Privacy Policy

Last updated: 21 August 2026  ·  Effective: 21 August 2026

1. Who We Are

Prinda is operated by Prinda.ai Ltd (Company No. 17191489), a private limited company registered in England and Wales, with its registered office at Lowin House, Tregolls Road, Truro, Cornwall, TR1 2NA. References to "we", "us", or "our" throughout this policy mean Prinda.ai Ltd.

Contact us at: privacy@prinda.ai

As we are based in the UK, Prinda is subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We extend the same protections to all users worldwide.

Prinda is normally the controller of personal data described here. Where an organisation provides Prinda to its personnel and determines why their data is used, that organisation may be the controller and Prinda its processor for that use. Contact privacy@prinda.ai if you are unsure which applies.

EU/EEA users: You may exercise your rights directly using the details below. Where Article 27 EU GDPR requires an EU representative, we will publish the representative's identity and contact details here before the relevant targeted offering or monitoring begins. The current EU adequacy framework for the UK supports transfers from the EEA to the UK, subject to its scope and continued validity.

2. What Data We Collect

Account information

People, household, gift and planning data

Potentially sensitive data

Free-text notes and optional planning fields can reveal health, disability or mobility needs, dietary requirements, religion, sexual orientation, family relationships or other sensitive information. Do not add sensitive information about another person unless you have a lawful reason and their permission where required. We use this information only for the feature requested (for example, accessibility filtering), restrict access, and do not use it for advertising. Where UK/EU special-category rules apply, we rely on your explicit action or consent and/or another condition permitted by law. You can remove or change optional profile and planning information in the app.

Information about other people

You may add recipients, household members or invitees. You are responsible for providing only information you are entitled to provide, keeping it proportionate, and respecting their choices. An invited person can exercise the rights in this policy. Private data is not made visible to a group merely because it helped produce an aggregate recommendation; feature-specific sharing controls still apply.

Subscription and billing data

We do not store your full card number, CVV, or bank details. Payment card data is handled entirely by our payment processor (Stripe) and never touches our servers.

Social and invite data

Technical data

How we obtain data

We receive data from you; from people who invite or collaborate with you; from your device when you grant a permission; from connected services you authorise; from payment and app-store providers; and from retailers, booking or affiliate partners when they report an attributed transaction. Required account and payment fields are identified at collection. Other profile, location, calendar and preference fields are optional, although a feature may not work without the data it needs.

3. How We Use AI

Prinda uses artificial intelligence to generate, classify, research, explain and rank suggestions for gifts, experiences, activities and holiday destinations. AI-assisted content is presented as a suggestion or supporting information, not as a human expert decision.

• When you ask for a suggestion, we select relevant context such as interests, broad location, budget, occasion, travel preferences, group composition and accessibility requirements. Prompts can include names or free text you supplied where needed for the requested result. We aim to minimise what is sent; do not enter secrets or unnecessary sensitive data in a prompt or note.
• AI requests are routed through OpenRouter to the model configured for that feature. Available model developers can include Google, Anthropic, xAI, Meta, OpenAI, Perplexity and others shown by OpenRouter. The model can change for quality, safety, availability or cost. These parties act under their applicable data-processing and retention settings; we review those settings and do not permit use of Prinda prompts for their independent advertising.
• The AI is not used for third-party behavioural advertising or to make solely automated decisions with legal or similarly significant effects. Prinda does use the person, group, occasion, timing, location, and budget context you provide to rank relevant recommendations and clearly labelled sponsored options inside Prinda.
• We store the suggestions generated so we can show them to you again and improve future results — you can discard any suggestion at any time.
• Prinda Learning may infer limited travel preferences from actions such as votes or shortlisting only when the relevant in-product permission is active. You can pause, reset, export or revoke that learning permission. Protected requirements such as accessibility are not silently inferred from ordinary clicks.

Automated decision-making (GDPR Article 22): Prinda does not make solely automated decisions that produce legal or similarly significant effects on you. All AI suggestions (gifts, experiences, destinations) are advisory recommendations only — you always decide whether to act on them. No automated profiling, scoring, or decision-making of any legal significance takes place.

EU AI Act transparency: Prinda is generally a deployer of third-party general-purpose AI models, not the provider of those underlying models. Our consumer recommendation features are not intended for prohibited practices or a high-risk purpose listed in the EU AI Act. We identify AI-assisted features, keep people in control, provide ways to report unsuitable output, maintain proportionate logging and oversight, and train relevant personnel in AI literacy. If a feature's purpose or legal classification changes, we will reassess it before release. AI output that could affect safety, travel, accessibility, health, price or legal decisions must be independently checked against current authoritative sources.

