Privacy policy

The data controller is Dokaly SAS, 6 rue d'Armaillé, 75017 Paris, France, registered under RCS Paris 988 723 813.

• Your account: first name, last name, email address, password (stored hashed, never in plain text), and if you add them: profile photo, bio and postal address. If you sign in with Google, Google shares your name, email and photo with us.
• Your lists: title, description, event date, images, gifts (name, link, price, image, note), a delivery address if you enter one, and the email addresses of people you invite to co-manage a list.
• Reservations: when someone reserves a gift, their name, and if they provide them, their email address and a message. They can also reserve anonymously.
• Group gifts: the amount, name and message of contributors. Payments are processed by Stripe: we never see card numbers. To receive the money, Stripe asks you directly for the information required by law (identity, bank details).
• Secret Santa draws: the group name, budget, date, the participants' first names and, if the organizer enters them, their email addresses, used only to send them their link.
• The contact form: your name, email and message.
• Technical data: IP address and connection logs (security), notification subscription if you turn them on, and audience measurement if you accept it.

• Running the service (account, lists, sharing, reservations, co-management, notifications): performance of our contract with you.
• Service emails (account confirmation, gift reserved, invitations, password): performance of the contract.
• Optional emails (reminders, news): your consent, which you can withdraw at any time in My account → Notifications.
• Group gifts and payments (contributions, payouts): performance of the contract and our legal obligations (accounting, fraud prevention).
• Security (anti-spam, abuse prevention, technical logs): our legitimate interest in protecting the service and its users.
• Audience measurement (Google Analytics): your consent, given or refused in the cookie banner.
• Generating a list description (only when you ask for it): performance of the contract. Only the list name and type are sent.

You choose each list’s visibility: public (visible to everyone and in search), private (reachable with the link) or password-protected. You also choose whether your profile and public lists may appear in search engines (My account → Privacy).

The list owner and co-managers see the name and message of the person who reserved a gift, unless they reserved anonymously. Their email address is never shown.

We never sell or rent your data. It is processed on our behalf and under our instructions by:

OVHcloud

RoleWebsite and database hosting, sending emails

LocationFrance

Cloudinary

RoleImage storage and optimization

LocationUnited States

Stripe

RoleGroup gift payments, identity checks of recipients

LocationIreland, United States

Google

RoleGoogle sign-in, reCAPTCHA (anti-spam), Google Analytics if you accept it

LocationUnited States

OpenAI

RoleGenerating a list description, when you ask for it

LocationUnited States

Browser notification service

RoleDelivering notifications if you turn them on (Google, Mozilla or Apple)

LocationVaries

Transfers to the United States rely on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses. We may also disclose data to authorities when the law requires it.

When you click “Buy”, the link may go through an affiliate program (Amazon Associates, Awin, Rakuten, Affilae) that pays us a commission, at no extra cost to you. We share no personal data with these programs, but the shop and the program may set their own cookies on their site, under their own policies.

Account, lists and gifts

As long as your account exists; deleted with it

Reservations

As long as the list exists

Secret Santa draws

30 days after the exchange date (90 days after the draw without a date), then deleted

Contact messages

As long as needed to handle your request and its follow-up

Group gift payments

Accounting records kept for 10 years, as required by law

Audience measurement cookies

13 months at most

You can delete your account at any time from My account → Privacy. Your lists, gifts and profile data are then erased. Other people’s lists you co-managed stay in place, as they belong to them.

At any time, you can:

• access your data and get a copy of it;
• have it corrected or erased;
• restrict or object to its processing;
• receive it in a reusable format (portability);
• withdraw your consent, for processing based on it;
• set instructions for what happens to your data after your death.

Write to us at contact@dokaly.fr: we reply within one month. If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.

Traffic with the site is encrypted (HTTPS), passwords are hashed, and access to data is limited to the people who need it to run the service.

Dokaly is intended for people aged 15 and over. Under 15, signing up requires the consent of a parent or guardian.

The cookies we use, and how to change your choices at any time, are described on our Cookies page.

We will update this policy if our processing changes. For significant changes, we will let you know by email or on the site before they take effect.