Privacy Policy

This Privacy Policy explains how Vested Gifts ("Vested," "we," "us") collects, uses, shares, and protects personal information when you use our website at vestedgifts.com, our applications, and related services (the "Services"). Capitalized terms not defined here have the meaning given in our Terms of Service.

We have written this policy to be readable. If anything is unclear, email support@vestedgifts.com.

Quick Summary

• We sell physical baby goods and operate a "Book" where gift-givers can record non-binding promises (Pledges) of future gifts.
• We do not hold or move any money. We do not collect bank, brokerage, or investment-account credentials.
• We collect the minimum information needed to ship goods, operate Books, and send reminders.
• We do not sell personal information for money. When you sign up on the Baby Shareholder Club page, or opt in on an early-access form, we use Meta advertising measurement as described below; some state laws may call this a "share" for targeted advertising. You can opt out with GPC or by emailing us.
• We honor the Global Privacy Control (GPC) signal as an opt-out of any "sale" or "share" under U.S. state privacy laws.
• The Services are not directed to children under 13. We treat any information you provide about a child recipient with heightened care.
• You have rights — including access, deletion, and correction — that you can exercise at support@vestedgifts.com.

1. Who We Are (Controller / Business)

Vested Gifts, based in Phoenix, Arizona, is the controller / "business" responsible for the personal information described in this policy.

• General, privacy, rights-request and security inquiries: support@vestedgifts.com

2. Scope

This policy applies to personal information we collect through the Services. It does not apply to personal information collected by third parties such as Shopify (which processes payments), Robinhood (which operates any brokerage account you link), or other websites you may reach through links from our Services. Those third parties have their own privacy practices.

3. Personal Information We Collect

We collect personal information in the categories below. Where state law (such as the California Consumer Privacy Act) requires categorization, we have indicated the corresponding statutory category in brackets.

3.1 From Purchasers (people who buy physical goods)

• Name, email, phone (optional), billing and shipping address [identifiers; commercial information]
• Order history and product preferences [commercial information]
• Payment information (handled and stored by Shopify; we receive only a confirmation token and the last four digits) [financial information, processed by our service provider]
• Device and usage data: IP address, user agent, referring URL, click events [internet/network activity; geolocation inferred from IP]

3.2 From Pledgers (people who record a non-binding gift promise)

• Name, email, optional phone, relationship to recipient [identifiers]
• Pledge details: amount, optional stock ticker, "wisdom note" or message [user-generated content]
• Device and usage data (as above)

3.3 From Custodians (parents or guardians of the recipient)

• Name, email, optional phone [identifiers]
• The recipient's first name and, optionally, a photo or short bio you choose to share [user-generated content; information about a known child]
• A publicly accessible third-party brokerage gifting link that you choose to paste (e.g., a Robinhood gift link). We treat this link as sensitive and encrypt it at rest.
• Device and usage data (as above)

3.4 From Waitlist Signups (including the Baby Shareholder Club)

• Email, and on the Baby Shareholder Club page your full name [identifiers]
• Right after you join the Baby Shareholder Club, an optional answer to "Where are you in your journey?" (pregnancy, adoption, surrogacy, baby's here, or giving a gift). You can skip it; see Section 10.1 [characteristics; may be consumer health data in some states]
• Which page version you saw and how you arrived, such as ad campaign tags and referring page [internet/network activity]
• Your consent choices and whether Meta measurement applied to your signup, as described in Section 8

We use this only to email you about the product you signed up for (for example, when Baby Shareholder Clubs open), to tailor that first email, and to measure our demand tests. Joining a waitlist does not sign you up for other marketing.

3.5 Cookies & Similar Technologies

We use cookies and similar technologies for authentication, security, preferences, analytics, and advertising measurement through Meta when you sign up on the Baby Shareholder Club page or opt in on an early-access form. See our Cookie Notice.

3.6 Information We Do NOT Collect

To make our limits explicit, we do not collect:

• Bank account numbers, routing numbers, or full payment card numbers (Shopify handles payments)
• Brokerage account credentials, usernames, or passwords
• Social Security numbers, taxpayer IDs, or government IDs
• Biometric data
• Precise geolocation
• Health information (other than what you voluntarily include in a Book note, or the optional club journey answer described in Section 10.1)
• Information about a child collected directly from a child

4. Sources

We collect personal information:

• Directly from you, when you make a purchase, create a Pledge, claim a Book, or send us a message;
• Automatically, when you visit or interact with the Services (device and usage data);
• From service providers, such as Shopify (order confirmations) and our email/SMS providers (delivery and engagement events).

5. How We Use Personal Information

We use personal information for the following purposes:

Outside the Meta signup measurement described in Section 8, we do not use personal information for cross-context behavioral advertising, profiling that has legal or similarly significant effects, or automated decision-making affecting access to financial services.

