What we collect
WishWarmly is a group card service. We collect only what we need to deliver the card.
- Card organiser: the name you give your card (e.g. “Elena’s farewell”), the recipient’s name, and the scheduled close date. We do not require your email address to create a card, but you may optionally provide one for delivery notifications.
- Contributors: the name a contributor chooses to display, their written message, and — if they record one — a video message up to 60 seconds long. Contributors do not create accounts.
- Payment: card payments are processed by our payment provider. We never store card numbers or payment credentials.
- Usage: We collect aggregate, anonymised page-view data (no cookies, no fingerprinting, no personal identifiers).
How we store it
- Card data and messages are stored in a secured, access-controlled database. Only the service can read your card — there is no admin dashboard that exposes message content to WishWarmly staff during normal operations.
- Video files are stored in encrypted cloud object storage. They are accessible only via time-limited private URLs (approximately 1-hour validity). After 90 days from the card’s delivery date, videos are permanently deleted.
- PDFs (Keepsake tier) are generated once and stored in encrypted cloud object storage. They are accessible via the same private-URL mechanism and are not deleted on the 90-day schedule — they persist as long as your account is active.
- Rate-limiting data (request counts keyed to IP) is held in a short-lived cache. No personal data is retained after the TTL expires.
PDF generation and background processing
When a Keepsake PDF is generated, a background job processes the card’s data — including contributor names, message text, and video transcripts. This processing state is held temporarily in our infrastructure for the duration of the generation job and is not used for any purpose other than producing the PDF.
Email
WishWarmly sends transactional email only — card delivery notifications and (on the Keepsake tier) PDF-ready notifications. We do not send marketing email unless you explicitly opt in. We do not share your email address with any third party.
Data retention
- Video messages — deleted 90 days after card delivery.
- Card data and text messages — retained indefinitely so the recipient can revisit the card. You can request deletion at any time (see Contact below).
- PDFs — retained until you request deletion.
Third-party services
WishWarmly uses trusted third-party infrastructure providers for hosting, data storage, email delivery, and background processing. These providers process data only as necessary to deliver the service and are contractually bound to protect it.
We do not use advertising networks or sell data to third parties.
Your rights
You may request access to, correction of, or deletion of your data at any time by emailing hello@wishwarmly.com. We will respond within 30 days.