Privacy and legal
Last updated: 5 November 2026
This notice explains what personal data Piploop uses, why, who else is involved and what your rights are. Piploop is in beta and open to anyone with a Google account. We keep what we collect to what Piploop needs to work.
Who runs Piploop
Piploop is run by Ryan Delia, a sole trader trading as DSL (Delcoserv). He is the data controller for Piploop.
Ryan Delia, trading as DSLMalta
VAT registration number: 33065719
Email: privacy@delcoserv.com
Write to that address for any privacy question or request.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Your Google account details: name, email address, profile photo and a Google account ID, received when you sign in with Google. | To sign you in and show your name to people you share loops and lists with. | Providing the service you asked for (contract) |
| Loops: the gift, the recipient's name, the occasion and dates, the target amount, notes, a gift link and picture, and the organiser's payment link (for example a Revolut link). | To run the group gift. | Contract |
| Pledges: your name, the amount, an optional message, and whether it was paid and received. | To track who has chipped in. Money is paid outside Piploop, directly to the organiser. | Contract |
| Wishlists: list names, items (name, link, picture, price, note), an optional character, an optional photo, and co-managers' email addresses. | To share wishlists and let people mark gifts as bought without spoiling the surprise. | Contract |
| Gift history: gifts you organised, chipped in to or marked as bought. | To show you what you've given. | Contract |
| Product look-ups: shop links you paste, a shared cache of the product details found, and a daily count of your look-ups. | To fill in the name, price and picture automatically, and to limit misuse (150 look-ups a day). | Contract; legitimate interest in preventing abuse |
| Usage counters: daily totals such as "loops created". They contain no names, emails, account IDs, loops or amounts. | To see which features are used. | Legitimate interest in improving Piploop |
| Technical logs kept by Google Cloud, such as request times and IP addresses, plus error notes that name a shop's website but not you. | To keep Piploop secure and working. | Legitimate interest in security |
Piploop doesn't use advertising, sell data, build profiles, or make automated decisions that affect you.
Information about other people
When you enter someone else's details, such as a recipient's name, a co-manager's email address or a photo on a list made for someone else, please make sure they would be happy with it. Take extra care with photos of children. We use these details only to run the loop or list (legitimate interest), and anyone named can contact us using the address above.
Who can see what
- Loops can be opened by anyone signed in with Google who has the link. The organiser sees each pledge. Contributors see their own pledge and the totals.
- Wishlists: anyone with the link can see the list's name, character and items, even without signing in. A list photo can be seen by anyone signed in with a Google account who has the link.
- "Bought" marks on a wishlist are hidden from the person the list is for, so the surprise is kept. The managers of a list made for someone else can see who bought what.
Who processes data for us
- Google (Firebase and Google Cloud) hosts Piploop and provides sign-in, the database and the product look-up service. Our database is stored in the EU (Belgium and the Netherlands), and the look-up service runs in Belgium. Google Ireland Limited acts as our processor under Google's data processing terms. Some services, such as sign-in and website delivery, may process data in other countries, including the United States. Those transfers are covered by the EU–US Data Privacy Framework and standard contractual clauses.
- Shops: when you paste a product link, Piploop's server opens that page to read the product details. The shop sees a request from Piploop's server, not from you.
- European Central Bank: we download its public daily exchange rates to convert prices to euro. No personal data is sent.
Some links take you to other services, such as Revolut to pay a pledge or WhatsApp to share a loop. What happens there is covered by their own privacy policies.
Cookies and storage on your device
Piploop doesn't use advertising or tracking cookies, so we don't show a cookie banner. It stores only what's needed for features you use:
- Sign-in session, stored by Firebase Authentication, keeps you signed in until you sign out.
- Your payment link (
piploop.payLink) is remembered after you add it to a loop, so you don't have to type it again. - Product look-up cache keeps recent results for links you've pasted on your device, so they fill in instantly.
When you sign in, Google sets its own cookies on its sign-in pages under its own privacy policy. Your Google profile photo is loaded from Google's servers. You can clear Piploop's storage at any time in your browser settings.
How long we keep data
- Your account, loops, pledges and lists are kept while you use Piploop. You can delete a loop or list yourself at any time.
- You can delete your account yourself at any time: tap your picture at the top, then Delete my account. It takes effect straight away (see below). You can also ask us by email, and we'll do it within 30 days. If the beta closes, we will tell users and delete beta data within 3 months, unless you move to a later version of Piploop.
- The product look-up cache and your daily look-up count hold no more than what's needed to work, and are cleared regularly.
- Google Cloud keeps technical logs for a limited period (normally 30 days).
Your rights
Deleting your account removes your profile, gift history and sign-in, your wishlist and the lists you made for someone else, and loops you organised (for everyone in them). Your pledges in other people's loops and the gifts you marked as bought on their lists are kept so their totals and surprises still work, but your name, messages and the link to your account are removed. Backups and logs kept by Google expire on their normal schedule.
You can also ask to see your data, get a copy, correct it, delete it or restrict how it's used. You can also object to uses based on legitimate interest. Email privacy@delcoserv.com and we'll reply within one month. We may need to confirm the request comes from your Google account.
You can also complain to Malta's data protection authority, the Information and Data Protection Commissioner (IDPC), or to the authority where you live. We'd appreciate the chance to sort it out with you first.
Age
To use Piploop yourself you must be at least 16, or have a parent's or guardian's permission. A parent can make a wishlist for a child.
Changes
If this notice changes, we'll update the date above. If the change is important, we'll tell people in Piploop or by email.