Gratos Privacy Policy

Notice. Gratos is available by invitation while we add merchants city by city. This document is effective and applies to your use of the service. It will be reviewed by counsel and may be updated as the product develops; material changes will be notified as described in the Changes section. Questions: support@gratos.ai.

Last updated: October 22, 2026 Effective: October 16, 2026

Gratos Inc. ("Gratos," "we," "us") operates a gifting platform with an agent that acts on a sender's behalf: it interprets a gift request, finds products across third-party merchants, and completes the purchase once the sender approves it. This policy explains what personal information we collect, why, who we share it with, and the choices you have.

We do not sell your information, and we do not disclose it to data brokers or to third parties who resell it.

We do not ask for, or record in anyone's profile, allergies, medical conditions or health-related dietary restrictions at this time. See Section 3.3.

This policy covers two groups of people:

• Senders, who use Gratos to choose and send gifts. A Sender may use Gratos under the account of a business that has an agreement with us (a "Customer"), or as an individual for personal purposes.
• Recipients, who receive gifts sent through Gratos. Most Recipients never create a Gratos account. Section 3 is written for you.

"Merchant" means the third-party retailer, restaurant, florist, or other seller that fulfills a gift. Merchants are the sellers of record.

1. Information we collect about Senders

• Account and contact details, such as name, email address, phone number, and company name, and the sign-in identifiers from our sign-in provider, Apple, or Google. We do not store your password.
• Your profile, if you add it: your postal address, time zone, and a description of yourself.
• Messaging consent. If you link a phone number for text messaging, we record the number and when and from what IP address you consented.
• Gifts and activity: orders, approvals, budgets and settings, amounts, merchants and items, and records of who approved what.
• Payment information. You enter your card into our payment partner's form, not into Gratos. We never receive the full card number. We keep the card brand, last four digits, expiration date, cardholder name, billing ZIP code, and our payment partner's reference for the card. Where a business pays fees by card, our billing provider gives us similar limited card details.
• Communications: your conversations with the Gratos agent (in the app, on the web, by text message, or in Slack), and messages you send to support.
• Contacts you import. If you import people from your phone's contacts or a file, we receive the names, contact details, addresses, and dates on the cards you pick.
• Device and usage information: IP address, browser and device information, push-notification tokens if you allow notifications, server logs, and records of how you use the product, such as the searches you run.

If you dictate in the iOS app, Apple's speech recognition turns your voice into text and only the text reaches us. The iOS app contains no analytics or advertising software and does not use your location, photos, or camera.

2. How we use information

• To operate the Services: finding products, placing orders, and delivering gifts.
• To understand your requests, draft gift messages, and read the agent's replies aloud if you ask.
• To detect gift occasions in workspaces a Customer has connected.
• To send messages about orders, deliveries, approvals, and your account.
• To improve gift suggestions, including keeping the recipient preferences described in Section 4.
• To secure accounts and prevent fraud and abuse.
• To bill fees. Individual Senders pay no service fee at this time.
• To comply with the law.
• To market Gratos to businesses. We do not use Recipient information for this.

We do not use Recipient information or workspace data for advertising, or for credit, insurance, or employment decisions.

AI model training. We do not use your information or your conversations to train, fine-tune, or improve generally available AI models.

De-identified information. We may use information that has been de-identified so that it cannot reasonably be linked to you, and we will not try to re-identify it.

3. Information about Recipients

If you received a gift through Gratos and did not sign up for anything, this section is for you. We received your information from the business or person who sent you a gift. We did not buy it from a data broker.

3.1 What a sender can give us

• Your name, delivery address, email address or phone number.
• Your relationship to the sender and the occasion, and dates such as your birthday.
• Your age or birth year, used only to decide whether an age-restricted gift, such as alcohol, can be suggested.
• Ordinary preferences: likes, dislikes, interests, sizes, things to avoid, or a lifestyle diet such as vegetarian or keto.

This is what the sender told us, not what you told us, and some of it may be wrong. You can correct or delete it under Section 7.

If your employer has connected Gratos to its Slack workspace, our software may read workspace messages to detect occasions such as a birthday or a welcome post, and may post a gift suggestion in that thread. We keep the name and the occasion, not the messages we scan. Your employer decides whether this is on and is responsible for telling you.

3.2 What you give us yourself

A sender may send you a link asking for your delivery address. We use it only to deliver gifts, and the sender who asked receives it as their record of where a gift went.

If you follow a claim link and confirm you are the person the gift is for, you can tell us your likes, sizes, wishlist, and address on your own profile. Senders linked to your profile benefit from it when choosing a gift, but we do not show them your declared preferences, except your wishlist, which you can turn off. You can delete your profile in the app or by writing to privacy@gratos.ai.

3.3 Health information

At this time we do not ask for, or record in anyone's profile, allergies, medical conditions or health-related dietary restrictions, whether from senders or recipients. If someone types such information into a conversation anyway, it stays in that conversation's history; write to privacy@gratos.ai and we will delete it. See our Consumer Health Data statement at app.gratos.ai/health-privacy.

4. Recipient preferences

We keep preference records about Recipients so that gifting improves over time. Preferences recorded by a Customer's users are available to that Customer's users for future gifts. They are not shared with other Customers unless the Recipient creates their own profile. We record where most preferences came from, and preferences we infer ourselves may be wrong.

We use scoring to rank gift suggestions, but a person selects and approves every gift. We make no decisions about you that have legal or similarly significant effects.

