Your data.
Your call.

Company and contact

A.M.E.X. Internet Marketing ltd
Makariou III, No.9, Larnaca, 7530, Cyprus
Company registration: HE 377934 · VAT: 10377934Z

For this website, contact Show email. Company details.

We are the controller for personal information used to operate WishlistGenius.com, its customer services and our temporary demos. This notice covers those services. A shop using the WishlistGenius plugin is responsible for the shopper information held in its own WordPress installation; contact that shop about its wishlists and customer emails.

Why we use personal information

• Accounts, purchases, licences and requested support: to provide the service you request, perform our contract with you or take steps you request before a purchase.
• Service security and administration: our legitimate interests in preventing abuse, authenticating access, keeping reliable records and resolving enquiries or disputes. We consider the effect on your rights and use the information needed for these purposes.
• Optional newsletters and installation reporting: your separate choices and, where required, consent. Withdrawing a choice does not affect the lawfulness of processing before withdrawal.
• Legal duties: applicable accounting, tax and other legal requirements, including responding to a valid legal request.

Accounts, purchases and licence records

When you create or use a customer account, we process your email address, a password hash when a password is set, verification and sign-in records, security tokens and account status. Required account or purchase information is needed to provide the relevant service. Optional marketing choices are separate; buying Pro or contacting support does not subscribe you to a newsletter.

For a purchase, we keep the selected plan, currency, price and tax amounts, purchase and payment references, payment or subscription status, accepted terms, and information needed for downloads, refunds, cancellations and support. We receive payment and subscription updates from Stripe. Stripe processes the checkout information you provide, including payment details, billing address and any business or tax details. Payment card entry is handled by Stripe; our application does not store your full card number or security code. Read Stripe’s privacy notice for its processing.

Licence registration connects purchase or manually granted access to a store origin, installation identifier, activation credentials and activation/check times. Releasing a site stops its activation; it does not automatically erase the purchase, grant or activation history. The retention section explains how we handle these records.

Website delivery

WishlistGenius uses Cloudflare for DNS, HTTPS and website protection, and a GoDaddy VPS in the United States for its website and application data. These providers process connection information to deliver and secure requests. Limited security request logs include IP addresses, timing and response status. Requests are grouped by route; these logs exclude private path identifiers, query strings and request bodies. These request logs rotate daily with up to 14 archives retained. Separate error logs may also be retained.

Cookies and browser storage

We currently use no optional audience analytics or advertising tracking on this website. Essential cookies support services you request, such as secure forms, account access, purchases and private demos. They are not an agreement to receive marketing. If optional tracking is introduced, the applicable choice must be offered before it runs.

• Customer account: sign-in cookies last up to 12 hours; the server ends access after one hour of inactivity. Account form and email-action protection cookies last up to two hours.
• Checkout: form protection lasts up to 30 minutes. A private purchase-access cookie lasts up to seven days.
• Support: form protection lasts up to one hour; access to a private ticket lasts up to 30 days. Staff sign-in has separate security cookies.
• Newsletter signup: opening the signup form sets a security cookie for up to 30 minutes. This does not subscribe you.
• Demo: the owner cookie lasts up to 24 hours, while each temporary store lasts up to 30 minutes, as described below.
• Choices saved in this browser: the currency selector remembers the currency you choose until you change it or clear that storage. Article invitation dismissal is described in Newsletter invitation preferences.

You can clear cookies and browser storage in your browser. Blocking necessary cookies may prevent sign-in, private access or form submission. Clearing storage does not delete server-held records or unsubscribe an email address.

Live demos

Our real Free and Pro demos run on plugins.shop, our separate demo host. Each edition uses a private temporary WordPress store lasting up to 30 minutes. The store holds your sample wishlists, notes, cart, settings and locally captured demo messages. Its working data is removed after expiry, reset or ending the session. Use fictional details only; do not enter personal, customer or confidential information. Payments and external email delivery are disabled.

Essential cookies connect your browser to its own demo stores. The owner cookie lasts up to 24 hours; it does not extend a store’s 30-minute lifetime. Limited start records support an hourly rate limit, and cleaned session metadata can remain for up to 24 hours. Capacity is limited to four active stores overall and two per browser, with at most eight starts per hour per browser and network. These limits protect availability; the launcher explains when you need to wait or end a session. Read the demo host’s privacy notice for its session and security data handling.

Newsletter invitation preferences

On individual blog posts and guides, an optional email invitation may appear after reading. Closing it, choosing No thanks or successfully requesting confirmation stores only a dismissal-expiry timestamp in this browser’s local storage, for the configured period of up to one year. This preference is not sent to us and does not identify you. Clearing browser storage resets it. If storage is unavailable, dismissal lasts only for the current page. Closing the invitation does not subscribe or unsubscribe you.

Opening the signup form and submitting its unchecked consent choice are separate actions. You can also open the email signup page without JavaScript.

