Privacy Policy

Who is responsible

MaybeYay is the service that processes the personal data described here. The operator is Georgia Thanou.

Postal address: Sofias Vempo. Country: Greece.

You can contact us at hello@maybeyay.com.

Data provided by the creator

When you create an invitation we store the names you enter, your email address, the personal message, the selected vibe, chosen activities, and the date and time options you offer. We do not ask for a meeting place or physical location.

We do not collect a marketing-email preference on new invitations. An unused flag may still exist on older records; it is not used to send campaigns.

Data stored about the recipient

If someone opens a real invitation link and answers, we store their yes or no, the activity they picked (when the vibe offers a choice), the date and time they picked, and the time of that answer. We also record the first time a real invitation link is opened.

We do not store the recipient’s email address, IP address or browser user-agent in the invitation record.

Why we process this data

We use creator details to build the invitation, take payment, email you the link and a management URL, and show the recipient what you wrote. We use recipient answers to show the result and to email you that they answered.

Legal basis

Creating, paying for and delivering the invitation, and sending the related transactional emails, is processing needed to perform the contract you request.

We rely on legitimate interests for basic security of the service, such as application logs used to keep the site running and to investigate abuse. Those logs are produced by the web server and may include an IP address, user-agent and the requested path. Invitation slugs and management tokens in those paths are redacted where our logging filter applies.

We do not send marketing email. New invitations do not collect a marketing preference.

Payments (Stripe)

Card payments are handled by Stripe on Stripe’s hosted Checkout. We send Stripe your email so they can create the Checkout Session, plus internal references that identify your invitation draft.

On our servers we store only the payment status and the Stripe Checkout Session id. We do not store card numbers, expiry dates or CVC. Stripe’s own privacy policy applies to data Stripe processes as an independent payment provider.

Transactional email (Brevo)

If email delivery is enabled, we queue a message to your address when the invitation becomes active and when the recipient answers. That queue stores the address, subject and message content until the send succeeds; after a successful send we clear the stored email bodies. We do not send marketing mail through this process.

Hosting and technical logs

The application and its database run on servers operated for MaybeYay. The database holds invitation records and the email queue described above.

The web server may log connection metadata (such as IP address, user-agent and requested URL) to operate and secure the service. We do not use those logs for advertising.

How long we keep data

Unpaid drafts are deleted 7 days after they were created (or the MAYBEYAY_DRAFT_RETENTION_DAYS value, if set). A paid invitation link stays accessible for 14 days after it is activated, then stops being publicly accessible immediately.

After the link expires we keep the invitation record for 30 days so we can handle support requests. After those 30 days a cleanup job erases the personal content (names, message, choices, answers, manage token, public slug and email-queue rows). We keep only a separate payment/legal record: the internal invitation reference, Stripe Checkout Session id, payment status, activation or payment time, and the legal-acknowledgement version and timestamp. Email-queue rows that are not deleted with an invitation stay after sending, without the message bodies. There is no self-service delete button yet; you can ask us to erase or restrict a record using the contact details below.

Who we share data with

We share what is needed with Stripe (payments), Brevo (transactional email, when that transport is enabled), and the hosting provider that runs the servers. Typefaces are served from MaybeYay’s own servers.

We do not sell personal data. We do not load advertising pixels or analytics products in MaybeYay.

International transfers

Stripe is operated by a company that may process data outside the European Economic Area. Where that happens, Stripe relies on its own transfer mechanisms (such as standard contractual clauses). Brevo may also process data on infrastructure outside your country depending on how the account is configured.

Your rights

If EU or UK data-protection law applies to you, you can ask us for access to your data, correction, deletion, restriction of processing, objection to processing based on legitimate interests, and a portable copy of data you provided, where those rights apply.

How to make a privacy request

Email hello@maybeyay.com and describe what you need. We will need enough detail to find the invitation (for example the creator email or the invitation link). We handle these requests manually.

Complaints

You can lodge a complaint with the data-protection authority in your country of residence or, where Greece is the operator’s country, with that country’s authority. This does not affect other remedies you may have.

Invitation links

Each invitation is reached by a private link. Anyone who has the link can open it. Share it only with the intended recipient. Do not post it publicly.

What you must not submit

Do not enter unlawful, abusive or harmful content, special-category data about anyone, or someone else’s personal information unless you have the right to do so.

Changes

If this policy changes in a material way we will update the date above. The version that applies is the one published when you pay.