Privacy Policy
Version 1.2 — Effective July 7, 2026
1. Introduction
It is important to WishlyBox that you feel confident about how we handle your personal data. This Privacy Policy describes how we collect and process personal data when you use our website (wishlybox.com), our web application (app.wishlybox.com), and related services (collectively, the "Services"). We process your data responsibly, with respect for your privacy, and in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.
Your use of the Services constitutes your acknowledgement that you have read and understood this Privacy Policy.
2. Who Is Responsible for Your Data
The data controller for the processing of your personal data is WishlyBox Ltd, registered at 128 City Road, London, EC1V 2NX, United Kingdom. If you have questions about how we process your personal data, please contact us at legal@wishlybox.com.
3. What Data We Collect
3.1 Data You Provide
When you create an account and use the Services, you may provide:
- Profile data: name, email address, date of birth, profile photo
- Wishlist data: wish titles, descriptions, prices, product links, images, tags, priorities
- Event data: event names, dates, locations, reminders, invitations
- Contact data: names, categories, and notes about your contacts
- Gift Room data: messages, images, gift ideas, and contribution amounts shared in coordination rooms
- Preference data: favourite colours, flowers, scents, and forbidden gift categories (provided during onboarding)
- Payment data: subscription selections and billing preferences. Payment card details are processed by our payment providers (Paddle) and are never stored on our servers
3.2 Data Collected Automatically
- Usage data: pages visited, features used, session duration, interactions
- Device data: browser type, operating system, screen resolution
- Network data: IP address and approximate location (used for currency detection and abuse prevention)
- Cookie data: see our Cookie Policy for details
3.3 Guest Use Without an Account
Some features can be used without creating an account. If you create a guest wishlist, we store the display name, wishes, preferences, and optional email address you provide. If you reserve a gift anonymously, we store the display name you enter and your IP address (used solely to prevent abuse).
3.4 Browser Extension
If you install our browser extension and choose to save a product, the extension reads the product page you are viewing (page address, title, price, images, and description) and sends this data to our servers to create the wish. The extension acts only on your explicit action and does not track your browsing.
4. How and Why We Use Your Data
We process your personal data for the following purposes:
- To provide the Services (GDPR Art. 6(1)(b)): operating the platform, managing your account, processing payments, enabling Gift Rooms and reservations
- To communicate with you (GDPR Art. 6(1)(f)): sending event reminders, notifications, and service updates
- To improve the Services (GDPR Art. 6(1)(f)): analysing usage patterns and linking your email address to your activity within our analytics platforms (Amplitude, PostHog) to understand product usage and provide support. We do not use this data for advertising or profiling. You can object and turn analytics off at any time in Settings → Privacy → Product analytics.
- To ensure security (GDPR Art. 6(1)(f)): detecting and preventing fraud or abuse
- To comply with law (GDPR Art. 6(1)(c)): meeting legal obligations
WishlyBox does not sell your personal data. We do not use your data for targeted advertising. We do not add products or recommendations to your wishlists.
5. Third-Party Service Providers
We use the following service providers to operate the Services. Each processes data under a data processing agreement and in accordance with their own privacy policy:
| Provider | Purpose | Data Region |
|---|---|---|
| Supabase | Database, authentication, file storage | EU (Ireland) |
| Vercel | Hosting, CDN | Global |
| Paddle | Payment processing | EU/US |
| Resend | Email delivery | US |
| OneSignal | Push notifications | US |
| Sentry | Error monitoring | EU |
| Amplitude | Product analytics | EU |
| PostHog | Product analytics | EU |
| Google Analytics | Web traffic analytics (website only) | US |
| Cloudflare | DNS, security, bot protection | Global |
| ipapi.co | IP-based country detection (currency) | US |
| Microlink | Product link metadata extraction | Global |
6. Who We Share Your Data With
We share your personal data only in these limited circumstances:
- With other users: according to your privacy settings (public wishlists, friend connections, Gift Room members)
- With service providers: listed in Section 5, solely to operate the Services
- For legal reasons: when required by law, court order, or regulatory authority
- In a business transfer: in connection with a merger or acquisition, where the new owner must honour this Policy
We never sell, rent, or trade your personal data to third parties for marketing.
7. Gift Reservation Privacy
When someone reserves a gift from your wishlist, we hide the reservation details from you by default: you will not see which items are reserved or who reserved them. This is by design to preserve the surprise of gift-giving.
You can adjust this in your reservation settings: optionally see which of your wishes are reserved, or (on paid plans) also see who reserved them. Safety notifications about long-inactive ("zombie") reservations only ever disclose the number of reserved gifts, never the reserver's identity.
8. Affiliate Links
Product links in wishlists may contain affiliate tracking tags. If a purchase is made through such a link, we may receive a small commission from the retailer. This does not affect the price for the buyer. We only apply affiliate tags to links you add yourself. We never add products to your wishlists. See our Advertising Disclosure for more details.
9. How Long We Keep Your Data
We keep your personal data for as long as you have an active account. If you delete your account, it is deactivated immediately and enters a 30-day recovery window during which you can restore it by logging back in. After 30 days your data is permanently deleted, unless we have a legal obligation to retain it.
If your account has been inactive for 2 years (no wishes created, no reservations, no logins), we may delete or anonymise your data after notifying you by email.
Anonymised, aggregated data that cannot identify you may be retained for analytical purposes.
10. Your Rights
Under the GDPR, you have the following rights:
- Access: request a copy of your personal data
- Rectification: correct inaccurate data
- Erasure: request deletion of your data
- Restriction: restrict how we process your data
- Data portability: receive your data in a structured format
- Object: object to processing based on legitimate interests. For product analytics you can do this directly in Settings → Privacy → Product analytics
- Withdraw consent: withdraw any consent you have given at any time
- Complaint: lodge a complaint with your local data protection authority
To exercise your rights, contact us at legal@wishlybox.com. We will respond within 30 days.
11. Security
We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS/SSL), Row Level Security on all database tables, secure authentication, and regular security assessments. However, no method of transmission is 100% secure.
12. Children
The Services are not intended for children under 13 (or 16 in the EEA) without parental consent. We do not knowingly collect data from children. If you believe a child has provided data without parental consent, contact us at legal@wishlybox.com and we will delete it.
13. International Transfers
Your data may be transferred outside the EEA. Our primary infrastructure is in the UK. For transfers outside the EEA, we use Standard Contractual Clauses or other appropriate safeguards under GDPR Chapter V.
14. Changes to This Policy
We may update this Policy. Non-material changes take effect when posted. Material changes will be communicated by email or in-app notification at least 14 days before taking effect. Continued use after changes constitutes acceptance.
15. Contact
Privacy inquiries: legal@wishlybox.com
General support: support@wishlybox.com
Website: wishlybox.com
WishlyBox Ltd, 128 City Road, London, EC1V 2NX, United Kingdom
This is version 1.2 of WishlyBox Ltd's Privacy Policy, dated July 7, 2026. It supersedes version 1.1 dated June 17, 2026.