Privacy Policy

This policy explains how Wishfully ("Wishfully", "we", "us") collects, uses, shares and protects your personal data when you use wishfully.co.uk and the Wishfully web and mobile apps (together, the "Service"). We are committed to complying with the UK GDPR, the Data Protection Act 2018, and the EU GDPR where it applies to our users.

1. Who we are

Wishfully is operated by VIZIT Solutions ("the data controller"), based in the United Kingdom. If you have any questions about this policy or how we handle your data, contact us at privacy@wishfully.co.uk.

2. Information we collect

Information you give us

• Account details: name, email address, password (stored as a salted hash), and profile information such as bio, avatar photo, and date of birth.
• Content you create: wishlists and wishlist items (titles, links, images, prices, priority, notes), groups and group chat messages, events, RSVP responses and answers to RSVP questions, and gift claims/contributions.
• Social graph data: group memberships, event guest lists, invite codes, and the connections you make with other users.
• Communications: messages you send us for support, and any account deletion request and optional reason you submit (see Section 8).
• Location details: if you add a location to an event using our maps integration, we store the address, coordinates and place identifier you select.

Information collected automatically

• Usage & device data: pages viewed, actions taken, browser/device type, and IP address, used for security, analytics and troubleshooting.
• Error and diagnostic logs: client and server error reports (which may include a user identifier, the page you were on, and technical details) to help us fix bugs.
• Cookies: see Section 6 below.

Information from third parties

If you sign in with Google or Facebook, we receive your name, email address and profile photo from that provider in order to create and secure your account.

3. How we use your information

We use your data to:

• Create and secure your account, and authenticate you when you sign in.
• Provide the core Service — creating and sharing wishlists, groups, events, RSVPs, gift claiming, and real-time chat.
• Send transactional emails (e.g. invites, RSVP confirmations, referral invites).
• Detect, investigate and prevent fraud, abuse and security incidents.
• Maintain, debug and improve the Service, including through error monitoring.
• Comply with our legal obligations and respond to lawful requests.

Our legal bases for this processing are: performance of a contract (providing the Service you've signed up for), our legitimate interests (keeping the Service secure, reliable and improving it), and consent (for optional features like sharing your birthday, or marketing communications, where applicable).

4. Who we share your data with

We do not sell your personal data. We share data with the following categories of service providers, who process it on our behalf under contract:

• Supabase — our database, authentication and file storage provider.
• Resend — used to send transactional emails (invites, confirmations).
• Sentry — used for error monitoring on our web app.
• Google Maps Platform — used to look up and display event locations.
• Google / Facebook — if you choose to sign in using these providers.
• Hosting providers (e.g. Vercel) — used to run and serve the Service.

We also share data with other users where you choose to: for example, wishlist items are visible to people you share your wishlist with, and group/event details are visible to members and guests you invite.

Some of these providers may process data outside the UK/EEA. Where they do, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms recognised under UK/EU data protection law.

5. How long we keep your data

We retain your account and content for as long as your account is active. If you request account deletion (Section 8), we retain the minimum information needed to action and confirm your request, then remove your personal data and content once the deletion has been carried out. We may keep limited records where required by law (e.g. for fraud prevention or accounting purposes).

6. Cookies

We use a small number of essential cookies, including:

• Authentication cookies (set by Supabase) to keep you signed in.
• Referral cookie (wishfully_ref) — stores a referral code for up to 7 days if you arrive via a friend's invite link.
• Invite redirect cookie (wishfully_next) — briefly remembers a group/event invite link you were following through sign-up, for up to 1 hour.

We do not currently use third-party advertising or analytics cookies. As these are strictly necessary to provide the Service, we do not display a cookie consent banner; you can control cookies through your browser settings, though blocking essential cookies may prevent you from signing in.

7. Your rights

Under UK/EU data protection law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure of your data (see Section 8 for account deletion).
• Restrict or object to certain processing.
• Request a portable copy of your data in a machine-readable format.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or your local supervisory authority.

To exercise any of these rights, email privacy@wishfully.co.uk. We'll respond within one month, as required by law.

8. Deleting your account

You can request deletion of your account and data at any time from Settings → Danger zone → Delete in the app, or by emailing privacy@wishfully.co.uk.

How this works today: submitting a request records it in our system immediately, but deletion is currently carried out manually by our team rather than automatically. We aim to complete verified deletion requests, and remove your personal data, wishlists, groups, events and messages, within 30 days, and will email you to confirm once it's done. Content you've shared with others (e.g. messages sent in a shared group chat) may remain visible to other members as part of the shared conversation history, unless you ask us to remove it specifically.

9. Children's privacy

The Service is not directed at children under 13, and we require users to be at least 13 years old to create an account. Wishlists may be created for children (e.g. by a parent or guardian), but the account holder must be an adult or otherwise meet our minimum age requirement. If you believe a child has provided us with personal data without appropriate consent, please contact us and we will take steps to remove it.

10. Security

We use industry-standard measures to protect your data, including encryption in transit, row-level security on our database, and access controls limiting who can view your data. No method of transmission or storage is 100% secure, but we work to continuously improve our safeguards.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll notify you via the Service or by email. The "Last updated" date at the top of this page shows when it was last revised.

12. Contact us

If you have questions about this policy or how we handle your data, email privacy@wishfully.co.uk. See also our Terms of Service.