Privacy Policy

Last updated: September 2026

1. Data controller

The controller of personal data is the publisher of the magicliste.fr website. For any question regarding your personal data, you may contact us at: contact@magicliste.fr.

2. Data collected

MagicListe processes the following data, depending on your role:

List creators and co-managers

For the creator: first name (or first names, for example the parents'), email address, list type, the baby's or recipient's first name (optional; for a wedding, the couple's first names are used automatically), which by default forms the beginning of the list's address, event date, welcome message, header photo, delivery address and payment details (all optional), as well as the gifts added (title, price, link, image, note). For a co-manager: their email address only, and the date they accepted the invitation. Anyone who has a list's link, even before it is published, can see the creator's first name, the recipient's first name, the date, the welcome message, the header photo, the delivery address and the gifts. Lists are not included in the sitemap and ask search engines not to index them; a list already in their results may remain there until their crawler's next visit. A list whose link is published on a public page remains readable by anyone who follows it. For a published list, these first names also appear in the preview shown when the link is shared; a preview already stored by a messaging app or social network may keep a first name that has since been changed or removed. Payment details are not shown on the list upfront: apart from the people who manage the list, they are given to anyone who pledges a contribution to a group gift, on screen and in the summary email if they left their address, and, if you have allowed it, any visitor of a published list can display them in one click under “Free contribution”. The photo file remains accessible at its address, even after it is removed or replaced, or after the list is deleted.

Loved ones who reserve or contribute

To reserve or give a gift: a first name, displayed next to the gift to all visitors of the list and sent by email to the people who manage it (a co-manager, once they have accepted their invitation); then, for a gift reserved or given outside a group gift, an optional email address and short note. The email address is used to send you a summary with your management links; the note is only visible to the people who manage the list. To contribute to a group gift: a name, exactly as you enter it, the amount pledged, and an optional email address and short note. No payment goes through MagicListe: the amount is a pledge, which you settle directly, using the payment details given on the list or, failing that, by arranging it with the creator. All visitors see the first word of the names (three at most, then how many others), the total raised and the goal: when only one person has contributed, the total raised is their amount, and the amount of a new contribution can be worked out from one visit to the next. The people who manage the list see the name, amount and note of each contribution, and receive them by email (a co-manager, once they have accepted their invitation). Your email address is never displayed: it is used to send you the summary of your contribution, with the payment details if there are any.

Messages and feedback

Contact form: category, name, email address and message, sent by email to the team, without being stored in the site's database. “Give feedback” bubble: a reaction (emoji) and an optional comment, stored with no link to a list or a person (apart from anything you write yourself in the comment), and sent by email to the team.

Technical data and audience measurement

Like any host, Vercel receives, for every page opened and every exchange with the site, the IP address, the browser, the site's cookies and the full address with its parameters (for example, an access or unsubscribe link contains your email address, in encoded form); its technical logs remain viewable for a limited time, which depends on the plan subscribed to. The IP address, and for some email requests the address entered, are also used to limit abuse (number of attempts), in memory only. To measure the site's audience and speed, the site sends Vercel Web Analytics and Vercel Speed Insights the page address, stripped of all its parameters, where a list's address is reduced to its 6-character code, without its readable part (first name or chosen text) — this code is nevertheless enough to open the list. Web Analytics also receives the site you came from, sometimes with the full address of the page you came from when that site passes it on; Speed Insights receives load times, the connection type and the page element concerned by the measurement. Like any request to the site, these requests also carry, in their headers, the full address of the page and the site's cookies. Vercel thus receives your IP address and your browser; according to its documentation, it derives from them an approximate location (country, region and city for Web Analytics, country only for Speed Insights), the device type and operating system, and, for Web Analytics, an identifier computed from the request, which lets it recognise the same visitor for 24 hours. The site also reports certain actions to Web Analytics, without an email or an amount, for example creating a list, adding or reserving a gift, or clicking through to a shop; a click through to a shop or a price correction may carry the merchant's name or the domain name of the gift's link. The click through to a shop is reported by the site's server, which itself sends Vercel your IP address and your browser. These tools do not set cookies.