4. Who We Share Data With

We do not sell your data. We share it only with services essential to running Prinda:

For restricted international transfers we use an applicable adequacy decision, the UK International Data Transfer Agreement or UK Addendum, EU Standard Contractual Clauses, or another lawful safeguard, together with transfer-risk review where required. Some providers may also rely on an approved certification framework where available. You may request information about the relevant safeguard. We do not sell personal data or share it with data brokers. Sponsored partners do not receive your identifiable Prinda profile merely because their placement is shown.

5. Legal Basis for Processing (UK GDPR)

• Contract performance — processing your account and gift list data is necessary to provide the Prinda service you signed up for.
• Legitimate interests — improving the app, preventing fraud, and maintaining security. We have conducted Legitimate Interests Assessments (LIAs) for each processing activity relying on this basis, balancing our interests against your rights and freedoms. You may request a copy of a relevant LIA by contacting privacy@prinda.ai.
• Consent — for optional features such as push notifications, birthday reminders, or marketing communications, where we ask separately. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Explicit consent or another permitted special-category condition — where an optional feature uses health, disability, religious or similarly sensitive information.
• Legal obligation — retaining billing and financial records as required by UK tax and financial reporting law.

6. How Long We Keep Your Data

• Account and gift list data — kept for as long as your account is active, or until you delete it.
• Deleted accounts — active account content is deleted or irreversibly de-identified within 30 days, except data that must be kept for legal claims, fraud prevention, financial obligations, another user's independent record, or secure backups. Backup copies age out under our backup schedule and are not restored for ordinary use.
• AI suggestions and feedback — generally retained with the related account or planning item until you delete it or the account; de-identified aggregates may be retained.
• Security logs — sign-in logs retained for up to 90 days for fraud prevention.
• Commercial interaction logs — identifiable click and recommendation telemetry retained for up to 24 months for attribution, fraud prevention, and product measurement, then deleted or aggregated unless needed for an active dispute.
• Push notification tokens — deleted immediately when you revoke notification permission or delete your account.
• Billing and financial records — retained for 7 years as required by UK financial regulations (HMRC). Payment transaction records are retained in anonymised form where full deletion conflicts with legal obligations.
• Legal consent and rights-request records — retained as necessary to demonstrate compliance and resolve claims, normally up to 7 years.

7. Your Rights

Under UK GDPR you have the right to:

• Access — request a copy of all data we hold about you.
• Rectification — correct inaccurate data in your profile or gift lists.
• Erasure — delete your account and all associated data. You can do this from Settings → Delete Account or by emailing privacy@prinda.ai.
• Portability — receive your data in a machine-readable format (JSON or CSV) on request.
• Restriction — request that we stop processing your data while a dispute is resolved.
• Object — object to processing based on legitimate interests at any time, including processing for direct marketing.
• Withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting prior processing.
• No automated decision-making — you have the right not to be subject to solely automated decisions with significant effects (see Section 3 — we do not engage in such processing).
• Complain — lodge a complaint with the ICO or, where EU GDPR applies, your local supervisory authority.

To exercise any of these rights, email privacy@prinda.ai. We will respond within one calendar month as required by UK GDPR. If you are not satisfied with our response, you have the right to complain to a supervisory authority:

• UK users: Information Commissioner's Office (ICO) — ico.org.uk
• EU/EEA users: your national Data Protection Authority. A full list is available at edpb.europa.eu.
• Outside UK/EU: contact us directly and we will assist you in identifying the appropriate authority for your jurisdiction.

8. Children's Privacy

Prinda accounts are not for children under 13. A user under the digital-consent age in their country must have valid parent or guardian authorisation where law requires it. Adults should use particular care before adding a child's details: use the minimum necessary, avoid sensitive free text, and do not enable sharing without authority. We do not use children's data for behavioural advertising.

If we learn that an account or data was created without required authorisation, we may suspend access while we verify the position and will delete data where required. A parent or guardian can contact privacy@prinda.ai.

9. Website Analytics, Cookies, Local Storage, and App Tracking

Strictly necessary cookies, local storage and session storage keep you signed in, protect your account, remember choices and provide requested features. These are used without analytics consent where permitted. You can clear them in your browser, but parts of the service may stop working.

