Privacy notice

Version: 2026-09-21

Ing. Francesco Massimo Gallo
Via Corrado Alvaro 7/A, 87036 Rende (CS), Italia
VAT number: IT03573440785
info@logisticait.com
+39 329 135 6443

Controller and scope

The controller is Ing. Francesco Massimo Gallo, Via Corrado Alvaro 7/A, 87036 Rende (CS), Italy, VAT IT03573440785. Contact info@logisticait.com or +39 329 135 6443. This notice covers xwish.link, shared pages and its PWA, not the independent notices of external shops.

Information processed

We process name, email, hashed passwords, language and preferences; optional profile information, lists, wishes, photos, links, reservations and store catalog contributions. We record the version and time of terms acceptance. Sessions and server logs may include IP addresses, browser details and diagnostics. Information comes from you, your browser, your chosen authentication provider and requested product sources.

Purposes and legal bases

Accounts, lists, reservations, requested imports and service emails are processed to provide the requested service or pre-contractual steps under GDPR Article 6(1)(b). Security, abuse prevention and defending rights rely on legitimate interests where necessary and proportionate following a balancing assessment, Article 6(1)(f). Legal duties rely on Article 6(1)(c). Accepting the terms is not marketing consent. We do not request blanket consent for all processing.

Required and optional information

Required fields enable the account or requested feature; without them that feature may be unavailable. Shared lists can be viewed without registering, but reservations require an account. Public profiles, pictures, Google login and product imports are optional. Do not upload identity documents, health data, sensitive information or unnecessary personal information about others. For lists concerning children, prefer non-identifying descriptions and avoid sharing personal information or photos without a legitimate basis.

Visibility and surprises

Public and link-accessible lists can be viewed without an account by anyone receiving the link, which may be forwarded. The owner name and public profile information may be shown. Private lists are restricted to their owner within the app. Surprise mode limits reservation information displayed to the owner; it does not change list visibility or prevent external disclosures. Changing visibility cannot recall copies or screenshots saved by others.

Hosting, email and recipients

The intended deployment uses Keliweb shared hosting and its SMTP service. Authorized personnel and technical providers access information only as necessary under their respective roles and agreements. Relevant information may be disclosed to authorities or advisers for legal duties or defending rights. The applicable processing agreement, processor identity and any other backup providers must be confirmed before publication; buying hosting alone does not complete these obligations.

Google, product lookup and fonts

When you choose Google login, we receive the profile identifier, name, email and verification information, not your Google password. OAuth tokens are not retained in the linked account record. Google operates its service under its own privacy notice. Barcode lookup sends the product code to UPCitemdb, not your email or list contents. Link imports contact the requested website and image sources from our server; avoid URLs containing private tokens or personal information. The template loads Google Fonts from the browser, disclosing technical connection data to Google. Opening an external shop makes a direct connection to that site.

International transfers

Google, UPCitemdb and requested sites may use infrastructure outside the European Economic Area. We do not claim that all processing occurs in Italy or that every recipient automatically benefits from an adequacy decision. Before launch, actual personal-data transfers and any required GDPR Chapter V safeguards must be identified and checked for each provider. Contact the controller for information about applicable safeguards and obtaining a copy. This section requires confirmation before publication.

Retention and deletion

Accounts and content are retained to provide the service while the account is maintained, subject to requested deletion or specific legal needs. You can delete your account in settings; shared store catalog information may remain without attribution to the deleted account. Temporary import results expire after 10 minutes; successful barcode product results are cached for 24 hours. The prepared production configuration specifies 14 days for daily application logs and 30 days for rotation of encrypted local backups when enabled. This does not automatically cover hosting logs, mailboxes or external backups: actual periods and procedures require confirmation before launch. Backup copies cannot always be edited immediately; deletion requests must be reapplied following restoration. Any retention for disputes must be limited to necessary information and a justified period.

Your rights

Contact info@logisticait.com to request access, correction, deletion, restriction and, where applicable, portability or objection. You may withdraw optional consent without affecting previous processing. We normally respond within one month; any legally permitted extension and its reasons will be notified within that period. Proportionate identity checks may be necessary. You may complain to the Italian data protection authority at www.garanteprivacy.it or seek a judicial remedy.

Statistics and changes

Personal statistics summarize your lists and wishes while respecting surprise settings. They do not make automated decisions with legal or similarly significant effects. New purposes or tracking tools require an updated notice and, where necessary, a separate choice. The version is displayed on this page.