Privacy Policy

Effective date: October 11, 2026 · Version 1.5

This Privacy Policy explains how Vishto Technologies Private Limited ("Vishto", "we", "us", "our"), a company incorporated in India, collects, uses, shares, and protects personal data when you use our website at https://vishto.com (including the installable web app) and our mobile application (together, the "Service"). "You" or "user" means the person using the Service, and "Content" means the material you add to the Service (product entries, photos, videos, posts, comments, messages, and similar).

Vishto is a personal wishlist platform. It is not an online store: we do not sell anything and we do not process payments. You save links and photos of products sold by third-party stores. The Service is free and is supported by our own first-party advertising.

This Privacy Policy should be read together with our Terms of Service and our Cookie Policy, which are separate documents.

1. Summary of key points

• We collect what you give us: account details (username, email, hashed password, optional profile information) and the Content you save or post.
• Approximate location, only if you allow it. The mobile app asks once, when you open it. If you tap Allow location, your phone turns its approximate location into a country, only to suggest your country and currency. We never receive the coordinates and they are not stored; only a country you confirm is saved to your account.
• We collect no payment data. No card numbers, bank details, or billing information — we never ask for them because nothing is sold on Vishto.
• No third-party analytics and no cross-site tracking. We do not use Google Analytics or similar tools, and we set no third-party advertising cookies or tracking pixels.
• Ads are our own. Advertising on Vishto is first-party. Ad impressions and clicks are counted server-side in aggregate daily totals — we do not build per-user advertising profiles.
• We do not sell your personal data. Ever.
• Some Content is public by design. "Picks" posts are visible to all users, and public share links expose a wishlist to anyone holding the link. Per-product privacy settings (private / friends / public) let you control visibility of your wishlist items.
• Your data is hosted in India (AWS Mumbai region). If you use the Service from outside India, your data is transferred to India. Some features send limited data to providers located outside India, including in the United States — see Sections 8 and 9.
• A small number of service providers help us run specific features (hosting, optional Google or Apple sign-in, push notifications in the mobile app, web/price/image search, currency rates). Section 8 lists each one and exactly what is sent.
• You are in control. You can delete individual products, posts, and your entire account from within the app, and you can ask us by email for a copy of your data. Your legal rights are described in Section 13.

2. Who we are

The Service is operated from India by Vishto Technologies Private Limited. For the purposes of the EU/UK General Data Protection Regulation ("GDPR"), we are the controller of the personal data described in this Policy. For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the data fiduciary.

You can reach us at support@vishto.com. How to raise a complaint if you are in India is set out in Section 15.

2.1 Users in the EU and UK

Vishto is established in India, not in the EU or the UK, and the Service is aimed at users in India. EU and UK users can raise any GDPR matter directly with us at support@vishto.com, and we will handle it in line with the rights described in Section 13.

3. Personal data we collect

3.1 Account data

When you create an account, we collect:

• username and email address;
• password (stored only in hashed form — we cannot read it);
• optionally: display name, phone number, gender, avatar photo;
• country, preferred currency, and language preference.

3.2 Data from Google or Apple sign-in (optional)

If you choose to sign in with Google (via Google Firebase Authentication), we receive your name, email address, and Google account identifier from Google. If you choose Sign in with Apple (on an iPhone or on the website), we receive, through Google Firebase Authentication, your Apple account identifier and email address (which may be a private relay address that Apple creates for you) and, the first time only, the name you let Apple share. Both are entirely optional; you can instead register with an email and password.

3.3 Content you add

• Product entries: title, store URL, price, description, and images — including photos you take with your device camera;
• personal notes and "desire" ratings;
• wishlist privacy settings (private / friends / public);
• Picks posts: photos, videos, and captions — these are public to all users (see Section 6);
• comments, gift reservations, and bookings, and group chat messages, which are end-to-end encrypted (see Section 12), so we store them without being able to read them.

3.4 Usage and technical data

• shop clicks and visits;
• ad impressions and clicks — counted server-side and aggregated into daily buckets; we do not build a per-user advertising profile;
• search queries (trending searches are shown only in aggregated form);
• notifications and follow relationships;
• a push token, if you allow notifications in the mobile app: an identifier for Vishto on that phone, which lets us send notifications to it. It is deleted when you sign out on that phone (if the phone is offline then, it stops accepting our notifications at once, and the token is deleted the next time we try to send to it), sign out your other devices, or delete your account, and when the phone stops accepting notifications from Vishto;
• server logs, which contain your IP address, browser user agent, and timestamps. Logs rotate and are not kept indefinitely (see Section 10).