6. Legal Bases (EU / UK Visitors)

If you are in the European Economic Area, United Kingdom, or Switzerland, our legal bases under the GDPR are:

• Performance of a contract (fulfilling orders; operating Books);
• Legitimate interests (security, fraud prevention, basic analytics, transactional reminders), balanced against your rights and freedoms;
• Consent (marketing email, SMS, non-essential cookies, and advertising measurement on early-access forms; you may withdraw consent at any time);
• The Baby Shareholder Club page and its ads are directed to U.S. residents. If you are in the EEA, UK, or Switzerland and sign up there, you may object to the Meta signup measurement described in Section 8 at any time by sending a Global Privacy Control signal or emailing support@vestedgifts.com;
• Legal obligation (tax, accounting, responding to lawful requests).

7. How We Share Personal Information

We share personal information only with:

7.1 Service Providers

We use service providers to operate the Services. The categories of providers we may share information with include:

• commerce and payment providers;
• hosting, database, security, and authentication providers;
• communications and customer-support providers;
• manufacturing, fulfillment, and shipping providers; and
• analytics and advertising-measurement providers.

These providers receive only the information reasonably necessary to perform services for us and are subject to contractual or legal restrictions. Meta is used for advertising measurement only as described in Section 8 and in our Cookie Notice.

7.2 Third Parties at Your Direction

If you paste a Robinhood gift link or use any third-party feature, your interaction with that third party is governed by its own terms and privacy policy. Vested does not transmit your personal information to Robinhood other than what you explicitly choose to include in a link you control.

Affiliate links to Robinhood. When you click an affiliate link to Robinhood from the Services, your browser sends a Robinhood-set tracking cookie that allows Robinhood and its affiliate-network provider (Impact) to recognize that the visit originated from Vested if you subsequently open or fund a Robinhood account. We do not transmit your name, email, or other personal information to Robinhood or Impact through this mechanism; the cookie is set by Robinhood directly. This is how Robinhood determines whether Vested has earned a referral payment under its affiliate program. The cookie's behavior is governed by Robinhood's and Impact's own privacy policies. We disclose this as a material connection under 16 C.F.R. Part 255; see our Affiliate Disclosure.

7.3 Legal & Safety

We may disclose personal information when we reasonably believe disclosure is required to comply with law, respond to lawful requests (subpoenas, court orders), enforce our Terms, protect the rights, property, or safety of Vested, our users, or the public, or investigate fraud.

7.4 Corporate Transactions

If Vested is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will notify you of any such transfer and any material change in this policy.

7.5 With Your Consent

For any other sharing, we will ask for your consent.

8. Sale, Sharing, Advertising Measurement, and GPC

We do not sell personal information for money. When you sign up on the Baby Shareholder Club page, or opt in on one of our paid-demand early-access forms, we share limited identifiers (a hashed email), device and network information, and signup and ad-attribution information with Meta to measure and improve our advertising. On the Baby Shareholder Club page this measurement is on by default, and Meta Pixel loads only after you submit the signup form. Depending on where you live, this may be considered "sharing" for cross-context behavioral advertising or targeted advertising.

We do not send Meta your name, your optional club answer, information about a child, pledge details, brokerage information, payment-card data, or purchase activity through this early-access measurement. Advertising measurement is separate from permission to receive marketing email, and opting out never affects your signup.

Affiliate revenue is not a "sale" of personal information. Vested receives flat per-account and per-funded-account payments from Robinhood when users open Robinhood accounts through affiliate links on the Services. This compensation is paid by Robinhood to Vested for marketing services. Vested does not transmit, license, or otherwise transfer personal information to Robinhood or any third party in exchange for this compensation. See our Affiliate Disclosure.

How to opt out. If your browser or device sends a Global Privacy Control (GPC) signal, we treat it as a valid opt-out request for any "sale" or "share" and do not use Meta advertising measurement for that visit. You can also email support@vestedgifts.com to opt out of, or withdraw consent to, advertising measurement, and we will stop sharing your information with Meta for it.

9. Children's Information

The Services are not directed to children under 13, and we do not knowingly collect personal information directly from a child under 13 in violation of the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501–6506; 16 C.F.R. Part 312).

A Book may contain limited information about a child — typically a first name and, optionally, a photo — that the recipient's parent or legal guardian (the Custodian) chooses to provide. By providing that information, the Custodian represents and warrants that they are the parent or legal guardian and have authority to share it.

We treat information about a child with heightened care:

• We do not display child information publicly. Books are accessed via an unguessable link.
• We do not behaviorally profile a child recipient.
• We do not transmit child information to advertising networks.
• We do not retain child photos beyond what is necessary to operate the Book, and a Custodian may request deletion at any time.
• We treat children's information as "sensitive data" under Virginia, Colorado, Connecticut, Texas, and other state privacy laws that recognize that category, regardless of whether they are technically required to do so for our use case.

