Privacy Policy

Last updated: June 2026

Euphora (“we”, “us”) operates the website euphora.io. This privacy policy explains what information we process, how we use it, and your rights under the General Data Protection Regulation (GDPR).

What we process

When you use Euphora's gift finder, we process:

• The details you provide about the gift scenario, whether you type them or select them in the guided finder: the recipient's relationship, the occasion, your budget, interests, and coarse recipient attributes such as age range and gender
• Which products you view, select, or pass on during a session
• Any feedback you provide during refinement (e.g. budget adjustments, preference notes)
• Your approximate country, derived from your connection (country-level only, not city or precise location)

This information is linked to a randomly generated session identifier. We do not link it to your name, email, IP address, or any other personally identifying information.

What we don't collect

• We don't require an account or login
• We don't collect your name, email address, or contact information
• We don't store your IP address
• We don't track your browsing activity across other websites
• We don't use advertising cookies, tracking pixels, or retargeting
• We don't sell or share any data with third parties for marketing purposes

How we use your data

We process session data for two purposes:

1. Generating your recommendations: your input text is parsed to understand the gift scenario and match it against our product catalog. Your text is sent to a third-party AI service provider for parsing into structured data (such as relationship, occasion, and budget). The provider processes this transiently via API and does not use inputs for model training. No personally identifying information is included in these requests.
2. Improving recommendation quality: aggregated, anonymised patterns from sessions are used to improve the service over time. See “Adaptive learning” below.

Legal basis

We process session data on the basis of legitimate interest (Article 6(1)(f) GDPR). Our legitimate interest is providing and improving the gift recommendation service. This processing is necessary for the service to function; there is no less intrusive alternative that achieves the same result. We consider the impact on data subjects to be minimal because we do not collect identifying information, sessions are anonymous and auto-expire, retention periods are short, and learning outputs are aggregated statistics that cannot be traced to individuals.

Adaptive learning

Euphora uses an adaptive learning system that analyses aggregated session data to improve recommendation quality for all users. This system does the following:

• Learns which product categories are preferred for different gift scenarios
• Calibrates typical budget ranges by relationship type
• Identifies products with low acceptance rates and adjusts their visibility
• Detects common interest combinations to improve matching
• Tracks per-country category preferences to better serve users in different regions

All learning outputs are aggregated and statistical. They describe population-level patterns, not individual behaviour. Individual sessions cannot be reconstructed from these outputs. Within the meaning of Recital 26 GDPR, these aggregated statistics are anonymous data and are not subject to data protection regulation.

Adaptive learning is integral to how the service delivers and improves recommendations. It cannot be separated from service delivery. The raw session data used as input is subject to the retention periods described below and is automatically deleted.

Cookies

Euphora uses two cookies:

euphora_session remembers your active gift recommendation session so you don't lose your results if you refresh the page. Duration: 24 hours. This is a strictly necessary cookie required for the site's core function under the ePrivacy Directive and does not require consent. It contains only a random session identifier, not personal information.

euphora_country stores your country code (e.g. “GB”, “DE”) so we can show relevant shipping information. Duration: 30 days. Detected automatically from your connection; you can change or delete it at any time. Contains only an ISO country code, not personal information.

We do not use advertising, analytics, or tracking cookies.

Local storage

We use your browser's localStorage to remember preferences like your region and currency. This data stays entirely in your browser, is never sent to our servers, and is never shared with anyone. You can clear it at any time through your browser settings.

Analytics

We use our own privacy-focused analytics system to understand how many people visit our site and which pages are popular. This system does not use cookies, does not collect personal data, and does not track individual users across sessions. Page views are counted using anonymised, non-reversible hashes that rotate daily; we cannot identify who visited, only how many people did. All analytics data is stored within the EU. No data is shared with third parties.

Affiliate links

When you click a product link, you are redirected to the retailer's website via an affiliate tracking system. The affiliate network may set its own cookies on the retailer's domain to track the purchase for commission purposes. We do not control these cookies; they are governed by the affiliate network's and retailer's own privacy policies.

Data retention

We apply the following retention periods, enforced by automated daily cleanup:

• Sessions: expire after 24 hours of inactivity. Expired session data is permanently deleted within 60 days.
• Interaction events (products you viewed, selected, or passed on): deleted after 90 days.
• Interest signals (categories that matched your scenario): deleted after 30 days.
• Analytics events: raw data deleted after 90 days. Daily aggregates (non-personal) are retained indefinitely.
• Adaptive learning outputs (anonymous, aggregated statistics): retained indefinitely. These contain no personal data.

Data location

Session data and analytics are processed and stored within the European Union. AI text parsing uses a US-based service provider via API, subject to their data processing terms. No personally identifying information is included in these API requests.

Your rights under GDPR

The GDPR grants individuals in the European Economic Area rights including access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with a local data protection authority.

Euphora is designed so that we do not identify users. We do not collect names, emails, IP addresses, or any other identifying information. Under Article 11 GDPR, where we cannot identify a data subject, we are not required to process rights requests under Articles 15 to 20 unless you provide additional information that enables us to locate your data.

If you wish to exercise a right, you may contact us with the session identifier stored in your browser's cookies (named euphora_session). If we can locate data associated with that identifier, we will act on your request. Otherwise, your session data will be automatically and permanently deleted within the retention periods listed above.

Under Article 21, you have the right to object to processing based on legitimate interest. Session processing and adaptive learning are integral to delivering the recommendation service and cannot be separated from it. If you do not wish your session data to be processed in this way, you may choose not to use the gift finder.

To exercise any right or raise a concern: [email protected]

Children

Euphora is not directed at children under 16. We do not knowingly collect information from children.

Changes

We may update this policy from time to time. The current version is always available on this page.

Contact

For privacy questions: [email protected]