List usage measurement

How many times a published list is viewed, without identifying the visitor but distinguishing visits by the people who manage the list; gift status changes (for example reserved, given, available again) and, for a group gift, the amount collected at that moment, without any name or email; and, when a list is created, how you arrived on MagicListe: the first page viewed and the last one viewed before the home page, described by their type (a loved one's list, the home page…) or, for blog articles and the site's information pages, by the page itself, along with the type of referring site (search engine, social network, AI assistant…) and, for an AI assistant, its name (ChatGPT, Claude, Gemini, Perplexity, Copilot or Mistral) and the browser family (for example a messaging app's browser). For this journey, MagicListe's database never keeps a list's address or the referring site's address, and nothing is stored on your device for this measurement.

3. Purposes and legal basis

Data is processed for the following purposes:

Creation and management of gift lists — Legal basis: performance of the service requested by the user (Article 6.1.b of the GDPR).

Sending service emails (for example: creation confirmation, access link, co-manager invitation, reservation, contribution, summary sent to a loved one) — Legal basis: performance of the service.

Sending follow-up emails (list progress, and automatic reminders: list still empty, list not published, list published with no reservation or contribution, date approaching with must-have gifts still available) — Legal basis: the publisher's legitimate interest in informing the user about activity on their list. Each of these emails sent to the creator contains a link to unsubscribe from all of them, for every list linked to their address. A co-manager who has accepted the invitation receives some of them, with no unsubscribe link: to stop receiving them, they can ask the creator to remove their access.

Service improvement (audience measurement, including clicks through to shops, list usage measurement, feedback) — Legal basis: the publisher's legitimate interest. Part of the list usage measurement is shown to the people who manage the list, on their management page (views of the list, activity since their last visit), and, beyond a certain threshold, to all visitors of the list (number of views, gifts taken during the week).

Security and continuity of the service (limiting abuse, database backups, outage monitoring) — Legal basis: the publisher's legitimate interest.

MagicListe does not carry out any profiling and does not use your data for advertising or commercial marketing purposes.

4. Data recipients

Your personal data is accessible to the following processors, strictly within the scope of their services:

Supabase Inc. (United States) — Hosting of the database and of the header photo storage. Data protected by the European Commission's standard contractual clauses.

Vercel Inc. (United States) — Hosting of the website and its functions, technical logs, audience and performance measurement. Data protected by the European Commission's standard contractual clauses.

Resend Inc. (United States) — Sending of the service's emails and of messages sent from the site. Resend receives the recipient's address and the content of each email, which may include, depending on the email, first names or names, a gift title, an amount, a message left by a guest, the payment details or delivery address given on the list, and personal access links; for a message sent from the site, the name, address, category and text of the contact form, or, for feedback, the reaction and the comment.

GitHub Inc. (United States) — Weekly backup of the database: the copy is produced on a GitHub server, then encrypted before being stored for 90 days at most. Data protected by the European Commission's standard contractual clauses.

To read the page of a product you add, the site sends that product's address to web page reading services and artificial intelligence services; it sends them neither your name, nor your email address, nor the content of your list. On the management page of a baby registry, the images of suggested gifts are loaded directly from the merchants' websites, notably Amazon: these websites then receive your IP address. When you click through to a shop, your browser is redirected to the merchant or its affiliate network, which receives your IP address and may set its own cookies; MagicListe sends them no data about you. At the bottom of most of the site's pages, except lists and management pages, the Product Hunt badge image is loaded from Product Hunt as it comes into view: Product Hunt then receives your IP address. MagicListe never sells, rents or transfers your personal data to third parties for commercial purposes.

5. Transfers outside the EU

Some processors (Supabase, Vercel, Resend, GitHub) are located in the United States. These transfers are governed by standard contractual clauses approved by the European Commission, in accordance with Article 46.2.c of the GDPR, ensuring an adequate level of protection of your data.

6. Retention period

Lists and gifts — Retained for as long as the list exists, with no maximum period. A person who manages the list can delete it at any time from their management page: its gifts, reservations, contributions and views are then deleted with it. Exception: the header photo file is not deleted.

