1. Who We Are and What This Covers
Prezynt Inc. ("Prezynt," "we," "us"), a Delaware corporation headquartered in Phoenix, Arizona, is the controller of personal information described here.
This Policy covers the Prezynt mobile apps, website, AI assistant (the "Agent"), and Agentic Checkout. It does not cover the practices of the third-party retailers and brands ("Partners") whose products appear in the Service, or of payment providers, whose own policies govern their handling of your information.
Contact: support@prezynt.com
2. Information We Collect
2.1 Information you give us
| Category | Examples |
|---|
| Account | Name, email, phone, password, date of birth, profile photo, bio |
| Preferences | Interests you select, gender (if provided), sizes, brand and category preferences |
| Recipients | Names, relationships, birthdays and event dates, interests, notes you write, delivery addresses |
| Lists and events | Wishlists, saved items, pasted product links, events, reminders, co-gifter invitations |
| Agent conversations | Everything you type or say to the Agent, including free-text notes about people |
| Purchase and Mandate | Payment method details (processed by our providers), billing and delivery addresses, order history, your Agentic Checkout Mandate and its limits |
| Support | Messages, attachments, and records of your contacts with us |
| Contacts (optional) | If you grant permission, names and contact details from your device address book, used only to help you add Recipients and find friends |
2.2 Information we collect automatically
- Usage and behavior: screens viewed, swipes (right/left) and the products they relate to, searches, taps, session timing, features used, referral source.
- Device and technical: device model, OS, app version, language, time zone, IP address, mobile advertising identifier, crash and diagnostic data.
- Approximate location: derived from IP address, and precise location only if you separately grant permission.
- Cookies and SDKs: on our website and in the app, as described in Section 9.
2.3 Information from third parties
- Partners and affiliate networks (for example, order confirmation, shipment, return, and commission-attribution data).
- Payment processors, card networks, and issuers (tokenized credential status, authorization outcomes, dispute and chargeback records).
- Fraud and identity providers (risk signals, verification results).
- Analytics and attribution providers.
- Other users, when someone adds you as a Recipient, a friend, or a co-gifter.
2.4 What we do not collect
We do not collect government identification numbers, precise health or medical records, biometric identifiers, or genetic data. We do not knowingly collect information from anyone under 18. We do not scrape social media profiles.
We do not store full payment card numbers. Card data is captured and stored by PCI-DSS compliant payment processors; we retain only tokens and the last four digits.
3. Agentic Checkout — Additional Processing
Agentic Checkout requires us to process information beyond ordinary browsing. This section describes it specifically.
What we create and keep for each Agentic Checkout transaction:
- the Mandate in force (your spend caps, in-scope Recipients and categories, confirmation mode, expiration);
- the instruction or context that triggered the purchase, including relevant Agent conversation;
- the Agent's decision record — candidate products considered, the selection made, and the ranking signals applied;
- the disclosures presented to you, including commission disclosure and final price;
- your confirmation, with timestamp, device, and IP address; and
- the resulting order and payment record.
Why. To execute the purchase you authorized, to prove authorization if a transaction is disputed, to detect fraud, to identify and remedy Purchase Errors, and to comply with card network rules and financial regulations.
Who receives it. Partners receive what they need to fulfill the order (item, price, delivery name and address, contact for delivery notices). Payment processors, card networks, and your card issuer receive transaction and authorization records, including agent-authorization evidence required by their rules. Fraud providers receive risk signals.
Retention. We retain Mandate and authorization records for at least 24 months after the transaction, and longer where required for a live dispute, legal claim, or regulatory obligation. These records are retained even if you delete your account, because they are the evidence of your authorization; we will delete or de-identify them when the applicable dispute and limitations periods have run.
Automated decision-making. The Agent selects products automatically. Under Assisted mode you confirm every purchase, so the final decision is yours. If you enable Autonomous mode, purchases within your limits are made without a further human decision. You can switch back to Assisted mode, revoke your Mandate, or request human review of any transaction at any time by contacting support@prezynt.com. We do not use automated decision-making to make decisions about credit, employment, housing, insurance, education, or access to essential services.
Our commercial incentives. Product ranking and Agent selection are influenced by affiliate commission rates and paid placement. We disclose in-flight whether we earn a commission on a transaction. See Terms of Service Section 7.