We use no third-party analytics services (no Google Analytics or similar).

3.5 Approximate location (mobile app, only if you allow it)

Once, when you open the mobile app, it offers to find your country and currency. Only if you tap Allow location and grant your phone's location permission does the app read your device's approximate location, once. It never asks for precise location and never reads your location in the background.

• Your phone's own geocoding service (Google on Android, Apple on iOS) receives the approximate coordinates in order to name the country they fall in. Vishto never receives them.
• The coordinates are not stored, on your phone or by us.
• The country is kept on your phone to prefill your country and currency. It reaches your account only when you confirm it: by creating your account with it where it is prefilled on the sign-up form, or by tapping Use on the suggestion.
• The app does not ask again. You can withdraw the permission at any time in your phone's settings; the app works the same without it, and you can choose your country and currency yourself. Withdrawing the permission does not remove a country already found: it stays on your phone until you clear the app's data or uninstall the app, and it is never sent to Vishto unless you confirm it.

3.6 Data we do not collect

We do not collect payment card data, bank details, government identifiers, or precise geolocation, and we never receive your device's location coordinates (Section 3.5). We do not purchase data about you from data brokers.

3.7 Availability of this notice

This notice is published in English. Under Section 5(3) of the DPDP Act, users in India may ask to receive this notice in English or in any language listed in the Eighth Schedule to the Constitution of India. To request the notice in one of those languages, email support@vishto.com.

4. How we use personal data, and our lawful bases

Where the GDPR applies to you, each purpose below rests on a lawful basis under Article 6:

4.1 What you must provide, and what is optional

A username, an email address, and a password (or, if you choose Google or Apple sign-in, the account details Google or Apple returns to us) are required to create and operate an account — this is a contractual requirement, and without them we cannot provide the Service. Display name, phone number, gender, and avatar photo are optional; if you do not provide them, the only consequence is that the related feature (for example, showing an avatar) does not work. Saving a product, using web or image search, or posting to Picks are entirely your choice, and the associated data is collected only when you use those features. The same goes for approximate location in the mobile app (Section 3.5): it is read only if you allow it, and the only consequence of declining is that you choose your country and currency yourself.

4.2 Position under the DPDP Act (India)

For users in India, we process personal data on the basis of your consent, given against this notice when you create an account and when you choose to use a particular feature. Where you voluntarily provide personal data to us for a specified purpose and have not indicated that you object to its use for that purpose — for example, the details you enter in a support request, or a product image you upload so that image search can run on it — we may also rely on the legitimate use in Section 7(a) of the DPDP Act for that specific purpose. We do not rely on any general or open-ended "legitimate interests" ground for Indian users, because the DPDP Act does not contain one.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects.

5. Cookies and similar technologies

We set no third-party advertising cookies, no analytics cookies, and no tracking pixels, and we do not use any cross-site tracking technology. What we do use is first-party and set out here, with the complete inventory, lifetimes, and purposes in our Cookie Policy:

• a first-party session cookie, which keeps you signed in;
• localStorage, sessionStorage and IndexedDB entries holding your own settings and cached Content so the app works quickly and offline;
• a service worker cache, which stores app files on your device for offline use;
• a frequency-capping key, stored in localStorage as vishto-ad-seen-ID (where ID identifies a specific Vishto ad). It records that a particular first-party ad has already been shown to this browser, so that the same ad is not shown to you repeatedly. It is not used to build a profile of you and it is not readable by any other site.

Storing or reading information on your device can require consent under the EU/UK ePrivacy rules, and advertising frequency capping is generally not treated as strictly necessary for that purpose, even where — as here — it is first-party and non-profiling. Vishto does not currently present a cookie consent banner. If you are in the EU or UK and would prefer this key not to be stored, you can clear or block site storage for vishto.com in your browser settings (see our Cookie Policy); the Service continues to work, and you may simply see a given ad more often.

