Privacy Policy

1. Who we are

yaydayz is operated by Audacious Loft, Lda, a company registered in Portugal ("we", "us"). We are the data controller for account and payment data. For guest replies collected on an invitation, the host decides what to collect and we process that data on the host's behalf.

Contact: hello@yaydayz.com

2. What we collect

• Hosts: name and email from Google or Apple sign-in; invitation content (names, date, venue, artwork); payment records (we never see full card details).
• Guests: household name, email or phone, names of attendees (including children), dietary or practical notes and questions sent to the host.
• Technical: basic logs and device data needed to run and secure the service. Drafts made without an account are stored on your device.

3. Why we use it (legal bases)

• To provide the service you asked for — contract (GDPR art. 6(1)(b)).
• To process payments, keep invoices and meet tax duties — legal obligation (art. 6(1)(c)).
• To keep the service secure and prevent abuse — legitimate interest (art. 6(1)(f)).
• Marketing emails only with your consent, which you can withdraw at any time.

4. Children's data

Guests may enter the names of children attending. This is visible only to the host and to the household that sent it, never to other guests. The service is intended for adults; children should not create accounts.

5. Who we share it with

We do not sell personal data. We use trusted processors for hosting, authentication and payments, bound by data processing agreements. Where data leaves the European Economic Area, we rely on EU Standard Contractual Clauses or an adequacy decision.

6. How long we keep it

Invitation details stop being public 12 hours after the event ends. Hosts can delete an event and its replies at any time. Accounts are kept until deleted. Payment and invoicing records are kept for the period required by Portuguese tax law (currently 10 years).

7. Your rights

You can ask to access, correct, delete, restrict or port your data, and object to processing, by emailing us. Guests can change or remove their reply via their private link. You may also complain to the Portuguese data protection authority, CNPD (www.cnpd.pt).

8. Cookies and local storage

We use only what is strictly necessary: sign-in session storage and on-device drafts. We do not use advertising cookies.

9. Changes

We may update this policy and will show the new date above. Significant changes will be notified to account holders.