This Privacy Policy describes how Totally Into collects, uses, discloses, and protects personal information when you visit our website, join our launch waitlist, or use our gift-planning products and services (collectively, the “Services”). By using the Services, you agree to this policy. If you do not agree, please do not use the Services.
1. Information we collect
We collect information in three ways: information you provide, information collected automatically, and information from third-party platforms when you connect them or when we display their content.
Information you provide
- Waitlist and marketing: email address and optional preferences when you request early access or product updates.
- Account and family planning data (when the application is available): sign-in identifiers, recipient nicknames or first names, age ranges, interests, budgets, saved gift ideas, notes, and similar planning data you choose to store.
- Support and concierge requests: contact details and message content you send us.
Information collected automatically
- Device and usage data: browser type, approximate location derived from IP address, pages viewed, referral source, and event timestamps.
- Analytics: aggregated, allowlisted interaction events on our public site (for example, waitlist submission outcomes) sent to our first-party analytics endpoint. We do not use third-party advertising pixels on the coming-soon site.
- Cookies and similar technologies: essential cookies required to operate the site; optional analytics cookies only where disclosed and permitted by your browser settings.
Information from merchants and APIs
When we integrate with merchant or marketplace APIs (including the Etsy Open API), we may receive product listings, shop metadata, pricing, availability, images, and—only when you authorize OAuth access—seller account data needed to provide the feature you requested. We request the minimum data required for the stated purpose.
2. How we use information
- Provide, maintain, and improve the Services, including gift discovery, price and availability checks, and family planning features.
- Send transactional messages (for example, waitlist confirmations) and, with your consent where required, product updates.
- Secure the Services, prevent abuse, and enforce our terms.
- Comply with law and respond to lawful requests.
- Generate aggregated or de-identified statistics that do not identify you.
3. Legal bases (EEA/UK)
Where applicable law requires a legal basis, we rely on: performance of a contract (providing the Services you request); legitimate interests (security, analytics, product improvement) balanced against your rights; consent (marketing where required); and legal obligation.
4. How we share information
We do not sell your personal information. We share information only as follows:
- Service providers who process data on our behalf under contract (hosting, email delivery, analytics infrastructure, payment processing when applicable), subject to confidentiality and security obligations.
- Merchant and marketplace platforms when you direct us to connect your account or when we retrieve public catalog data through approved APIs.
- Legal and safety: when required by law, to protect rights and safety, or in connection with a merger or acquisition with notice as required by law.
5. Etsy API and Etsy member data
When our Services use the Etsy Open API:
- We access Etsy data only to provide features you request (for example, showing eligible Etsy listings that match your gift criteria).
- Where Etsy member or seller personal information is accessed through the API, we act as a service provider processing that information on behalf of the applicable Etsy seller, solely to deliver the Services described in our terms with that user, and in compliance with applicable privacy laws and Etsy’s API Terms of Use.
- We inform users what Etsy-related data we collect, how it is used, stored, secured, and shared, and what controls they have, through this policy and in-product disclosures.
- We refresh displayed Etsy listing content on a schedule consistent with Etsy API requirements (listing content no more than six hours stale relative to Etsy; other Etsy content no more than twenty-four hours stale unless a shorter period is required).
- We retain cached Etsy content only as long as reasonably necessary to provide the Service, then delete or refresh it.
- We do not store Etsy member ID and password combinations, transfer API credentials to third parties, or use Etsy data for unrelated analytics, model training, or bulk scraping except as expressly permitted in writing by Etsy.
If we become aware of unauthorized access to Etsy member data obtained through our Services, we will notify Etsy at dpo@etsy.com and the affected Etsy seller within twenty-four hours of discovery, as required by Etsy’s API terms.
6. Data retention
- Waitlist emails are kept until you unsubscribe or ask us to delete them, or until they are no longer needed for launch communications.
- Account and planning data are kept while your account is active and for a limited period afterward unless you delete your data sooner.
- Deletion: registered users may request deletion of workspace data through the in-app privacy controls when available; we also honor verified requests sent to the contact address below.
- Anonymized catalog observations (merchant price history without user or recipient identifiers) may be retained for aggregate pricing integrity after account deletion, as disclosed in our application privacy experience.
7. Security
We use administrative, technical, and organizational measures appropriate to the sensitivity of the data, including encryption in transit (TLS), access controls, and vendor review. No method of transmission or storage is completely secure; we cannot guarantee absolute security.
8. Your rights and choices
Depending on where you live, you may have rights to access, correct, delete, restrict, or port your personal information, and to object to or withdraw consent for certain processing. You may opt out of marketing emails using the unsubscribe link in any message. To exercise rights, contact us at the address below; we may verify your identity before responding. You may lodge a complaint with your local data protection authority.
California residents: We do not sell personal information as defined by the CCPA. You may request disclosure or deletion subject to applicable exceptions.
9. Children
The Services are directed to adults planning gifts for family members. We do not knowingly collect personal information directly from children under 13 (or under 16 in the EEA/UK where applicable). Recipient profiles may include child age ranges supplied by a parent or guardian; we minimize such data and do not treat children as account holders.
10. International transfers
We may process information in the United States and other countries. Where required, we use appropriate safeguards (such as standard contractual clauses) for cross-border transfers.
11. Third-party links
Our Services may link to merchant sites. Their privacy practices govern information you provide on those sites. We validate outbound merchant links against an approved allowlist where applicable.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the effective date. Material changes may be communicated by email or in-product notice where required by law.
13. Contact us
Questions about this policy or our data practices:
Email: privacy@totallyinto.com
Web: https://totallyinto.com/