Privacy policy

Who is responsible for your data?

The data controller is RAPAILLE CONSULTING SRL (Wishivo), a private limited company (société à responsabilité limitée), Rue Allende 98 box A, 7021 Mons, Belgium; company number 0645.672.283; VAT BE0645672283.

For any question about your data: privacy@wishivo.com.

Which data do we process?

We only collect what the service needs.

• Account: your e-mail address (you sign in with a magic link, without a password) and, if you provide them, a display name and your language.
• Lists: title, description, event type and date, items (title, note, link, price, quantity, optional photo) and the delivery addresses you enter. The optional photos of items are erased when the item, the list or the account is deleted.
• Beneficiaries: an optional first name and an optional hint (for example a size). We do not ask for a date of birth, a gender or a photo of the child.
• Guests who reserve a gift: name, e-mail address, reserved quantity, an optional message and, if they choose, their agreement to be named to the organizer. No account is needed to reserve.
• Sign-in with Google (optional): if you choose “Continue with Google”, Supabase Auth stores the email address, name, avatar (picture URL) and account identifier of your Google account, and the fact that you sign in through this provider. We do not read your contacts, calendar or any other Google data. This information is part of your data export and is deleted with your account.
• Invitations: the e-mail address of the person you invite to join a list.
• Group event: everyone who has the event link sees the attached lists, with first names; co-organizers are notified by e-mail when a list is attached.
• Technical data: the strictly necessary cookies described below, and our hosting providers’ technical logs, needed for security and for the service to work.
• Abuse protection: when you request a sign-in link (or a data export), we keep for at most 24 hours an irreversible fingerprint of your IP address and e-mail address (never the values themselves) to limit the number of requests.

Children and beneficiaries

A birth or birthday list can concern a child. We apply data minimization: the first name is optional, we ask for no date of birth or gender, and no photo is ever required.

A beneficiary’s data is only visible to the members of the list and to people who receive the sharing link. It is deleted with the list.

Why, and on what legal basis?

Each purpose relies on a legal basis under the GDPR.

• Providing the service (account, lists, reservations, confirmation and invitation e-mails): performance of the contract.
• Showing the organizer a guest’s name, and only after the event date or as the organizer has set it: the guest’s consent, unticked by default and withdrawable by cancelling the reservation or by writing to privacy@wishivo.com.
• Securing the service and preventing abuse: legitimate interest.

The surprise

The beneficiary and the organizers never see who reserved what, unless the guest has agreed and the organizer has turned on the reveal (after the event, or immediately). A guest’s e-mail address is never shown to the organizer.

How long do we keep data?

We do not keep data longer than necessary.

• Account and lists: as long as your account exists. You can delete it at any time, which deletes your lists (or hands them to a co-organizer).
• Inactive accounts: we record the date of your last activity; if you have not signed in or changed anything for 24 months, we warn you by e-mail, and your account is deleted 30 days later (unless you sign in), together with your profile, your wishes, the lists you are the only organizer of, your invitations and your preferences; your reservations and contributions as a guest are anonymized.
• Guests’ name, e-mail address and message: erased (anonymized) at the latest 6 months after the event date or the archiving of the list; for a list with no date that is never archived, when the list or the account is deleted. The reserved quantity is kept without personal data.
• Invitation e-mail addresses: erased at the latest 30 days after acceptance, or 30 days after an unaccepted invitation expires (an invitation is valid for 7 days), and in any case when the list or the account is deleted.
• Account deletion: immediate. Your reservations as a guest are anonymized, including those you made with your address while signed out.
• Backups: our database is hosted by Supabase, whose free plan we use. We do not guarantee that backups exist or how long they are kept. Deleted data may remain in a backup, if one exists, until our host replaces it, with no guaranteed timeframe; if a backup were ever restored, we would delete again the data of people who had asked for erasure.

Who receives the data?

We use processors bound by contract. We do not sell any data.

• Supabase: database and authentication, data hosted in the European Union (region eu-west-3, Paris). Supabase is a US company: see ‘Transfers outside the European Union’.
• Vercel (US provider): hosting of the application.
• Resend (US provider): sending e-mails (sign-in links, confirmations, invitations) and storage of the waiting list.
• Cloudflare (Turnstile) (US provider): anti-robot check on the sign-in, booking and waitlist forms. The script and the check are loaded from challenges.cloudflare.com only when you first interact with the form; Cloudflare receives technical information from your browser (including your IP address) to tell humans from robots. No cookie is set on Wishivo. Cloudflare may, from its own domain (challenges.cloudflare.com), use technical cookies or storage strictly necessary for the check to work; they are not set on Wishivo.
• Google: if you choose to sign in with Google, Google receives the sign-in request (and knows that you use Wishivo); its processing is governed by its own privacy policy.

Transfers outside the European Union: US providers (Vercel, Resend, Cloudflare, Supabase) covered by the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses, as provided for in their DPAs.

Your rights

You have the right to access your data, correct it, erase it, restrict its processing, object to it, receive it in a reusable format, and withdraw your consent.

You can exercise two of them right away, without writing to us, from the My account page: download all your data (JSON file) and delete your account.

For the other rights, or if you have no account (a guest who made a reservation), write to us at the contact below.

You can also lodge a complaint with a data protection authority: the Belgian Data Protection Authority or the CNIL (France).

Cookies

Wishivo only uses cookies that are strictly necessary for the service. They do not require consent, which is why there is no banner.

• sb-…-auth-token: technical sign-in cookie (Supabase), set when you confirm your sign-in. Page scripts cannot read it (HttpOnly) and it expires 90 days after your last activity; removed when you sign out and when you delete your account.
• sb-…-code-verifier: temporary technical cookie used during some sign-ins (Supabase) to secure them. It expires after 10 minutes.
• wsh-session: a hint that contains no data (value “1”) so the right header is shown to signed-in people. Same lifetime as the sign-in; removed when you sign out.
• NEXT_LOCALE: remembers your language (French, Dutch or English). One year.

No analytics, advertising or social network cookies are used. If that changes, we will ask for your consent before setting them.

Contact

Privacy questions: privacy@wishivo.com. Other questions: contact@wishivo.com. Postal address: RAPAILLE CONSULTING SRL, Rue Allende 98 box A, 7021 Mons, Belgium. See also our legal notice.