Local plugin review preference

The plugin can keep a first-save date, a bounded count of distinct saving days and an administrator’s review dismissal or reminder preference in the store database. These local values are used only to decide whether to offer an optional honest-review invitation. No shopper identity or wishlist content is included, and this information is not sent to us.

Optional plugin installation reporting and merchant emails

Wishlist features work without sharing an installation or joining an email list. After the first successful setup save, the plugin offers two separate, unchecked choices in Privacy & email preferences. Either choice, both, or neither can be selected. These choices do not grant shopper-notification consent or activate a Pro licence.

Installation details: the site hostname, reported Free/Pro edition, plugin version, WordPress/PHP versions and site language. The hostname excludes URL paths and query strings. A random connection identifier and secret token authenticate the report and withdrawal. Accepted reports refresh at most weekly while WordPress cron runs. Changing the site address pauses reporting. We use these reports to understand opted-in installations and compatibility needs; they are not proof of domain ownership or a count of all installations.

Optional merchant emails: the entered email address and reported Free/Pro edition for setup tips, releases, articles and occasional Pro offers. The site administration email may be prefilled locally, but is sent only when the email choice is selected and saved. Email-only signup does not send the hostname. New requests require inbox confirmation. Existing subscribers keep their existing permissions. A reported edition helps avoid irrelevant upgrade offers; it is not verified purchase history.

Requests go to this website’s /newsletter-api/v1/plugin-welcome/ service. The service receives connection IP information under the delivery/security logging described above. Neither choice sends shopper wishlists, customer emails, order data, administrator passwords or Pro licence credentials.

Installation/connection reports expire after 90 days without an accepted refresh. Stopping reporting deletes its corresponding details; a pseudonymous revocation record can remain for that bounded period to reject delayed requests. Pending email requests expire after 48 hours; confirmed newsletter records expire after at most 730 days. Consent history and unsubscribe suppression records are retained for 180 days.

Stop either reporting scope in the plugin’s Privacy & email preferences. Reporting stops locally before the server withdrawal is attempted; failed withdrawals can be retried. Stopping email/edition reporting cancels a pending signup created by that connection. Confirmed newsletters remain independent: use the private preferences or unsubscribe link in an email to change or stop them. Deactivating the plugin stops scheduled reporting but does not unsubscribe a confirmed email. Read the newsletter privacy notice for preferences and email handling.

Plugin data, downloads and optional Pro connections

Free keeps wishlist records in your WordPress database and does not contact WishlistGenius to run its wishlist features. Optional installation reporting and merchant email signup are separate choices described above. Historical Free ZIP downloads hosted on wishlistgenius.com connect to this website when downloaded. The separately labelled WordPress.org directory link opens that service, where its privacy terms apply.

Pro features require an eligible explicit licence activation for this store. The connection starts off; installing the add-on alone does not unlock Pro. When an administrator activates it, the plugin sends the licence key, store origin, a random installation identifier, connector version and any supplied staging proof to https://wishlistgenius.com. The service also receives the connection IP. Activation credentials are encrypted at rest in WordPress. While connected, entitlement checks send the activation ID and token, store origin, installation identifier and connector version every six hours when WordPress cron runs. Explicit staging-proof requests additionally send the selected staging origin and installation identifier.

Pro publisher update checks have a separate preference and also start off. When enabled, or when an administrator chooses Check once now, a connected plugin sends its activation credentials, store origin, installation identifier and connector version to obtain verified release information and a signed, time-limited download. These connection and update requests do not send shopper wishlists, order data or administrator passwords.

Turning off publisher update checks stops scheduled update requests and updater downloads, but a connected licence service continues its entitlement checks. Release this site ends the remote activation and stops future entitlement checks; Forget local credentials stops this installation’s checks without releasing the remote site slot. Successful local release or Forget locks Pro features again. Free features, saved-data access, privacy tools and unsubscribe remain available. Earned activation otherwise survives expiry, temporary service outages and later remote denial. A changed store hostname, non-default port or home path requires activation for that store.

Current Pro versions do not request publisher update information until a native licence is connected. The former public evaluation channel is retired. Current Pro plans are available through the pricing page; eligible account downloads use the current protected delivery service.

Local customer-email setup records

Pro’s email setup panel keeps only the latest requested test record for each store administrator in that WordPress store: a random test identifier, request time, transport outcome, optional manual receipt-confirmation time and a salted binding to the administrator’s profile email. It does not upload these records to WishlistGenius. The latest record remains until replaced, removed through WordPress’s personal-data erasure tool, the WordPress user is deleted or the plugin’s explicit erase-on-uninstall option removes it; the panel displays records from the last 30 days. A profile email change hides the old address-bound result.

Guest subscription changes keep requested additions and any new email address pending until confirmation, for at most 24 hours. Existing confirmed choices remain effective unless withdrawn. Individual withdrawals apply immediately and cancel pending changes. These store-held records follow the plugin’s existing expiry, export and erasure controls. The store’s own privacy notice should describe its customer notifications and email provider.

