Privacy Policy

Data we collect

• Account data: name, work email, phone number, company name, and password (stored hashed by our authentication provider). If you sign in with Google, we receive your name, email address, and profile picture from Google.
• Recipient data provided by your employer: name, email, phone number, department, manager, start date, birthday, and other dates used to schedule gifts. Companies may import this from an HR system they connect, such as Jisr, ZenHR or Kayan HR.
• Delivery data: shipping address, location pin, delivery notes, and gift choices made by a recipient.
• Order and payment data: orders, invoices, and payment status. Card details are entered on our payment provider's page and are never stored by Bundle.
• Brand assets: logos and images a company uploads to brand its gifts and previews.
• Messages: emails and WhatsApp messages exchanged with our team.
• Usage data: pages visited, device and browser information, and IP address, collected through cookies and product analytics.

How we use it

• To create and secure accounts and sign you in.
• To run gifting campaigns: send gift links and reminders, collect recipient choices and addresses, and deliver gifts.
• To produce branded gift previews and mockups from uploaded logos.
• To process orders, invoices, and payments.
• To send service emails, such as verification codes, receipts, and account notices.
• To support customers, prevent fraud and abuse, and improve the product.
• To meet legal, tax, and accounting obligations.

Google user data

When you choose Sign in with Google, Bundle requests only your basic profile (name, email address, profile picture). We use it solely to create your account, sign you in, and confirm you own your email address.

We do not use Google user data for advertising, do not sell it, and do not transfer it to others except the service providers needed to operate sign-in. Bundle's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share it with

We do not sell personal data. We share it only with providers that help us run Bundle, under agreements that limit their use to providing the service:

• Supabase (authentication) and Vercel (hosting and file storage).
• Resend (email) and Twilio (WhatsApp messages).
• Moyasar (payments).
• PostHog (product analytics).
• OpenAI and OpenRouter (generating gift previews from brand assets; recipient data is not sent).
• Delivery and fulfilment partners, who receive the recipient name, phone number, and address needed to deliver a gift.
• Authorities, when required by law.

What companies see

The company that sends you a gift can see whether you opened and claimed it and which gift you chose. Your delivery address and phone number are used for delivery and are shown to that company only where needed to fulfil an office or bulk delivery.

International transfers

Some providers store or process data outside the Kingdom of Saudi Arabia. Where that happens, we rely on safeguards permitted under the Personal Data Protection Law and its regulations.

Retention

We keep account and campaign data while the company's account is active and for as long as needed for the purposes above. Order and invoice records are kept for the periods required by tax and commercial law. When data is no longer needed, we delete or anonymise it.

Your rights

Under the Saudi Personal Data Protection Law you may ask to be informed about how your data is processed, access a copy of it, correct it, or have it deleted, and you may withdraw consent where processing relies on it. If a company added you as a recipient, you can contact them or us. Email us at the address below and we will respond within the period the law requires.

Cookies

We use essential cookies to keep you signed in and remember your language, and analytics cookies to understand how Bundle is used. You can block cookies in your browser; signing in will not work without the essential ones.

Security

Data is encrypted in transit, access is limited to staff who need it, and third-party credentials such as HR system keys are stored encrypted.

Children

Bundle is a business service and is not directed at children under 18.

Changes and contact

We will post updates to this page and change the date above; material changes will be notified by email or in the product. Questions or requests: gifts@getbundle.co.