 27 del RGPD pasa a ser obligatorio — hay que designarlo por escrito y su nombre y dirección van publicados en este apartado. Anotarlo en la lista de apertura de ciudad, no descubrirlo después.

2 · What we never collect

The two we designed around

Your delivery address. When a Muse redeems her code, she gives her address straight to the florist. It never passes through Gift & Meet, we have no field for it, and the florist's own portal shows no member name and no address. We cannot disclose, lose or be compelled to produce an address we do not hold.

Your identity document and your selfie. They go to Veriff and not to us. What comes back is a yes or a no, and your first name, your age and the country on the document. We never receive the images.

We also do not collect your location, your contacts, your calendar, or your activity on other apps and websites. There is no advertising network in this application.

3 · What we collect

CategoryWhat it is
AccountThe identifier you sign in with, the side you joined as, the city, and the date you joined. It is your phone number: you sign in with a one-time code. There is no password, no username, and no sign-in through Google, Apple or Facebook.
ProfileYour photographs and videos, your bio, your interests, your current preference about how you want to connect, your age preference, and whether you are visible.
From verificationA yes or a no, and your first name, your age and the country on your document. They are stamped onto your profile and cannot be edited. Not the images.
What you writeNotes, the greeting a Muse writes when she accepts, conversations, reports and their description, and your support threads.
What you doLast connection, gestures sent, received, accepted or declined, winks, favourites, and which profiles you have opened.
PaymentHandled by Stripe. We hold a token, the card type and the last digits — never the full number and never the security code.
DeliveryThe redemption code, its state, and the photograph a florist may upload as proof. That photograph is of the box with the code on it, and florists are told not to photograph doors, street numbers or faces. It is seen by our team and by nobody else, including the member.
TechnicalIP address, device and application version, and error logs.

PENDIENTE: notificaciones push. No existen todavía. El día que entren, este apartado tiene que decir qué identificador de dispositivo se guarda, y las etiquetas de privacidad de las tiendas tienen que cuadrar.

4 · Why, and on what legal basis

What forLegal basis
Running your account, showing your profile, delivering gestures and arranging the flowersPerformance of our contract with you
Verifying that you are a real adultLegal obligation and our legitimate interest in an adults-only community. The biometric part rests on your explicit consent — see section 5
Reviewing reports, moderation, preventing fraud and abuseLegitimate interest in a community that is safe to be in
Ordering what you see in DiscoverLegitimate interest in the service being useful. The ordering uses what you do in the application; it is never sold and never bought
Keeping transaction recordsLegal obligation, tax and accounting
Answering you when you write to supportPerformance of our contract, and legitimate interest

Where we rely on legitimate interest, we have weighed it against your rights, and you can object — section 10.

5 · Identity verification

Verification is carried out by Veriff (Veriff OÜ, Estonia). You upload your document and a selfie to Veriff directly. Veriff compares them, which involves processing biometric data — a special category under the GDPR, with a higher bar.

The legal basis for that specific processing is your explicit consent, which you give in the application before you upload anything. You can refuse; the consequence is that you cannot be admitted, because we do not have another way of knowing you are a real adult. You can withdraw it afterwards, and then we close the account.

The check also tells us whether you already have an account here. Veriff compares your selfie against those of earlier checks and answers a single question: is this the same person? It never tells us anything about anybody else. It is what stops one person from holding two accounts, and what stops someone who has been blocked from coming back with a different document. It rests on the same explicit consent, and if you withdraw that consent we cannot keep you in the service.

And it is what gives you your account back if you lose your phone number. You verify again with whatever document you have, we recognise you, and you are in. There is no recovery email and no recovery code: the check is stronger than either.

How long Veriff keeps your document and your selfie is governed by Veriff's own privacy policy, and you should read it before you upload. We are told the result, not the images, and we never see them.

6 · We do not read what you write

Nobody reads your notes and nobody reads your conversations. Not a person, not a filter and not a machine. What you write goes to the person you wrote it to.

There is one exception and it is the one you can trigger yourself: if one of the two people in a conversation reports it, a person at Gift & Meet opens that thread to decide. Only that thread, only because of the report, the member who is reported is told that it happened, and the access is logged. That is the difference between moderation and surveillance, and it is a line we hold.

There is no automated decision-making with legal or similarly significant effects in this service. Admission, reports and disputes are all decided by people.

7 · Who else sees your data

WhoWhat they get
Other membersYour profile as you built it, your last connection as a rough time, and — if you are a Muse — who has opened your profile. Gifters are not shown who viewed theirs.
VeriffYour document and selfie, directly from you. Not from us.
StripeYour payment details, directly from you, and the amount.
The partner floristA code and a city. No name, no address, no photograph, nothing else.
Infrastructure providersHosting, storage and error reporting, under contracts that only let them process data on our instructions. PENDIENTE: listarlos por nombre cuando se cierre la infraestructura.
AuthoritiesOnly when we are legally required, and we will tell you unless we are forbidden from doing so.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. Under the laws of California and other United States states that use those terms, we have nothing to opt you out of.

8 · Where your data goes

The company is in the United States, the service runs in the United Arab Emirates, and our providers are in several countries — Veriff is in Estonia. So your data crosses borders. We transfer it under written contracts that bind each provider to process it only on our instructions and to protect it to the standard described here.

PENDIENTE: contrato de encargado firmado con cada proveedor, y comprobar cómo encaja la ley de protección de datos de Emiratos en las transferencias fuera del país. El día que haya una ciudad de la UE hacen falta además las cláusulas contractuales tipo de la Comisión Europea.

9 · How long we keep it

10 · Your rights

You can ask us to give you a copy of your data, correct it, delete it, hand it to another service, restrict what we do with it, or object to processing we base on legitimate interest. Where we rely on consent you can withdraw it, and that does not undo what we did before.

Write to legal@giftandmeet.com. We answer within one month. We will ask you to confirm it is really you, and we will not charge you.

If you think we have handled it badly you can complain to the data protection authority of your country. We would rather you wrote to us first, but you do not have to.

11 · Reports

Who made a report is never revealed to the person reported. Not in the application, not by our support team, not in any message we send. A member who is reported is told that a report exists and that a conversation has been opened, and nothing more.

12 · Security

Data is encrypted in transit and at rest, access is limited to the people who need it for the task, and access to a reported conversation is logged. We never store a password in this service. If we discover a breach that puts you at risk, we will tell you and the relevant authority within the time the law allows.

13 · Cookies and this website

This website sets no cookies and runs no analytics. It stores one thing in your browser — which of the two languages you chose — so that it does not have to ask again. That is strictly functional, it never leaves your device, and it needs no consent banner. If we ever add analytics, a banner will appear and you will be able to say no.

14 · Children

Gift & Meet is for adults. We do not knowingly process data of anyone under 18, and identity verification exists precisely to prevent it. If you believe a minor has an account, write to legal@giftandmeet.com and we will close it.

15 · Changes and contact

If we change this policy, the date at the top changes and we tell you inside the application before a material change takes effect. Questions, requests and complaints: legal@giftandmeet.com.