Privacy Policy.

From hosts (account holders)

• Account details — name, email address, and a password (stored only in encrypted, hashed form).
• Event details — event name, couple or celebrant names, event date, venue, and greeting text.
• Billing records — the plan purchased, transaction amount, payment status, and the receipts we issue for each payment.

From guests (no account needed)

• Wishes — the guest name entered (optional), the written message, and any photos or videos uploaded through the table QR form.
• RSVP and invitation responses — name, phone number, attendance status, and party size submitted through a digital invitation link.

From enquiries

• Contact form submissions — name, email address, phone/WhatsApp number, event date, expected guest count, and your message.

Payment information

• Payments are processed by CHIP, a licensed Malaysian payment gateway. Your card or banking details are entered directly with CHIP — we never see or store your full card number. We receive only the transaction reference, amount, and payment status.

Technical data

• Standard log and device information — IP address, browser type, and pages visited — plus the cookies described in the Cookies section below.

• To run the service itself — displaying wishes on the event's live screen, building the event's digital gallery, and rendering digital invitations.
• To manage host accounts, event credits, and subscriptions.
• To process payments through our payment gateway, and to generate and send you a receipt for each one.
• To respond to enquiries and provide support.
• To send essential service notifications (for example, email verification, payment receipts, or password resets).
• To keep the platform secure — detecting abuse, moderating flagged content, and preventing fraud.
• To improve Wishigram, using aggregated, non-identifying usage patterns.

We do not sell personal data, and we do not use your data — or your guests' wishes and photos — for third-party advertising.

Wishigram is, by design, a shared experience. Please understand how content flows at an event:

• Wishes and photos submitted by guests are shown on the event's live venue display and are visible to everyone attending or viewing that screen.
• Each event has public display and invitation links protected by long, unguessable tokens. Anyone the host shares a link with can view that event's live wishes or invitation.
• Hosts control their event — they can moderate, hide, or delete any wish, and can open or close submissions at any time.

Guests should only submit messages and photos they are comfortable being displayed at the celebration and kept in the host's gallery.

• With the event host — wishes, photos, and RSVP responses submitted to an event belong to that event and are visible to its host for moderation and safekeeping.
• With service providers who help us operate — hosting infrastructure and the CHIP payment gateway — strictly for providing the service.
• When required by law — if Malaysian authorities lawfully require disclosure.

That is the whole list. We never sell, rent, or trade personal data.

• Event content (wishes, photos, videos) is kept so the host's digital gallery remains available as a keepsake.
• Hosts may delete individual wishes, whole events, or their entire account at any time from the dashboard — deleting an account removes its personal data from active systems.
• Billing and receipt records are retained as required by Malaysian tax and accounting law, even after an account is deleted.
• Guests who wish to remove a submission may ask the event host, or contact us directly and we will assist.

• All traffic is encrypted in transit (HTTPS).
• Passwords are stored only as one-way cryptographic hashes — we cannot read them.
• Public event links use long, randomly generated tokens that cannot be guessed.
• Access to moderation and administration tools is restricted by role-based permissions.

No online service can promise absolute security, but we treat your celebration's memories with the care they deserve. If we ever discover a breach affecting your personal data, we will notify affected users and the relevant authorities as required by law.

Under the Personal Data Protection Act 2010, you have the right to:

• Access the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Withdraw consent to further processing (which may mean we can no longer provide parts of the service).
• Limit processing of your data for certain purposes.

To exercise any of these rights, reach us through the contact details below. We will respond within the timeframes required by the PDPA.

Wishigram uses only essential, first-party cookies:

• Session cookie — keeps hosts signed in and secures forms against forgery (CSRF).
• Language preference — remembers whether you chose Bahasa Melayu or English.

We do not use third-party advertising or tracking cookies.

Wishigram accounts are intended for adults. Guests of all ages may naturally appear in celebration photos or submit wishes at an event they attend — this content is controlled by the event host. If you are a parent or guardian and would like a child's submission removed, contact the host or reach us directly and we will remove it promptly.

We may update this Privacy Policy as Wishigram grows. When we do, we will revise the "Last updated" date at the top of this page, and for significant changes we will notify hosts by email or an in-app notice. Continued use of the service after an update means you accept the revised policy.

Questions about this policy, or a request about your personal data? We're one message away.

• Through our contact page — we respond within one business day.
• By email — support@wishigram.com