TECHNICAL TEST ONLY — UNAPPROVED LEGAL DRAFT. NOT FOR PUBLICATION OR LIVE SALES.

Privacy Policy

GET NOTHING | Review Draft R3 / v0.3 | NOT FOR PUBLICATION
Effective: [EFFECTIVE DATE — SET AT RELEASE]

1. Controller, websites and contact

For GET NOTHING's own website operation, personalisation, fulfilment support and processing described in this Policy, the intended data controller is [EXACT REGISTERED NEW MEXICO LLC NAME], a New Mexico LLC (GET NOTHING, we), at [VERIFIED BUSINESS CONTACT ADDRESS], privacy inquiries: [PRIVACY EMAIL]. This Policy covers getnothing.store and collectnothing.com, which share application infrastructure. The LLC is named as controller only once actually formed and in this substantive role. The private name or nationality of an individual member is not published here unless legally required; that does not prevent mandatory identification to banks, payment providers or competent authorities.

Lemon Squeezy acts as Merchant of Record for applicable sales. It may handle payment, billing, tax and fraud data under its own privacy notice and contractual responsibilities. Actual independent-controller/processor roles and any sharing must be verified from the signed arrangements; this Policy is not a replacement for Lemon's notices.

2. Categories and sources

Data provided directly by a purchaser or site user may include giver/purchaser and recipient names and email addresses, occasions, optional personal or secret messages, chosen serials, product options, configured gift, broad postal area/country and support requests. We create checkout references, certificate/ownership/Journey records, payment status references provided by our Merchant of Record, delivery attempts, bounce/correction history, and records of the versions of legal statements presented and accepted.

Depending on actual deployment, operational systems may process IP/network/security events, browser/session identifiers and device data; first-party storage is used for reservation and some feature continuity. The recipient's details are usually received from the purchaser, not directly from the recipient. Payment card details are not intended to be stored in GET NOTHING's application database; these are handled by the checkout provider.

Analytics, if lawfully operated, can involve pseudonymous checkout and serial identifiers, product configuration, price/tier, acquisition source, funnel state, delivery result and public Journey/QR/share activity. Identifiers remain personal data where association with an individual is reasonably possible. Private messages, raw contact information, private certificate tokens and unfiltered webhook error strings must not be copied into analytics.

3. Purposes and GDPR grounds where applicable

| Purpose | Main data | Relevant GDPR ground (to be confirmed as applicable) | | --- | --- | --- | | Configure and supply purchased digital content | configuration, order reference, product state and buyer contact | Art. 6(1)(b) when necessary to perform the contract | | Deliver a gift to a third-party recipient | recipient contact, certificate and delivery event | a separately assessed legitimate interest under Art. 6(1)(f), or another justified basis according to the facts; not automatically the recipient's contract | | Correct delivery, address complaints and customer support | order details, messages to support, delivery history | Art. 6(1)(b) or 6(1)(f), depending on processing | | Protect payments, credentials, serial integrity and infrastructure | security/technical events and transaction references | assessed Art. 6(1)(f) and/or applicable legal duties | | Fulfil legally required recordkeeping | accounting, payment/legal evidence | Art. 6(1)(c) where a specific law imposes the duty | | Necessary reservation/session continuity | feature identifiers and state | Art. 6(1)(b) or 6(1)(f), plus separate device-access rules | | Non-essential device tracking/attribution | optional identifiers and clickstream | prior consent when law requires it; no activation before consent | | Direct marketing | contact and preferences | consent or a specific applicable permission, with unsubscribe/objection rights | | Optional research surveys | voluntarily supplied responses | separately disclosed and documented basis, consent where needed | | Anonymous aggregate research | results that truly no longer identify anyone | source-data processing requires a basis; genuinely anonymised results fall outside GDPR |

Acceptance of Terms or acknowledgement of this Policy is not consent for cookies, marketing or voluntary research. We must complete and document legitimate-interest balancing, optional tracker classification and all processing purposes before publication.

4. Gift recipients

The purchaser provides recipient information for a requested digital gift. Where GDPR Article 14 applies, a recipient must receive the appropriate privacy information within the applicable period, usually in or with the first relevant direct contact where required. Recipient information is not used to automatically enroll them in marketing. We may restrict abusive messages and provide procedures for unwanted contact, objection and correction.

