Privacy Policy

1. Controller

The controller for the processing of personal data on tadaya.app within the meaning of the GDPR is:

Provider

Leon Achtellik (Tadaya)

Address

Traifelbergplatz 4, 70597 Stuttgart, Deutschland

Email

hallo@tadaya.app

We are not required to appoint a data protection officer; the conditions of Article 37 GDPR and § 38 BDSG are not met. Questions about data protection go to hallo@tadaya.app.

2. Who decides what

A wall has three roles, and that matters for data protection too:

• You, as the organizer, create the wall, invite people, sort and hide contributions. You decide who gets the link and when the gift is handed over.
• Contributors upload their own contribution. What it says and shows is up to them.
• We provide the technology: storage, video conversion, playback, sending the emails.

We are the controller for the processing carried out by the platform. If you create a wall purely privately, for a birthday among friends or family, that is a personal activity for you under Article 2(2)(c) GDPR. That exemption does not apply to us as the provider. If you use Tadaya for a company, a team or an association, you are responsible for the content of your wall and must inform the people you invite accordingly.

3. When you open the site

Opening our pages makes your device send technically necessary data to the server: IP address, date and time, the address requested, browser and operating system. Without them the server cannot send a reply. They are processed for operation and security (Article 6(1)(f) GDPR), stored in our hosting provider’s logs and deleted there after a short time. We do not analyze them and do not combine them with other data.

To fend off automated mass requests, a few routes count requests per IP address: uploads, password checks and admin sign-in. That counter lives in memory, expires after a few minutes and is never stored.

The site’s fonts are served from our own server. Opening a page creates no connection to Google Fonts or any other font service.

4. Account and sign-in

You only need an account if you create a wall yourself. For that we store your email address and the language you last chose. There is no password: signing in works through a link we email you.

The basis is performance of the user agreement (Article 6(1)(b) GDPR). Sign-in and session handling are done by Supabase as a processor (section 11).

5. Creating a wall

When you create a wall we process what you enter: the occasion, the name of the person receiving the gift, the handover date, the invitation text and dedication, optionally a password, a background image or a portrait. You can also add the recipient’s email address so we can send them the gift link.

The basis is our contract with you (Article 6(1)(b) GDPR). For details about other people you are the one who decides that we receive them: the recipient’s name, their email address, their year of birth for the timeline. A password is only ever stored as a hash, never in clear text.

6. Uploading contributions

Anyone contributing through an invitation link needs no account. We process:

• Name. Required, because otherwise nobody knows who is speaking. It appears on screen while the contribution plays.
• The contribution itself. Video, photo, text or voice message, plus the technical details of the file.
• Confirmation of minimum age, with date and time. