WishWish1. Scope & who we are
WishWish (“we”, “us”) provides a chat-driven commerce mobile app. This policy covers the WishWish mobile app and any connected services. It does not cover third-party merchants, payment processors, or websites we link to — their own policies apply.
2. Information we collect
| Category | Examples | Required? |
|---|---|---|
| Account | Phone number, OTP verification, display name | Yes |
| Profile | Name, email, avatar, saved addresses | Optional |
| Order & commerce | Cart contents, orders, delivery details, order status | Yes |
| Payment | Tokenized payment method reference (never the full card number) | Optional |
| Chat & AI prompts | Messages you send in the assistant, selections you tap | Yes |
| Device & technical | OS, app version, device model, language, crash logs, IP address | Yes |
| Usage | Screens viewed, features used, session timing | Aggregated |
| Location | Coarse location for delivery estimates (only with permission) | Optional |
| Communications | Support messages, feedback you send us | Optional |
We do not collect biometric identifiers, precise background location, or contacts.
3. How we collect it
- Directly from you — when you sign up, place orders, or chat with the assistant.
- Automatically — from your device when you use the app (crash reports, technical diagnostics).
- From partners — payment processors confirm transaction status; delivery partners report shipment progress.
4. How we use your data
- Create and secure your account (phone/OTP authentication).
- Process orders, payments, and deliveries.
- Power the AI assistant so it can understand your requests and show relevant products.
- Provide order updates and customer support.
- Detect fraud, abuse, and violations of our terms.
- Improve the app — fix bugs, measure feature performance in aggregate.
- Comply with legal obligations (tax, consumer protection, lawful requests).
We do not sell your personal information, and we do not use your chats to train third-party AI models.
5. Legal bases (GDPR)
- Contract — to provide the app and fulfil orders you place.
- Legitimate interests — to keep the service secure, prevent fraud, and improve product quality.
- Consent — for optional items like location and marketing messages. You can withdraw consent any time.
- Legal obligation — for tax records, dispute handling, and responding to lawful requests.
6. AI & chat processing
WishWish is chat-first. When you message the assistant, your prompt and minimal conversation context are sent to our AI backend to generate a reply and pick relevant products. Prompts are stored so the assistant can maintain conversation history for you.
- We strip sensitive fields (payment numbers, OTPs) before storage.
- AI model providers process prompts on our behalf under data-processing agreements and are not permitted to use your prompts to train their models.
- You can delete your chat history at any time from Settings → Privacy.
8. International transfers
Your data may be processed in countries other than your own. When we transfer personal data out of your region, we rely on approved safeguards — Standard Contractual Clauses (SCCs), adequacy decisions, or equivalent — to keep protection in place.
9. Data retention
| Data | Retention |
|---|---|
| Account & profile | Until you delete the account |
| Orders & invoices | Up to 7 years (tax & consumer law) |
| Chat history | Until you delete it, or 24 months of inactivity |
| Crash & diagnostic logs | Up to 90 days |
| Support tickets | Up to 3 years after resolution |
Deleting your account triggers permanent deletion of personal data, except records we must retain for legal reasons.
10. Security
- Transport-layer encryption (TLS) for all traffic between the app and our servers.
- Encryption at rest for stored personal data.
- OTP-based authentication; no reused passwords.
- Least-privilege access controls, audit logging, and regular reviews.
- Tokenized payment handling — full card numbers never touch our servers.
No system is perfectly secure. If we discover a breach that affects you, we will notify you and the relevant regulator as required by law.
11. Your rights
Depending on where you live, you may have the right to:
- Access — get a copy of your data.
- Correct — fix inaccurate information.
- Delete — erase your account and associated data.
- Restrict / Object — limit how we use your data or object to certain processing.
- Portability — receive your data in a machine-readable format.
- Withdraw consent — where processing is based on consent.
- Complain — lodge a complaint with your local data-protection authority.
Most of these are available in-app under Settings → Privacy. For anything else, email us (section 17). We respond within 30 days.
12. Your choices & controls
- Permissions — grant or revoke location and notification access from your device settings.
- Marketing — opt out of promotional messages from Settings → Notifications.
- Chat history — clear individual conversations or all history.
- Delete account — from Settings → Account → Delete Account.
13. Children
WishWish is not directed to children under 13 (or the equivalent minimum age in your country). We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.
15. Regional disclosures
European Economic Area & UK
Legal bases are described in section 5. You may contact your local supervisory authority; in the UK, that is the ICO.
California (CCPA/CPRA)
California residents have the right to know, delete, correct, and limit the use of sensitive personal information. We do not sell or share personal information as those terms are defined under the CCPA. Submit requests via the contact channel below; we will not discriminate against you for exercising these rights.
Other regions
Where local privacy law provides additional rights (e.g. LGPD in Brazil, PIPEDA in Canada, DPDP Act in India), we honour them on request.
16. Changes to this policy
We may update this policy from time to time. Material changes are announced in-app before they take effect. The “Effective” date at the top always reflects the current version.
17. Contact us
For privacy questions, data requests, or complaints, reach our Data Protection team:
- Email: wishwish.admin@gmail.com
- In-app: Settings → Help & Support → Privacy
Questions about your data?
Our privacy team responds within 30 days.