6. How your Content is shared and who can see it

Visibility on Vishto works as follows — please choose your settings with this in mind:

• Per-product privacy levels. Each product entry can be private (only you), friends, or public.
• Public share links. If you share a wishlist via a public share link, anyone who has the link can view that list, whether or not they have a Vishto account. Links can be forwarded by recipients.
• Picks are public. Posts to the "Picks" feed (photos/videos with captions) are visible to all Vishto users. Do not post anything in Picks you want to keep private. Picks media files are stored publicly readable, consistent with their public nature.
• Groups. Content shared within a group is visible to that group's members. Group chat messages are end-to-end encrypted and can be read only by the people who were members when each message was sent, on any phone or browser they sign in on. Anyone with a group's invite code can join it and read the messages sent after they join.
• Secret gift reservations. When someone reserves a gift on your list, the Service deliberately hides the reserver's identity from the list owner so the surprise is preserved.
• Comments and follows are visible in line with the visibility of the content they attach to.

7. Advertising

Advertising on Vishto is first-party: the ads (startup splash, banners, sponsored cards, feed ads) are served by our own ad system, not by an external ad network. Impressions and clicks are counted on our servers and aggregated into daily totals. We do not build per-user advertising profiles and we do not engage in cross-site behavioural advertising. No advertising cookies or third-party trackers are used. The only advertising-related data stored on your device is the frequency-capping key described in Section 5.

Affiliate disclosure: outbound links to Amazon carry Vishto's affiliate tag, and Vishto may earn a commission on qualifying purchases. No personal data is shared with Amazon beyond your clicking an ordinary link.

8. Third parties and processors

We share personal data only with the service providers below, each for a specific function, and only to the extent described. We do not sell personal data to anyone.

1. Amazon Web Services (AWS), Mumbai region (ap-south-1) — hosting. Our servers (EC2), database (RDS PostgreSQL), and file storage (S3) run on AWS in India. All Service data is stored here. User-uploaded Picks media is stored publicly readable, because Picks are public content.
2. Google Firebase Authentication, and Apple — used only if you choose Google sign-in or Sign in with Apple, to authenticate that account. Apple confirms your Apple account to Firebase, and Firebase passes us the details listed in Section 3.2. If you use neither, these services are not involved. Google and Apple process this data outside India, including in the United States.
3. SerpApi — for price comparison and "Search the web", when you use them. The product title is sent to this service to retrieve results. SerpApi processes this data outside India, including in the United States.
4. Bright Data and Microsoft Bing — used only for image search on a product you saved with a photo, and only when you use "Search the web" on it. A link to the product image itself — which may be a photo you took — is passed through Bright Data's network to Microsoft's Bing Visual Search to identify the product and find matching pages. No account data is sent. Both providers process this data outside India, including in the United States.
5. Google Cloud Vision — a fallback for the same image search. The product image itself — which may be a photo you took — is sent to Google's Cloud Vision API to find pages showing the same item. No account data is sent. Google processes this data outside India, including in the United States.
6. Currency exchange-rate API — used to convert prices into your preferred currency. No personal data is sent to this provider.
7. Amazon Associates — outbound Amazon links carry our affiliate tag (see Section 7). No personal data is shared beyond the ordinary operation of your clicking a link.
8. Expo (650 Industries, Inc.), Apple Push Notification service and Google Firebase Cloud Messaging — used only if you allow notifications in the mobile app. Your phone's push token and each notification's content (its title and text, which can include the name of the person who followed you, or a wish's name and new price) are sent to Expo, which delivers them through Apple (iPhone) or Google (Android) to your phone. Depending on your phone's settings, notifications can appear on its lock screen. Expo, Apple and Google process this data outside India, including in the United States.

Your phone's geocoding service. If you allow approximate location in the mobile app (Section 3.5), the app asks your phone's own geocoding service (Google on Android, Apple on iOS) to name the country your approximate coordinates fall in. The coordinates go from your phone to Google or Apple for that one lookup, and the answer (the place they fall in) comes back to your phone. Vishto never receives the coordinates or the place, and the app keeps only the country from the answer. Google and Apple process this data outside India, including in the United States.

We may also disclose personal data where required by law, court order, or a lawful request by a public authority, or to protect the rights, safety, or property of Vishto, our users, or others.

9. International data transfers

Vishto is operated from India and the Service's data is hosted in India (AWS Mumbai region). The Service is available in 20+ languages and can be used from anywhere; if you access it from outside India, your personal data is transferred to and stored in India.

