Privacy Policy

1. Who handles your data

Codetum Oy is the data controller for Jingle. Our contact details are above. This policy covers organizers, participants, visitors, and people who contact us.

2. What we collect

We collect participant names and mobile numbers from the organizer, who may be someone else in your group. We also store assignments, order references, payment amount and currency, payment status, and SMS delivery and retry records. When you contact us, we receive your contact details and message.

Our website and infrastructure providers may process IP addresses, request and device information, and security logs. We use a country code supplied by our infrastructure to choose the initial pricing currency. Stripe collects payment information directly and may return payment references and customer contact details. We do not receive your full card details.

3. Why we use it

We use organizer data to fulfill the order and provide support (GDPR Article 6(1)(b), contract). We use participant data to run the agreed gift exchange and send matches, based on our and the group’s legitimate interest in delivering that requested service (Article 6(1)(f)). The organizer must first ask participants and share this notice.

We use necessary technical and order records to secure the service, prevent fraud, investigate delivery problems, and handle claims (legitimate interests). We retain required payment and accounting records to meet legal obligations (Article 6(1)(c)). We do not sell personal data or use participant numbers for marketing.

Names and mobile numbers are needed to provide the service; without them, we cannot send matches. The draw is automated and random, but we do not use profiling or automated decisions with legal or similarly significant effects.

4. Who receives it

Twilio and mobile network providers handle recipient numbers, message contents, and delivery information. Each participant receives their assigned person’s name. Stripe handles payment; Jingle sends it the order reference, amount, currency, and group size, not the participant list.

Hosting, database, network, and support providers may handle information needed to operate the service. Authorized staff may access records for support and administration. We may share necessary records with professional advisers or authorities when legally required or needed to handle a claim.

Providers may process data outside the EU/EEA. Such transfers require an applicable GDPR safeguard, such as a European Commission adequacy decision or standard contractual clauses with any necessary additional protections. Contact us for details of the providers, transfer locations, and applicable safeguards or copies of them.

5. How long we keep it

Retention depends on what the information is needed for: completing the draw and delivery retries, resolving support issues, meeting accounting obligations, and establishing or defending legal claims. Names, numbers, and assignments are not accounting records merely because they belong to a paid order.

The app currently has no automatic deletion schedule; server-side order and message records remain until manually deleted. Retention must be limited to those purposes. You can contact us to request deletion or ask about the retention of your order. Legally required records and information needed for an ongoing claim may need to be kept longer.

6. Browser storage

When you continue to checkout, Jingle stores the group’s names, numbers, currency, and a checkout reference in your tab’s session storage so you can return from payment. This normally lasts for the tab’s session and can be removed through your browser settings. Jingle does not add advertising or analytics cookies. Stripe’s hosted payment page and infrastructure providers may use their own necessary storage.

7. Your rights

Email [email protected] to request access, correction, deletion, restriction, or, where applicable, a portable copy of your data. You can object to processing based on legitimate interests for reasons relating to your situation. If processing is based on consent, you may withdraw it without affecting earlier lawful processing.

These rights depend on the circumstances and are not always absolute. We may need to verify your identity and protect other participants’ information. We normally respond within one month; if a lawful extension is needed, we will explain it within that month. A data correction cannot recall an SMS already sent.

You may complain to the Finnish Data Protection Ombudsman or your local EU/EEA supervisory authority.

8. Updates and questions

We update this policy when our data handling changes and show the effective date above. We will provide any further notice required by law. For privacy questions, contact [email protected].