Hib · هِب ← Back to hibgift.ae
Legal · الخصوصية

Privacy Policy

Last updated 24 September 2026 · Hib One Portal · Humaideya 1, Plot 254, Ajman, United Arab Emirates
The short version: we collect only what we need to deliver your gift — your name and number, the recipient's name and number, and your order. Card payments are handled entirely by Stripe (we never see or store card numbers). We don't sell data, we don't run ads, and your data is hosted on secure Amazon Web Services cloud infrastructure. Questions? hello@hibgift.ae

1. Who we are

Hib ("هِب") is a digital gifting platform operated by Hib One Portal, a business licensed in Dubai, United Arab Emirates (Trade License No. 1642822, activity: Portal). Hib lets you send cash gifts and curated items that recipients redeem at participating UAE merchants. For the purposes of UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL), Hib One Portal is the data controller.

2. What we collect

DataWho it relates toWhy we need it
Name, UAE mobile number, emailSender (account holder)Create your account, sign you in with a one-time code (OTP), send receipts
Recipient's first name and mobile numberRecipientDeliver the gift link by SMS and identify the voucher at redemption. This is provided to us by the sender
Order details (gift type, amount, merchant, message)Sender & recipientFulfil and track the gift, operate redemption, resolve disputes
Payment informationSenderProcessed directly by Stripe — card numbers never touch our servers. We receive only a payment confirmation and reference
Device push tokenApp usersSend notifications: gift received, opened, redeemed, and expiry reminders
Basic usage data (screens visited, app crashes)App usersFix problems and improve the app

If you are a merchant, we additionally collect business details (trade license, bank IBAN, signatory ID) for verification (KYC) and weekly payouts.

3. How we use it

We do not sell personal data, and we do not use it for third-party advertising.

4. Who we share it with

PartnerWhat they receivePurpose
Participating merchantsRecipient's first name, voucher details, gift messageRedeem and fulfil the gift in store
StripePayment details (entered on Stripe's secure fields)Process card and Apple Pay payments
TwilioMobile numbers, message contentDeliver OTP codes and gift-link SMS
Google Firebase (FCM)Device push tokenPush notifications
Amazon Web Services (currently Mumbai region, ap-south-1)Platform data at restHosting — we plan to migrate to the AWS UAE region once service there is restored

5. Where your data lives

Our primary systems are hosted on Amazon Web Services, currently in the Mumbai (ap-south-1) region. Following disruption to AWS's UAE region, we intend to migrate our primary hosting to the UAE (me-central-1) once service there is restored, and this policy will be updated when that happens. Some service providers listed above (Stripe, Twilio, Google) process data on their global infrastructure under their own data-protection terms. Where data is processed outside the UAE, we rely on appropriate safeguards as required by the PDPL.

6. How long we keep it

Order and voucher records are kept for the life of your account and for up to 5 years afterwards, as required for accounting and dispute purposes. Recipient contact details for unclaimed gifts are kept for the voucher validity period (6 months) plus a short grace period, then deleted. You may ask us to delete your account at any time (see below); we will remove data we are not legally required to retain.

7. Your rights

Under the UAE PDPL you may request to: access the data we hold about you, correct it, delete it, object to or restrict certain processing, and receive a copy of your data. Email hello@hibgift.ae from your registered email or number and we will respond within 30 days.

If you received a gift and don't want to hear from us again, reply to the gift SMS or email us and we will stop notifications to your number (this will void the gift's reminder messages but not the gift itself).

8. Security

We use encrypted connections (TLS) everywhere, one-time passcodes instead of passwords, and role-based access internally. Card data is handled exclusively by PCI-DSS-certified Stripe. No system is perfectly secure, but protecting gift-givers' trust is the core of our business.

9. Children

Hib is intended for users aged 18 and over. We do not knowingly collect data from children.

10. Changes to this policy

If we change this policy, we will update the date at the top and, for material changes, notify users in the app before the change takes effect.

Talk to us

Privacy questions, data requests, or anything at all:
hello@hibgift.ae · Hib One Portal · Humaideya 1, Plot 254, Ajman, United Arab Emirates