Wishplace – Privacy Policy

1. Introduction

This Privacy Policy describes how the Wishplace mobile application and wishplace.app website (together, the "Platform") collect, use and share personal data. Wishplace is owned and operated by Alessio Di Salvo, acting as an individual (natural person) based in Spain ("the Controller," "we," "us," or "our").

This Policy provides information about our processing; it is not a request for blanket consent. We process personal data only on the legal bases described below and in accordance with the General Data Protection Regulation (GDPR) and other applicable laws.

2. Data Controller

Controller: Alessio Di Salvo
Postal Address: Avinguda Diagonal, 08019 Barcelona, Spain
Contact Email: alessio@wishplace.app

For any questions regarding this Privacy Policy or your data, please contact us at the email address provided above.

3. Personal Data We Collect

We collect information that you provide directly to us, as well as information generated automatically when you use the Platform.

3.1 Account and Profile Data

• Identity Information: Name (provided by you during registration or shared by your social login provider, such as Apple or Google).
• Contact Information: Email address (provided by you or shared by your social login provider).
• Profile Information: Profile photo (if uploaded), professional role (optional), and short biography (optional).
• Preferences: Preferred currency (e.g., EUR).
• Authentication Identifiers: Unique identifiers provided by our authentication service (e.g., Firebase UID).

3.2 User-Generated Content, Listings & Search Preferences

We collect the criteria and content that you input to create Wish Places, Property Listings and Room Listings. This data is used to provide the requested feature, including technical matching and user-to-user communication.

• Property Preferences: Property type, price ranges, number of rooms/bathrooms, surface area (m²), furnishing status, floor preferences, energy class, heating type, availability, pet policies, garden/balcony preferences, and parking requirements.
• Parking Preferences: Type of parking (garage, box, etc.), price range, covered/uncovered status, electric vehicle charging availability, gated access, and security camera presence.
• Geographic Preferences (Wishplace): Location names, search radius, city, region, country, and precise GPS coordinates (latitude/longitude) provided for area-based searches.
• Room Listings and room searches: The address or location of the relevant property, room price, availability date, intended duration, furnishing, bathroom and room characteristics, included utilities or services, occupancy and household preferences, and any description, image or other content that you choose to provide.
• Room-listing declaration: Where you create a Room Listing, we record your confirmation that you have the right to publish it and that its publication and any eventual rental comply with applicable law. This is a record of your declaration, not a verification by Wishplace of the underlying facts or legal status.
• Communication: Messages sent through the Platform's Direct Chat. Note: Messages are encrypted but may be accessed for moderation, investigation of reports, or legal compliance.

3.3 Technical and Usage Data

• Device, network and diagnostic data: Device type, operating-system and app version, technical identifiers, IP address, access times, crash reports, performance and error data, and hardware or network settings necessary to diagnose and improve the App.
• Location and map data: Precise or approximate device location when you permit it, and the address, coordinates, map interactions and search queries you provide or select. These data are used to provide location-based searching, maps, address autocomplete and Street View.
• Analytics and advertising-measurement data: Information about how you interact with the App, such as features used, time spent, app activations, registrations, Credit-store views, purchases, listings, wishes and chats. Where required, advertising measurement and tracking are used only after your consent.
• Website and consent data: When you visit wishplace.app, we may process browser, device, IP, page-view, referral and consent-choice information. Non-essential analytics or advertising storage is disabled until consent where required. You can change or withdraw your choice through the website consent controls.

3.4 Purchase Data

• Transaction Info: We track Credit balances and purchase-history data, including the store, product identifier, transaction identifier, status, amount, currency and information needed to verify and restore a purchase. We may receive and retain receipt or purchase-token information for that purpose.
• Payment Processing: We do not collect or store your credit-card or bank details. Purchases are processed by Apple App Store or Google Play, which process payment data under their own terms and privacy information.

4. Purposes and Legal Basis for Processing

Under the GDPR, we process your data based on the following legal grounds:

• Performance of a Contract (Art. 6(1)(b) GDPR): To provide the technical features you request, including account management, Credit usage, publishing and managing your Wish Places, Property Listings or Room Listings, matching relevant preferences and listings, and enabling user-to-user communications.
• Consent (Art. 6(1)(a) GDPR): For optional processing, including analytics and Meta advertising measurement or tracking where consent is required, and for device permissions such as precise location where the operating system requires your permission. You may refuse or withdraw consent without losing access to the core Platform features that do not depend on it.
• Legitimate Interests (Art. 6(1)(f) GDPR): To improve and protect the Platform, ensure network and information security, prevent fraud and abuse, investigate reports, and establish or defend legal claims. We consider the necessity and impact of this processing and do not rely on this basis where your rights and interests override ours.
• Legal Obligation (Art. 6(1)(c) GDPR): To comply with applicable tax, accounting, or legal requirements.

