Privacy Policy

Last updated: August 2026

This policy explains what personal information Shuppy collects, why, how we use it, and your rights over it. We’ve tried to write it plainly. If anything’s unclear, contact us at hello AT shuppy DOT com

Shuppy (“we”, “us”, “our”) operates the website shuppy.com and the app at app.shuppy.com. This policy covers both.

Who we are

Shuppy is a UK and Ireland gift-list platform. The data controller responsible for your information is Peter O’Connell who operates Shuppy and is based in the United Kingdom. You can reach us at hello AT shuppy DOT com

What we collect

Depending on how you use Shuppy, we may collect:

  • Account details — if you create an account: your name and email address, and a securely stored password.
  • Lists you create — the wish lists you make, the items on them, occasion dates, and any notes you add.
  • Lists you’ve been sent — if you save lists that others have shared with you, we store a reference to them in your account.
  • Reservations you make — if you reserve or pledge a gift on someone’s list, we record that reservation (and, where relevant, an email address to send you a confirmation).
  • Emails we send — records of transactional emails (like reservation confirmations and occasion-date reveals).
  • Basic technical data — standard information your browser sends, such as general usage data, used to keep the service working and secure.

We do not collect payment card details, because Shuppy does not process payments between users — any gift purchases happen directly with retailers or between the people involved, not through us.

Why we use it, and our legal basis

We use your information to:

  • Provide the service — create and store your lists, let you share them, let others reserve gifts, and reveal givers on the occasion date. (Legal basis: performance of a contract / legitimate interests in running the service you’re using.)
  • Send necessary emails — reservation confirmations and the occasion-date reveal. (Legal basis: performance of a contract / legitimate interests.)
  • Keep Shuppy secure and working — prevent misuse, fix problems, protect the service. (Legal basis: legitimate interests.)

We only collect what we need to provide Shuppy. We do not sell your personal data to anyone.

The surprise mechanic and what others can see

Shuppy is built around keeping gifts a surprise. Some things to know:

  • When you share a list, the people you share it with can see the items on it. They do not need an account to view or reserve a gift.
  • List owners can see that an item has been reserved, but not who reserved it, until 9am on the occasion date, when giver details are revealed to the owner.
  • If you add a private “note for givers”, it is shown only to someone after they reserve a gift — never on the public list.

Who we share it with

We share personal data only where necessary to run the service:

  • Service providers who help us operate Shuppy — for example, our hosting and email-delivery providers — who process data on our behalf under appropriate safeguards. Lovable/Supabase for hosting and database, and our WordPress host,Spaceship, who also manages email capabilities.

We do not sell your data, and we do not share it for third-party advertising.

How long we keep it

We keep your information for as long as your account is active or as needed to provide the service. Lists and reservations are retained so the service works over the life of an occasion and afterwards as history in your account. If you delete your account or ask us to erase your data, we remove it as described below, except where we’re required to keep certain records.

Your rights

Under UK data protection law (UK GDPR), you have the right to:

  • Access the personal data we hold about you.
  • Correct data that’s inaccurate.
  • Erase your data (“right to be forgotten”) — see note below.
  • Restrict or object to certain processing.
  • Data portability — receive your data in a usable format.

To exercise any of these, contact hello AT shuppy DOT com . We’ll respond within the timeframe required by law (normally one month).

A note on erasure and shared lists: if you ask us to delete a list that other people have already reserved gifts from, we may need to handle this carefully so that givers who have committed to a gift aren’t left stranded — we’ll explain how we’ll manage it when you ask. Where a list has been shared and pledged on, full deletion may only be possible after the occasion has passed.

You also have the right to complain to the UK’s Information Commissioner’s Office (ICO) at ico.org.uk if you’re unhappy with how we’ve handled your data.

Cookies and similar technologies

Shuppy uses only the cookies and storage necessary to keep you logged in and the service working. We also use Google Analytics and we obtain consent via a cookie notice.

Children

Shuppy is intended for use by adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we’ll remove it.

Changes to this policy

We may update this policy from time to time. We’ll post the updated version here with a revised “last updated” date.

Contact

Questions about your data or this policy: hello AT shuppy DOT com