What we collect. What we don't. Plain English.

1. Who we are

"We," "us," and "Vanilla Gift" refer to Vanilla Gift, Inc., a Maryland corporation based at 1101 N. Calvert Street, Suite 405, Baltimore, MD 21202. This policy explains how we handle information on vanilla.gift.

2. What we collect from you

To check a gift card balance, you give us three pieces of information:

• The 16-digit card number
• The expiration date
• The 3-digit CVV from the back of the card

We pass these to the card issuer's lookup service, get back the balance, and show it to you. The card number and CVV are held in memory for the duration of that one request and then dropped. We do not write them to disk, we do not include them in logs, and we do not retain them on any system we control.

If you contact us through the support form or by email, we keep the message and your email address as long as the conversation is open. After it's closed, we keep the thread for 18 months in case you reply, then delete it.

3. What we collect automatically

Like every web server, ours writes a request log. The log records the URL you visited, your IP address, the time, your browser's user agent, and the HTTP status of the response. We use this to debug problems and count how many balance checks we ran. The log is automatically deleted after 14 days.

The request log never contains card data. We strip it before the log line is written.

4. Cookies and similar tech

We set one first-party cookie called vg_pref. It saves your site preferences (such as dismissing a notice). It's only set after you actually change something. We don't use it for tracking. See the Cookie Policy for the full list.

We do not run Google Analytics, Facebook Pixel, Google Tag Manager, or any other third-party analytics or advertising script.

5. Who we share data with

Three categories, all narrow:

• Card issuers. When you check a balance, your card details go to the issuer that issued the card (Visa, Mastercard, or the prepaid provider). This is unavoidable — they're the only ones who know your balance.
• Hosting and infrastructure. Our servers run on Amazon Web Services in us-east-1 and eu-west-1. AWS sees the encrypted traffic but not its contents.
• Law enforcement, with a valid order. If we receive a subpoena or court order from a US court of competent jurisdiction, we'll comply with the narrowest possible response. We have never received one as of the date of this policy.

We do not sell or rent your data. We don't share it with advertisers. We don't share it with data brokers. We don't share it with affiliates because we don't have any.

6. How long we keep things

Quick reference table:

• Card number, expiration, CVV: Held in memory during the balance check, then dropped. Not stored.
• Request logs: 14 days.
• Support emails: 18 months after the last reply.
• Aggregated daily counts: Forever (no personal info in these).

7. Your rights

If you're in the US, you have rights under state laws like the CCPA (California) and CPA (Colorado) and others. If you're in the EU or UK, you have rights under the GDPR. In short: you can ask us what data we have on you, ask us to delete it, or ask us to correct it. Email support.vanilliagift@gmail.com and we'll respond within 30 days. Usually within a few days.

You don't need to use a specific form. A regular email is fine. Just tell us what you want and how to verify you're the right person (usually by replying from the email address we have on file).

8. Security

All traffic between your browser and our servers is encrypted with TLS 1.3. Our internal services don't have access to the card data path — only the balance-check function does, and it doesn't have write permissions anywhere. If we ever have a breach involving your personal information, we'll notify you within 72 hours of discovering it, by email if we have your address.

9. Kids

This service isn't intended for children under 13. We don't knowingly collect data from anyone in that age range. If you think a child has somehow used the site, email us and we'll delete the relevant data.

10. Changes to this policy

When we change this policy in a meaningful way, we'll update the "Last updated" date at the top and post a notice on the homepage for at least 14 days. Minor edits (typos, clarifying a sentence) don't get a notice. The version history is on GitHub if you really want to compare.

11. How to reach us about privacy

Email is best: support.vanilliagift@gmail.com.

For physical mail (rare, but it works):

Vanilla Gift, Inc.
Attn: Privacy
1101 N. Calvert Street, Suite 405
Baltimore, MD 21202
USA