The fine print, minus the fine
Privacy policy
Last updated: 18 September 2026. If the short version is all you want: we collect your email, your lists, and your claims — and nothing is sold to anyone, ever.
The formal bit: the “controller” for this site is the person who launched wishli (“we”, “us”, “our”). We’re a small team, so if you’d rather talk to a human, email [email protected] and it lands with us directly.
What we collect
Owners — your email (required, used as your sign-in), an optional name, and the lists you create: titles, occasions, notes, gift details, store links, and any images you upload or import.
Guests — your email (needed to send the magic link), an optional name, and which gifts you’ve marked as yours. Guests are linked to one list at a time — we don’t build profiles of you across lists.
Everyone — the cookie-banner choice you make (accepted / declined, plus the page where you made it). That’s it. No device IDs, no fingerprinting.
How we use it
Your data does the job: the email verifies who you are (magic link), the list data renders the page, the claims stop double-gifting. We’ll never send marketing emails without asking first.
Cookies
One essential cookie, wishli_session, keeps you signed in for 30 days after you open a magic link. One optional preference cookie, wishli_consent, remembers your banner choice. No analytics, advertising, or tracking scripts as of today — if that changes, the banner comes back and asks again.
Legal bases (GDPR)
Performance of a contract (Art. 6(1)(b)) — signing you in and rendering your list are the service you asked for. Legitimate interest (Art. 6(1)(f)) — keeping sessions alive and remembering your cookie choice, balanced against the fact they’re tiny and reversible. Consent (Art. 4(1) + PECR) — where you tick, tap, or accept.
Who we share it with
Our email provider (sends the magic-link and no-reply transactional mail — they process it on our instructions, under a processor agreement, and are contracted not to use it for their own purposes) and our database/hosting provider. No one else. We’re UK/EU-based and rely on adequacy decisions or standard contractual clauses for any provider sitting outside the UK/EU.
Sending you the list — a one-off legal note
When an owner clicks “share”, we email a guest a link to a third party’s list. Strictly that’s also a disclosure to that guest — we treat the owner’s instruction as consent, and the guest’s reply (or lack of it) tells us everything we’d ever need.
How long we keep it
For as long as your list is live. When you delete a list — or use “Erase my account” from the dashboard — the data goes with it, and a guest’s data is wiped the moment they use “Erase my data”. Deletions are reflected in backups within 30 days, and inactive owner accounts are purged after 24 months.
Your rights
Access, rectification, erasure, portability, restriction, and objection — the usual GDPR set. You can exercise most of them yourself (download or erase your whole account from the dashboard, delete a list, or — as a guest — use “your data” on any list page). For anything else, email us and we’ll reply within 30 days. You can also complain to your local supervisory authority — the ICO if you’re in the UK.