Privacy Policy

For your account, your projects and your use of the Service, wish4 is the controller of your personal data.

For data about the visitors and customers of the sites you publish with wish4 — for example form submissions and built-in analytics — you are the controller and wish4 processes that data on your behalf (see section 4).

• Account data: your name, email address and, if you sign in with Google, your Google profile name and picture. We send one-time sign-in codes to your email; we don't use passwords for new accounts.
• Onboarding and attribution: the answers you give when you sign up (such as what you want to build) and how you found us (referrer and campaign tags).
• Project content: prompts and chat messages, files and images you upload, the pages, data tables and records of your projects, and settings such as connected domains.
• Connector credentials: API keys and tokens you save for connected services, stored encrypted.
• Billing data: your plan, payments and invoices. Card details are handled by Stripe and never reach our servers.
• Usage and device data: log data such as IP address, browser and device type, pages visited in the dashboard, actions taken, and AI credit usage.
• Communications: messages you send us through email or the support chat.
• Shopify data: if you install the wish4 or Productifi app, your store details and the store data the app needs — such as products and, for Productifi, the orders it fulfils, including your customers' names, shipping addresses and contact details.
• Partner Program data: your PayPal email, company and website, referrals and earnings.
• AI assistant connections: which assistants you connected through the MCP server, when, and to which workspace.

• To provide the Service: build and host your projects, run the agents and connectors you turn on, deliver Productifi orders and process payments.
• To keep the Service secure: authenticate you, prevent fraud and abuse, and enforce our Terms.
• To communicate with you: sign-in codes, receipts, account and service notices, and support.
• To send product news and offers by email — you can unsubscribe from these at any time using the link in every such email.
• To understand and improve the Service, for example with aggregated usage statistics, and to measure our own marketing.
• To comply with legal obligations.

We do not use your project content to train our own AI models.

Legal bases (EEA/UK): we rely on performance of our contract with you; our legitimate interests in running, securing, improving and promoting the Service; your consent where required (for example certain cookies and marketing emails); and compliance with legal obligations.

When you publish a site with wish4, we process the following on your behalf:

• Built-in analytics: page path, referrer, campaign tags, device type and country, plus a random identifier kept in the browser tab's session storage to group a visit. Our analytics set no cookies and do not store IP addresses — the IP is used only to look up the country.
• Form submissions: whatever your forms ask for, stored in your Customers inbox, and sent to services you connect (for example to email you each submission).
• Data in your project database and data your site exchanges with services you connect.

We use this data only to provide the Service to you. As the controller, you are responsible for telling your visitors about it and obtaining any consent required where they are.

To build and edit your projects, run the agents and power built-in AI features, we send the relevant prompts, project content and files to AI model providers — currently Anthropic (Claude), OpenAI and Google (Gemini) — through their business APIs. They process this data to return results to us under their API terms. We do not send them your connector credentials.

If you connect an AI assistant through the MCP server, the assistant's provider receives the data you ask it to read, under your own agreement with that provider.

We share personal data only with service providers that help us run the Service, when you ask us to (for example connectors), or when the law requires it. Our main providers are:

Services you connect yourself (such as Resend, Brevo, Klaviyo, Twilio, Discord, Telegram or Google Analytics) receive the data your projects send them, under your own account with them.

We may also disclose data to comply with law or legal process, to protect the rights and safety of wish4, our users or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to it. We do not sell personal data.

We use a session cookie to keep you signed in and remember security settings; these are necessary for the Service to work. We store some preferences (such as dark mode) in your browser.

On our marketing website we use Google Analytics, Google Ads and the Meta Pixel to understand how people find and use wish4 and to measure our advertising, and Crisp for the support chat. These may set cookies. You can block or delete cookies in your browser settings, and opt out of Google Analytics with Google's browser add-on. Blocking necessary cookies will prevent you from signing in.

The built-in analytics on sites published with wish4 do not use cookies (see section 4).

We send emails you need to use the Service — sign-in codes, receipts, security and account notices — and these can't be turned off while you have an account. We also send onboarding tips, product news and offers; every such email has an unsubscribe link, and you can also ask us at [email protected].

wish4 is based in the United States and our providers may process data in the United States and other countries. Where we transfer personal data from the EEA, the UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or our providers' participation in the EU-U.S. Data Privacy Framework.

• Account and project data: for as long as your account is active. When you ask us to delete your account, we delete it within 30 days, except where we must keep information to meet legal, tax or accounting obligations, resolve disputes or prevent abuse.
• Backups: deleted data may remain in encrypted backups for up to 90 days before it is overwritten.
• Billing records: as long as tax and accounting laws require.
• Data about your sites' visitors: for as long as the project exists, or until you delete it.

We protect data with encryption in transit (TLS), encryption of connector credentials at rest, access limited to people who need it, and monitoring of our systems. No method of transmission or storage is completely secure, so we can't guarantee absolute security. If we learn of a breach that affects your personal data, we will notify you and the authorities as the law requires.

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, to withdraw consent, and to not be discriminated against for exercising these rights.

EEA and UK: you also have the right to lodge a complaint with your local data protection authority.

California and other US states: we do not sell personal data. Our use of advertising cookies on our marketing site may be considered “sharing” for cross-context behavioral advertising; you can opt out by writing to us, or block these cookies in your browser.

To exercise any right, email [email protected] from the address on your account. We will respond within 30 days and may need to verify your identity. If you are a visitor of a site built with wish4, please contact that site's owner first — we will help them respond.

The Service is not directed to children and is intended for people 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this Privacy Policy as the Service evolves. We will post the new version here with a new date and, for material changes, notify you by email or in the Service.

Questions or requests about privacy: [email protected].