Privacy & Cookies

Privacy & Cookies Policy

Last updated: August 2026

We respect your privacy and are committed to protecting your personal data.

This policy explains what we collect, why we use it, who we share it with, and your rights when you use What I Really Really Want.

1. Who Is Responsible For Your Data

What I Really Really Want is responsible for the personal data we collect through our website and platform. You can contact us at hello@whatireallyreallywant.com.

2. What Information We Collect

We may collect and process:

name, email address, login details and account information;
wishlist titles, messages, images, dates, gift items and sharing links;
contributor names, messages, privacy choices and contribution information;
payment-related information, excluding full card details;
Stripe account and payout status information for wishlist creators;
support requests, feedback submissions and communications with us;
IP address, browser, device, approximate location, referral and usage information;
cookie, analytics and performance data where applicable.

We do not store full card details.

Card payments and payout setup are handled securely by Stripe.

3. How We Use Your Information

We use personal data to:

create, verify and manage user accounts;
create, display, edit and share wishlists;
process contributions and support Stripe payout setup;
send service emails such as account, wishlist, contribution and receipt messages;
provide customer support and respond to feedback;
detect fraud, abuse, technical problems and security issues;
improve the website, user experience, reliability and performance;
send marketing emails only where we have permission or another lawful basis.

4. Lawful Bases

Depending on the situation, we rely on:

contract, where we need data to provide the service you requested;
consent, such as optional marketing or certain non-essential cookies;
legitimate interests, such as improving the platform, preventing abuse and supporting users;
legal obligations, where we must keep or share information to comply with the law.

5. Marketing

We only send marketing emails where we have permission or where the law allows us to do so. Marketing may include offers, promotions, partner opportunities, new features, surveys and commercial updates.

You can opt out of marketing at any time by using an unsubscribe link in an email or by contacting us. Service emails about your account, wishlist, payments, security or support may still be sent.

6. Third-Party Services

We use trusted providers to operate the service, including:

Stripe for payments, connected accounts, fraud checks and payouts;
Supabase for authentication, database, storage and account sessions;
Vercel for hosting, deployment, performance and analytics tooling;
Resend or similar providers for transactional email;
Slack or similar tools for internal support and operational alerts;
analytics and monitoring tools to understand site performance and usage.

These providers process data only as needed to provide, secure, monitor or improve the service. Some providers may process data outside the UK. Where required, we rely on appropriate safeguards.

7. Public Wishlist Information

Wishlists are designed to be shared. If you publish or share a wishlist, information such as the wishlist title, image, message, recipient name, gift items, progress and selected contribution messages may be visible to people with the link.

Contributors may be offered privacy options such as anonymous display or private amounts. We will try to honour those choices in the public display, but payment and operational records may still be kept internally where needed.

8. Cookies & Similar Technologies

We use cookies and similar technologies to:

keep you logged in and remember secure sessions;
make the website work properly;
measure performance and understand how the platform is used;
support analytics, testing, security and reliability;
support advertising or sponsored-content features in future, where enabled.

Strictly necessary cookies are used because the website cannot work properly without them. For non-essential cookies, analytics or advertising technologies, we will use consent controls where required.

You can also control cookies through your browser settings, but blocking some cookies may stop parts of the service from working.

9. How Long We Keep Data

We keep personal data only for as long as reasonably needed for the purposes described in this policy. Here are our specific retention periods:

Accounts & Wishlists

Active accounts and wishlists: kept for as long as your account is active
You can delete your account and all data at any time via account settings
Inactive accounts (no login for 2 years): will be deleted with 30-day notice email

Contribution Records

Contribution data (amount, date, anonymized gift info, payout records) is kept for 7 years for tax, accounting and legal compliance as required by UK law.

Payment Information

Card details: never stored by us (Stripe handles all payments securely)
Stripe payment records: retained per Stripe's standard policies
Transaction receipts: kept for 7 years for accounting purposes

Analytics & Usage Data

Google Analytics data: 14 months
Performance monitoring data: 90 days
No personally identifiable information is stored in analytics

Cookies

Session cookies: expire when you close your browser
Preference cookies (language, theme): 1 year
Analytics cookies: 13 months
You can delete all cookies via your browser settings

Support & Communications

Support tickets and emails: 1 year
You can request deletion of your support data at any time

Fraud, Security & Legal Records

We may keep data longer where required for fraud prevention, security, legal disputes, chargebacks or compliance with law.

10. Your Rights

Depending on the law and the circumstances, you may have the right to:

access your personal data;
correct inaccurate data;
request deletion;
object to or restrict certain processing;
withdraw consent where processing is based on consent;
request a copy of certain data in a portable format;
complain to the UK Information Commissioner’s Office.

To exercise your rights, contact us at hello@whatireallyreallywant.com.

11. Data Security

We use reasonable technical and organisational measures to protect personal data. No online service is completely secure, so you should use a strong password, keep your email account secure and tell us if you suspect unauthorised access.

12. Children

Wishlists may be created for children or family occasions, but accounts should be created and managed by adults. Do not upload personal data about a child unless you have the right to do so and are comfortable sharing it with people who receive the wishlist link.

13. Changes to This Policy

We may update this policy from time to time. The latest version will always be available on our website. If a change is significant, we may take additional steps to tell users.

14. Contact

For privacy questions or data rights requests, contact hello@whatireallyreallywant.com.

Loading...

Getting your wishlist ready!