Wistlora privacy
Updated 5 November 2026 · Operator: Starment House, operating Appsorcerer · care@starmenhouse.com
Wistlora stores shop identity, settings, product handles, variant identifiers, save times, and list-level save/cart counts to provide wishlists. Guest keys stay in browser local storage; only a keyed digest identifies the stored list. Signed-in lists use a keyed digest of Shopify’s authenticated customer identifier. We do not request customer names, addresses, email, phone numbers, orders, or payment information.
Encrypted store and app-installation identifiers support subscription verification and installation-specific free allowances. These records are deleted on uninstall. The current plan is checked with Shopify and cached in server memory for up to one minute; Wistlora does not store payment-card details or create charges outside Shopify.
Lists are private until a shopper creates a read-only link. Anyone holding that link can view its saved product references. Links expire after 30 days and can be replaced or revoked. Product names, images and availability are obtained from the store when displayed. Prices are shown on the store’s product and cart pages.
Guest lists expire after 90 inactive days; signed-in lists after 365. Consumed guest-key digests are retained for up to 365 days to prevent reuse after merging. Cart deduplication identifiers expire after one day. Privacy exports expire after 30 days. Erasing a list removes its items, shares and activity; signed Shopify privacy and uninstall events remove the relevant data. The database and privacy erasure records are encrypted at rest. Encrypted operational backups are retained for up to seven days; separate erasure records are kept for up to eight days so deletions can be reapplied during recovery. Recovery invalidates old guest lists and sharing links and pauses wishlists for verification. Recently erased lists may be excluded even if later saved again. Backups are stored on the same hosting server; an off-server disaster recovery copy is not currently configured.
Shopify provides authentication, storefront and cart services. Wistlora uses its own hosting for wishlist storage. No advertising trackers, marketing integrations, notifications or sale of personal information are included. Merchants can download requested customer data through the app and provide it through their established privacy process. Contact support to request access, correction or deletion.
Hosting: OVH infrastructure in France. Merchant agreement acceptance records include store, version, document digest, time and a keyed digest of the authenticated staff identifier; they remain while installed and are deleted on uninstall with the restricted backup schedule. Read the Merchant Privacy and Data Protection Agreement for roles, instructions, subprocessors, transfer safeguards and termination.