Privacy Policy

Last updated: 13 September 2026

Buy Me This (“we”, “us”) is a private gift-capture app. This policy explains what personal data we collect, why, and your rights under UK GDPR and the Data Protection Act 2018.

Who we are

Buy Me This is a trading name of AG Cyber Ltd, a company registered in England and Wales (company number 14513719), registered office New Court, The Steadings Business Centre, Maisemore, Gloucester GL2 8EY. AG Cyber Ltd is the “data controller”. For any privacy question or to exercise your rights, contact support@buymethis.online.

How we make money (and how we don't)

Buy Me This is funded by subscriptions — you pay for the app, and that's it. We don't show ads, we don't use affiliate links, and we never sell or rent your data or share it for marketing. AI gift suggestions are optional and opt-in, used only to help you — never to advertise to you or anyone else.

What we collect

Account data: your email address, an optional display name, and a securely hashed password.
Content you create: the people you add (names, relationships, notes, birthdays/anniversaries), gift items (titles, notes, prices, links, retailers), photos you upload, and private fields such as where you've hidden a bought gift.
Operational data: minimal logs and sync/event records used to run the service, keep it secure, and fix problems, plus your storage usage. We do not use advertising trackers or third-party analytics SDKs.
Technical data: the IP address you use to register and to sign in. We keep a short history of these to protect the service from abuse and to meet our legal obligations (see “Keeping everyone safe” below); they are automatically deleted after about three months. If you turn on group alerts in the app, we also store a push-notification token for your device so we can send the (deliberately vague) “something's new” nudge; it's removed when you sign out or delete your account. Group alerts never include what was added or who added it.

Other people's information

You may record details about other people (for example a friend's name or birthday). You're responsible for adding only information you're entitled to keep. This data is private to your account and is never shown to those people or anyone else.

Why we use it (lawful basis)

To provide the service (your account and the content you create): performance of a contract with you.
To keep the service secure and working (operational logging, abuse prevention, storage limits): our legitimate interests.
To meet our legal obligations (online-safety duties, and detecting and reporting child sexual abuse material — including keeping the sign-in IP history described above): compliance with a legal obligation.
Where we ever rely on consent, you can withdraw it at any time.

Who processes your data

We host the service on Cloudflare (application, database, image storage) and send transactional email (verification, password reset) via Resend. When you paste a shop link, we read its title, price and image — first from your own device, and if that's blocked, via Zyte, a web-extraction service that fetches the page for us. Barcode scans are looked up via UPCitemdb. If you turn on AI gift suggestions, the relevant recipient details are sent to Anthropic to generate ideas (processed on our behalf, not used to train their models). These providers act as our processors and may process data on infrastructure outside the UK; where they do, appropriate safeguards apply. We are integrating the Internet Watch Foundation (IWF)'s image-matching service to check uploaded images against known child sexual abuse material (see “Keeping everyone safe” below). We do not sell your data or share it for marketing.

Keeping everyone safe

Your photos are cleaned on upload. Every image you add is automatically stripped of embedded metadata — such as GPS location and device details — before it's stored, so you don't accidentally share where a photo was taken.

Image safety scanning. To keep everyone safe and to meet our legal obligations under the Online Safety Act 2023, we are integrating automated checking of uploaded images against the Internet Watch Foundation (IWF)'s database of known child sexual abuse material (CSAM). We will update this policy when that checking is live. It is an automated hash-comparison — we don't otherwise browse your photos. Where such material is identified, or reported to us, we are legally required to remove it and to report it to the relevant UK authorities (such as the National Crime Agency), along with information necessary for that report (which can include account details and the sign-in IP history noted above). This is the reason we keep a short IP history. Anyone can also report an item shared with them in a group from within the app; every report is reviewed by a person.

How long we keep it

We keep your data while your account is active. When you delete an item, person, or your whole account, the associated data is removed; routine backups and logs age out shortly afterwards. Sign-in IP records are automatically deleted after about three months.

Your rights

Under UK GDPR you have the right to access, correct, delete, export (portability), restrict, or object to our processing of your personal data, and to withdraw consent. In the app, go to Settings → Your data to export everything we hold about you as a file, or to permanently delete your account and all its data. You can also email support@buymethis.online for help exercising any of these rights.

Outside the UK you get the same rights, wherever you live. US state privacy laws (such as California's CCPA) describe rights to know, delete and correct, and to opt out of the sale or sharing of personal information and targeted advertising: we don't sell or share personal information, show no advertising and don't profile you, so there is nothing to opt out of. Send any request to the address above and we'll answer within the time your local law sets (45 days in the US). We won't treat you differently for asking.

Security

Data is encrypted in transit (HTTPS). Passwords are stored only as salted hashes, never in plain text. Your images and content are access-controlled and private to your account.

Children

Buy Me This is not intended for children under 16. On the US App Store, Apple handles age assurance and parental consent; we receive only an age range (not a date of birth) and use it solely to apply the 16+ rule, keeping a record of the range and when we received it.

Changes

We may update this policy as the app evolves; we'll change the “last updated” date above and, for significant changes, let you know in the app.

Complaints

If you're unhappy with how we've handled your data you can contact us, or complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.