How we collect, use and protect your personal data.
Last updated: October 2026 · Version 1.0
This policy explains how babywishgift.com (BabyWishGift) handles personal data. We do not sell your personal data, and we do not use advertising or third-party tracking cookies.
Controller: AEF WebDesign (Aef Webdesign SpA), a company incorporated in Chile
Activity: Software-as-a-service provider of gift lists and events for baby showers
Privacy contact: [email protected]
We have not appointed a data protection officer given the current scale of our processing. Send any privacy question to the address above.
Providing the service: managing lists, reservations and transactional emails. Basis: performance of a contract.
Marketing communications: only if you have given explicit consent, which you can withdraw at any time. Basis: consent.
Legal obligations: accounting records of payments and responding to competent authorities. Basis: legal obligation.
Security and abuse prevention: rate limiting, access logs, protection against attacks. Basis: legitimate interests.
Analytics: understanding aggregate use of the site, only if you accept analytics cookies. Basis: consent.
Guest data is not used for marketing. A Guest's email is used only to verify and confirm their reservation.
We do not sell or share personal data with third parties for their own commercial purposes. We use the following service providers, who process data on our behalf:
PayPal
Processes the one-time activation payment through PayPal's official buttons. We do not store card data. PayPal acts under its own privacy policy (paypal.com/privacy).
Cloudflare R2 (United States)
Stores gift images.
Resend (United States)
Sends transactional email. It does not use email data for its own purposes.
Google sign-in (OAuth)
Identity provider. We only receive your verified name and email when you sign in. Subject to Google's privacy policy.
Umami (self-hosted)
Privacy-friendly analytics operated by us. It sets no tracking cookies of its own and runs only if you accept analytics.
Hosting and infrastructure
Our servers and database are operated on infrastructure of the hosting provider we contract.
International transfers. We are based in Chile, and your data is processed in Chile, the European Union and the United States, in addition to the country where you live. Where data is transferred internationally, we rely on appropriate safeguards such as standard contractual clauses or the provider's equivalent certified mechanisms, as applicable.
If a data breach affects you and the law requires it, we will notify you and the competent authorities within the legally required deadlines.
| Data | Retention |
|---|---|
| Host profile and event data | While the account is active |
| Unconfirmed reservations that expire | 24 hours (automatic deletion) |
| Guest data (name, email) | Until the Host deletes the list or closes their account |
| Data after account closure | 90 days until anonymization, unless the law requires longer |
| Payment records (payer name, email) | For the period required by applicable accounting and tax rules |
| Technical access logs | 90 days |
Everyone whose data we process, Hosts and Guests alike, can ask us to:
Access: Tell you what personal data we hold about you and give you a copy.
Correction: Correct inaccurate or incomplete data.
Deletion: Delete your data.
Objection: Stop processing based on legitimate interests, and in particular stop direct marketing.
Restriction: Limit the processing of your data in certain cases.
Portability: Provide your data in a structured, commonly used format.
Withdraw consent: At any time, without affecting the lawfulness of earlier processing.
To exercise any of these rights, email:
[email protected]We will respond within one month (or 45 days for California residents), extendable where the request is complex and where the law allows.
California residents have the right to know what personal information we collect, use and disclose; to request access, correction and deletion; and not to be discriminated against for exercising these rights. We do not sell your personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you. You may use an authorized agent to submit a request; we may need to verify your identity.
If you are in the EEA or the UK, the rights listed above apply to you under the GDPR / UK GDPR, and you may lodge a complaint with your local data protection supervisory authority. The legal bases for our processing are those listed in section 3.
The Service is intended for adults and is not directed to children under 13 (or under 16 where the law of your country sets a higher age). We do not knowingly collect personal data from children. If you believe a child has given us personal data, email [email protected] and we will delete it. Event information about a baby (such as a name or due date) is provided by the adult Host.
We may update this policy from time to time. We will notify you of material changes at least 15 days in advance through a notice in the Service and/or by email. The current version is always available at babywishgift.com/privacidad.
AEF WebDesign (Aef Webdesign SpA)
Privacy: [email protected]
Published by AEF WebDesign (Aef Webdesign SpA). Version 1.0, October 2026. See also the Terms of Service and the Legal Notice.