In addition, the specific items described in Section 8 are sent to providers that process data outside India, including in the United States: authentication data to Google (Firebase) and Apple if you use Google sign-in or Sign in with Apple; product titles to SerpApi; product images — which may be a photo you took — to Bright Data / Microsoft Bing and, as a fallback, Google Cloud Vision when you use image search; and push tokens and notification content to Expo, Apple and Google if you allow notifications in the mobile app. No other categories of personal data are routinely transferred to those providers. Separately, if you allow approximate location in the mobile app, your phone sends its approximate coordinates to Google (Android) or Apple (iOS) to name the country (Section 3.5); Vishto never receives them.

India has not received an adequacy decision from the European Commission or the UK Government. For users in the EU/UK:

• The transfer of your account data and Content to India, and the transfers to the providers named above, are necessary to perform the contract you enter into with us and to take steps at your request before providing the features you invoke. Where no other mechanism applies, we rely on the derogation in Article 49(1)(b) GDPR (and the equivalent UK GDPR provision) for those transfers.
• Where Standard Contractual Clauses or other Article 46 safeguards are in place for a given recipient, we rely on them for that transfer in preference to a derogation, and you can obtain details by writing to support@vishto.com.

We apply the security measures described in Section 12 to all data regardless of where you are located.

10. Data retention

We keep personal data only as long as needed for the purposes described in this Policy:

• Account data and Content: retained while your account is active. When you delete a product or post, it is removed; when you delete your account, your account and Content are removed (Section 11).
• Push tokens: kept while you stay signed in on that phone, and deleted when you sign out there (or, if the phone is offline then, the next time we try to send to it), sign out your other devices, delete your account, or the phone stops accepting notifications from Vishto.
• Server logs (IP address, user agent, timestamps): retained for approximately 14 days and then overwritten in the ordinary course of log rotation. They are not retained indefinitely.
• Encrypted backups: because we take encrypted database backups (Section 12), data you have deleted from the live Service can remain in a backup until that backup is rotated out, which is up to 7 days (our automated database backup retention window). Backups are not used to restore individual deleted items and are accessible only for disaster recovery.
• Aggregated data (daily ad counts, trending searches): retained in aggregate form, which does not identify you.
• Data we must keep to comply with a legal obligation, or to establish or defend legal claims, may be retained for as long as that need exists.

11. Deleting your data and getting a copy

You can, at any time and from within the app:

• delete individual products and posts;
• delete your entire account, which removes your account and your Content.

The Service does not currently include a self-service download or export button. If you want a copy of the personal data we hold about you, email support@vishto.com and we will provide it, in a structured, commonly used, machine-readable format where the law requires that. You can also contact us at the same address to request deletion.

12. Security

We apply reasonable technical and organisational measures to protect personal data, including HTTPS encryption for all traffic, hashed password storage, access-controlled infrastructure, and encrypted database backups. These measures are consistent with the "reasonable security practices and procedures" contemplated under the Indian IT Act, 2000 and its rules. We hold no security certifications and make no claim beyond the measures described here. No online service can guarantee absolute security, and you should use a strong, unique password for your account.

End-to-end encrypted group chat. Group chat messages are encrypted on the sender's device for the devices of the group's members at that moment, and can be decrypted only on the devices of people who were members when the message was sent. Our servers store and pass on the encrypted text but do not hold the keys to read it. We can still see who sent a message, in which group, when, and which product it is attached to. Because we publish each device's public key and we ship the website and app code that does the encryption, this protection depends on us running the Service as this policy describes; you cannot verify it independently. The keys that decrypt messages never leave members' devices unencrypted, and they are never backed up. Someone who joins a group can read only the messages sent after they joined. Every phone or browser they sign in on can then read everything they could read since joining, including messages sent before that phone or browser was signed in. A device that is missing a key gets it from a device in the group that already has it, yours or another member's, sealed so that only the receiving device can open it. We only store and pass on that sealed copy: we never hold these keys and cannot open the copy. This happens while a device that has the key has the group open, so older messages can appear late. If no device that has the key is left, they stay unreadable on the new one. Someone who leaves or is removed from a group cannot read the messages sent after they left, but what they already saw stays on their devices. If they are added back, the messages sent while they were away stay unreadable to them on every device. Anyone who signs in to your account can read everything in your groups that you could read since you joined them, including messages sent before they signed in, so keep your sign-in safe.

13. Your rights

13.1 If you are in the EU or UK (GDPR)

You have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten");
• restrict processing in certain circumstances;
• data portability — receive the data you provided to us in a structured, commonly used, machine-readable format. There is no download button in the app; email us and we will provide it (see Section 11);
• object to processing based on legitimate interests;
• withdraw consent at any time where processing is based on consent (without affecting prior processing);
• complain to a supervisory authority in your EU member state or to the UK Information Commissioner's Office.

