Privacy Policy

Wishper (wishper.gift) is operated by Ally Clark, Helsinki, Finland. Contact: ally@wishper.gift

We collect only what is necessary to run the service.

• Email address: for wish list owners, used for sign-in and email notifications when guests reserve items.
• First name: for guests, entered when reserving an item. Shared only with the wish list owner so they know who is bringing each gift.
• Family list members (Christmas lists): a first name or nickname for each person, and the wishes they add. For children, please use a first name or nickname only. Giving this is voluntary; the list manager decides who is added.
• Which link a list was created from: when you create a list after clicking one of our "make your own list" links, we note which link it was (for example the one at the bottom of a list), so we can tell which placement works. It is a short label, not a name or an address.

Wishper's operator may access this data as needed to operate, maintain, and provide support for the service.

We do not use advertising trackers, user profiling, or advertising cookies. We only count visits, with a cookie-free counter (see Cookies and visit counts below). We do not share personal data with third parties beyond what is needed to run the service: sending email, counting visits, and reading a shop page when you, or an adult with a private link, ask for it (the page address is sent to our page-reading service).

• Email address: Contract performance. We need it to authenticate you and send reservation notifications.
• Guest name: Legitimate interest. It prevents duplicate gifts and helps the wish list owner coordinate thank-yous.
• Family list members' names and wishes: Legitimate interest. Our interest is to let a list manager give each person a place for their own wishes. We keep this to the minimum (a first name or nickname and wishes, no accounts, a private link per person), and for children the manager approves every wish before guests can see it. You can object at any time (see Your rights).
• Visit counts and the link a list was created from: Legitimate interest. Our interest is to understand how Wishper is used and which parts help people, so we can improve the service. We keep this to anonymous counts (see section 8).

Our database is hosted in Frankfurt, Germany (European Union). Email delivery is handled by Lettermint, based in the Netherlands, which processes email data in the European Union. The website itself is delivered through our hosting provider, Lovable, which serves pages from locations around the world and processes data in several countries, including the United States; these transfers rely on safeguards such as EU Standard Contractual Clauses. When a shop page is read (see sections 3 and 10), the page address is sent to our page-reading service, Firecrawl, whose servers are in the United States. A shop page address is not normally personal data, so please do not paste addresses that contain personal information.

Visit counts are handled by Plausible Analytics (Plausible Insights OÜ, Estonia), whose servers are in Germany (European Union).

Account data is kept while your account is active. You can delete your account yourself at any time at the bottom of your dashboard: your lists, their wishes, the reservations on them and any private links are then removed right away. You can also ask us by email, and we remove your data within 30 days. Copies in our backups disappear as the backups expire, within 7 days, and our email provider keeps delivery logs for a limited time. Guest reservation names are kept until the wish list they belong to is deleted. A private link is deleted when the person or the list is deleted, and the wishes are deleted with the list.

Anonymous visit counts are kept for as long as we use the counting service, and contain no names or email addresses.

You can also ask us by email to remove your name from someone else's list.

Under GDPR, you have the right to access, correct, delete, restrict, and port your data, and to object to processing that is based on legitimate interest. You also have the right to complain to the Finnish Data Protection Ombudsman (tietosuoja.fi). An email address is needed to have an account, and a guest first name is needed to reserve an item. We do not make automated decisions about you. To exercise any of these rights, email us at ally@wishper.gift

Your browser keeps a sign-in session while you are signed in, and remembers your language and cookie choice. There are no profiling, advertising or third-party cookies.

We count visits with Plausible Analytics. Plausible uses no cookies and stores nothing on your device. When a page loads, your IP address and browser information are used briefly to estimate your country and region and to tell visits apart for one day through an anonymous code that changes every day; Plausible says it does not store the IP address. We record which pages are visited, where visitors came from (for example a website or a social network), and anonymous actions such as "a list was created", "an item was reserved" or "a make-your-own link was clicked". Names of lists and private links are removed from the page addresses we send, and we send no names, email addresses or list contents. Pages opened with a private personal link are not counted at all.

Wishper does not currently show advertisements. If we start to show advertisements, we may use your approximate location at city level (worked out from your IP address) and the content of the page you are viewing to show locally relevant ones, for example an advertisement from a Helsinki shop to a visitor in Helsinki. Your IP address itself is not kept. No persistent identifiers, advertising cookies or user profiles are created for this. We will update this policy before any advertising starts.

On a family Christmas list, the person who manages the list can give each family member their own private link. Anyone who has a link can see only that person's own section and add wishes to it. No account, email address or password is needed.

For children we only need a first name or nickname, so please do not use a full name. A wish that a child adds stays hidden from guests until the list manager approves it.

A link works until the manager switches it off, creates a new link, or deletes the person. A new link makes the old one stop working at once. The link is part of the page address, so please keep it private. Ordinary technical logs at our hosting provider can contain page addresses.

An adult with a private link can paste a shop page address and press the "Read the link" button. Only then is that address sent to our page-reading service, which returns the name, price and picture. Nothing is read for children, and nothing is read unless the button is pressed.

To prevent misuse we keep short-lived technical counters, based on your IP address and the link used, for up to a day. This is our legitimate interest in keeping the service secure. They are not used to follow or profile anyone.

The private link pages are not counted in our visit counts, and they ask search engines not to list them.

If we make material changes to this policy, we will notify registered users by email.

Questions about this policy? Email ally@wishper.gift