Wishlist Stack

Wishlist Stack Privacy Policy

Effective March 2, 2026 · Updated November 12, 2026

Wishlist Stack (the “App”) is provided by SDG (“we”, “our”, or “us”). This policy covers the App and this public website. Merchants use the App to build wishlist experiences and remain responsible for their storefront privacy notices and customer data.

1. Information We Process

Merchant and installation data: store identifiers and domain, subscription and usage status, Shopify authentication credentials, and merchant staff details supplied through Shopify sessions. Store-owner contact details may be used for operational and privacy-request communications.

Wishlist data: Shopify customer IDs, list and group names, descriptions, product and variant references, quantities, notes, custom properties, share settings, and timestamps. A Shopify customer ID can identify or be linked to an individual; it is treated as personal data. Product information and selected metafields are retrieved from Shopify to populate wishlist responses.

Imports and privacy requests: CSV files, validation results, import history, and error rows can contain customer IDs and merchant-provided notes or properties. Shopify privacy requests can include customer contact details. Do not include sensitive personal information in notes, properties, or import files.

Technical data: our infrastructure processes IP addresses, request and device information, security events, and operational diagnostics to deliver and protect the service.

2. Cookies, Local Storage, and Analytics

The embedded app uses PostHog for product analytics and error monitoring, which can use cookies or local storage and process app interactions, technical information, and store, merchant, customer, or wishlist identifiers. Hosting and security providers also process technical request information. This static marketing website does not add an advertising pixel or a site analytics script. A merchant’s storefront integration may use its own storage or analytics; the merchant is responsible for those choices and any required notices or consent.

3. How We Use Information

We use information to authenticate installations and customers, provide wishlist and sharing features, hydrate product data, process imports, report aggregate wishlist activity, manage subscriptions and capacity, respond to privacy requests, provide support, and monitor reliability and security.

4. Sharing and Service Providers

We do not sell or rent personal data. Service providers process information needed for their role in delivering and supporting the service:

Shopify separately provides the commerce platform, product data, customer authentication, and app billing.

5. Retention and Deletion

Wishlist data is retained while the app is installed so merchants can provide the service. Uninstallation disables the installation and invalidates cached access; it does not immediately erase every record. Merchant-data cleanup is scheduled after Shopify sends its shop-redaction request, with safeguards against deleting a reinstalled store. Customer-redaction requests remove the relevant customer’s active wishlist records and related import data.

Unconfirmed import uploads have a 24-hour expiry. Confirmed imports have a seven-day retry window; source files are scheduled for deletion when an import completes, is canceled, or expires. Processing and cleanup retries can affect the time deletion finishes. Operational logs, telemetry, and managed backups follow their separate retention schedules; deletion from active app storage does not mean immediate removal from all backups.

6. Security

We use HTTPS, access controls, authenticated requests, rate limits, and infrastructure security measures. No system is completely secure.

7. International Processing

Primary application and database infrastructure is located in the United States. Content delivery, security, and other providers may process information in other locations. Appropriate transfer safeguards apply where required.

8. Privacy Requests

Customers should contact the merchant whose store holds their wishlist. Wishlist Stack supports Shopify’s customer-data request, customer-redaction, and shop-redaction workflows and assists merchants with applicable privacy obligations. Merchants can contact us for access, deletion, or other privacy assistance.

9. Children

The App is not intended for children under 13. We do not knowingly collect personal data from children under 13.

10. Changes and Contact

We may update this policy as the service changes. Contact [email protected] with privacy questions.