Privacy Policy
Last updated: September 2, 2026
1. Identity and Contact Details
Wishreg ("we", "us", or "our") operates the Wishreg wishlist platform. We are committed to protecting your privacy and handling your personal data responsibly.
- Data Controller: Kyrnich & CO
- Email: [email protected]
2. Personal Data We Collect
We collect and process the following categories of personal data:
Account Information
- Email address (required for account creation)
- Display name (optional)
- Username (required, public identifier)
- Profile avatar (optional)
- Language preference
OAuth Data (when using social login)
- Google: Email, name, profile picture, OAuth identifier
- Facebook: Email, name, profile picture, OAuth identifier
User-Generated Content
- Wishlists and their settings (title, description, event type, privacy level)
- Items added to wishlists (names, descriptions, prices, URLs, images)
- Claims and reservations on shared wishlists
Behavioral Data (with consent)
- List view analytics (view counts, unique visitors)
- Feature usage patterns
3. Legal Bases for Processing
We process your personal data based on the following legal grounds:
Contract Performance
Processing necessary to provide our wishlist services, manage your account, and fulfill our terms of service.
Legitimate Interests
Processing for service improvement, security measures, fraud prevention, and basic analytics to understand how our service is used.
Consent
Processing for analytics cookies, marketing communications, and any other purposes where we explicitly request your consent.
4. Data Sharing and Third Parties
We share data with the following third-party services to provide our platform:
| Service | Purpose | Data Shared |
|---|---|---|
| Google OAuth | Authentication | OAuth tokens, user identifier |
| Facebook OAuth | Authentication | OAuth tokens, user identifier |
| Cloudflare R2 | Image storage | Uploaded images (avatars, item images) |
| OpenAI (ChatGPT) and user-selected MCP clients | User-authorized access to Wishreg through conversational tools | Scoped OAuth tokens, tool inputs, and relevant account, wishlist, wish, and reservation data |
ChatGPT and MCP integrations
When you connect Wishreg to ChatGPT or another Model Context Protocol (MCP) client, Wishreg shares only the information needed to run the tools you request. Depending on the tool, this may include:
- Account profile fields: email address, username, display name, locale, default currency, avatar URL, profile visibility, and notification preferences
- Wishlist and wish fields: identifiers, titles, privacy and event settings, descriptions, links, images, prices, quantities, and booking state
- Reservation fields: identifiers, status, quantity, contribution amount and message, and the relevant wishlist and owner context
- The tool inputs and results needed to fulfill your request, plus scoped OAuth access and refresh tokens used to authenticate the connection
Wishreg never shares your password with an MCP client.
You choose whether to create an MCP connection and which permissions to approve. You can revoke a connection at any time in Settings → Integrations. Revocation prevents future access but does not delete information the client already retained.
After Wishreg sends information to an MCP client, that provider's privacy policy, retention practices, and account controls apply. ChatGPT is governed by the OpenAI Privacy Policy.
We do not sell your personal data to third parties. Data is only shared as necessary to provide our services.
5. Data Retention
We retain your personal data for the following periods:
- Account data: Retained while your account is active, plus 30 days after deletion request for recovery purposes.
- Analytics data: Retained for 1 year, then anonymized or deleted.
- Notification history: Retained for 2 years.
- Soft-deleted content: Retained for 6 months before permanent deletion.
- Audit logs: Retained for 7 years for legal compliance.
6. Your Rights
Under GDPR and applicable privacy laws, you have the following rights:
Right of Access
Request a copy of all personal data we hold about you.
Right to Portability
Export your data in a machine-readable format (JSON).
Right to Rectification
Correct inaccurate personal data in your account settings.
Right to Erasure
Request deletion of your account and associated data.
Right to Restrict Processing
Request limitation of how we process your data.
Right to Withdraw Consent
Withdraw consent for optional processing at any time.
To exercise any of these rights, please contact us at <email>[email protected]</email> or use the data management features in your account settings.
7. Cookies
We use cookies and similar technologies to provide, protect, and improve our services. For detailed information about our use of cookies, please see our <link>Cookie Policy</link>.
8. International Data Transfers
Your personal data may be transferred to and processed in countries outside of the European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses approved by the European Commission
- Transfers to countries with adequacy decisions
- Binding Corporate Rules where applicable
9. Children's Privacy
Wishreg is not intended for users under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child under 16, please contact us at <email>[email protected]</email> and we will take steps to delete such information.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make material changes:
- We will update the "Last updated" date at the top of this policy
- For significant changes, we will notify registered users via email
- We will provide a prominent notice on our platform
We encourage you to review this policy periodically to stay informed about how we protect your data.
Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us:
- Email: [email protected]
You also have the right to lodge a complaint with your local data protection authority if you believe we have not handled your personal data appropriately.