5. How we share information

We share information with these categories of third parties:

• Merchants and the commerce platforms that place orders with them. They receive the recipient's name, delivery address and contact details, the gift message, and the sender's name and contact details, so they can fulfil the order. Merchants have their own privacy practices.
• Payment partners. They hold your card and issue a one-time payment credential for each purchase. We never receive your full card number.
• Affiliate networks. When Gratos places an order, it may use the retailer's affiliate-network link (for example impact.com or Rakuten Advertising) so the retailer can pay Gratos a commission on that order. The network and the retailer receive the order's value, our order reference, and, when Gratos places the order in its own browser, that browser's technical details. That browser is ours, not yours, so no affiliate cookie is set on your device. We use such a link only after you approve a gift, once per approved order, and never during search or pricing. A commission never changes what you pay.
• Service providers who help us run Gratos: hosting, databases, messaging and email, sign-in, fee billing, error monitoring, and network transit. On the web app, error monitoring may record a replay of your visit, with text you see or type masked before it leaves your browser.
• AI model providers: Anthropic, OpenAI and Google. They process your requests and the merchant pages we work with to help find and buy gifts. They do not use this data to train their models. Every provider that receives your information is bound by terms that require the same or equal protection of it. You can withdraw your permission for this sharing at any time in the app (Account › AI data sharing) or in the web app's settings; Gratos cannot use AI for you without it, so you will be asked to allow it again before you continue.
• Customers. If you use Gratos through a Customer's account, that Customer sees your activity on it.
• Senders. A sender sees what they and others on their account recorded about a Recipient, and any address the Recipient gave them.
• Legal and safety, and business transfers. Where the law requires it, to protect rights and safety, or in a merger or sale.

When we complete a purchase on a merchant's website, we keep a record of the steps we took and screenshots of the confirmation page and of any step that failed. These can show the delivery address and the gift. We keep them for the periods in Section 8.

We do not sell personal information or share it for cross-context behavioral advertising. A list of our service providers is available at privacy@gratos.ai.

6. Who decides what happens to your information

Gifts sent through a business account. We process the sender's information about you on the Customer's behalf, under a contract that restricts us to providing the Services. We may direct your request to that Customer and help them respond.

Gifts sent by an individual. We are responsible for that information. You exercise your rights directly with us, and we will not tell the sender you made a request.

In both cases we are responsible for our own account and billing records, security, and recipient profiles you create yourself.

7. Your rights

You do not need a Gratos account. Email privacy@gratos.ai with your name, the email address, phone number, or address the gift went to, and what you want.

Depending on where you live, you may have the right to know what we hold and where it came from, get a copy, correct it, delete it, limit use of sensitive information, opt out of sale or targeted advertising, withdraw consent, and not be treated worse for using these rights. You may use an authorized agent.

We will acknowledge your request within 10 business days and respond within 45 days, or tell you if we need up to 90 days in total. We may need to verify your identity. If we deny your request, you can appeal by replying "Appeal", and we will respond within 45 days.

Text messages. We text a Recipient only if that number has texted us first. Reply STOP to any message to stop, or HELP for help.

8. Retention and deletion

We keep information while your account is active and until you, or the person it is about, asks us to delete it, except:

Deleted information may remain in backups until they expire.

Deleting your account. You can delete your account in the app. Deleting it removes your name, email address, phone number and address, your login, your saved cards, your linked texting number, the people you added and your conversations. On a shared workspace, people added by other members stay with the workspace. It cancels gifts you scheduled that have not yet been bought, so they are not charged; a gift being bought at that moment still completes and is charged; address requests you sent that nobody has answered stop working. We keep your past orders as financial records, the record of your consent to receive texts and the record that you accepted our Terms, and we keep the time-limited records listed in the table above, such as approvals of payments and checkout logs, until their period ends and then delete them. If you signed in with Apple, remove Gratos from Sign in with Apple in your Apple Account settings to finish. You can also write to privacy@gratos.ai with any question about your data.

Recipients. Write to privacy@gratos.ai and we will delete what we hold about you, except what we need to complete a gift already on its way.

9. Regional disclosures

California. In the past 12 months we collected: identifiers; commercial information; internet activity; location inferred from address or IP; professional information; account log-in credentials; and inferences from these. Sources, purposes, and recipients are described in Sections 1, 2, 3, and 5. We use sensitive information only to provide the service, for security, and for quality assurance.

Washington and Nevada. We do not collect consumer health data at this time; see our Consumer Health Data statement.

Other US states. Residents of states with privacy laws have the rights in Section 7, including the right to appeal.

Outside the United States. The Services are offered only in the United States.

10. Security

We use encryption, access controls, and monitoring, and limit production access to a small number of people. No system is perfectly secure, and we do not yet hold a SOC 2 or similar certification.

Agents carry their own risks. The Gratos agent acts on your behalf. It can make mistakes, including an unintended purchase or message, and it reads content from merchants and others that may try to mislead it. No gift purchase happens without a recorded approval from a person and a payment authentication with our payment partner. Review the agent's activity as you use Gratos.

11. Cookies

The web app uses only the cookies our sign-in provider needs to keep you signed in. We do not use advertising cookies or third-party analytics. When Gratos places an order in its own browser, that browser may receive affiliate-network cookies from the retailer; those cookies never reach your device.

12. Children

No one under 18 may have a Gratos account, and every recipient must be an adult. A gift meant for a child is sent to an adult, such as a parent. If we learn we hold information about a child beyond a first name in a gift message, we delete it. A parent or guardian can ask us to delete it at privacy@gratos.ai.

13. Changes

We will update the date at the top when this policy changes, and give advance notice of material changes to how we use information already collected.

14. Contact

Gratos Inc. Attn: Privacy c/o Legalinc Corporate Services Inc. 131 Continental Dr, Suite 305 Newark, DE 19713

Privacy requests: privacy@gratos.ai Legal notices: legal@gratos.ai Security reports: security@gratos.ai Everything else: support@gratos.ai