Privacy Policy

WiSwish Ltd (company no. 16740292, VAT no. GB528372281), registered at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, is responsible for the personal data collected through this website. You can reach us at Support@WiSwish.com.

When you place an order or contact us, we collect the details you provide — such as your name, email address, delivery address, phone number, and order details — so we can process and deliver your order and answer your enquiries.

We ask for a phone number at the payment step. Our payment provider collects and checks it for us, and passes it to us with your order. It goes to the UK warehouse that picks and despatches your order, and to our delivery partner, so they can send you delivery updates and reach you if there is a problem on the day. We do not use it for marketing. This delivery number is separate from any mobile number you may choose to sign in with, which we describe under Your account and signing in below.

You can create an account and sign in with an email and password, a one-time magic link, your mobile number, or your Google or Apple account. Sign-in and account security are handled on our behalf by our authentication provider. If you sign in with your mobile number we send a one-time code to it by text message, through our text-message provider. That number is used only to sign you in and to keep your account secure. We never use it for marketing, and it is held separately from any delivery number you give at the payment step.

If you choose Google or Apple, that provider verifies your identity and shares basic profile details (such as your name and email) so we can set up your account, under that provider's own privacy policy. We never receive your password for those accounts.

A small number of first-party cookies and browser storage items run at all times, because they're needed to provide the service you've asked for: your basket, kept in your browser's local storage; once you create an account and sign in, an essential session cookie that keeps you signed in; a cookie that simply remembers your cookie choice itself (see below); if you use the light/dark/system switch, your display preference in local storage; and, while you are on the checkout page, your email address and your choices in the checkout box, kept in that browser tab's session storage until you close the tab, so a dropped connection cannot lose or misapply them. None of these are used for advertising, and none of them run anything from a third party.

We also use advertising cookies and a third-party advertising tag from Google, but only if you choose "Accept". If you have not accepted, no Google tag is loaded at all — not in a disabled state, not silently: the script is never requested. If you choose "Accept", the tag may set advertising cookies so that we can measure which Google adverts lead to sales, as described below, and Google may also use information about your visit for personalised ads, which means the adverts Google shows you elsewhere may take your visit here into account. If you choose "Reject", the tag is never loaded. If you accept and later withdraw consent, we tell the tag straight away that it may no longer do either, and the next time you open the site or reload a page it is not loaded at all.

Everything else described below is off by default and only runs if you choose "Accept" in the cookie banner, or later switch it on via "Cookie preferences" in the footer of every page. If you choose "Reject", or later withdraw consent, none of it runs, and anything it had already stored on your device is deleted straight away. Your choice is remembered for up to 6 months, after which we'll ask again.

With your consent, we keep a short list of products you've recently looked at in your browser's local storage, so we can show you a "Recently viewed" row. This stays on your device only — we never receive it, store it on our servers, or link it to you personally.

With your consent, we also store a random, anonymous session identifier in your browser's local storage and use it to send us anonymous activity events — for example, that a page or product was viewed, a search was run, a basket was changed, a filter was applied, how far down a page you read, or that a technical error occurred — so we can understand and improve the store. Alongside each event we record how you arrived (for example from a paid advert, an unpaid search result, another website, an email, or a link you typed yourself), the first page you landed on, whether you are using a phone, a tablet or a desktop computer, and the browser you are using. Where you run a search we store the words you typed, shortened and stripped of anything that looks like personal information such as an email address, a phone number or a postcode. Where you complete an order we store the value of the goods, but never the order reference, your name, your email address or your delivery address. It is not linked to your name, email, account or any other personal data, we do not use it to identify you personally, and we never share it with third parties.

We also measure advertising. If you reached us by clicking a Google advert, then with your consent Google gives us a click identifier which we store in a first-party cookie (wiswish.attribution.v1) for up to 90 days; if you have not accepted, that identifier is discarded and no such cookie is kept. If you have accepted and you place an order, we tell Google that a purchase happened, with the order reference, the value of the goods you ordered (delivery is not included) and the currency, so we can tell which adverts lead to sales, and that is linked to the click identifier above. If you have not accepted, we do not tell Google about your order at all. The order reference is sent so the same order is never counted twice; it is not a name, an email address or an account.

We do not send Google your name, your delivery address, your phone number or the contents of your basket. We do send a one-way scrambled form of your email address, never the address itself. This is called "enhanced conversions": the address is turned into a fixed string of letters and numbers using a standard method called SHA-256, and that string cannot be turned back into your address. Google uses it to work out which of its adverts led to a sale. It is only ever sent if you have chosen "Accept", it is created on our server at the moment your order is confirmed, and we do not keep it — it is not stored against your order or anywhere else.

The advertising measurement described above is the only measurement we carry out that is not anonymised and aggregated. Everything else is: any other usage analysis we carry out is based on anonymised, aggregated data.

Card payments are processed securely by our payment provider. They handle your card details under their own strict security standards, and we do not receive or store your full card details.

When you attempt to place an order, we record your IP address, browser/device information (user-agent), the date and time, and a snapshot of what was in your basket (product and quantity only, never price). We do this to prevent fraud — such as automated attempts to test stolen card numbers — and so that, if a card issuer later disputes a charge (a "chargeback"), we can show the payment genuinely came from you.

This information is stored separately from your order and is only ever used for fraud prevention and to respond to a payment dispute — never for marketing or profiling.