If you believe a child under 13 has provided personal information directly to us, contact support@vestedgifts.com and we will delete it promptly.

10. Sensitive Personal Information

We do not seek and generally do not collect "sensitive personal information" as defined under U.S. state privacy laws (such as precise geolocation, racial or ethnic origin, religious beliefs, genetic data, biometric data for identification, health, sexuality, or contents of mail/email/texts). The Robinhood gift link a Custodian may store with us is treated by us as sensitive and is encrypted at rest. Information about a child recipient is treated as sensitive as described in Section 9.

You may limit the use of sensitive personal information by emailing support@vestedgifts.com.

10.1 Consumer Health Data (Washington, Nevada, and Similar Laws)

Some state laws, such as Washington's My Health My Data Act and Nevada's consumer health data law, may treat the fact that a person is expecting a baby as consumer health data. The only such information we ask for is the optional pregnancy or surrogacy answer to the Baby Shareholder Club journey question.

• What and why: if you choose that answer, we store it with your waitlist signup and use it only to tailor emails about the club.
• Consent: we collect it only when you choose it. Skipping the question has no effect on your signup.
• Sharing: we do not sell it and do not share it with Meta or any other advertising company. Our hosting and email service providers process it on our behalf.
• Your rights: you can ask to see it, delete it, or withdraw consent by emailing support@vestedgifts.com. We respond as described in Section 12.

11. Retention

We retain personal information only as long as necessary for the purposes described in this policy:

When information is no longer needed, we delete or de-identify it.

12. Your Rights

12.1 Universal Rights

Wherever you live, you can email support@vestedgifts.com to:

• Ask what personal information we have about you;
• Correct inaccurate information;
• Request deletion of your information;
• Unsubscribe from marketing communications;
• Opt out of any non-essential analytics.

We will respond within 45 days (and may extend by 45 more days where permitted by law if the request is complex). Requests are free; we may charge a reasonable fee for manifestly unfounded or excessive requests, as permitted by law.

12.2 California (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the parties with whom we share it;
• Delete personal information we have collected (subject to exceptions);
• Correct inaccurate personal information;
• Opt out of any "sale" or "sharing," including the Meta advertising measurement described in Section 8;
• Limit use of sensitive personal information — note our limited use is already aligned with this;
• Not be discriminated against for exercising your rights.

Designated request method: email support@vestedgifts.com.

We verify identity by matching the email and order/Book identifiers on file. Authorized agents may submit requests with written authorization signed by you.

12.3 Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Florida, Montana, Iowa, Tennessee, Indiana, Delaware, New Hampshire, New Jersey, Kentucky, Maryland, Minnesota, and Rhode Island

You have equivalent rights to access, correct, delete, opt out of targeted advertising, sale, or certain profiling, and appeal a denied request. To appeal, reply to our response email or contact support@vestedgifts.com.

12.4 European Economic Area, United Kingdom, Switzerland (GDPR)

You have rights to access, rectification, erasure, restriction, portability, and to object. You also have the right to lodge a complaint with your local data protection authority.

13. International Transfers

Vested is based in the United States and processes personal information in the United States. If you access the Services from outside the United States, you understand that your information will be transferred to and processed in the United States, where laws may differ from those in your country. Where transfers from the EEA, UK, or Switzerland are involved, we rely on the Standard Contractual Clauses or other lawful transfer mechanisms.

14. Security

We protect personal information with administrative, technical, and physical safeguards including:

• TLS encryption in transit;
• Encryption at rest for sensitive fields (including any third-party brokerage gift link a Custodian provides);
• Strict access controls with least-privilege roles;
• Magic-link authentication with token rotation and expiration;
• Vendor due diligence and contractual data protection commitments;
• Audit logging of administrative actions, with sensitive payload fields redacted.

No system is perfectly secure. If you suspect a security issue, email support@vestedgifts.com.

15. Automated Decision-Making

We do not use personal information for automated decision-making that produces legal or similarly significant effects on you.

16. Do Not Track

Some browsers transmit a "Do Not Track" signal. There is no industry standard for responding to it, and we do not currently respond. We do honor the GPC signal as described in Section 8.

17. Third-Party Links

The Services may contain links to third-party sites (including Robinhood). We are not responsible for the privacy practices of those sites. Review their privacy policies before providing any information.

18. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will provide notice (for example, by email or a prominent notice on the Services) at least 14 days before the changes take effect. The "Effective Date" and "Version" at the top reflect the current version.

19. Contact

Privacy questions and rights requests: support@vestedgifts.com