GiftSplit Privacy Policy

Last updated: 17 October 2026

GiftSplit is a Shopify app that adds gift messages, gift wrapping and shipping to multiple addresses from one checkout. It is made by 89 Design Lab (trading as Lab89), 19, Jalan Eco Majestic 7/1A, Mellowood, Eco Majestic, MBX #182, 43500 Semenyih, Selangor, Malaysia (“Lab89”, “we”, “us”).

This policy explains what information GiftSplit collects when a merchant installs it, how we use that information, and the choices merchants and their customers have.

1. Who is responsible

• The merchant (the Shopify store that installs GiftSplit) decides to offer gifting and multi-address shipping to its customers and is the controller of its customers’ data.
• Lab89 processes that data only to run GiftSplit for the merchant, following the merchant’s instructions and these terms. For data about the merchant itself (account and support details), Lab89 is the controller.

2. What we collect

From the store, when GiftSplit is installed

• Store name, store domain, contact email of the store, currency, plan, and the settings the merchant chooses in GiftSplit.
• Product and variant details needed to show the cart on the recipient page and to create orders.

About each multi-address purchase

• Buyer: email address, name, billing/own address, phone (optional), Shopify customer ID when logged in, the discount code used, and the order numbers Shopify assigns.
• Recipients: the name, postal address and phone number the buyer enters for each recipient, the items chosen for them, the gift message, gift-wrap choice and requested delivery date, and the recipient’s email if the buyer adds it. Recipient emails are stored only as part of the gift note; GiftSplit and Shopify never send marketing or order emails to recipients.
• Fulfilment: shipping status and tracking numbers of the recipient orders, so the buyer can see them on the order status page.

Gift messages on single-address orders

Saved on the Shopify order only (as a note and an order attribute). GiftSplit’s database does not keep them.

GiftSplit does not see or store payment details. Payment happens in Shopify’s checkout.

3. How we use it

• To show the recipient page, quote shipping and tax per address, create the paid order and the recipient orders in the merchant’s Shopify store, and show shipment status to the buyer.
• To show the merchant their sends, alert them when a recipient order could not be created, and let them export recipient lists.
• To answer support questions and keep the service running (error logs contain no personal data).

4. Support assistant

GiftSplit’s Help panel uses an AI assistant (provided by Anthropic) to answer merchant questions. It sees the merchant’s question and the store’s GiftSplit setup (modules, settings, plan, install status, recent send statuses and error messages). It does not receive buyer or recipient names, addresses or emails. When the assistant can’t help, the chat is passed to a person at Lab89.

5. Service providers

Provider	Purpose	Data
Cloudflare	Hosting and database	All GiftSplit data, including buyer and recipient details
Shopify	The store platform GiftSplit runs inside	Orders, customers, products
Anthropic	AI support assistant	Merchant questions and store setup, no customer data
Brevo	Support and alert emails	Merchant email, ticket content
GitHub	Code hosting	No customer data

Tools the merchant connects. When a merchant connects Klaviyo, GiftSplit sends one “Placed Gift Order” event per purchase to the buyer’s Klaviyo profile (order numbers and recipient count, no recipient details). That tool’s own privacy policy then applies. The merchant is responsible for having the right basis to use the data there.

We may disclose information if the law requires it.

6. How long we keep it

• Sends, buyers and recipients: for as long as the store has GiftSplit installed, so the merchant can look up past gifts and shipments. Abandoned recipient pages (never paid) are deleted after 14 days.
• After uninstall: when Shopify sends us the store’s deletion request (48 hours after uninstall), we delete all of the store’s GiftSplit data.
• Support chats and tickets: 12 months.

7. Security

Data is encrypted in transit (HTTPS) and at rest. Integration keys are stored encrypted. Only the people who build and support GiftSplit can access live data, using accounts protected with two-factor sign-in. If a security incident affects your data, we tell affected merchants without undue delay.

8. Rights of merchants and customers

• Merchants can view, export and delete their data in the app, and can ask us at support@lab-89.com for a copy or deletion of their account data.
• Customers of a store should contact that store first. The store can ask Shopify to send us an access or deletion request, and we act on it. Customers can also email us directly and we will work with the store.

Depending on where you live (for example under the GDPR, UK GDPR, California law or Malaysia’s Personal Data Protection Act), you may have the right to access, correct, delete or restrict the use of your data, and to complain to your local data protection authority.

9. International transfers

Our service providers may process data outside your country, including in the United States. Where the law requires it, we rely on safeguards such as standard contractual clauses provided by those providers.

10. Changes

If we change this policy we will update the date above. For important changes, we will tell merchants in the app or by email.

11. Contact

89 Design Lab (trading as Lab89)
19, Jalan Eco Majestic 7/1A, Mellowood, Eco Majestic, MBX #182, 43500 Semenyih, Selangor, Malaysia
Email: support@lab-89.com (subject “Data request” for access or deletion requests; we reply within 7 days). See Data requests.