Privacy
Last updated 30 August 2026. English is the binding version; any translation is for convenience only.
The short version
This site is a public record, so most of what a chief executive enters here is meant to be seen: their name, their company, and the gifts they give. Everything else — the sign-in address, the payment — is kept because the site cannot work without it, and is not sold, shared for advertising, or used to build a profile of anyone.
What is collected
- From Google, when you sign in: your email address, your name, your profile picture, and the Workspace domain your account belongs to. The domain is what ties a seat to a company; without it a seat cannot be granted.
- From you, when you take a seat: the company name, website, country, an optional logo, the name you want shown, an optional LinkedIn address and photo.
- From you, when you give: the text of each gift and any link you attach.
- From Stripe, when you pay: confirmation that the payment succeeded, and an identifier for the session. Card details are handled by Stripe and never reach this site.
No advertising trackers are used and no analytics cookies are set. If site analytics are added later, this page will say so before they are switched on.
What is public
Public: your company's name, website, country, logo, seat number, the name and optional photo and LinkedIn address you chose to show, and every gift you publish. Not public: your email address, and anything to do with your payment.
Why, and on what basis
The sign-in data and the seat details are processed to perform the contract between you and gift.ceo. The public listing is the service itself. Payment records are kept because tax and accounting law requires it. Where we rely on a legitimate interest — keeping the site secure and preventing someone publishing under a company that is not theirs — we have weighed it against your interests.
Who else processes it
- Supabase — database and authentication, hosted in the EU (Frankfurt).
- Stripe — payments.
- Google — sign-in, for as long as you use it to sign in.
- GitHub Pages — serves the pages themselves.
Each of these is a processor acting on instructions, except Google and Stripe, which are also controllers of the data you give them directly under their own policies.
How long it is kept
Published gifts and the company's seat record are kept for as long as the site exists: a public record that disappeared piece by piece would not be a record. Sign-in data is kept while the account exists. Payment records are kept for ten years, as Swiss accounting law requires.
Your rights
Under the Swiss FADP and, where it applies, the GDPR, you may ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, object to processing based on legitimate interest, and receive your data in a portable form. Deletion has one limit worth stating plainly: gifts already published stay published, because other people may have relied on them. The name attached to them can be reduced to the company alone on request.
You may also complain to the Swiss Federal Data Protection and Information Commissioner, or to your local supervisory authority in the EU.
Transfers outside Switzerland and the EU
Stripe and Google may process data in the United States under standard contractual clauses and their respective adequacy frameworks. Database storage stays in the EU.
Contact
Write to gift.ceo.support@gmail.com for anything on this page, including a request to exercise the rights above.