Privacy Policy

Wishdrop is a concierge shopping and cross-border delivery service that lets customers in Sri Lanka buy products from affiliated Indian stores or request products from other online stores, without handling international purchasing, warehousing, customs, or shipping themselves.

This policy applies to personal data we collect through Wishdrop.shop (and any subdomains), our account dashboard, our WhatsApp and in-app chat channels, and any related customer support interactions. It does not cover the privacy practices of third-party stores, marketplaces, couriers, or payment processors we work with — their own privacy policies govern the data they collect directly.

We collect the following categories of information:

• Account and identity data: full name, email address, WhatsApp / mobile number, date of birth (where required for verification), password (stored as a salted hash — we never store plain-text passwords), and profile photo if you add one.
• Delivery and contact data: saved addresses, recipient names and phone numbers in your Address Book, and delivery instructions.
• Order and request data: product links or descriptions you submit, quotes generated, order history, quantities, sizes/variants, special instructions, and communications about a specific order.
• Payment data: Wishdrop does not store your full card number, CVV, or bank credentials. Payments are processed by our licensed payment gateway partner, and we retain only a transaction reference, the last four digits of a card (if applicable), payment status, and amount.
• Verification data: WhatsApp number verification (OTP) status, and, where legally required for higher-value shipments or customs purposes, government-issued identification details.
• Wishlist, cart, and community data: saved products, boards, follows, community posts and comments, and loyalty/points activity.
• Support data: chat transcripts, emails, call notes, and attachments you share when contacting support.
• Technical data: IP address, device type, browser type, operating system, pages visited, referring URL, and approximate location derived from IP, collected automatically through cookies and similar technologies (see Cookies below).
• Marketing preferences: your subscription status for promotional emails, SMS, or WhatsApp messages, and your engagement with those messages.

We use personal data to:

• Create and manage your account, and authenticate you when you log in.
• Process buying requests: look up products, generate quotes, purchase items on your behalf, and communicate with the seller or store where necessary.
• Coordinate quality checks, consolidation, customs documentation, international shipping, and final delivery to your address.
• Process payments, issue receipts, and manage refunds or credits.
• Provide customer support, respond to enquiries, and resolve disputes or claims.
• Send transactional updates about your requests, orders, shipments, and account (these cannot be opted out of while you hold an active account, since they are necessary for the service).
• Send promotional offers, deals, and product recommendations, where you have not opted out (see Your rights).
• Detect, investigate, and prevent fraud, abuse, prohibited-item shipments, and security incidents.
• Comply with legal obligations, including customs, tax, anti-money-laundering, and law-enforcement requests.
• Improve the platform — understand usage patterns, debug issues, and test new features. Where possible we use aggregated or de-identified data for this.

We do not use your data to make fully automated decisions that produce legal or similarly significant effects about you without human review.

Depending on the activity, we rely on one or more of the following bases:

• Performance of a contract — processing needed to create your account, fulfil a buying request, process payment, and deliver your order.
• Consent — for optional marketing communications, non-essential cookies, and WhatsApp number verification.
• Legitimate interests — fraud prevention, service improvement, and securing the platform, balanced against your rights and expectations.
• Legal obligation — customs declarations, tax records, and responding to lawful requests from authorities.

We share personal data only where necessary, with:

• Affiliated stores and sellers — order and delivery details needed to fulfil the specific product you requested.
• Logistics and customs partners — recipient name, address, phone number, and shipment contents, as required for international shipping, customs clearance, and last-mile delivery in Sri Lanka.
• Payment processors — transaction details necessary to process your payment securely, under their own PCI-DSS-compliant safeguards.
• Cloud infrastructure and service providers (for example, hosting, database, messaging, and analytics providers) — acting under our instructions and bound by confidentiality and data-protection obligations, solely to operate the platform on our behalf.
• WhatsApp / messaging providers — to deliver order updates and verification codes you have requested.
• Professional advisors and auditors — where necessary for legal, accounting, or insurance purposes, under confidentiality obligations.
• Authorities and regulators — where required by law, customs regulation, court order, or to protect the rights, safety, or property of Wishdrop, our customers, or the public.
• A buyer in a corporate transaction — if Wishdrop is involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to confidentiality arrangements.

We do not sell your personal data to third parties.

Because Wishdrop connects Sri Lankan customers with stores, warehouses, and delivery partners in India and elsewhere, your order and delivery data will necessarily be transferred outside Sri Lanka to fulfil your request. Some of our infrastructure and service providers may also process data outside Sri Lanka. Where we transfer personal data internationally, we take reasonable steps to ensure it receives a comparable level of protection, including contractual safeguards with our processors.

We use cookies and similar technologies to:

• Keep you logged in and remember your cart and wishlist between visits.
• Understand how the site is used, so we can fix issues and improve it.
• Measure the performance of promotions and, where you consent, personalise marketing.

Strictly necessary cookies (for login sessions, cart, and security) cannot be disabled, as the platform will not function correctly without them. You can control non-essential cookies through your browser settings or any cookie-preference banner presented on the site. Blocking all cookies may affect your experience.

We retain personal data for as long as your account is active, and for a reasonable period afterwards to comply with tax, accounting, and customs record-keeping obligations, resolve disputes, and enforce our agreements. Transactional order records are generally retained for at least the period required by applicable Sri Lankan tax and consumer-protection law.

If you close your account, we will delete or anonymise personal data that is no longer needed, except where we are required or permitted by law to retain it (for example, completed order and payment records).

We use administrative, technical, and physical safeguards designed to protect personal data, including encryption of data in transit, access controls limiting staff access to what is needed for their role, and monitoring for suspicious activity. No system is completely secure, and we cannot guarantee absolute security of information transmitted to us. You should keep your account password confidential and notify us immediately of any suspected unauthorised access.

Subject to applicable law, including the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your personal data, subject to our legal and contractual retention obligations.
• Object to or restrict certain processing, including direct marketing.
• Withdraw consent at any time where processing is based on consent.
• Request a copy of your data in a portable format, where technically feasible.

You can manage most of these directly from your Profile, unsubscribe from marketing using the link in any promotional message, or contact us using the details in Contact us to exercise any of the rights above. We will respond within a reasonable time and may need to verify your identity before acting on a request.

Wishdrop is not directed at children under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

If a data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify affected customers and the relevant supervisory authority without undue delay, in line with our obligations under applicable law.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated version here with a new “Last updated” date, and where changes are material, we will notify you by email, in-app notice, or WhatsApp before they take effect.

For questions about this policy or to exercise any privacy right, reach our support team through Contact us, the in-app chat, or WhatsApp. We aim to acknowledge privacy-related requests within a reasonable time and resolve them as quickly as possible.