Privacy & cookies
How Listeca handles your lists and information.
Last updated: .
Who is responsible
Listeca is run by Alana AragĂŁo, who is responsible for how your personal information is used. For privacy questions or requests about your data, email info@listeca.nl.
Why we use your information
We use account information, lists and uploaded images to provide the service you request, on the legal basis of performing our agreement with you. Guest reservations help the host and guests coordinate gifts. We process these details, and the technical information needed to prevent abuse and keep the site working, based on our legitimate interests in operating this service. We also use this basis to answer messages and privacy requests. You can object to processing based on legitimate interests.
Sign-in and essential storage
Google and Firebase Authentication handle sign-in and remember your account in this browser. We receive your account identifier, verified email address and profile name. We request sign-in access only, without access to your Gmail, Drive or calendar. You can sign out from the user menu.
An essential cookie lets Listeca remember your guest details for each list for up to one year. It contains a random browser identifier, not your name or email. Your chosen language is saved in browser storage and, when signed in, in your account preferences. Listeca does not use advertising or analytics cookies.
Usage analytics
We also use Vercel Web Analytics to count visits and page views, with basic browser and device information, referring websites and approximate visitor location. Page URLs and route categories exclude private list and invitation identifiers, query parameters and fragments. Vercel uses no analytics cookies or persistent browser identifiers. It processes network information to estimate daily visitors. We respect Do Not Track, Global Privacy Control and this browser’s analytics exclusion preference. Vercel Web Analytics privacy information.
For our published gift guides, we also count visits and clicks to shops using public article and product references, the shop category and whether the photo, product name or shop button was clicked. These events do not include private wishlist products, full shop URLs or purchase details.
We use PostHog to count page visits and completed actions, such as creating a list or reserving a gift. Events include page categories and basic browser and device information. We remove list and invitation identifiers, names, URL query parameters and fragments before sending events. We do not send account details, list contents, guest contact details or uploaded images.
On public pages, we may also record a predefined campaign label to understand whether an advertisement leads to wishlist creation. This label is shared by all visitors from that campaign. We do not send advertising click identifiers or store the label in your browser.
Vercel estimates your country, region and city from your connection’s IP address. We include this approximate location in PostHog analytics to understand where visits come from. We do not request GPS access or include your IP address, coordinates or postal code in these location properties. The estimate can be inaccurate, especially with a VPN or mobile network.
Analytics uses no cookies or browser storage, account profiles or session recordings. We respect Do Not Track and Global Privacy Control. PostHog processes network information, including IP addresses, to receive requests and produce daily visitor counts. Our PostHog project is hosted in the European Union. PostHog’s privacy notice and PostHog’s Data Processing Agreement.
This optional choice stores only a yes/no preference in browser storage without an automatic expiry, plus a cookie shared between listeca.nl and www.listeca.nl. The cookie lasts up to 400 days and is renewed during excluded visits. You can undo the choice using the same control. It contains no visitor identifier. Set it separately in each browser or profile; clearing site data, private browsing or browser storage limits can remove the preference. It prevents future events and does not change past anonymous events.
List details
Lists are created by adults. Only add photos and personal information you are allowed to share, and avoid including sensitive information about children or other people.
List titles, notes, dates, optional addresses and gifts are stored using Google Cloud Firestore. Uploaded images are stored privately in Google Cloud Storage. List data and image storage are located in the European Union.
Your list and its shared link
Draft lists are private to your account. When you publish a list, its shared link is public: anyone with the complete link can view it, including photos, notes or a delivery address you choose to include.
Each shared link includes a randomly generated access code. This makes the link difficult to guess from the list’s name, while allowing your guests to open it and reserve gifts without creating an account.
You choose who receives the link. Anyone who receives it can also pass it on. You can close the shared link by archiving or deleting the list; it also closes automatically one year after publication. Your archived list stays in your account.
Gift reservations
Guests can reserve gifts without creating an account. We ask for a name and email to remember their reservations. The host’s reservation view shows the guest’s name, gifts and quantities; the shared list shows which gifts are still available. Guest email addresses are not shown to the host. Entering an email does not create a Listeca account.
Your browser remembers the guest details you enter for each list. You can return to your reservations using the same email, including on another browser or device. Removing your guest details signs you out of that list without cancelling reservations. Cancelling a reservation removes it and its attached contact details.
We use Resend to send a confirmation after you reserve a gift. Resend processes your name, email address and the confirmation contents, including the list title, gift details, image and link to manage your reservation. Replies sent to info@listeca.nl are received and handled in Google Workspace (Gmail). Resend’s privacy notice.
