Privacy Policy

1. Data we collect

Data you give us

• Account details: your name, email address and password (stored securely as a hash), or your name, email and profile picture from Google if you sign in with Google.
• Gift content: photos, messages, audio or music, and any other content you add to gifts.
• Recipient details: names and email addresses of the people you send gifts to.
• Support messages: anything you send us when you contact us.

Data collected automatically

• Usage and device data: IP address, browser and device type, pages viewed, approximate location (from IP), and dates and times of visits.
• Gift activity: whether and when a gift has been opened, so the Service can work and show you its status.
• Cookies and similar technologies: see section 7.

Data from third parties

• Lemon Squeezy: confirmation of your purchase, the order ID, amount, country and email address. We do not receive your full card details.

2. How we use it, and our legal basis

For users in the EU and UK, GDPR requires a “legal basis” for each use.

We do not sell your personal data, and we don’t use your photos or gift content for advertising.

3. Gift recipients

When you send a gift, we process the recipient’s name and email address only to deliver the gift and let them view it. We don’t add recipients to marketing lists. If you are a recipient and want your details removed, contact us. By adding a recipient’s details, you confirm you have a legitimate reason to share them with us.

4. Who we share data with

We share personal data only with service providers that help us run Cherrywish, and only for that purpose:

We may also disclose data if required by law, to protect our rights or users’ safety, or as part of a business sale or merger. If that happens, we will notify you.

5. International transfers

We are based in Sri Lanka, and our providers may store or process data in other countries, including the United States and the EU. Where we transfer data out of the EU or UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, or the provider’s certification under the EU–US Data Privacy Framework.

6. How long we keep data

• Account and gift content: kept until you delete it or your account. You can delete it at any time.
• Inactive accounts: may be deleted after more than 5 years without a sign-in, with advance email notice.
• Purchase records: kept for as long as tax and accounting laws require, typically 6–7 years, even after account deletion.
• Backups: deleted data may remain in backups for up to 30 days before being permanently removed.
• Analytics data: kept for 14 months.

7. Cookies and similar technologies

We use:

• Essential cookies and storage: needed to keep you signed in, keep the Service secure and save your drafts. These can’t be switched off.
• Analytics cookies (Google Analytics): help us understand how people use the site. In the EU, UK and other places where the law requires it, we only set these after you consent through our cookie banner. You can change your choice at any time through the cookie settings on the site.

8. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you
• correct inaccurate data
• delete your data (you can also delete gifts or your account yourself)
• restrict or object to certain processing
• data portability, receiving your data in a common format
• withdraw consent at any time, for example for analytics
• lodge a complaint with a data protection authority

Sri Lanka: you have rights under the Personal Data Protection Act No. 9 of 2022, and can complain to the Data Protection Authority of Sri Lanka.

EU and UK: you can complain to your local data protection authority.

United States (including California): you have the right to know what personal information we collect, to request deletion or correction, and not to be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioural advertising.

To use any of these rights, email info.zetrone@gmail.com. We’ll respond within 30 days and may need to verify your identity first.

9. Children

The Service is not intended for children under 13, or under the minimum age of digital consent in their country if that is higher. We don’t knowingly collect data from them. If you believe a child has given us personal data, contact us and we’ll delete it.

10. Security

We use reasonable technical and organisational measures to protect your data, including encryption in transit (HTTPS), access controls, and password hashing through our authentication provider. Gift links can be protected with a lock. No system is completely secure, so we can’t guarantee absolute security. If a data breach is likely to put you at risk, we will notify you and the relevant authorities as the law requires.

11. Changes to this policy

We may update this policy. If changes are significant, we’ll notify you by email or on the site before they take effect. The effective date at the top always shows the latest version.

12. Contact