5. Data Sharing and Third-Party Services

We do not sell personal data. We share personal data only as described below, where necessary to operate the Platform, where you choose to use an integrated feature, where you consent, or where we are legally required to do so.

5.1 User-to-User Sharing (including room listings)

5.2 Service Providers

• Google / Firebase: Google Cloud and Firebase services for hosting, authentication, database or file storage, push notifications, analytics and crash diagnostics.
• Google Maps Platform: Google Maps, Places and Street View to display maps, provide address autocomplete and geocoding, and display Street View. The relevant address, coordinates, search query, technical data and, where enabled, location data may be sent to Google when you use those features.
• AI and search services: Google Gemini, Perplexity and SerpApi for automated suggestions, search, news or event features. We limit data sent to what is needed for the relevant request, which may include an area, location, search or listing preferences.
• Analytics, diagnostics and advertising measurement: Google Analytics for Firebase, Firebase Crashlytics, New Relic, and Meta/Facebook App Events. Meta App Events may receive app-activation, registration, engagement and purchase-conversion events. Where consent is required for analytics, advertising measurement or tracking, these activities are enabled only after consent.
• Website consent management: consentmanager records and communicates website consent choices; Google Analytics is used on the website only in accordance with those choices where consent is required.
• App stores: Apple App Store and Google Play to process and verify Credit purchases and restores. Apple and Google act under their own applicable terms and privacy information for their store services.
• Communications: Firebase Cloud Messaging and email providers, where enabled, to deliver service messages and notifications.
• Legal Compliance: Disclosure to authorities if required by law.

These providers may process data as processors for Wishplace or, for their own services, as independent controllers under their own terms. When you consent to the use of Google services, Google may use personal data as described in Google's Business Data Responsibility Site. Meta's processing is described in its applicable privacy information.

6. International Data Transfers

Some providers listed above may process data outside the European Economic Area, including in the United States. Where a transfer requires a safeguard under applicable data-protection law, Wishplace relies on the transfer mechanism applicable to that provider and processing, such as an adequacy decision or the European Commission's Standard Contractual Clauses, with supplementary measures where required. You may contact us for further information about the applicable mechanism.

7. Data Retention

• Account Data: Retained while the account is active. Account deletion deactivates the account and starts our deletion or anonymisation process; information may remain where needed for a legal obligation, an unresolved report, fraud prevention, a dispute or the establishment, exercise or defence of legal claims.
• UGC & Preferences: Wishes, search criteria and listing content are retained until you delete them, they expire or the account is closed, subject to the same legal, safety and claims-retention criteria. Stored copies and backups may be retained until overwritten under the applicable backup cycle.
• Room data: Room Listings, room-search preferences and the associated declaration record are retained until the relevant listing or preference is deleted, expires or your account is closed, unless a longer period is necessary to handle a report, protect legal claims, or comply with a legal obligation.
• Anonymized Data: We may retain aggregated, anonymized data for statistical purposes indefinitely.
• Purchases and accounting: Credit-purchase and verification records are retained for the period required by applicable accounting, tax, fraud-prevention and limitation rules.
• Diagnostics: Technical logs, crash reports and security records are retained for as long as reasonably necessary for security, reliability and incident investigation, then deleted or anonymised in accordance with the relevant provider's retention configuration.

8. Your Rights (GDPR)

If you are located in the EEA, you have the following rights:

• Right to Access: Request a copy of your personal data.
• Right to Rectification: Request correction of inaccurate data.
• Right to Erasure: Request deletion of your data ("Right to be forgotten").
• Right to Restriction: Request that we limit how we use your data.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing already carried out before it was withdrawn.

To exercise these rights, please contact us at alessio@wishplace.app. You also have the right to lodge a complaint with your local Data Protection Authority (for example, the AEPD in Spain).

8.1 Required and optional data

Account credentials and data marked as required in the relevant screen are necessary to create an account or provide the requested feature. If you do not provide them, we may be unable to create the account, publish or match a listing, enable a chat, or verify a purchase. Optional profile data, optional device permissions and consent-based analytics or advertising measurement are not required for unrelated core features.

8.2 Automated matching

Wishplace uses automated matching and recommendation tools to suggest potential compatibility between preferences and listings, including Room Listings. These tools do not make decisions that produce legal effects or similarly significant effects about you. They do not decide whether you may rent, offer, buy or sell a property or room; users make those decisions independently.

9. Security

We implement appropriate technical and organisational measures designed to protect personal data, including access controls and security measures appropriate to the nature of the processing. However, no method of transmission over the internet or electronic storage is completely secure.

10. Children's Privacy

Wishplace is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a minor has provided us with personal data, we will take steps to delete it immediately.

11. Multilingual Versions

This policy may be translated into several languages for user convenience. If a translation differs from the English version, the English version is the reference version, except where mandatory applicable law requires otherwise.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the App or by email where appropriate, and will update the version and "Last Updated" date at the top of this document. Where applicable, we will obtain a new consent before enabling optional processing that requires it.

13. Contact Us