Privacy Policy

Make a Wish (https://wishfountain.net) is run by me, through my company SMART CODING SRL, a company registered in Romania (CUI RO49279197, Reg. Com. ROONRC.J2023002373321), registered office at Mircea Alifanti 14, Cisnadie, Romania ("I", "me", "my"). This policy explains what personal data I collect when you use the Service, why, and what your rights are.

Your wish is public — read this first

When you throw a coin, the name and wish you submit are displayed publicly on the fountain, visible to anyone who visits the site. If you chose a bronze or gold coin, an optional website link is also shown; gold coins may also show an uploaded logo/avatar. None of that is private — don't submit anything you wouldn't want to be public.

What I collect

• What you type into the purchase form: your email, the name and wish you want displayed, and — for bronze/gold — an optional website link and, for gold, an optional logo image.
• Billing address: collected during checkout (country, region/county, city, postal code, address line) so that VAT can be calculated correctly for your location. This is collected and processed by Stripe; I store it alongside your purchase record.
• Payment details: I never see or store your card number, expiry date, or CVC — these go directly to Stripe.
• Technical data: standard web request data (IP address, browser, pages visited) collected through Google Analytics and, when something goes wrong on my end, through my error monitoring tool (Sentry).

There's no account or login on this Service. I keep an internal record linked to the email you provide solely to associate you with your own purchase(s) — for example, to send you your confirmation email or to look up your order if you contact me.

Why I collect it

• To take your payment, assign you a coin, and display it on the fountain — performance of the purchase contract with you.
• To calculate and remit the correct VAT on your purchase, and to keep accounting records — legal obligation.
• To detect and prevent fraudulent payments (handled by Stripe) and to keep the Service running reliably (error monitoring) — my legitimate interest.
• To understand how the site is used, via Google Analytics — based on your consent where required by your location.

Who I share it with

I don't sell your data. I share it only with the service providers that make Make a Wish work:

• Stripe — payment processing, fraud prevention, and tax calculation. Stripe receives your billing details and card information directly.
• Brevo — sends the transactional emails you receive (your purchase confirmation). Brevo processes your email address and the content of that email.
• Google Analytics — aggregate, anonymized-where-possible site usage statistics.
• Sentry — error monitoring, so I notice and fix bugs. Error reports can include technical request data such as your IP address.

Some of these providers may process data outside Romania or the European Economic Area. Where that happens, they do so under their own applicable data-transfer safeguards (such as the EU Standard Contractual Clauses).

How long I keep it

Purchase and billing records are kept for as long as required by Romanian tax and accounting law. The name, wish, link, and logo attached to an active coin are kept displayed for as long as the Service operates, unless you ask me to remove them (see "Your rights" below) or I remove them under my content rules in the Terms & Conditions.

Your rights

If data-protection law applies to you (for example, the GDPR), you can ask me to:

• tell you what personal data I hold about you;
• correct inaccurate data;
• delete your data — note that this includes removing your wish and coin from public display, since that's part of the same record;
• restrict or object to certain processing;
• receive a copy of your data in a portable format.

Some of this may be limited by my legal obligation to keep accounting/tax records for a minimum period, even after a deletion request. To exercise any of these rights, email me at [email protected].

Cookies and similar technologies

• Essential: a session/security cookie set by the Service itself, needed for the site to function (for example, to protect the purchase form). This can't be disabled without breaking the site.
• Google Analytics: cookies used to measure site traffic and usage.
• Stripe: when you reach the payment step, Stripe sets its own cookies for fraud prevention and, if you use it, its Link one-click checkout feature. These are governed by Stripe's own privacy policy.
• Google Fonts: the site loads a font directly from Google's servers, which means your browser contacts Google when the page loads.

I don't use advertising or cross-site tracking cookies. Most browsers let you block or delete cookies through their settings; doing so may affect the payment step or analytics, but shouldn't break core browsing of the site.

Security

All payment data is handled directly by Stripe, a PCI-DSS-compliant payment processor — I never receive or store your full card details. Data I do hold (your purchase records) is stored on infrastructure I control, protected by standard technical and organizational measures. No system is perfectly secure, and I can't guarantee absolute security of information transmitted to me.

Children

The Service isn't directed at children, and I don't knowingly collect personal data from anyone under 16. If you believe a child has provided me with personal data, contact me and I'll remove it.

Changes to this policy

I may update this Privacy Policy from time to time. If I make a material change, I'll update the date below. Continuing to use the Service after a change means you accept the updated policy.

Last updated: October 2026

Contact

Questions about this policy, or want to exercise your rights? Email me at [email protected].