4. How We Use Information
- Provide the Service: create and secure your account, build recipient profiles, generate recommendations, manage events and reminders, operate lists and co-gifting.
- Operate Agentic Checkout: as described in Section 3.
- Personalize: train and tune our recommendation systems on your interactions so suggestions improve.
- Communicate: transactional messages (order, delivery, security, Purchase Error notices) and, with your consent where required, marketing.
- Loyalty: administer Sparks.
- Analytics and product development.
- Advertising and measurement: as described in Sections 6 and 9.
- Trust and safety: detect and prevent fraud, abuse, and unauthorized transactions.
- Legal: comply with law, enforce our Terms, respond to lawful requests, and establish or defend legal claims.
AI and model training. We use your information to generate outputs for you and to improve our own recommendation and ranking systems. We do not sell your information to train third-party AI models, and we do not permit our third-party model providers to train their general-purpose models on your content. Where we use third-party models to power the Agent, your inputs are processed under contractual terms that prohibit such training.
Legal bases (EEA/UK, if applicable). Performance of contract (providing the Service and executing purchases); legitimate interests (security, fraud prevention, product improvement, and — for Recipient Information — the gifting purpose you and the Recipient's relationship imply); consent (marketing, precise location, contacts access, non-essential cookies); legal obligation (financial records, tax).
5. Recipient Information — Information About People Who Are Not Our Users
We treat information about Recipients seriously, because a Recipient did not sign up.
Our commitments:
- We collect Recipient Information only from the user who has the relationship, and only what is needed for gifting: name, relationship, occasion dates, interests, notes, and — for a purchase — a delivery address.
- We use Recipient Information only to generate gift recommendations, manage the associated event, and fulfill a purchase for that Recipient.
- We do not sell or share Recipient Information for cross-context behavioral advertising.
- We do not build advertising profiles of Recipients, do not enrich Recipient records with data purchased from brokers, and do not market to Recipients using contact details a user provided, except to send a delivery notification or an invitation the user chose to send.
- Where a Recipient is also a Prezynt user, the two records are kept separate and the Recipient's own privacy choices govern their account.
- Delivery addresses: when a user ships directly to a Recipient, we do not reveal the Recipient's address to the user, and we do not reveal the user's payment details to the Recipient.
If you are a Recipient, you may email support@prezynt.com to ask what information about you we hold, correct it, ask us to delete it, or ask us to stop processing it. We will act on your request even where it degrades a user's experience. We may need to contact the user who added you in order to honor a deletion request, and we will do so without disclosing the substance of your request beyond what is necessary.
6. How We Disclose Information
| Recipient | What | Why |
|---|
| Partners and retailers | Order details, delivery name and address, delivery contact | Fulfill your order |
| Affiliate networks (e.g., AWIN, CJ, Rakuten, Impact) | Click and transaction identifiers, order value | Commission attribution |
| Payment processors, card networks, issuers | Payment tokens, transaction and authorization records, agent-authorization evidence | Process payment, resolve disputes |
| Cloud, hosting, database, and email providers | As needed to operate | Infrastructure |
| AI model providers | Agent inputs and context | Power the Agent, under no-training terms |
| Analytics and attribution providers | Usage and device data, identifiers | Measure and improve |
| Advertising partners | Identifiers and event data, subject to your opt-out | Advertising and measurement |
| Fraud and identity providers | Risk and verification signals | Prevent fraud |
| Other users | Content you choose to share (public wishlist, co-gifter activity, friend profile) | Social features |
| Professional advisors, auditors | As needed | Governance |
| Law enforcement, regulators, courts | As legally required | Legal compliance |
| Acquirer or successor | All categories | Merger, acquisition, financing, or asset sale |
We do not sell your personal information for money.
We do use advertising and analytics technologies that may constitute a "sale" or "sharing" for cross-context behavioral advertising under the California Consumer Privacy Act and similar state laws. The categories involved are identifiers, commercial information (products viewed and purchased), and internet activity. You can opt out at any time — see Section 8. We do not sell or share the personal information of anyone we know to be under 16.