13.2 If you are in India (DPDP Act)

You have the right to access a summary of your personal data and the processing activities, to correction and erasure of your personal data, to grievance redressal (see Section 15), and to nominate another individual to exercise your rights in the event of death or incapacity. You may withdraw consent at any time; doing so may prevent us from providing parts of the Service that depend on that data.

13.3 If you are a California resident (CCPA/CPRA)

In the preceding 12 months we have collected the following categories of personal information, as described in Section 3: identifiers (username, email, optional phone number, IP address, Google or Apple account identifier, push token); personal information categories under Cal. Civ. Code § 1798.80 (name, contact details); characteristics of protected classifications (optional gender, if you provide it); internet or other electronic network activity (shop clicks, aggregated ad interactions, search queries, server logs); audio/visual information (photos and videos you upload); geolocation-level data limited to country (as you set it, or as your phone's approximate location suggested it if you allowed that and confirmed the country; we never receive coordinates); inferences only in the limited sense of aggregate recommendations (no per-user advertising profile); and sensitive personal information in the form of account log-in credentials (your username or email in combination with your password). Sources: you directly, your device, and Google or Apple (if you use their sign-in). Purposes: as set out in Section 4.

Sensitive personal information. We use your log-in credentials only to authenticate you and to keep your account secure. Your password is stored only in hashed form. We do not use or disclose this information to infer characteristics about you or for any purpose beyond those permitted for exempt uses under the CCPA regulations, so no "Limit the Use of My Sensitive Personal Information" link is required, and we do not sell or share it.

Disclosures for a business purpose. In the preceding 12 months we disclosed personal information for a business purpose, to the categories of recipients listed in Section 8, as follows:

We disclosed no personal information for monetary or other valuable consideration.

You have the right to know what personal information we collect and how we use it, to delete it, to correct inaccurate information, to opt out of sale or sharing of personal information, and to non-discrimination for exercising your rights. Vishto does not sell personal information and does not share personal information for cross-context behavioural advertising, as those terms are defined in the CCPA/CPRA — so there is nothing to opt out of, and we honour this position by design.

13.4 How to exercise your rights

Use the in-app tools (edit profile, delete products/posts/account) or email support@vishto.com. We may need to verify your identity before acting on a request. We respond within the time limits set by applicable law. An authorised agent may submit a request on your behalf where the law permits, subject to verification.

14. Children

The Service is not directed at children under 13, and we do not knowingly collect personal data from children under 13 (consistent with the US Children's Online Privacy Protection Act, COPPA). If you believe a child under 13 has created an account, contact us at support@vishto.com and we will delete it.

Under the DPDP Act, a person under 18 in India is a child, and we must obtain the verifiable consent of a parent or lawful guardian before processing their personal data. Users under 18 may use the Service only with the consent of a parent or guardian, as further set out in our Terms of Service.

Consistent with Section 9(3) of the DPDP Act, we do not carry out tracking or behavioural monitoring of children, and we do not direct targeted advertising at children. Our advertising is first-party and non-profiling for every user, as described in Section 7.

15. Complaints and grievances (India)

In accordance with the Information Technology Act, 2000 and rules made thereunder, and the DPDP Act, you may raise a complaint or grievance with us at:

• Email: support@vishto.com

We will acknowledge your complaint within 24 hours of receipt and resolve it within 15 days, in line with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and will respond to requests under the SPDI Rules within the one-month period those rules prescribe.

Under the DPDP Act you should use this grievance mechanism first. If you are not satisfied with the outcome, or if we do not respond within the prescribed period, you may complain to the Data Protection Board of India.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service (for example, a notice in the app) and update the effective date and version number above.

Where a change introduces a new purpose, or affects processing that rests on your consent, we will ask for your fresh consent — through a clear affirmative action and, for users in India, against an updated DPDP-compliant notice — rather than treating your continued use of the Service as acceptance. For changes that do not affect consent-based processing, the updated Policy applies from its effective date.

17. Contact

• Support: support@vishto.com
• Complaints (India): support@vishto.com (Section 15)
• Operator: Vishto Technologies Private Limited, India

This Privacy Policy is governed by the laws of India, and the competent courts in India have exclusive jurisdiction, as further set out in our Terms of Service.