Privacy Policy

Wishsway for Shopify · Last updated 2026-08-16

Wishsway ("the App") is a wishlist app for Shopify stores, developed and operated by Cosmicro ("we", "us"). This policy explains what information the App receives when a merchant installs it, what it stores about the merchant's customers when they use the wishlist, how that information is used, and the choices merchants and their customers have. By installing the App you agree to this policy.

1. Information we collect from merchants

When you install the App we receive, through Shopify's APIs and with your authorisation, the information needed to run the service:

• Store information — your myshopify.com domain, store name, store owner name and email, country, currency, timezone, locale and Shopify plan.
• API access tokens — the Admin API credential Shopify issues so the App can read your products, customers and theme, and a Storefront API access token used by the wishlist widget to load product details on your storefront. Both are stored in access-controlled infrastructure and are deleted when you uninstall.
• Configuration you create — widget design settings, wishlist page settings and reminder-email settings (schedule, subject, content, sender and reply-to addresses).
• Theme access — the App reads your published theme's settings only to check whether the Wishsway app embed is enabled. It does not modify theme files.
• Product data — read on demand to display wishlisted products in the wishlist page and in reminder emails; the App stores product identifiers your customers saved, not your catalogue.

2. Information collected about your customers

The wishlist renders in your customers' browsers as a Shopify theme app extension. To provide the wishlist it stores, per store:

• Wishlist entries — the Shopify customer ID of a signed-in customer together with the product (and, where chosen, variant) identifiers they saved, the wishlist they belong to, and timestamps. Signed-out visitors' wishlists are kept only in their own browser (local storage) and are synced to their account if they later sign in.
• Customer profile fields — when a signed-in customer uses the wishlist, the App may store their name, email address, phone number, country, locale, currency, timezone and account creation date, as provided by Shopify, so that reminder emails can be addressed to them.
• Reminder-email history — when a reminder for a wishlist entry was last sent.
• Aggregate usage counters — adds, removes, page views, wishlist revenue — per store, per day, with no personal identifiers.

Product details shown on the wishlist page are fetched by the customer's browser directly from your Shopify storefront using the Storefront API. The App does not collect payment details or browsing history and does not set cross-site tracking cookies.

3. How we use information

• to store and display each customer's wishlist and shareable wishlists;
• to send the reminder emails you configure, from the sender address you configure, to customers who saved products in your store;
• to show you wishlist analytics;
• to provide support, respond to your requests and notify you of important service changes;
• to operate, secure and improve the App (error monitoring, abuse prevention).

We do not sell, rent or share your or your customers' data with advertisers, and we do not use it for purposes unrelated to the App. You are responsible for ensuring you have the necessary consent to send marketing reminders to your customers.

4. Sharing and sub-processors

We share data only with service providers that host or support the App, under contractual confidentiality: cloud hosting and database providers, error monitoring, and transactional email delivery for reminder emails. Shopify itself processes data under its own Privacy Policy. We may disclose information if required by law.

5. Data retention and deletion

Store data, configuration and customer wishlists are kept while the App is installed. When you uninstall, Shopify notifies us and your access tokens are invalidated immediately; store records, wishlists and customer data are deleted within 30 days unless a longer period is required by law, and in any case when Shopify sends the shop/redact request 48 hours after uninstall. You may request earlier deletion at any time via the contact below.

6. Your rights and Shopify's privacy webhooks

The App implements Shopify's mandatory privacy webhooks. Merchants and their customers may request access to, correction of, or deletion of personal data at any time. Requests received via Shopify are honoured as follows: customers/data_request — we compile the customer's wishlist entries and profile fields held for your store and provide them to you to pass on to the customer; customers/redact — we delete that customer's wishlist entries, wishlists and profile fields for your store; shop/redact — we delete all data held for your store. If you are in the EEA, UK or another jurisdiction with data-protection rights, you may also lodge a complaint with your local supervisory authority.

7. Security

Data is transmitted over TLS and stored in access-controlled infrastructure. Storefront requests to the App are verified with Shopify's app-proxy signature. Access is limited to personnel who need it to operate the App.

8. International transfers

Cosmicro is based in Ho Chi Minh City, Vietnam; hosting providers may process data in other regions. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.

9. Children

The App is a business tool for merchants and is not directed at children under 16. We do not knowingly collect their data.

10. Changes to this policy

We may update this policy as the App evolves. Material changes are announced in the App or by email to the store owner. The "last updated" date above always reflects the current version.

11. Contact

Cosmicro · Ho Chi Minh City, Vietnam
Email: [email protected]