Privacy policy

Last updated: 13 September 2026. This is an informational draft for a Belgium/EU service and is not legal advice.

1. Who is responsible

The controller of your personal data for Wishlistar is Kobe Amerijckx (eenmanszaak, Belgium; company number BE0765.870.131), with address Blijkheerstraat 92, 1755 Pajottegem, Belgium. Contact for privacy questions: contact@kobelly.be. Website: https://wishlistar.be.

2. What data we process

• Account: name, email, password (stored as a secure hash), role, email verification status, account creation date. Admin accounts also have a separate login name.
• Wishlistar content: lists and items you create (titles, notes, links, images you add, quantities, favourites), reservations, and sharing settings.
• Groups: group names, membership, ownership, and invite tokens needed to join a group.
• Security tokens: password-reset and email-verification tokens (stored hashed, time-limited).
• Technical: HTTP-only session cookie after sign-in; limited local browser storage so the app works offline/PWA-style; server logs needed to operate and debug the service (for example failed email sends).
• Analytics (optional): if you accept Google Analytics, Google may process page views, device/browser information, and approximate location via cookies. The Google tag loads with Consent Mode; analytics storage stays denied until you opt in.

3. Why we process it (purposes and legal bases)

• Provide the service (create an account, sign in, sync lists, groups, invites) — performance of a contract (GDPR Art. 6(1)(b)).
• Security and abuse prevention (rate limits, session cookies, hashed passwords) — legitimate interests (Art. 6(1)(f)).
• Email verification and password reset — contract / legitimate interests; emails are sent only when you request them or when required to activate an account.
• Legal obligations if we must retain or disclose data under EU/Belgian law (Art. 6(1)(c)).
• Optional analytics (Google Analytics 4) — consent (Art. 6(1)(a) and the ePrivacy rules for cookies). You can refuse or withdraw this at any time via Cookie settings. We do not use advertising cookies.

4. Who receives your data

• Other Wishlistar users you share with (for example group members can see lists shared with that group; reservation details follow the app’s privacy rules for gift surprises).
• Email delivery: Zoho Mail EU (smtp.zoho.eu) when password-reset or verification emails are sent — only the necessary message content and your email address.
• Hosting: the server and storage hosting Wishlistar are provided by netcup in Germany (EEA).
• Analytics: if you accept analytics, Google LLC (USA) processes measurement data as a processor for Google Analytics 4. Google may store data in the United States. We rely on your consent and Google’s EU-US Data Privacy Framework participation / Standard Contractual Clauses as described in Google’s documentation.

We do not sell your personal data.

5. How long we keep data

• Account and wishlist data: for as long as your account remains open.
• When you delete your account: we remove your user profile and clean group memberships from the live store. Rolling server backups (last 50 saves) may still contain older copies until those backups rotate off.
• Reset / verification tokens: until they expire (password reset about 1 hour; email verification about 24 hours) or are used.
• Analytics: if you accepted Google Analytics, Google retains measurement data according to the retention period configured in our Analytics property (defaults are typically 2 or 14 months of event data, plus cookie lifetimes described in the Cookie policy).

6. Transfers outside the EEA

Processing for the core service is intended to stay in the EEA: application hosting with netcup in Germany, and Zoho Mail EU for transactional email. If you accept Google Analytics, some measurement data is transferred to Google in the United States under the safeguards in section 4. If that changes, we will update this policy.

7. Your rights

Under the GDPR you may have the right to access, rectify, erase, restrict, object, and data portability, and to withdraw consent where processing is based on consent. You can:

• Update profile/email/password in your Account page.
• Download a copy of your data (Account → Download my data).
• Delete your account (Account → Delete my account).
• Change or withdraw analytics consent with Cookie settings.
• Email us at contact@kobelly.be.

You may also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données) or your local EU supervisory authority.

8. Children

Wishlistar is intended for users aged 13 or older. If you believe a child under 13 has created an account, contact us so we can delete it.

9. Changes

We may update this policy when the product or law changes. The “Last updated” date at the top will change when we do.