Images and shop links
When you paste a shop link, Listeca requests its public page to find the product’s name, image and price. Your list details and browser cookies are not sent to the shop. You can review the result before saving it.
External product images are loaded from their image host, which receives a request from your browser. Shop links open external websites with their own privacy policies.
Gift suggestions
When you look up a shop link, OpenAI may interpret a limited set of product text and image descriptions from that shop page to identify its product name, main photo and displayed price. We do not send shop URL queries, image files, uploaded photos, list details or guest contact details. Missing or uncertain facts remain available for you to fill in.
When you save your own gift, OpenAI processes its product name and shop URL without query parameters or fragments to assign a category and interests. We do not send your list details, notes, photos or guest contact details. The gift saves even if automatic classification is unavailable.
Gift ideas are editorial selections with prices checked on the date shown, not live prices or parent reviews. Sample wishlists use illustrative products. Check prices and availability at the shop. Some shop links are affiliate links. Our commission notice is in the footer.
Messages and feedback
Feedback messages and any optional reply email are stored privately in Google Cloud Firestore and sent through Resend to info@listeca.nl, where they are received and handled in Google Workspace (Gmail). Resend processes the message, optional reply address, submission time, country and reference. Providing an email is optional; we use it only to reply to your message. The visitor cookie helps limit repeated submissions and is not included in the email. We do not attach your wishlist, page address or photos to your feedback. We do not send marketing email.
Privacy requests sent to info@listeca.nl are received in Google Workspace (Gmail). We use that correspondence to answer and record your request, and keep it for up to 12 months from receipt unless a legal obligation requires a different period, which we will explain to you.
Service providers and data locations
Vercel hosts the website. Google provides sign-in through Firebase Authentication, database storage through Cloud Firestore and image storage through Cloud Storage. These providers also process technical information, such as IP addresses and browser information, to deliver and protect their services. Authorized people maintaining Listeca can access data when needed to operate the site or handle your request.
Although our list database and image storage are in the EU, Firebase Authentication processes data in the United States. Hosting and support services can also involve processing outside the European Economic Area. Information about the providers’ transfer safeguards is available in Google’s Firebase privacy information and Vercel’s privacy notice.
Google and Vercel describe their applicable contractual safeguards, including Standard Contractual Clauses for relevant international transfers, in their Firebase data processing terms, Google Workspace data processing terms and Vercel Data Processing Addendum. You can contact us for information about safeguards relevant to your data.
How long information stays
Accounts, lists and uploaded images: these remain stored while your account exists, unless you request their deletion. A published link closes after one year or when you archive the list. Closing the link does not delete the list, its images or reservations. Archived lists remain available to their owner.
Reservations: we delete guest contact details within 30 days after the list expires or is archived. You can request deletion sooner. Cancelling a reservation deletes its name and email along with the reservation.
We may keep anonymous totals of reserved gifts in the host’s saved list, without guest names, emails, recovery details or browser identifiers.
Feedback: we keep messages and optional reply emails for up to 12 months after submission, unless you request deletion sooner.
Browser storage: the visitor cookie lasts for up to one year. Your language preference and sign-in information stay in browser storage until changed, cleared or, for sign-in, you sign out. Clearing browser storage does not delete information already saved with Listeca.
Google’s Firebase Authentication documentation states that logged IP addresses are kept for a few weeks. After an account is deleted, authentication data is removed from Google’s live and backup systems within 180 days. This provider retention is separate from the data stored in your Listeca lists.
Deleted database information may remain in restricted backups for up to seven additional days. These copies are used only for recovery. If a backup is restored, we repeat applicable deletions before returning the restored data to normal use.
Your privacy rights
You can permanently delete a wishlist from My lists. This also deletes its gifts and reservations, and closes its shared link. Uploaded images follow the account retention described above.
You can request access to your personal data, correction of inaccurate information, deletion or a restriction on its use. You can object to processing based on legitimate interests and request a portable copy where that right applies. If we rely on your consent, you can withdraw it without affecting earlier lawful processing.
Requesting access or deletion
Email us at info@listeca.nl to request access, correction or deletion of your account, lists, uploaded images, reservations or messages. Include enough details to identify your data. We may need to verify your identity without asking for unnecessary information. Account deletion is handled by request; signing out or archiving does not delete your account.
We respond without undue delay, within one month. Complex or numerous requests can require up to two additional months; we will explain any extension within the first month. Requests are normally free. If an exception prevents us from fulfilling a request, we will explain why.
Raising a concern
You can complain to the Dutch data protection authority, Autoriteit Persoonsgegevens, or the supervisory authority where you live or work. You do not have to contact Listeca first to exercise this right.