Privacy Policy

Last updated: November 1, 2026

This Privacy Policy explains how iGreet ("we", "us", or "our") collects, uses, and protects your personal data when you use our website, mobile applications, AI connectors (including our Model Context Protocol / MCP server), and related services (collectively, the "Services"). By using the Services, you agree to the collection and use of information in accordance with this Policy.

1. Information We Collect

We may collect the following types of information:

  • Account information: such as your name, email address, password, and contact details.
  • Order information: such as delivery address, billing details, and order history.
  • Usage data: information about how you access and use the Services, including IP address, device information, browser type, and pages visited.
  • Content you provide: such as personalized messages, images, or videos used in your cards.
  • Workspace data (business accounts): such as contacts, teammates, reminders, and organisation settings you store in a panel workspace.
  • AI connector data: when you connect an AI assistant (for example Claude, ChatGPT, or Cursor) via OAuth or an access token, we process the tool requests that assistant makes on your behalf and the account data those tools need to fulfill them. See section 5.
  • Cookies and similar technologies: as described in our Cookie Policy.

2. How We Use Your Information

We use the information we collect for purposes including:

  • Providing and operating the Services, including processing and delivering your orders;
  • Managing your account, preferences, and wishlists;
  • Enabling AI assistants you authorize to create and manage greeting cards and related data in your account;
  • Improving and personalizing the user experience;
  • Communicating with you about your orders, account, and important updates;
  • Sending marketing communications where permitted by law (you can opt out at any time);
  • Monitoring and protecting the security, integrity, and performance of the Services;
  • Complying with legal obligations and enforcing our Terms of Service.

Mobile app promotions

Our mobile apps may show promotions for our other apps. The backend uses your IP address to estimate a two-letter country code; an enabled geolocation service may process the IP address for this purpose. We do not request GPS access for promotions. A random installation identifier is stored locally and sent to our backend, where a keyed hash and display timestamps enforce frequency limits. This identifier is not sent with promotion analytics events. Firebase Analytics records promotion impressions, clicks and dismissals with campaign ID, country code and platform, subject to the app’s analytics settings. No scanned content is included in these events.

3. Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

  • To perform a contract with you (for example, to fulfill your orders or operate an AI connector you enable);
  • With your consent (for example, for certain marketing activities, or when you authorize an AI client);
  • For our legitimate interests (for example, to improve our Services and prevent fraud), provided that your rights and interests do not override those interests;
  • To comply with legal obligations.

4. How We Share Your Information

We may share your information with:

  • Service providers and partners who help us operate the Services, such as printing and delivery partners, payment processors, hosting providers, and analytics services;
  • AI assistants you authorize — when you connect a third-party AI client to iGreet, that client can access account data within the permissions you grant (see section 5). Those clients process data under their own privacy policies;
  • Professional advisers such as lawyers, accountants, and auditors;
  • Authorities or law enforcement where required by law or to protect our rights or the rights of others;
  • Other parties with your consent or at your direction.

We do not sell your personal data to third parties.

5. AI Assistants and MCP Connectors

iGreet provides a remote Model Context Protocol (MCP) server so you can connect AI assistants (such as Claude, ChatGPT, or Cursor) to your iGreet account or business workspace.

  • Your authorization only: a connector can access your account only after you sign in and authorize it (OAuth) or create an access token in MCP settings. You choose whether send/schedule permissions are included.
  • What an authorized assistant may access: depending on the scopes you grant and whether you use a consumer or workspace account, this can include card designs, your cards and drafts, messages on cards, recipients, reminders, contacts, teammates, occasions, and related status information needed to create, edit, schedule, send, or delete cards.
  • What we do not collect from the AI chat: we do not request Claude’s (or another assistant’s) conversation history, memory, or uploaded files. We only receive the tool arguments and API calls the assistant makes to iGreet to perform the actions you asked for.
  • Payments: AI connectors cannot complete checkout or charge your payment method. If a card pack is required, we may return a purchase link for you to open in your browser.
  • Revocation: you can revoke OAuth clients and access tokens at any time from MCP settings. Revoking ends further access for that connection.
  • Logging: important connector actions (such as create, schedule, and send) may be logged on your account for security and support.

