This policy explains what personal data Yubira collects, why, and what rights you have over it, under the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP). See our Impressum for who is legally responsible for this service.
1. What data we collect
1.1 If you're a host (account holder)
- Name, username, email, phone, and postal address you provide at signup or in Settings
- If you enable Business or Marketplace Partner: company name, service radius, website, category
- Event details you create: title, dates, location, guest list, email templates, gift payout details (e.g. IBAN, if you enable bank-transfer gift payouts)
- Billing details are collected and stored by Stripe directly — Yubira never sees or stores your card number
1.2 If you're a guest (invited to someone's event)
- Name, email, phone, and RSVP answers entered by the host or by you
- Optional fields a host may enable: gender, salutation, dietary preferences, allergies, and any custom questions the host has added
- We treat allergy/dietary information as sensitive and only collect it when a host has explicitly enabled that field for their event
2. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Running your account and the events you create | Performance of a contract (Art. 6(1)(b) GDPR) |
| Sending guests scheduled emails/reminders on a host's behalf | Performance of a contract, on the host's instruction |
| Billing and subscription management (via Stripe) | Performance of a contract |
| Security, fraud prevention, and abuse handling | Legitimate interest (Art. 6(1)(f) GDPR) |
| Optional Marketplace Partner profile and campaigns | Consent (opting in to Marketplace Partner) |
3. Who we share data with
We use the following processors to operate Yubira. None of them may use your data for their own purposes.
| Processor | Purpose | Data shared |
|---|---|---|
| Stripe | Payment processing | Billing name, email, payment details (collected directly by Stripe) |
| Resend | Transactional email delivery | Recipient email address, email content |
| Hetzner | Server hosting (Germany) | All data in transit/at rest on our servers |
We do not sell personal data, and we do not use any advertising or analytics trackers on this site (see Section 5).
4. Where your data is stored, and international transfers
Our servers are hosted with Hetzner in Germany. Stripe and Resend are US-headquartered companies; both offer Standard Contractual Clauses (SCCs) covering any transfer of data outside the EU/EEA. [To confirm: exact SCC/data-processing-addendum status accepted with each provider.]
5. Cookies
Yubira currently sets exactly one cookie: a session-authentication cookie (httpOnly, used to keep you logged in). This cookie is strictly necessary to provide the service you've asked for, so under Art. 25(2) TTDSG / GDPR Recital 173 it does not require your consent — we don't show a cookie-consent banner because we don't set any cookie that would need one. We do not use analytics, advertising, or tracking cookies of any kind. If that ever changes, we'll add a consent choice before any new cookie is set, not after.
6. How long we keep data
[To confirm exact retention periods.] As a general rule: account data is kept for as long as your account is active, plus a limited period afterward for legal/accounting purposes. Guest and event data is kept for the lifetime of the event plus a limited retention window, after which it is deleted unless you request earlier deletion.
7. Your rights
Under GDPR and the Swiss FADP, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data ("right to be forgotten")
- Restrict or object to certain processing
- Receive your data in a portable format
- Lodge a complaint with your local data protection authority
To exercise any of these rights, contact us at jaegerpe@gmx.ch.
8. EU representative
[To be added once appointed — see Impressum for status.] Under Art. 27 GDPR, as a Swiss company serving customers in the EU, we are in the process of appointing an EU-based representative as an additional point of contact for EU data subjects and supervisory authorities.
9. Changes to this policy
We may update this policy as the service evolves. Material changes will be noted here with an updated date.
Last updated: [date]