Privacy Policy

Last updated: July 2025

1. Company Information

This Privacy Policy describes how App Snap Ltd ("we", "us", or "our") collects, uses, and protects personal data in connection with our service, Wishlo (the "Service"). This policy is written in accordance with the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

  • Company name: App Snap Ltd
  • Registered address: [Registered Address Placeholder, England]
  • Company number: [Company Number Placeholder]
  • ICO registration number: [ICO Registration Number Placeholder]
  • Contact email: privacy@wishlist.app

2. Data Controller

App Snap Ltd is the data controller of your personal data as defined under the UK GDPR. This means we are responsible for deciding how and why your personal data is processed. If you have any questions about this Privacy Policy or our data practices, please contact us using the details provided in section 14.

3. Legal Basis for Processing

We process your personal data only where we have a lawful basis to do so under Article 6 of the UK GDPR. The applicable legal bases depend on the specific processing activity:

  • Contract performance (Article 6(1)(b)): We process your email address, username, and wishlist data to provide the Service and fulfil our contractual obligations to you.
  • Legitimate interests (Article 6(1)(f)): We process affiliate click data and device/browser information for the purposes of maintaining and improving our Service, ensuring security, and generating revenue through affiliate partnerships. We have carried out a legitimate interests assessment and consider these interests not to be overridden by your rights and freedoms.
  • Consent (Article 6(1)(a)): We process your data for marketing communications where you have provided explicit consent. You may withdraw consent at any time by contacting us or using the unsubscribe mechanism in any communication.

4. Data We Collect

We collect the following categories of personal data:

  • Account information: Email address and username provided at registration.
  • Wishlist data: Items you add to your wishlists, including item names, descriptions, images, notes, quantities, and preferred options.
  • Item URLs: Links to external products and services that you save to your wishlists.
  • Affiliate click data: Records of clicks on affiliate links, including timestamps, referral identifiers, and anonymised interaction data used for commission tracking.
  • Payment information: We do not store your payment card details directly. Payment data is collected and processed by our payment service provider, Stripe Payments Europe, Ltd., in accordance with the Payment Card Industry Data Security Standard (PCI DSS). We may retain records of transactions (amounts, dates, and subscription status) for our own records.
  • Device and browser information: IP address, browser type and version, operating system, device type, and general usage data collected automatically when you access the Service.

5. How We Use Your Data

We use the personal data we collect for the following purposes:

  • Providing the Service: To create and manage your account, display and share your wishlists, and enable others to view and reserve items.
  • Processing payments: To process subscription payments and maintain billing records via our payment provider, Stripe.
  • Affiliate tracking: To track clicks on affiliate links within wishlists, attribute commissions, and report on affiliate performance.
  • Communications: To send service-related notifications (such as claim confirmations, price alerts, and reminders) and, where you have consented, marketing communications about Wishlo features and updates.
  • Security and fraud prevention: To detect and prevent unauthorised access, abuse, and fraudulent activity.
  • Service improvement: To analyse usage patterns and improve the functionality, performance, and user experience of the Service.

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve the Service. The types of cookies we use are as follows:

  • Essential cookies: These are strictly necessary for the operation of the Service, including session management, authentication, and security. These cookies cannot be disabled as the Service would not function without them.
  • Analytics cookies: These cookies help us understand how visitors interact with the Service by collecting information about pages visited, time spent, and error messages. This data is aggregated and anonymised.
  • Affiliate tracking cookies: When you click an affiliate link on a shared wishlist, a cookie may be set by the affiliate network or the destination retailer to attribute any resulting purchase to the appropriate referral. These cookies are subject to the third-party's own privacy policy.

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the Service.

