Privacy Policy

This English text is a courtesy translation; the German version is legally binding.

1. Controller

The controller within the meaning of the GDPR is:

2. Hosting & server logs

The site is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, acting as our processor (Art. 28 GDPR). Data may be transferred to the USA; Vercel is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Technical access data (e.g. IP address, time, page requested) is processed automatically. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). For cookieless audience measurement we also use Vercel Web Analytics: no cookies are set and nothing is stored on your device; only pseudonymised, aggregated data is recorded (e.g. page, time, referrer, country, device type, browser), and visitors are told apart by a hash discarded after 24 hours. In the same pseudonymised way we also count how often gift suggestions are shown and Amazon links are clicked (without search terms or product names). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the site). More: vercel.com/docs/analytics/privacy-policy.

3. Local storage

The gift finder stores your funnel answers, anonymous usage events and interim results locally in your browser. To improve the service, we also transmit pseudonymous usage data of your session to our own database (see section 12). Depending on your consent, analytics and marketing events are sent to the services listed in sections 5–9.

4. Cookies & consent management (Cookiebot)

We use the consent platform Cookiebot (Usercentrics A/S, Copenhagen) to obtain, document and manage your consent. Your choice is stored in the “CookieConsent” cookie (12 months). Legal bases: Art. 6(1)(c) and (f) GDPR, § 25(2) TDDDG. You can change or withdraw consent anytime via “Cookie settings” in the footer.

5. Google Tag Manager

We use Google Tag Manager (Google Ireland Ltd.) to manage analytics and marketing tags. It is loaded when you visit the site, which technically transmits your IP address to Google. It sets no cookies of its own and controls the services below according to your consent. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in consent-controlled management of these services). Data may be transferred to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework.

6. Google Analytics 4

With your consent (Art. 6(1)(a) GDPR), we use Google Analytics 4 to evaluate site usage. IP addresses are not logged / truncated on collection; retention is 14 months. Free-text entries are not sent to Google Analytics. Without consent, only cookieless, aggregated signals without device recognition are transmitted (Google Consent Mode). Data may be transferred to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework.

7. Google Ads (conversion & remarketing)

With your consent (Art. 6(1)(a) GDPR), we use Google Ads conversion tracking and remarketing to measure ad performance and show interest-based ads. Without consent, only cookieless Consent Mode signals apply.

8. Meta Pixel (Facebook/Instagram)

With your consent (Art. 6(1)(a) GDPR), we use the Meta Pixel (Meta Platforms Ireland Ltd.) to measure the effectiveness of Facebook/Instagram ads and build audiences. Without consent, the pixel is not loaded. Joint controllership (Art. 26 GDPR) applies to the “Insights” function. Data may be transferred to the USA (DPF).

9. Pinterest Tag

With your consent (Art. 6(1)(a) GDPR), we use the Pinterest Tag (Pinterest Europe Ltd., Dublin) to measure the effectiveness of Pinterest ads, build audiences and understand how visitors coming from Pinterest interact with our site (e.g. page visits and clicks on Amazon links). Without consent, the tag is not loaded. Data may be transferred to the USA (DPF).

10. AI gift recommendations

For recommendations, your funnel details (recipient, occasion, budget, interests, optional free text) are sent to and processed by an AI service (Google Gemini API, Google LLC). The legal basis is Art. 6(1)(b) GDPR (performance of the service you requested). A transfer to the USA may take place; Google LLC is certified under the EU-U.S. Data Privacy Framework. Please do not enter personal data of third parties or any sensitive information (e.g. about health, religious or philosophical beliefs, or sex life) in the free-text field.

11. Amazon Associates

Beeshopping participates in the Amazon Associates program. Clicking an ad link takes you to Amazon; from there Amazon’s privacy policy applies.

12. Sharing gift ideas and usage statistics (Supabase)

For every completed gift selection we automatically store a snapshot of the displayed selection (gift ideas and categories together with the recipient, occasion, interest and budget details, including freely entered labels — but without your free-text description and without the personal AI summary) under a random, unguessable link ID. Via the associated result link — which you can pass on using “Share” or directly from the address bar — recipients see the same selection. Snapshots are deleted 12 months after the last retrieval; snapshots that are never opened are deleted after 3 months. To improve the gift finder, we also store pseudonymous usage data of your session: the steps you chose, your inputs including free-text entries, the generated recommendations, clicks on Amazon links and the origin of your visit (the address of the referring website without path details, the entry page you opened and any campaign identifiers in the address; advertising click identifiers such as “gclid” are not stored as values — we only record that one was present). The data is stored in a database at Supabase (EU region Frankfurt) acting as our processor; no IP addresses, cookies or cross-device identifiers are stored, and the assignment is based solely on a random session ID. This usage data is deleted after 24 months. Legal bases: Art. 6(1)(b) GDPR (providing shared links) and Art. 6(1)(f) GDPR (legitimate interest in improving the service). Please do not enter third-party personal data or any special categories of personal data within the meaning of Art. 9 GDPR (e.g. data about health, religious or philosophical beliefs, or sex life) in the free-text fields. We do not need any special categories of personal data. If such data is entered nonetheless, we will delete it on request.

13. Voice input

Instead of typing, you can optionally dictate your input using the microphone. For this we use the speech recognition built into your browser (Web Speech API). Speech recognition is performed not by us but by your browser: in Google Chrome, the audio recording is sent to a Google speech recognition service for this purpose; in other browsers it may be sent to a service of the respective browser vendor. The privacy policy of the respective provider applies. We do not receive any audio data, only the recognized text, which is then processed like typed input (see sections 10 and 12). The legal basis is Art. 6(1)(b) GDPR (performance of the service you requested). Voice input is optional; you can always type your details instead.

14. Product images

The images of gift ideas and topics shown on the site are loaded directly from the image libraries Pexels (images.pexels.com) and Unsplash (images.unsplash.com). When the images are loaded, your browser necessarily transmits your IP address and standard connection data (e.g. time, browser type, requested image file) to the respective provider. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in an appealing and fast-loading presentation of the gift ideas. The providers are Pexels, a brand of Canva Germany GmbH, Pappelallee 78/79, 10437 Berlin, Germany, and Unsplash Inc., a Getty Images company; Unsplash images are delivered via the service provider imgix. According to Pexels, data may also be processed in countries outside the EU (including the USA and Australia). Processing in third countries, in particular the USA, is also possible with Unsplash; Unsplash does not provide further details. More information: pexels.com/privacy-policy and unsplash.com/privacy.

15. Your rights

You have the rights to access, rectification, erasure, restriction, data portability and objection, and the right to lodge a complaint with a supervisory authority (Art. 15–21, 77 GDPR). The supervisory authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany. You can withdraw consent at any time with future effect via “Cookie settings” in the footer.

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

16. Cookie declaration

The following automatically updated overview lists all cookies and services in use:

Last updated: October 2026