Retained add-on data in a store

WishlistGenius Free 0.3.31 and newer continue exporting, erasing and applying retention to existing Pro customer contact and consent records, recovery history, alert associations, saved language and currency context, and workflow records while Pro is inactive or removed. These are local privacy operations: they do not install Pro storage or enable paid features. A successful guest erasure invalidates that guest identity and its previous recovery access. A storage failure is reported as incomplete so the store owner can resolve it and retry.

Support and staff access

The private support desk stores the information you submit so staff can respond. Keep your private ticket link and read the support privacy notice before submitting. Staff sign-in uses essential security cookies. Website-ticket replies are available through the private conversation. Direct email correspondence uses Show email, hosted on the GoDaddy VPS and delivered through its outbound relay.

Support records can include the subject, topic, submitted email and optional name, messages, staff replies, conversation status, internal notes and activity history. Staff may use OpenAI to classify or summarise a request and prepare a draft reply. A staff member must approve a reply before sending it. Structured contact fields, private notes and ticket-access tokens are excluded from prompts; recognised contact details and credentials are redacted from message text. Redaction cannot guarantee that every personal detail is removed, so please avoid unnecessary personal information. API responses are requested without storage; this setting is not a promise of zero provider-side retention. See the support notice for this workflow.

How long information is kept

Retention depends on the purpose and record. Account, purchase, licence-history and support records do not currently have a fixed automatic deletion deadline. Closing a ticket, cancelling renewal or releasing an activation does not erase them. We assess whether records are still needed for active service access, unresolved support or disputes, security, and applicable accounting or legal obligations. You can request deletion using the contact options below; if information must be retained, we explain the reason and applicable retention criteria.

• Website request logs: daily rotation with up to 14 archives, as described above. Separate operational error logs are subject to system log limits.
• Customer service housekeeping: session and account-action expiry is enforced during access checks. Records are eligible for maintenance cleanup after session expiry; for account-action records, seven days after expiry; for sent or cancelled account-email queue records, 30 days after creation; and for account security-event records, 180 days after creation. An automatic schedule for this account-record cleanup is not currently enabled, so eligible records may remain. These rules do not erase the underlying account or purchase.
• Optional installation and email records: installation reports expire after 90 days without refresh, pending signup requests after 48 hours, and confirmed newsletter records after at most 730 days. Consent history and unsubscribe suppression records are retained for 180 days. The separate newsletter notice explains any further choices.
• Demo data: store contents expire after 30 minutes or when ended/reset; limited cleaned session metadata can remain for up to 24 hours.

Recovery copies

Restricted local recovery snapshots can contain account, purchase, licence and support records. The current local snapshot process does not automatically prune old snapshots, so a change or deletion in the active service may remain in an older recovery copy. Separate encrypted recovery exports may also be retained by the operator. These copies support recovery and are not a mailing audience or a separate customer-facing service.

A privacy request can cover recovery copies as well as active records. We assess any continuing need to retain a copy, restrict its use and explain any applicable limitation. The expiry of a browser cookie does not delete a recovery copy. We do not promise immediate erasure from every backup or a fixed backup expiry that is not configured.

Providers and international transfers

Authorised staff and service providers receive information needed for their roles: GoDaddy for hosting and mail infrastructure, Cloudflare for delivery and security, Stripe for payments, and OpenAI for the staff-assistance workflow described above. Our application and support hosting is in the United States, and providers may process data in other countries outside the European Economic Area.

Providers publish data-processing and transfer terms, including EU Standard Contractual Clauses where applicable: GoDaddy’s data-processing terms, Cloudflare’s data-processing terms, Stripe’s data-processing terms and OpenAI’s data-processing terms. The terms and safeguards that apply depend on the service and processing role. Contact us for information about the safeguards relevant to your data or to request an available copy. These provider links do not grant permission for marketing or change your choices.

Your rights and how to contact us

Depending on the circumstances, you can request access to your personal information, correction, deletion, restriction of use or a portable copy. You can object to processing based on legitimate interests and withdraw consent for optional processing. You can object to direct marketing at any time. These rights have legal conditions and exceptions; a request to close an account does not necessarily require deletion of records we must keep for a legal obligation.

Contact us through the private support desk, use Show email, or write to our company address above. State that your message is a privacy request and identify the service involved. We may ask for information needed to verify your identity; do not send passwords, licence keys or full payment-card details. We respond within one month. If a permitted extension is needed because of complexity or the number of requests, we explain it within that first month.

You can complain to the Cyprus Commissioner for Personal Data Protection or the data protection authority where you live or work, or where you believe an infringement occurred. You do not have to contact us first. For information held only in a merchant’s WordPress store, contact that merchant; our support desk cannot directly erase its customer database.

Your choices

Optional website analytics are disabled. The demo and currency selector retain only the preferences needed for those features. Data stored by the plugin in a WooCommerce store is governed by that store's own privacy notice.

For privacy questions, contact WishlistGenius through the private support desk. Do not include passwords, licence keys, payment details or customer records.