We use your information to fulfil orders, provide customer service, and meet our legal and accounting obligations.

We only send marketing to people who have opted in — we never use bought lists. Every marketing message has an unsubscribe link; when you unsubscribe we stop and add you to a suppression list so you are not contacted again. We do not sell your personal data.

If you sign up for our welcome offer, we store your email address, your marketing consent, and the one-time discount code we issue you, so we can honour that code at checkout. To decide whether the offer can apply, we check whether that email address, and your account if you're signed in, has placed an order with us in the last 6 months. If you sign up with our sign-up form (at the foot of our pages or in the pop-up), we also email the code to you; ticking the box at checkout does not email it. This is only ever used with your explicit, un-ticked opt-in.

If you tick the box on the checkout page, we keep your email address, the words you agreed to and a reference to that checkout, so we can send you at most two reminders if you do not finish the order, with a link that puts your basket back at today's prices. Where that box also offers our welcome offer, ticking it adds the offer to that order (if that email address, and your account if you're signed in, hasn't placed an order with us in the last 6 months), and unticking it before you pay removes the offer and withdraws your agreement. To decide which box to show under your email address, we check that address against our orders and our email list, and, if you're signed in, your account's orders and membership; nothing is saved when we do. If you agreed to product news, we may also send you two short welcome emails and, for products whose pack states a number of servings, a reminder about ordering again. Each kind can be switched off on its own in your email preferences, and we send at most two marketing emails in any seven days.

About a week after your order is dispatched we email you once to ask for a review; you can switch these requests off in your email preferences. A published review shows as Verified buyer, or your first name and the first letter of your surname if you choose.

If you are signed in and tick Remember my choices in the product finder, we keep your three answers on your account until you untick the box or close your account.

We ask every customer the same way: one email about 7 days after the order is dispatched, with a link that works once, for 60 days. Nobody is asked twice for one order, and we offer nothing for a review — no discount, voucher or prize draw.

We publish every review, good or bad, and do not edit what customers write. The only reviews we do not publish are ones that are spam, abusive, contain someone's personal details, or are not about the order or the products — we never hold back a review for being negative. A star average appears once there are 5 published reviews.

Taking and fulfilling your order, and answering your enquiries — because it is necessary to perform our contract with you.

Keeping order and transaction records for around 6 years — because we have a legal obligation to, under UK tax and company law.

Preventing fraud and defending payment disputes — because it is in our legitimate interests to protect the business from fraudulent transactions and chargebacks. We record only what is needed, keep it separate from your order, never use it for marketing, and delete it after around 13 months.

Marketing emails (including basket reminders, welcome emails and reorder reminders), non-essential cookies, analytics, advertising measurement and personalised advertising by Google — because you have consented. You can withdraw your consent at any time, and withdrawing it does not affect anything we did before you withdrew it.

Asking for a review after your order, emailing the brand's directions for use on the day your order is due, and reminding members every six months what their membership costs — because it is in our legitimate interests, and, for membership reminders, part of our contract with you.

We share data only as needed to run the business, for example with our delivery carrier (DPD) to deliver your order, the UK warehouse that picks and despatches it, our payment provider to take payment, our authentication and secure-database provider to run your account, our text-message provider to deliver a one-time sign-in code if you choose to sign in with your mobile number, our email provider to send you order confirmations and any marketing you have opted in to, our hosting provider to serve this website, and, only with your consent, our advertising provider (Google), for advertising measurement and personalised ads, and professional advisers where required by law.

Your account and order data is stored in the United Kingdom. Order and marketing emails are sent through a provider that delivers from within the European Economic Area.

Some of the companies we rely on to run the shop, including our payment provider, our hosting provider and, only with your consent, our advertising provider, are based outside the UK, and our systems may be accessed from outside the UK to run the business. When your data goes outside the UK we rely on the UK government's decision that a country protects personal data to an equivalent standard where there is one, and otherwise on the UK's approved standard contract terms for international transfers, so your data keeps essentially the same protection it has here. Ask us and we will tell you which safeguard applies to a particular provider.

We keep order and transaction records for around 6 years, to meet UK tax and accounting requirements. Marketing suppression records are kept so we can continue to honour your unsubscribe. Basket-reminder records are deleted after 90 days. A record of each email we send, used to keep to our two-a-week limit and never send the same email twice, is kept for 24 months. A review link that was never used is deleted 30 days after it expires; one that was used is kept with the review. Fraud-prevention and dispute-evidence data (see above) is kept for around 13 months — long enough to cover a payment dispute window — and then deleted. Anonymous activity events are kept for 24 months, and technical error reports for 90 days, after which both are deleted.

You have rights over the data we hold about you. You can ask us for a copy of it, ask us to correct it, ask us to delete it, ask us to restrict how we use it, ask us to send it to you or to another provider in a portable form, and object to certain uses. Where we rely on your consent, you can withdraw it at any time. To exercise any of these, contact us. For step-by-step instructions on requesting deletion of your account and data, see our Data Deletion Instructions page. This covers fraud-prevention and dispute-evidence data (see above) as well as your account and order details.

You can object at any time to our using your details for marketing, including deciding which reminders to send you. Use the unsubscribe link in any email or switch it off in your email preferences, and we will stop.

If you think we have handled your data wrongly, please tell us so we can put it right. You can also complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113, at any time and without coming to us first.

For any privacy question, email Support@WiSwish.com.