Privacy Policy

Reindeers Forever Gifts ("we," "us," or "our") is a 501(c)(3) tax-exempt nonprofit organization dedicated to connecting generous donors with children in need through gift matching.

This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you visit our website at rewardsandgifts.com and use our platform (collectively, the "Service").

By accessing or using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

a) Information You Provide

• Account registration: email address, username, and role selection (Donor, Recipient, or Care Agency)
• Profile information: display name and avatar image
• Gift requests: item descriptions, images, and categories
• Offer listings: item descriptions, images, condition, and quantity
• Communications: feedback and support messages you send to us

b) Information Collected Automatically

• Log data: IP address, browser type, device information, and pages visited
• Cookies: session cookies for authentication and preference cookies
• Usage data: gift browsing patterns and donation matching activity

c) Information from Third Parties

If you sign in using Google, we receive your name and email address from Google with your consent.

We use the information we collect to:

• Operate and maintain the gift matching platform
• Match donors with gift recipients and facilitate donations
• Process and display gift requests and free item offers
• Send notifications about donation matches and platform updates
• Ensure platform security and prevent fraudulent activity
• Analyze usage patterns to improve the Service
• Comply with applicable legal obligations
• Communicate about our nonprofit programs, impact, and initiatives

We do not sell your personal information.

We may share your information only in these limited circumstances:

• Donation matching: when a donor fulfills a wish, limited information (such as username and gift details) is visible to both parties to facilitate the donation.
• Service providers: we use Amazon Web Services (AWS) for hosting, authentication, and data storage. These providers act as data processors under contract and may only use your data to provide services to us.
• Legal requirements: we may disclose your information if required by law, court order, or governmental request.
• Safety: to protect the rights, safety, or property of our users, the public, or Reindeers Forever Gifts.
• Nonprofit reporting: aggregated, anonymized statistics may be shared in impact reports. These statistics cannot be used to identify individuals.

We rely on the following third-party services:

Our platform facilitates physical gift matching only. We do not process any online payments.

Each third-party service operates under its own privacy policy. We encourage you to review the AWS Privacy Policy and Google Privacy Policy.

We take reasonable measures to protect your personal information:

• All data is transmitted using HTTPS/TLS encryption
• Passwords are managed by AWS Cognito and are never stored in plaintext
• Access to user data is restricted based on user roles and the principle of least privilege
• We conduct regular security monitoring of our systems

While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to implementing and maintaining appropriate safeguards.

All Users

• Access your personal data through your account dashboard
• Update or correct your profile information at any time
• Request deletion of your account and associated data by contacting us
• Opt out of non-essential email communications
• Manage cookie preferences through your browser settings

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know what personal information we collect, use, and disclose
• Right to delete your personal information, subject to certain exceptions
• Right to opt-out of sale — we do not sell personal information
• Right to non-discrimination for exercising your privacy rights

To exercise these rights, please email us at the address listed below. We will respond to verifiable requests within 45 days.

Other US State Privacy Laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other states with comprehensive privacy laws have similar rights. Please use the same contact method to submit requests. We will process them in accordance with applicable state law.

• Active accounts: we retain your data for as long as your account is active and the Service is in use.
• Deleted accounts: upon account deletion, your personal data will be removed within 30 days, except where retention is required by law.
• Gift matching records: retained in anonymized form for nonprofit impact reporting.
• Log data: retained for up to 12 months for security and fraud prevention purposes.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email and/or by posting a notice on the Service at least 30 days before the changes take effect.

If you have questions or concerns about this Privacy Policy or wish to exercise your privacy rights, please contact us: