Privacy Policy

Effective date: 01/09/2026

Wishing Well ShPK (“us”, “we”, or “our”) operates the website wishingwell.cloud and the web application available at app.wishingwell.cloud (together, the “Service”).

This page informs you of our policies regarding the collection, use and disclosure of personal data when you use our Service and the choices you have associated with that data.

We use your data to provide and improve the Service. By using the Service, you agree to the collection and use of information in accordance with this policy. Unless otherwise defined in this Privacy Policy, the terms used here have the same meanings as in our Terms of Service.

Definitions

Service — the website wishingwell.cloud and the web application at app.wishingwell.cloud, operated by Wishing Well ShPK.

Personal Data — data about a living individual who can be identified from those data, or from those and other information either in our possession or likely to come into our possession.

Usage Data — data collected automatically, either generated by the use of the Service or from the Service infrastructure itself.

Cookies — small files stored on your device.

Data Controller — the natural or legal person who determines the purposes for which and the manner in which personal data are processed. For the purpose of this Privacy Policy, we are the Data Controller of your Personal Data.

Data Processor (or Service Provider) — any natural or legal person who processes data on behalf of the Data Controller.

Data Subject (or User) — any living individual who uses our Service and is the subject of Personal Data.

Information We Collect

Account data. When you create an account, we collect your email address and a password. The password is stored only in encrypted form and is never accessible to us in readable form. You may also set a preferred language, which we store with your account.

Wishlist data. When you add an item to your wishlist, we store the product link, its title, image, price and the marketplace it comes from. This information reflects your personal interests and preferences, and we treat it accordingly.

Security data. For security purposes we record authentication events — successful and failed sign-ins, account creation and account deletion — together with the IP address from which they originate. This information is retained for 90 days and is then deleted.

Usage data. We collect information automatically when you access the Service, including your IP address, browser type and version, the pages you visit, and the date and time of your visit.

Analytics data. We use Google Analytics to understand how the Service is used. Google Analytics sets cookies on your device and processes data on our behalf, including data transfers to servers operated by Google outside the European Economic Area.

Affiliate Links

Some links in our Service — including items in our Showcase and in your wishlist — are affiliate links. When you follow one, you are redirected to the merchant’s website through a link that identifies us as the referrer. If you make a purchase, we may receive a commission from the merchant at no additional cost to you.

This redirect passes an identifier to the merchant. We do not receive personal information about you from the merchant, and we do not currently track which links you follow. Merchants operate their own privacy policies, which we do not control. We encourage you to review the privacy policy of any site you visit through our Service.

Cookies

We use cookies and similar technologies:

• Session cookies, necessary to keep you signed in to the web application
• Preference cookies, to remember your settings such as your chosen language
• Analytics cookies, set by Google Analytics

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. If you do not accept cookies, some parts of the Service may not work.

How We Use Your Data

• to provide, maintain and improve the Service
• to create and manage your account
• to store and display your wishlist
• to send you transactional emails, such as account verification and password reset
• to protect the Service against unauthorised access and abuse
• to detect, prevent and address technical issues
• to understand how the Service is used
• to comply with legal obligations

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

Legal Basis for Processing under the GDPR

If you are from the European Economic Area, our legal basis for collecting and using your personal data depends on the data concerned and the context in which we collect it. We may process your data because:

• we need to perform a contract with you — to provide the Service you have signed up for
• it is in our legitimate interests — to keep the Service secure and to improve it, where those interests are not overridden by your rights
• you have given us consent — for example for analytics cookies
• we are required to comply with the law

Where Your Data Is Stored

Our website is hosted by Aruba S.p.A. on servers located in the European Union. Our web application and its database are hosted by DigitalOcean on servers located in Frankfurt, Germany. Your account data and wishlist therefore remain within the European Economic Area.

Google Analytics data may be transferred to and processed on servers operated by Google outside the European Economic Area. Google states that it applies appropriate safeguards to such transfers.

Retention of Data

We retain your account data and wishlist for as long as your account is active.

When you delete your account, your account record and the personal data associated with it are permanently removed from our database. This action cannot be undone.

Security event records are retained for 90 days and are then deleted.

We may retain certain data for longer where we are legally obliged to do so, or where it is necessary to resolve disputes or enforce our agreements.

Disclosure of Data

Business transaction. If Wishing Well ShPK is involved in a merger, acquisition or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Legal requirements. We may disclose your Personal Data in the good faith belief that such action is necessary to comply with a legal obligation, to protect and defend our rights or property, to prevent or investigate possible wrongdoing in connection with the Service, to protect the personal safety of users of the Service or the public, or to protect against legal liability.

Security of Data

We protect your data with encrypted connections (HTTPS), encrypted password storage, and limits on repeated authentication attempts.

The security of your data is important to us, but no method of transmission over the Internet or method of electronic storage is completely secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

Your Data Protection Rights under the GDPR

If you are a resident of the European Economic Area, you have certain data protection rights. We aim to take reasonable steps to allow you to correct, amend, delete or limit the use of your Personal Data.

You can access and update your account data, and delete your account, from the account settings section of the web application.

In certain circumstances, you have the following rights:

• the right to access, update or delete the information we hold about you
• the right of rectification — to have your information corrected if it is inaccurate or incomplete
• the right to object to our processing of your Personal Data
• the right of restriction — to request that we restrict the processing of your personal information
• the right to data portability — to be provided with a copy of your information in a structured, machine-readable and commonly used format
• the right to withdraw consent at any time, where we relied on your consent to process your personal information

Please note that we may ask you to verify your identity before responding to such requests.

You also have the right to complain to a Data Protection Authority about our collection and use of your Personal Data. For more information, please contact your local data protection authority in the European Economic Area.

Children’s Privacy

The Service is not directed to anyone under the age of 16, and we do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us and we will take steps to remove that information.

Service Providers

We employ third party companies to facilitate our Service, provide the Service on our behalf, or assist us in analysing how our Service is used. These include our hosting providers and Google Analytics.

These third parties have access to your Personal Data only to perform these tasks on our behalf and are obliged not to disclose or use it for any other purpose.

Links to Other Sites

Our Service contains links to other sites that are not operated by us. If you click a third party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over, and assume no responsibility for, the content, privacy policies or practices of any third party sites or services.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page, and we will update the effective date at the top.

You are advised to review this Privacy Policy periodically. Changes are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, please contact us:

By email: info@wishingwell.cloud