Loved ones' data — The first name, email address and note of a reservation are removed from the list when the reservation is cancelled or released; otherwise they are retained for as long as the gift exists. A contribution to a group gift is retained for as long as the gift and the list exist.

Email addresses — Retained with the list they belong to. An address that has unsubscribed is retained, with no time limit, so that it no longer receives follow-up emails.

Messages and feedback — Feedback is kept for 24 months in the database, then automatically deleted. Messages from the contact form are not stored in the database. The copy of feedback and messages received by email by the team is not deleted automatically.

List usage measurement — A list's views are kept for as long as it exists and deleted with it. The other labels (how the creator arrived on MagicListe, gift status changes) are kept for as long as the list exists; when it is deleted, they lose their link to it, then are automatically deleted 25 months later.

Backups — An encrypted backup of the database is made every week and kept for 90 days at most: deleted data may remain in it until then.

Audience measurement — Retained by Vercel according to its own rules; how long it can be viewed depends on the plan subscribed to. Until the filtering described in section 2 was put in place, in September 2026, these tools could receive the full address of pages, parameters included: for example the first name at the beginning of a list's address, or the email address encoded in an unsubscribe link; the site could also report the amount of a contribution to a group gift to them. This data remains subject to the same retention rules.

7. Cookies

MagicListe does not set any advertising or tracking cookies. The site uses two kinds of strictly necessary cookies: one session cookie per list, set on the device of a person who manages that list after it is created or an access link is opened, valid for 90 days and extended whenever they come back to manage the list, which contains their email address and the list's address; and a display language cookie. Your browser's local storage keeps what is yours: your recent lists, your reservations (so you can manage them) and your display preferences. Vercel Web Analytics and Speed Insights do not set cookies. After you click through to a shop, the merchant or its affiliate network may set their own cookies.

8. Your rights

In accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights:

Right of access — Obtain confirmation that your data is being processed and receive a copy of it.

Right to rectification — Have inaccurate or incomplete data corrected.

Right to erasure — Request the deletion of your data. A person who manages a list can also delete it themselves. What remains includes: the header photo file, lists created by duplicating it, which are independent, backups for up to 90 days, list usage measurement labels, detached from the list, until they are deleted after 25 months, audience measurement kept by Vercel, the unsubscribed address where applicable, emails already sent, and link previews already stored by the services where the link was shared.

Right to restriction of processing — Request the suspension of processing in certain cases.

Right to data portability — Receive your data in a structured, machine-readable format.

Right to object — Object to the processing of your data based on legitimate interest.

To exercise these rights, send an email to contact@magicliste.fr specifying your request. We undertake to respond within 30 days.

If you consider that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the CNIL (the French Data Protection Authority) at www.cnil.fr.

9. Security

MagicListe implements appropriate technical and organizational measures to protect your personal data against any unauthorized access, loss or alteration. Data exchanges are encrypted via HTTPS (TLS). Your browser never accesses the database directly: the site's reads and writes go through its server, and the database grants no public access to lists, gifts or contributions (Row Level Security). The weekly backup (section 4) and the publisher's administration tools also access it directly. Header photos are accessible to anyone who knows their address.

10. Minors

MagicListe is not intended for persons under the age of 16. No data is knowingly collected from minors. A list may nevertheless contain information about a child, provided by the child's parents or loved ones (a baby registry or a birthday wishlist, for example): the child's first name, the date of the event or a photo, all optional. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us so that we may delete it.

11. Browser extension (the Magic Button)

MagicListe offers a browser extension (Chrome, Edge), 'the Magic Button', which lets you add a product to your list in one click from any online store. The extension does not read any page, injects no script and sets no cookie.

The active tab's address (URL) is used only at the exact moment you click the extension's icon, and solely to be passed to the magicliste.fr/ajouter page in order to pre-fill your list. The extension does not collect, store or share any data with third parties, and does not track your browsing. On the site, this address goes through the host's technical logs; it is removed from the page address sent for audience measurement. If you add the product, it is sent to the web page reading and artificial intelligence services mentioned in section 4, and becomes the link of the gift added to your list.

12. Changes

This policy may be updated to reflect changes to the service or to the regulations. The date of the last update is indicated at the top of this page.