Privacy notice

What this product is

SendingGood lets someone buy GOOD credit and send it, in kinds such as Vibes or Luck, through a private link. There is no membership and no password. A cookie on the device, or a secure link the person saves, is how they return to a wallet.

Data we hold

Wallet and payment records: a random wallet id, GOOD balances, purchase amounts, and a Stripe payment reference. We do not store full card numbers. Stripe processes the card payment.

A browser cookie named sg_session. It is essential, HttpOnly, and used only to recognise the wallet on that browser. We do not use it for advertising.

If you ask for an email link, we store that email address and send one message through Resend. The link works once and expires after 7 days.

A gift can include an optional recipient name and a private note. The note is encrypted in the sender's browser. We store the scrambled note only. The key stays in the private link, after the #, and is not sent to our server. We cannot read the note.

Why we use it

To sell GOOD, keep the balance, create private links, and send a recovery email you asked for. The legal bases are contract (providing the credit and the link you paid for) and legitimate interests (securing wallets, preventing abuse, and keeping basic payment records). Sending a recovery email is something you request.

Who else sees it

Stripe (payments), Resend (only if you ask for an email), and the host that runs the site and database (Vercel, and the database provider). They process data to provide those services. Card payments and email may be processed outside the UK. Where that happens, we rely on the provider's UK transfer safeguards, such as the UK extension to EU standard contractual clauses or the UK-US data bridge where it applies.

A recipient sees the gift you put in their link. They do not see your wallet. A share graphic, if they make one, is a separate image of the public amounts only.

How long we keep it

Wallet and payment records are kept while the wallet exists and for as long as tax and accounting rules require payment records, normally up to six years. A recovery email token is deleted from use once it is spent or after 7 days. You can ask us to delete a wallet. We may retain the minimum payment record the law requires.

Your rights

You can ask for a copy of your data, a correction, deletion, restriction, or a portable copy, and you can object to processing based on legitimate interests. Email good@sendinggood.com. Because there is no account, we may need the wallet link or the email you used so we can tell which wallet is yours. We respond within one month. You can complain to the ICO.

Children

SendingGood is not directed at children under 13. Do not buy GOOD for a child to use as their own account. There is no account.