Privacy Policy
Dernière mise à jour : 30 Sep 2026
This policy describes how Cherishko ("we") collects, uses and protects your personal data when you use our gift concierge service, including when you sign in with Google or Facebook.
1. Data controller
Cherishko — contact: contact@cherishko.com.
2. Data we collect
Customer account
- First name, last name, email address, phone / WhatsApp number (optional).
- Password: never stored in clear text (hashed only). Accounts created via Google or Facebook have no password.
- Email address verification status.
Google / Facebook login
When you choose "Continue with Google" or "Continue with Facebook", the provider sends us: your technical identifier with that provider, your name, your email address (if you authorize it), the email verification indicator (Google), and your profile photo URL. We store these elements in a "linked social account" record.
We never store or reuse your Google / Facebook access or refresh tokens. They are used only, for the duration of the login, to retrieve the information above, then discarded. We never access any other data from your Google / Facebook account (contacts, posts, etc.).
Gift request
- Recipient details: name, phone, governorate, city, delivery address.
- Request content: products, occasion, message, desired dates.
- Exchanges with our team (customer service messages).
Payments and refunds
Payments and refunds are processed securely by Stripe. We never receive or store your full card number: only a technical transaction identifier, the amount, the currency, the date and the status of the payment or refund are communicated to us for contract performance and accounting purposes.
Technical data
Session cookie (keeps you logged in, CSRF protection), optional "remember me" token, technical logs (IP address, date, action) for security and abuse prevention purposes.
3. Purposes and legal bases
- Create and manage your account, authenticate you (contract performance).
- Process your gift requests, issue quotes, execute and deliver orders, and process any refunds (contract performance).
- Send you transactional emails (quote available, payment confirmation, refund issued, delivery tracking, customer service replies) — legitimate interest / contract performance.
- Secure the service and prevent fraud (legitimate interest).
- Comply with our accounting and legal obligations.
We do not use your data for behavioral advertising purposes and we do not sell it.
4. Recipients
- Stripe — secure processing of payments and refunds.
- Our email delivery provider — delivery of notifications.
- Google / Facebook — only as identity providers, at your initiative.
- Carrier / delivery partner — recipient details strictly necessary for delivery.
No other sharing. Our subcontractors are bound by confidentiality and security obligations.
5. Retention period
- Account and requests: for as long as your account is active, then limited archiving.
- Linked social accounts: until you unlink the provider or delete your account.
- Invoices and accounting records: kept for the applicable legal period.
- Technical logs: short duration.
6. Your rights
You may request access to, rectification, restriction, portability or deletion of your data, and object to certain processing. To exercise these rights, write to us at contact@cherishko.com. The deletion procedure is detailed on the Data Deletion page.
You can also revoke, at any time, the authorizations granted to Cherishko from your Google or Facebook account security settings.
7. Security
Encrypted connections (HTTPS), hashed passwords, single-use and time-limited reset tokens and verification links, rate limiting on sensitive endpoints, strict separation between the customer and administration areas.
8. Cookies
We only use strictly necessary cookies: a session cookie and, if you choose, a "remember me" cookie. No advertising cookies or third-party trackers.
9. Changes
This policy may evolve. The last update date appears at the top of the page.