Who we are
Wishing.ai is a trading name of Property Investments (UK) Limited, a company registered in
England and Wales (Company No. 08852962). Our registered office is Westminster House, 10
Westminster Road, Macclesfield, SK10 1BX.
For the purposes of UK GDPR and the Data Protection Act 2018, the data controller is
Property Investments (UK) Limited. If you have questions about how we handle your data,
contact us at hello@wishing.ai.
What we collect
We collect the minimum data needed to make the service work:
- Account data. If you sign in, we store your email
address and authentication credentials via Supabase Auth. Signing in is optional — the core
experience works without an account.
- Saved destinations. If you use the Passport feature,
we store which destinations you've saved. This data is tied to your account.
- Payment data. If you subscribe to Wishing Premium,
payment is processed by Stripe. We store your Stripe customer ID and subscription status. We
never see or store your card details — Stripe handles all payment information directly.
- Local storage. We use browser local storage to
remember your ritual answers and visit streak. This data stays on your device and is never sent
to our servers.
- Email notifications. If you have a streak in progress,
we may send reminder emails to the address on your account. You can disable these in your profile
settings at any time.
Lawful basis for processing
Under UK GDPR (Article 6), we process your personal data on the following bases:
- Contract. Account data and payment data are processed
to deliver the service you've signed up for.
- Legitimate interest. Analytics data (aggregated,
non-personal) is processed to improve the service. We've assessed that this does not override
your rights — we use privacy-focused analytics and never track individual behaviour.
- Consent. Email notifications are sent based on
your consent, which you can withdraw at any time via your profile settings.
What we don't collect
- We use Matomo Analytics, an open-source, privacy-focused analytics platform. We see aggregate page view counts
and custom event counts — never individual user behaviour. Matomo is GDPR-compliant and we
do not use it to track you across other websites.
- We do not serve advertisements.
- We do not sell, rent, or share your data with third parties.
- We do not track your browsing behaviour across sessions.
Cookies
We use essential cookies only. These are strictly necessary for the service to work. We do
not use advertising, analytics, or preference cookies.
- Authentication. Session cookies managed by Supabase,
required for the sign-in feature.
- Wish tracking. A
wishing_session cookie tracks your daily wish count (expires after 24 hours) and a wishing_streak cookie tracks your
visit streak (expires after 8 days). Both are functional cookies with no personal data.
Hosting and infrastructure
The site is hosted on Vercel (frontend), Supabase (database and authentication), and Stripe
(payment processing). These providers process data under their own privacy policies. Data is
stored in secure, industry-standard cloud infrastructure.
International data transfers
Our infrastructure providers (Vercel, Supabase, Stripe) may process data outside the United
Kingdom. Where this occurs, transfers are protected by appropriate safeguards including
Standard Contractual Clauses (SCCs) or adequacy decisions recognised by the UK Government.
Your data is always handled in accordance with UK GDPR standards regardless of where it is
processed.
Data retention
We keep your data only as long as it's needed:
- Account data. Retained while your account is active.
Deleted within 30 days of account deletion.
- Payment records. Retained for 7 years after the
end of your subscription, as required by UK tax and accounting law.
- Local storage. Stays on your device until you
clear it. We have no access to this data.
Age restriction
Wishing.ai is not intended for anyone under 16 years of age. We do not knowingly collect
personal data from anyone under 16. If you believe we have collected data from a child under
16, please contact us and we will delete it promptly.
Your rights
Under UK GDPR, you have the right to:
- Access — request a copy of the personal data we
hold about you.
- Correction — ask us to correct inaccurate or incomplete
data.
- Deletion — ask us to delete your data. We will
do so unless we have a legal obligation to retain it.
- Restriction — ask us to limit how we process your
data.
- Portability — request your data in a structured,
machine-readable format.
- Objection — object to processing based on legitimate
interest.
- Withdraw consent — where processing is based on
consent, you may withdraw it at any time.
We will respond to any request within 30 days. To exercise your rights, email hello@wishing.ai.
If you are not satisfied with our response, you have the right to lodge a complaint with the
Information Commissioner's Office (ICO) at ico.org.uk.
Changes
If we change this policy, we'll update the date at the top. Material changes will be noted
on the site.
Contact
Questions about your privacy: hello@wishing.ai