5. Cookies and browser storage

Known first-party browser storage from the source includes getnothingExactBrowserId (localStorage), getnothingExactTabId and getnothingRecipientLoopGiver (sessionStorage), plus reservation and tab lock keys; the last named item may retain giver name and email. The Cookie & Similar Technologies Policy must accurately list every used key/provider/category/retention and any tracking from Cloudflare, checkout, embedded content or scripts based on live browser inspection, not only source review. Only genuinely necessary storage may operate without consent where a legal exception permits; optional tracking must honour refusal and withdrawal.

6. Operational analytics, public activity and research

Our aim is to follow Nothing, not people: product performance, serial lifecycle, sale/checkout conversion, release/reacquisition patterns, delivery quality, coarse source attribution and public QR/share engagement. Access to linkage between pseudonymous events and operational personal data should be restricted. Do not publicly expose recipient email, personal/secret messages, private URLs, precise location or tracking tokens through certificates or Journey pages. Publication of aggregated research must include re-identification controls; we do not sell raw personal information as a dataset. Any sale/share/targeted advertising definition under an applicable US state law must be separately assessed and disclosed if implicated.

7. Sharing and processors

Depending on the actual services engaged, data may be shared with Cloudflare (hosting, Worker, D1 and security infrastructure), Resend (transactional email), Lemon Squeezy (payment/Merchant of Record), and [VERIFIED ADDITIONAL PROVIDERS]. Roles, data-processing arrangements, subprocessors and actual regions must be recorded. Competent authorities may receive data when legally required. We do not disclose a private member's personal identity to site visitors solely because that individual owns the LLC; legally required corporate disclosures remain public.

8. International transfers

Our infrastructure, customers and service providers may process data in more than one country. For GDPR-covered transfers outside the EEA, actual legal mechanisms (such as valid adequacy status or standard contractual clauses where appropriate), vendor contracts and any required supplemental assessment must be documented. [COMPLETE PROVIDER/COUNTRY/TRANSFER MECHANISM TABLE BEFORE RELEASE]. We make no unverified claim of certification or adequacy.

9. Retention and deletion

Personal data is kept only for a documented, necessary period appropriate to purpose, contract, legal duties, security and disputes. The published final schedule must specifically cover: checkout/order/payment references; certificates/serial histories; private gift messages; encrypted private access credentials; delivery/correction logs; support requests; security/IP logs; browser storage; analytics events; legal evidence; marketing preferences; and optional research. [INSERT ACTUAL RETENTION PERIODS OR OBJECTIVE CRITERIA PER CATEGORY, DELETE/ANONYMIZE RULES AND EXCEPTIONS]. We may retain irreversibly anonymised aggregate data longer. Some statutory records cannot be deleted immediately on request.

10. Your choices and rights

Depending on applicable law, you may have rights of access, correction, deletion, restriction, objection, data portability and withdrawal of consent. You may object to direct marketing and unsubscribe from marketing emails. Submit requests to [PRIVACY EMAIL]; we may require proportionate identity/entitlement checks and explain any lawful refusal or retention restriction. When GDPR applies, you can complain to a competent supervisory authority. Where US state privacy laws apply based on scope and thresholds, required state-specific rights, appeal processes and notices must also be implemented. [FINAL STATE-BY-STATE APPLICABILITY / THRESHOLD AND APPEAL ASSESSMENT].

11. Children, safety and automation

The product is not intended to solicit children's personal data. [FINAL AGE THRESHOLDS, CHILDREN'S DATA AND THIRD-PARTY RECIPIENT AGE HANDLING POLICY]. We do not currently intend legally significant decisions solely by automated means in the ordinary gift flow; verify against deployed anti-fraud mechanisms and update if changed. Security measures include access controls, credential protections, relevant encryption and audit controls, but no system can provide absolute security.

12. EU/UK establishment and representation

GDPR territorial scope turns on actual establishment, processing context, EU-targeting/monitoring and other facts—not merely the place of incorporation or an owner's nationality. If Article 27 (or UK equivalent) requires a representative, it must be appointed and identified. [COMPLETE ASSESSMENT OF EU/UK ESTABLISHMENT, GDPR TERRITORIAL SCOPE, REPRESENTATION, CONTROLLER CONTACT AND SUPERVISORY AUTHORITY].

13. Changes

We will identify revisions by effective date and give additional notice where required. Contact: [PRIVACY EMAIL]. Related: /cookie-policy; /terms; /legal.