Privacy Policy

1.Who is responsible for your information

WellWishes Limited (NZ company number 9434049, NZBN 9429053715852) operates wellwishes.co.nz and is the agency responsible for personal information collected through it, in terms of the Privacy Act 2020. Contact us about privacy at hello@wellwishes.co.nz.

2.What we collect and why

If you are a couple with a registry:

• Your email address (used to sign you in and to send you receipts, gift notifications and service emails about your own registry).
• Both partners' names, your wedding date and everything you choose to put on your registry page: photos, stories, gift items and settings.
• Your Stripe account reference and its verification status, so we know your payout account is ready. Identity documents you provide during payout onboarding go directly to Stripe; we never see or store them.

If you are a guest sending a gift:

• Your name, your email address (for your receipt and refund link), your gift amount and any message you write to the couple.
• Your card details are entered into Stripe's secure payment form and go directly to Stripe. They never touch WellWishes servers and we cannot see them.

If you joined the waitlist: just your email address, used to tell you when WellWishes opens.

Collected automatically from everyone:

• Essential cookies: your sign-in session, your "keep me signed in" choice, which registry you last opened and whether you have entered a password-protected registry's password. The site does not work without these.
• Basic analytics (pages visited, buttons used) so we can see what is confusing and improve it.
• Error reports when something breaks, so we can fix it.
• A record of emails we have sent you, so we never send the same one twice.
• For abuse prevention we rate-limit requests by internet address, but the address is scrambled (hashed) before storage so the stored value cannot be turned back into your address.

3.What we never do

• We do not sell personal information. To anyone, ever.
• We do not share it with advertisers and we do not run advertising trackers.
• We do not use your information for marketing beyond service emails about your own registry, and for the waitlist, the launch announcement you signed up for.

4.Who processes information for us

Like almost every online service, we run on specialist providers. Each one processes only what its job requires:

Because some providers are outside New Zealand, some information is stored overseas. We choose providers that commit contractually to protect personal information to standards comparable to New Zealand's Privacy Act, and our European provider operates under the EU's GDPR, which is stricter than NZ law in most respects.

Beyond these providers, we disclose personal information only if the law requires it (for example a court order) or if it is necessary to prevent a serious threat.

5.How we protect it

• All traffic to and from the site is encrypted (HTTPS).
• The database enforces row-level rules so each account can only ever read its own information, even if our application code had a bug.
• Card numbers are handled entirely by Stripe, which is certified to the highest card-industry security standard (PCI DSS Level 1).
• Access to production systems is limited to the people who operate the service.

6.How long we keep it

• Registry information lives for as long as the registry does. About 30 days after a registry closes, we email the couple a full keepsake summary and then permanently delete the registry's content, gifts and messages from our systems.
• If you delete your account, your information is deleted at that point instead.
• Waitlist emails are kept until we have launched and announced it, or until you ask us to remove yours.
• Payment and transaction records are retained by Stripe under financial regulations, which is separate from us and outside the deletion above.

7.Your rights

• Under the Privacy Act 2020 you may ask us for a copy of the personal information we hold about you, and ask us to correct it. Email hello@wellwishes.co.nz and we will respond within 20 working days as the Act requires.
• You can delete your account, and the information in it, yourself at any time.
• If you are unhappy with how we have handled your information, tell us first and we will try to put it right. You can also complain to the Office of the Privacy Commissioner (privacy.org.nz).

8.If something goes wrong

If we ever suffer a privacy breach that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the affected people as the Privacy Act 2020 requires, and tell you plainly what happened and what we are doing about it.

9.Changes to this policy

If we change this policy in a way that matters, we will tell you by email or by a notice on the site before the change takes effect. The current version will always live at wellwishes.co.nz/privacy.