7. Data Sharing

We do not sell your personal data. We share your data with the following categories of third-party service providers only as necessary to operate the Service:

  • Stripe (Payments Europe, Ltd.): Payment processing. Stripe processes payment card data on our behalf and is compliant with PCI DSS Level 1 and UK GDPR. For more information, see stripe.com/gb/privacy.
  • Resend: Email delivery. We use Resend to send transactional and, where consented, marketing emails on our behalf. Resend processes personal data in accordance with its privacy policy. For more information, see resend.com/privacy.
  • Affiliate networks: When a wishlist item is linked through an affiliate programme, click and referral data may be shared with the relevant affiliate network to attribute commissions. Each network operates under its own privacy policy.

All third-party service providers are bound by data processing agreements that require them to process personal data only on our instructions and in compliance with the UK GDPR.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements:

  • Account data (email, username): Retained for the duration of your account and for 30 days following account deletion to allow for recovery.
  • Wishlist data: Retained for the duration of your account and deleted within 30 days of account closure unless you have shared a wishlist that remains actively accessed by others, in which case it is retained for as long as the shared wishlist is in use.
  • Affiliate click data: Retained for a maximum of 12 months from the date of the click, after which it is automatically deleted.
  • Payment records: Retained for 6 years from the date of the transaction in accordance with UK tax and accounting regulations.
  • Server logs and device data: Retained for a maximum of 90 days.
  • Marketing consent records: Retained for 3 years from the date of consent or until consent is withdrawn, whichever is sooner.

9. Your Rights Under UK GDPR

Under the UK GDPR, you have the following rights in respect of your personal data. There are no fees for exercising these rights, and we will respond to all requests within one calendar month.

  • Right of access (Article 15): You have the right to obtain confirmation as to whether we process your personal data and, if so, to access a copy of that data along with information about the processing.
  • Right to rectification (Article 16): You have the right to have any inaccurate personal data corrected and any incomplete personal data completed.
  • Right to erasure (Article 17): You have the right to request the deletion of your personal data where it is no longer necessary for the purposes of processing, where you withdraw consent, or where the data has been unlawfully processed. Certain exemptions may apply under UK law.
  • Right to data portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format (such as JSON or CSV) and to transmit that data to another controller.
  • Right to object (Article 21): You have the right to object to the processing of your personal data based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
  • Right to restriction of processing (Article 18): You have the right to request the restriction of processing of your personal data in certain circumstances, such as where you contest the accuracy of the data.
  • Right to withdraw consent (Article 7(3)): Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
  • Right to lodge a complaint (Article 77): You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe that our processing of your personal data infringes the UK GDPR.

To exercise any of these rights, please contact us at privacy@wishlist.app. We may request verification of your identity before processing your request.

10. International Data Transfers

Some of our third-party service providers are based in the United States. This means your personal data may be transferred to, stored, and processed in the United States. The transfer of personal data to countries outside the United Kingdom is governed by the UK GDPR.

Where we transfer personal data to the United States, we rely on the UK Extension to the EU-US Data Privacy Framework, which has been deemed by the UK government to provide an adequate level of protection for personal data. Where the Data Privacy Framework does not apply, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK government, supplemented by additional technical and organisational measures where necessary.

For further information about the safeguards we apply to international transfers, please contact us using the details in section 14.

11. Data Breach Notification

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach, as required by Article 33 of the UK GDPR.

Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, providing information about the nature of the breach, the data controller's contact details, the likely consequences, and the measures taken or proposed to address the breach.

12. Children's Data

The Service is not directed at individuals under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected personal data from a child under 13, we will take steps to delete that information without undue delay. If you believe that a child under 13 has provided us with personal data, please contact us at privacy@wishlist.app.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, changes in applicable law, or for other operational reasons. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where appropriate, by providing additional notice such as an email notification or a prominent notice within the Service.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Your continued use of the Service after any changes to this policy constitutes your acceptance of the revised policy.

14. Contact Details

If you have any questions, concerns, or requests relating to this Privacy Policy or our handling of your personal data, please contact us:

  • Email: privacy@wishlist.app
  • Company: App Snap Ltd
  • Address: [Registered Address Placeholder, England]
  • ICO registration number: [ICO Registration Number Placeholder]

If you are dissatisfied with our response to any data protection concern, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.