Privacy Policy

Introduction

Protecting your personal data is a priority for Olaf Wishlist. This privacy policy informs you about how we collect, use, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

Data Controller

The data controller for personal data is:

Data Protection Officer (DPO)

For any questions regarding the protection of your personal data, you can contact our data protection officer at: contact@olaf-wishlist.com

Data Collected

In the course of using the Website and its services, we may collect the following data:

Processing Purposes

Your personal data is processed for the following purposes:

Cookies and Trackers

The Website only uses cookies strictly necessary for its operation. These cookies do not require your prior consent in accordance with applicable regulations.

List of cookies used:

The Website uses your browser's local storage to remember your navigation preferences. This data remains on your device and is never transmitted to our servers.

No advertising tracking cookies or third-party analytics are used on this website.

Audience Measurement

This website uses Umami, a privacy-friendly audience measurement solution. This solution is self-hosted on our servers and does not use any cookies. No personal data is collected or shared with third parties. Statistics are anonymous and aggregated, and are used solely to improve the user experience of the website.

Browser Extension

The Olaf Wishlist browser extension (available for Chrome, Firefox, and Edge) also includes audience measurement via Umami.

No personally identifiable data is collected by the extension. Only anonymous, aggregated usage events are recorded (e.g., number of items added, number of reservations made).

These anonymous statistics are used solely to understand extension usage and improve its features.

The extension stores your session credentials and preferences locally on your device. This data is never shared with third parties.

Email Sending

For sending emails (transactional emails, notifications, confirmations), we use our own email infrastructure hosted on our servers.

No personal data is transmitted to a third-party provider for email delivery.

The data processed for sending communications is:

• Recipient's email address
• Message content
• Technical data related to sending (timestamp)

This data is processed solely to ensure the delivery of communications and is stored on our servers located within the European Union.

Emails are transmitted from our infrastructure to recipients' mail servers. Our server attempts to establish an encrypted connection (TLS) when the recipient server supports it (opportunistic encryption). However, as with any email exchange on the Internet, end-to-end encryption cannot be guaranteed, as it depends on the configuration of the recipient's mail server.

Data Sharing

Your personal data is never sold to third parties. It may be shared with:

• Our hosting provider, for secure data storage
• OpenAI, for automatic moderation of testimonials published on the website (textual content analysis only, without transmitting personally identifiable data)
• Google (Gemini), to optionally analyze product photos taken from the mobile app when you trigger that feature (the photo is sent for analysis only, is never stored by Olaf, and the processing is governed by the Google AI Studio terms)
• Public list creators, who can view the name and email address of people who reserved an item, after the event date
• Stripe, our payment service provider, when you contribute to a cash gift or are its beneficiary (see the "Cash Gift and Payment Data" section)
• Competent authorities, upon legal request

Transfers outside the EU: except for the optional product-photo analysis, which may involve processing by Google outside the European Union when you enable it from the mobile app, and the processing of cash gift payments by Stripe, which may involve transfers governed by appropriate safeguards (standard contractual clauses of the European Commission), no data is transferred outside the EU. All other data is hosted in France by OVH.

Cash Gift and Payment Data

When a cash gift is activated on a public wishlist, or when you contribute to one, the following data is processed:

• For the contributor: email address, name, contribution amount and any support tip, optional message to the beneficiary, receipt language, as well as a technical fingerprint of the IP address (irreversible hash) for fraud prevention purposes
• For the beneficiary: cash gift status, optional goal and technical identifiers of their Stripe payment account — never the full IBAN or identity documents
• Card details are entered exclusively on the payment page hosted by Stripe and never pass through Olaf Wishlist
• The beneficiary's identity verification documents are collected and stored directly by Stripe, in accordance with its legal anti-money-laundering obligations (5 years after the end of the relationship)

Stripe Payments Europe, Ltd. (Ireland) processes this data as a payment service provider, in accordance with its own privacy policy: https://stripe.com/privacy

Contribution records (amount, status, contributor's email and name, message) are retained for the lifetime of the public wishlist, then archived for the duration of legal obligations. The name, message and amount of each contribution are revealed to the beneficiary after the event date, as indicated to the contributor at the time of payment.

Automatic deletion of inactive accounts

In accordance with the storage limitation principle (GDPR Article 5), your Olaf Wishlist account and all associated data are automatically deleted after 3 years of inactivity, meaning the absence of any sign-in during that period. This duration corresponds to the recommendation of the CNIL (French data-protection authority) for consumer services.

You are notified by email, in-app notification and push notification (if enabled) on three occasions before deletion: 30 days before, 7 days before, and 24 hours before.

Any sign-in to your account updates the last-active date and prevents automatic deletion for another 3 years. Simply signing in is enough to keep your account.

When deletion occurs, your lists (private, public and memo), your reservations and your contributions are erased. Ownership of your groups is automatically transferred to another member (priority to the oldest admins). If you are alone in a group, the group is also deleted. You can download all your personal data before deletion from your profile.

In addition, an account that is created but never verified by email is automatically deleted 30 days after it was created. A reminder email is sent to you 7 days before this deadline. You can verify your address — or request a new verification link — at any time, as long as the account has not yet been deleted.

You can also delete your account yourself at any time, without waiting for this automatic deletion. Visit the dedicated account deletion page.

Your Rights

In accordance with the GDPR, you have the following rights regarding your personal data:

To exercise these rights, you can:

• Use your account settings ("My Profile" page)
• Contact us at: contact@olaf-wishlist.com
• Download your personal data from the "My Profile" page

You also have the right to lodge a complaint with your local data protection authority.

Deletion of User Data Linked to Facebook Login

If you used Facebook Login to create or connect your Olaf Wishlist account, you can request the deletion of your data in two ways:

Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

Security Measures

We regularly review our security practices to adapt to technological developments and emerging threats. In the event of a security breach affecting your data, we commit to informing you as soon as possible in accordance with our legal obligations.