Privacy policy

When you sign in

Sign-in is with Google, and nothing else. Google tells us your name, your email address and your profile photo. We never see your Google password, and we ask Google for nothing more: not your contacts, your calendar, your files or your mail.

When you send a gift

• About the person it is for: their name, how they are related to you, their city, area, landmark and house, and their phone number if you choose to give one.
• About the gift: what you picked, the delivery day and speed, whether it is a surprise, the note for the card and any message for a cake.
• About you, as the sender: your name, email address and phone number as you type them at checkout.
• About the order: its number, what each gift and fee cost in dollars and rupees, the exchange rate it was priced at, where it stands and when each step happened, and which emails we sent about it.

When you pay

Your card details go straight from your browser to Stripe, our payment processor. They never reach our server and we don’t store them. We keep Stripe’s reference for the payment, the amount, and whether it was paid or refunded.

When you use the site

Which pages you open and what you click, what kind of device and browser you use, roughly where your connection comes from, and any error the site runs into. We also keep a recording of your visit: what the pages showed, and where you clicked and scrolled. In a recording, whatever you type into a field is hidden, and names, addresses, phone numbers, email addresses and the note for the card are blanked out. The card fields are never recorded.

When you write to us

Your email and whatever you tell us in it, so we can answer.

Some things are kept in your own browser, not on our servers:

• Your bag, until you pay for it or empty it. It stays on that device and in that browser.
• The details you have typed at checkout, so a refresh doesn’t lose them. They go when you close the tab, sign out or pay.
• A note of a payment that was started and not yet confirmed, so pressing Pay again can’t pay twice for one gift.
• That you closed the Dashain offer, so it isn’t shown to you again.

And these cookies:

• Sign-in cookies, which keep you signed in. They are set on this site by Neon Auth, the service that runs our sign-in.
• Two cookies from Stripe on the page where you pay, which Stripe uses to prevent fraud: __stripe_mid, kept for a year, and __stripe_sid, kept for thirty minutes.
• One cookie from PostHog, the service that shows us how the site is used: ph_…_posthog, kept for a year. It tells one visit from another, and PostHog keeps a copy of it in your browser’s storage.

We use no advertising cookies, and nothing on the site follows you to other sites.

• To know whose account and whose orders are whose, so only you can open your orders and track them.
• To buy the gift and bring it to the right door on the right day.
• To take your payment, and to send money back when a refund is due.
• To email you your receipt, and to answer when you write to us.
• To see how the site is used and where it goes wrong, so we can fix what breaks and what confuses.
• To keep the site safe: to stop one order being paid for twice, to limit how fast one account can place orders, and to turn away an account that has been banned.

We don’t sell what we collect, and we don’t use it for advertising.

The name, email address and profile photo we get from Google are used to sign you in, to identify your account, to show you who is signed in, and to fill in your name and email at checkout so you don’t have to type them. They are used for nothing else.

We don’t sell them, don’t use them for advertising, and share them only with the services named below that run sign-in and store your account for us.

Only those who need it to get your gift there, and the services the site runs on:

• Our team in Nepal, who see each order in full: what to buy, the card note, who it is for, the address and phone number, and who sent it.
• The partner shop the gift is bought from, which is told what it needs to prepare it, such as the message for a cake or the note for the card.
• The rider, who goes by the recipient’s name, address, landmark and phone number.
• Stripe, which takes your card payment and makes refunds. What you type into the card fields is Stripe’s to handle, under Stripe’s privacy policy.
• Google, which signs you in.
• Neon, which runs our sign-in (Neon Auth) and the database that holds accounts and orders.
• Resend, which sends our emails: your receipt, and the order to our team.
• Vercel, which hosts the site and so handles every request to it.
• PostHog, which keeps the record of visits described above: pages, clicks, recordings and errors. It knows a signed-in visitor by an account number, not by name or email. It handles them under PostHog’s privacy policy.

We share it with no one else, unless the law requires us to.

Your account and your orders are kept for as long as you have an account, so that you can see and track what you have sent. Nothing deletes them automatically.

An order that was paid for is also our record of the purchase and of any refund, so we keep it even if you ask us to close your account. Ask us and we will tell you what we are keeping and why.

Your bag stays in your browser until you pay for it, empty it or clear your browser’s storage.

Email hello@sagungifts.com from the address you sign in with, and we will send you a copy of what we hold about you, correct it, or delete it, apart from the order records described above. There is no form and it costs nothing.

You can also stop us receiving anything further from Google at any time, by removing Sagun from the apps connected to your Google account.

If you gave us someone else’s details so we could deliver to them, they can write to the same address about theirs.

When this policy changes, the new one is published here with a new date at the top.

Questions about any of it go to hello@sagungifts.com. What you agree to when you order is in our terms.