Privacy policy

1. Who we are and what this policy covers

Wishfo is a customer-data enrichment service operated by Trevbag LLC d/b/a Wishfo (“Wishfo,” “we,” “us,” or “our”) in Orange County, California, United States. This policy explains how we process personal information through the Wishfo website, Shopify application, integrations, support channels, and related services (collectively, the “Services”).

This policy applies to Shopify merchants and their authorized users, visitors to our website, people who contact us, and customers whose information a merchant instructs us to process. Questions and privacy requests may be sent to privacy@wishfo.com.

2. Our privacy roles

When Wishfo processes customer and order information to provide the Services to a merchant, the merchant generally acts as the business or controller and Wishfo acts as its service provider or processor. The merchant determines the purpose and lawful basis for that processing and is responsible for customer-facing notices, consent, opt-outs, and its use of enriched information.

Wishfo acts as a controller or business for limited information used to manage our own website, merchant relationships, support, security, billing, and legal obligations.

3. Information we process

Merchant, account, and billing information

We process store name and domain, merchant contact details, application installation and authentication data, authorized user and role information, Shopify and Klaviyo connection details, merchant settings, plan and credit activity, transaction records, support communications, and account preferences.

Shopify order and customer information

To identify and enrich an eligible record, we may process customer name, postal address, telephone number, existing email value or domain, marketing-consent status, Shopify customer and order identifiers, order name and date, and sales channel. When this identity information comes from Shopify, raw names, postal addresses, and telephone numbers are used transiently for a lookup and are not written to the Wishfo database.

Merchant-uploaded CSV information

An authorized merchant user may upload a CSV containing customer names, US postal addresses, and optional telephone numbers. Wishfo parses the file in request memory and does not retain the raw CSV file. For rows the merchant imports, Wishfo stores the identity fields using application-level encryption while the record is pending or being processed. Wishfo also stores keyed identity fingerprints for merchant-specific duplicate detection.

Enrichment, verification, and destination information

We process identity fingerprints, provider-attempt status, candidate email addresses, identity-match indicators, deliverability and quality results, confidence information, duplicate indicators, destination-list details, synchronization status, and audit records. Stored email values and integration tokens are encrypted at rest.

Website, support, and technical information

We may receive information submitted through our website or support channels, such as a name, work email, company, store website, estimated volume, and message. We also receive standard technical and security information such as IP address, browser and device type, referring page, request timestamps, and application or server logs.

4. Where information comes from

• Shopify APIs, webhooks, authentication, and billing workflows.
• Merchants, their authorized users, merchant-uploaded CSV files, and their configured integrations.
• Contracted identity-enrichment and email-verification providers used to perform a merchant-requested lookup.
• Klaviyo when a merchant authorizes Wishfo to connect an account and destination list.
• Our hosting, database, security, transactional-email, and support systems when they generate operational records.

Wishfo does not collect information directly from a merchant’s customers through storefront forms, pixels, or browsing trackers.

5. How we use information

• Provide, operate, secure, troubleshoot, and support the Services.
• Validate and stage merchant-uploaded customer records.
• Detect records eligible for merchant-requested enrichment.
• Perform identity matching through a multi-source waterfall.
• Verify candidate email deliverability and filter unsafe results.
• Detect duplicates and prevent unnecessary provider requests.
• Send verified profiles to a merchant-authorized Klaviyo list.
• Administer plans, credits, approved charges, usage notifications, accounting, audits, and customer support.
• Prevent abuse, protect the Services, and comply with law.
• Enforce our agreements and establish or defend legal claims.

We do not use one merchant’s customer data for another merchant, for Wishfo’s independent advertising, or to train general-purpose artificial-intelligence or machine-learning models.

6. Legal bases for processing

Where a legal basis is required for Wishfo’s own processing, we rely on performance of a contract, compliance with legal obligations, consent where requested, and legitimate interests such as providing and improving the Services, securing accounts, preventing fraud, communicating with merchants, and maintaining business records. We balance those interests against the rights of affected people.

For customer information processed on a merchant’s behalf, Wishfo follows the merchant’s documented instructions and the merchant is responsible for identifying an appropriate lawful basis.

7. How we disclose information

We disclose information only as reasonably necessary to:

• Shopify for authentication, app operation, billing, and required privacy or compliance workflows.
• Merchant-authorized Klaviyo accounts and destination lists.
• Contracted enrichment and verification providers that receive only the fields needed to perform their assigned task.
• Hosting, database, security, monitoring, transactional-email, billing, and support providers that help operate the Services.
• Professional advisers, regulators, courts, law enforcement, or other parties when required by law or reasonably necessary to protect rights, safety, and the integrity of the Services.
• A buyer, investor, or successor in connection with a proposed or completed financing, merger, acquisition, reorganization, or sale, subject to appropriate confidentiality and data protections.