Setup instructions are available at iGreet MCP setup.

iGreet for Teams — company workspaces

This Policy also covers iGreet for Teams. An organisation may add or import your name, work email, job title, team, country, birthday and employment start date. These details support membership, company calendars, celebrations and reminders. Your profile and celebration details may be visible to other authorised workspace members according to the feature and their access. Administrators manage membership and workspace settings; card organisers and contributors have the permissions assigned to their roles.

When Slack sign-in or profile import is authorised, we may receive the provider’s user/workspace identifiers and available profile details, such as name, email, photograph, job title and status, within the permissions granted. Additional integrations will be described when made available. Disconnecting an integration does not automatically delete information already imported into your profile.

Card messages and media may be visible through a shared viewer link. Uploaded digital-gift files have separate access controls; the presence of a gift can be shown without exposing the file. The uploader and organiser can access it for management, and recipient access is checked separately. Do not put private voucher codes in ordinary card messages.

For employee data processed on the organisation’s instructions, the organisation generally determines the purpose and legal basis and iGreet processes that data on its behalf. iGreet separately determines processing needed for its own billing, service security and legal obligations. Contact your workspace administrator for organisation-controlled data requests, or ask@igreet.com for help identifying the appropriate contact. Closing your personal access does not necessarily delete the organisation’s cards or records.

The Business Terms and DPA are currently review drafts. They do not replace an executed customer agreement.

6. International Transfers

Your information may be processed in countries other than the country in which you are resident. Where we transfer personal data internationally, we take appropriate measures to protect your data in accordance with applicable data protection laws.

7. Data Retention

We retain personal data only as long as needed for the purposes in this Policy, to meet legal and accounting obligations, resolve disputes, and enforce our agreements. In practice:

  • Account and profile data — while your account is active, and for a limited period afterward if needed for legal, fraud-prevention, or backup purposes after deletion requests;
  • Cards, messages, and orders — for as long as they remain in your account or are required for fulfillment, customer support, or statutory record-keeping;
  • Workspace contacts and reminders — until you delete them or the organisation account is closed;
  • OAuth authorizations and MCP access tokens — until you revoke them, they expire, or the related account is closed;
  • Security and action logs — for a limited operational period (typically up to 90 days, or longer where needed for investigations or legal requirements).

8. Your Rights

Depending on your location, you may have the right to:

  • Access the personal data we hold about you;
  • Request correction of inaccurate or incomplete data;
  • Request deletion of your personal data, subject to legal obligations. Consumer (personal) accounts can be deleted from Account → Personal details. Organisation / workspace accounts are not self-serve — contact us instead;
  • Object to or restrict the processing of your personal data;
  • Withdraw consent where processing is based on consent (including by revoking AI connector access);
  • Request data portability in certain circumstances.

To exercise these rights, please contact us using the details below. We may need to verify your identity before responding to your request.

9. Cookies and Similar Technologies

We use cookies and similar technologies to operate and improve the Services, analyze usage, and personalize content. For more details, please see our Cookie Policy.

10. Children’s Privacy

The Services are not intended for children under the age of 16, and we do not knowingly collect personal data from children under 16. If you believe that a child has provided us with personal data, please contact us so that we can take appropriate action.

11. Security

We use reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, misuse, or alteration. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

To report a security vulnerability in the Services (including our MCP connector), email ask@igreet.com with the subject line "Security vulnerability". We investigate reports with care and aim to acknowledge them promptly. See also our security.txt.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Your continued use of the Services after any changes are posted constitutes your acceptance of the updated Policy.

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at ask@igreet.com.