7. Retention
| Data | Retention |
|---|
| Account and profile | While your account is active, then deleted or de-identified within 30 days of closure |
| Recipient Information | While the associated user account is active, or until the user or Recipient deletes it |
| Agent conversations | 24 months from the conversation, or until you delete them |
| Swipe and behavioral signals | 24 months, then aggregated or de-identified |
| Mandate and authorization records | At least 24 months after the transaction; longer for live disputes or legal claims |
| Order and financial records | 7 years, for tax and accounting |
| Fraud and abuse records | Up to 5 years |
| Marketing preferences and suppression lists | Indefinitely, to honor your opt-out |
| Backups | Purged on a rolling 35-day cycle |
8. Your Privacy Rights and How to Use Them
All users. In the app, you can view and edit your profile and interests, view and delete Recipients and Recipient facts, delete Agent conversations, delete saved and swiped items, manage notification and marketing preferences, view and change your Mandate, and delete your account.
Rights under U.S. state privacy laws (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others as they take effect): the right to know/access, correct, delete, obtain a portable copy, opt out of sale, sharing, targeted advertising, and profiling with legally significant effects, and limit the use of sensitive personal information. We will not discriminate against you for exercising these rights.
Rights under GDPR/UK GDPR (if we serve your region): access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests), withdrawal of consent, and the right to complain to your supervisory authority.
How to exercise. Use in-app controls, the "Do Not Sell or Share My Personal Information" and "Limit Use of Sensitive Information" links in the app and website footer, or email support@prezynt.com. We will verify your identity using your account credentials or, for non-users, information sufficient to match you to our records.
Opt-out preference signals. We honor Global Privacy Control (GPC) on our website.
Timing. We respond within 45 days, extendable once by 45 days with notice.
Appeals. If we deny your request, you may appeal by replying to our decision or emailing support@prezynt.com with "Appeal" in the subject line. We will respond within 45 days with our decision and reasons, and will tell you how to contact your state attorney general if you remain dissatisfied.
Authorized agents may submit requests on your behalf with proof of authorization.
9. Cookies, SDKs, and Tracking
On our website we use strictly necessary, functional, analytics, and advertising cookies. On first visit from a jurisdiction that requires it, you may accept or reject non-essential categories, and change your choice at any time via "Cookie Settings." We honor GPC.
In our apps we use analytics, attribution, crash-reporting, and advertising SDKs. On iOS we request App Tracking Transparency permission before tracking you across apps and websites, and we do not track without it. On Android you can reset or delete your advertising ID in device settings.
10. Security
We use encryption in transit and at rest, access controls and least-privilege permissions, network segmentation, logging and monitoring, secure development practices, vendor security review, and periodic penetration testing. Payment card data is handled only by PCI-DSS compliant processors, and Agentic Checkout uses tokenized credentials scoped to the Agent where supported.
Access to Recipient Information and to Agent conversations is restricted to the account that created it and to a limited number of authorized personnel for support, security, and legal purposes, with access logged.
No system is perfectly secure. If a breach affects your information, we will notify you and applicable regulators as required by law. Report a vulnerability to support@prezynt.com.
11. Children
The Service is for adults 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it promptly. If you believe a child has provided us information, email support@prezynt.com.
If you add a minor as a Recipient (for example, a child in your family), provide only what is needed for gifting — first name, age or birthday, and interests. Do not provide a minor's contact details, school, or precise whereabouts.
12. Health and Sensitive Information
We do not seek to infer or process health information. Our Agent may surface products in wellness, fitness, or personal-care categories, but we do not use product interactions to infer, record, or target based on any person's health condition, diagnosis, treatment, pregnancy status, reproductive health, sexual orientation, religion, immigration status, or union membership, and we do not sell or share such inferences. Where a state health-privacy law (such as Washington's My Health My Data Act or Nevada SB 370) applies, we treat any consumer health data we may hold accordingly and will obtain separate consent before collecting or sharing it.
13. Changes
We will update this Policy as the product evolves and will change the version and date above. For material changes we will provide at least 30 days advance notice by email and in-app. Where a change materially expands how we use information you already gave us, we will obtain your consent where required by law.
14. Notice at Collection (California)
We collect the categories of personal information listed in Section 2 — identifiers, customer records, commercial information, internet activity, approximate geolocation, inferences, and, only if you provide it, information you consider sensitive. We use it for the purposes in Sections 3 and 4. We disclose it as described in Section 6, and we share identifiers, commercial information, and internet activity for cross-context behavioral advertising subject to your opt-out. Retention is described in Section 7. Your rights and how to exercise them are in Section 8.