Service providers are permitted to process information only for contracted purposes and are expected to maintain appropriate confidentiality and security safeguards.

8. Marketing consent; no sale or behavioral-advertising sharing

Wishfo does not replace Shopify order or customer email fields. When a merchant enables Klaviyo, Wishfo may carry an affirmative Shopify marketing-consent status into Klaviyo, but does not create consent, broaden consent, or reverse an existing Klaviyo opt-out or suppression. Merchants remain responsible for their communications and for honoring all consent and opt-out requirements.

A CSV upload is not treated as marketing consent. Wishfo does not mark a CSV-imported profile as subscribed in Klaviyo. The merchant remains responsible for determining whether and how it may contact the person.

Wishfo does not sell personal information or share personal information for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics about a person. Disclosures to providers and merchant-authorized destinations are made to deliver the Services and are not made for those parties’ independent marketing.

9. Cookies and similar technologies

Wishfo and Shopify may use cookies, tokens, or similar technologies that are necessary for authentication, session continuity, security, and core application functionality. We do not currently use third-party advertising cookies on wishfo.com, and Wishfo does not place cookies or tracking pixels on merchant storefronts. If those practices change, we will update this policy and provide any choices required by law.

10. Retention and deletion

• The raw CSV file is not retained. Encrypted identity fields from an imported row are removed after successful delivery to the merchant-authorized destination, or the entire pending record is deleted after the merchant-selected retention period of 1–90 days; the default is 30 days.
• Completed customer-match records and encrypted email values are retained for the merchant-selected period of 1–90 days; the default is 30 days.
• Completed and failed background-job records and encrypted privacy request exports are retained for up to 30 days.
• Security and access audit records are generally retained for one year and may be retained from 90 days to seven years depending on configured security, contractual, and compliance needs. These records are designed not to contain raw names, addresses, phone numbers, or customer email values.
• Financial and transaction records without customer content may be retained as required for accounting, tax, reconciliation, fraud prevention, disputes, and legal compliance.

When a merchant uninstalls Wishfo, we delete customer-match data, pending work, integration credentials, settings, sessions, and operational shop data through our deletion workflow. We also honor Shopify’s mandatory customer and shop redaction webhooks. Limited information may remain temporarily in encrypted backups until the applicable backup cycle expires or where retention is required by law.

11. Security

We maintain administrative, technical, and organizational safeguards designed to protect personal information. These include data minimization, encryption in transit, application-level encryption of merchant-uploaded identity fields, matched email data, and integration tokens at rest, keyed hashing of identity fingerprints, scoped credentials, access controls, multi-factor authentication for administrative systems, audit logging, environment separation, and retention controls. No method of transmission or storage can guarantee absolute security.

12. International processing

Wishfo is based in the United States, and we and our service providers may process information in the United States and other countries that may have different data-protection laws. Where required, we use recognized transfer safeguards such as adequacy decisions, data-protection agreements, or standard contractual clauses.

13. Privacy rights and choices

Depending on location and subject to applicable exceptions, a person may have rights to request access, correction, deletion, restriction, portability, or objection; to withdraw consent; to appeal a denied request; and to complain to a privacy or data-protection regulator. We do not discriminate against anyone for exercising a privacy right.

Because Wishfo generally processes customer information on a merchant’s behalf, customers should first contact the merchant with whom they transacted. Merchants and customers may also email privacy@wishfo.com. We may verify the requester’s identity and authority, coordinate with the relevant merchant, and retain a limited record of the request as required by law.

14. Automated matching and verification

Wishfo uses automated rules and provider signals to estimate whether identity information refers to the same person and whether a candidate email appears deliverable. These results determine whether a profile is eligible for the merchant-selected workflow. Wishfo’s processing is not intended to make decisions that produce legal or similarly significant effects for customers. Merchants may use manual review and remain responsible for how they use a result.

15. Children

Wishfo is a business service and is not directed to children. We do not knowingly collect personal information directly from children through our website. Merchants are responsible for ensuring that customer information submitted to the Services may lawfully be processed.

16. Changes to this policy

We may update this policy as the Services or legal requirements change. We will post the updated policy at this URL and revise the effective date. When appropriate, we will notify merchants of material changes through the Services or by email.

17. Contact us

Privacy questions, requests, and complaints may be sent to Trevbag LLC d/b/a Wishfo, Orange County, California, United States, at privacy@wishfo.com. General support questions may be sent to hello@wishfo.com.