Public website only: with your analytics consent, Google Analytics may collect a consent identifier, truncated or otherwise processed IP/network information, browser and device attributes, approximate location, referrer, pages viewed and interaction events. Google may set or read analytics storage. You can reject analytics without losing access and change your choice using the cookie-settings control. Microsoft Bing may receive ordinary web requests when it crawls the public site and provides webmaster/search reporting; we found no Bing advertising or behavioural analytics tag in the Prinda client. If we add one, it will remain off until the required consent and this notice are updated.

Native apps: the installed iOS and Android apps do not include Google Analytics, Bing analytics, third-party behavioural analytics, advertising identifiers or cross-app tracking. They do use necessary service communications and privacy-minimised first-party operational events, such as feature reliability, recommendation impressions, outbound clicks, security events and subscription validation. On iOS we do not use IDFA; on Android we do not use the Advertising ID.

If you follow a retailer, map, video, booking or other external link, that provider's privacy and cookie terms apply. Embedded content is identified where practical and may make a request to its provider when you choose to load or play it.

10. Security

We take security seriously. Your password is hashed using industry-standard algorithms and is never stored in plain text. All data is transmitted over HTTPS/TLS. Access to the database is protected by Row Level Security (RLS) policies — database rules ensure you can only read and write your own data, even at the infrastructure level. We monitor for unusual access patterns and review security practices regularly.

No service can guarantee absolute security. Use a unique password, enable available multi-factor authentication, keep devices updated, review sharing controls, and report suspected misuse promptly.

11. Data Breach Notification

In the event of a personal data breach, we will assess the risk to your rights and freedoms without delay. Where required by UK GDPR (Article 33), we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of a qualifying breach. If the breach is likely to result in a high risk to your rights and freedoms (for example, exposure of sensitive gift-list or financial data), we will notify you directly without undue delay in accordance with GDPR Article 34.

Any breach notification we send to you will include: what happened and when, what data was involved, what steps we have taken to address the breach, and how to contact us for further information or to exercise your rights.

12. International Users

California Residents (USA)

We do not sell your personal information as defined by the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), and we have not done so in the preceding 12 months. California residents have the right to: know what categories of personal information we collect and why; request a copy of the specific personal information collected about them; request deletion of their personal information; opt out of any future sale of their data (which we do not conduct); and not be discriminated against for exercising these rights.

To exercise any California privacy right, contact privacy@prinda.ai. We will respond within 45 days as required by CCPA. California residents also have rights under the California "Shine the Light" law (Cal. Civ. Code § 1798.83) regarding disclosure of personal information to third parties for direct marketing — we do not disclose personal information for direct marketing purposes.

Canada

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25). Canadian residents have the right to access their personal information, request correction of inaccurate information, withdraw consent for non-essential processing, and lodge complaints. To exercise these rights, contact privacy@prinda.ai. Unresolved complaints may be referred to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for Quebec residents, the Commission d'accès à l'information (CAI).

Australia

To the extent applicable, we handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). Australian residents may request access to or correction of their personal information held by us. We will respond to access requests within 30 days. If you believe we have handled your information in breach of the APPs, you may raise a complaint directly with us at privacy@prinda.ai. If not resolved, complaints may be referred to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Other Jurisdictions

We respect applicable privacy laws in all countries where Prinda is used. If the laws of your country grant you additional privacy rights not described here, please contact us at privacy@prinda.ai and we will do our best to accommodate your request and comply with applicable law.

13. Changes to This Policy

We may update this privacy policy from time to time. For material changes we will provide a prominent in-app or email notice before they take effect where practical. We will request fresh consent only where consent is the lawful basis and the existing consent no longer covers the processing; acknowledgement of a notice is not used to manufacture consent where another lawful basis applies.

For minor, non-material changes (such as clarifications, corrections, or contact detail updates), we will update the "Last updated" date at the top of this page and note the change in the app. You can always review the current version at prinda.ai/legal/privacy.html.

14. Contact Us

For any privacy questions, data requests, or concerns:

• Privacy & data requests: privacy@prinda.ai
• General support: support@prinda.ai
• General enquiries: hello@prinda.ai
• Support page: www.prinda.ai/support
• Post: Prinda.ai Ltd, Lowin House, Tregolls Road, Truro, Cornwall, TR1 2NA, United Kingdom