Privacy Notice

1. Information we collect

• Account and identity information, such as name, email, authentication identifiers, account role, and security events.
• Marketplace activity, such as searches, favorites, messages, listings, shops, orders, returns, reviews, support requests, promotions, and ad interactions.
• Payment and payout references supplied by payment providers. Wishlilly should not store complete payment-card numbers.
• Shipping and contact details needed to fulfill an order, validate an address, provide tracking, or handle a return.
• Device, browser, cookie, log, IP-derived security, and diagnostic information used to operate and protect the service.
• Information a seller provides for onboarding, verification, tax, payment, and marketplace-compliance purposes.

2. How information is used

• Provide accounts, listings, checkout, payment, shipping, messaging, reviews, returns, support, and marketplace administration.
• Authenticate users, enforce permissions, prevent fraud and abuse, investigate incidents, and keep audit records.
• Send transactional notices and, only when permitted, marketing communications with an unsubscribe option.
• Measure marketplace performance, improve search and recommendations, produce seller analytics, and diagnose reliability problems.
• Comply with legal, tax, accounting, sanctions, recordkeeping, and valid law-enforcement obligations.

3. When information is shared

Wishlilly shares information only as needed with the buyer or seller involved in a transaction; authentication, hosting, database, storage, email, payment, fraud, analytics, support, and shipping providers; professional advisers; or authorities when legally required.

Wishlilly does not intend to sell personal information for money. The final notice must be re-reviewed before enabling cross-context behavioral advertising, third-party advertising pixels, or data-broker integrations.

4. Cookies, retention, and security

Wishlilly uses essential cookies for authentication, security, cart state, shop selection, preferences, and reliable marketplace operation. Non-essential analytics or advertising technology must receive the consent or opt-out treatment required by applicable law before launch.

Information is retained only as reasonably needed for accounts, transactions, disputes, fraud prevention, financial and audit records, and legal obligations. Final periods must be documented in the launch retention schedule.

Wishlilly uses access controls, encryption in transit, protected secrets, logging, backups, and recovery procedures. No online service can guarantee absolute security.

5. Your choices and requests

• Update available account information and communication preferences through your account.
• Use the unsubscribe link in eligible email messages.
• Use the pre-launch support form at /support/contact to record an access, correction, deletion, or portability request where applicable.
• The identity-verification, response-deadline, fulfillment, denial, and appeal procedures for privacy requests must be approved and made operational before public launch.

6. Children, international use, and contact

Wishlilly is not directed to children under 13 and does not knowingly collect their personal information. Wishlilly is designed for a U.S. launch; the final operator, service geography, and processing locations must be documented before public release.

Use the pre-launch support form at /support/contact to record a privacy question or request. The form records an intake case; it is not yet a verified privacy-rights response channel. The final notice must include the complete legal entity, mailing address, verified request and appeal procedures, processor inventory, retention schedule, and state-specific disclosures confirmed by counsel.