Privacy notice

Last updated: 15 October 2026

Who we are

WishlistLab (wishlistlab.io) is run by Helix Platforms Ltd (registered in England and Wales, company no. 17032196, registered office Unit 2 Lions Barn, Langham Lane, Colchester, CO4 5HY), the data controller. Contact: privacy@wishlistlab.io.

What we collect

• Your email address, when you request an audit or join the Pro waitlist.
• The Steam store URL you submit, and public data about that game from Steam and SteamSpy.
• Your IP address, used to limit free audits (3 per day) and stop abuse.
• Your marketing choice (the optional tick box) and, if present, the campaign link you arrived from.
• Waitlist choice: which Pro tier you're interested in.
• Subscription details (Pro): your plan, the Steam games you register, and your Stripe customer and subscription IDs. Card details go straight to Stripe and we never see them.

We don't use advertising cookies or trackers.

Why we use it, and our lawful basis

• To produce and email your audit: performing the service you asked for (contract).
• Pro subscriptions (billing, weekly re-audits and emails): contract. We keep invoices and billing records for 6 years to meet our legal obligations.
• Rate limiting and security (IP address, captcha): our legitimate interest in keeping the free service working and preventing abuse.
• Pro waitlist emails: your consent, given when you join the waitlist.
• Auto-posting (Pro, optional): if you connect Discord, Bluesky or X, we store your webhook URL, app password or access token encrypted (AES-256-GCM) and use it only to publish the weekly posts you've switched on. Disconnect any time, and the credential is deleted. Lawful basis: contract.
• Marketing tips and updates: only if you tick the box (consent). You can unsubscribe any time.

Who processes data for us

• OpenAI: analyses the public Steam page data to write your audit. We don't send it your email address.
• Resend: sends the report email.
• Stripe: takes payments and manages subscriptions.
• Discord, Bluesky and X: only if you connect them for auto-posting. The posts go to the accounts you choose.
• Railway: hosts the website and database.
• Cloudflare: DNS, security and bot protection (Turnstile).

Some of these providers process data outside the UK, for example in the US. Where they do, transfers are covered by the UK International Data Transfer Addendum or the UK–US data bridge.

How long we keep it

• Audits and the related email: 24 months, then deleted or anonymised.
• IP addresses used for rate limiting: 30 days.
• Waitlist and marketing emails: until you unsubscribe or ask us to delete them.

Your rights

Under UK GDPR you can ask to access, correct, delete or move your data. You can also object to or restrict how we use it, and withdraw consent at any time. Email privacy@wishlistlab.io and we'll reply within one month. If you're unhappy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk.

Shared audit links

Each audit has an unguessable link (/r/…) that shows the game's public Steam data and its score, but never your email. Anyone you share the link with can see it.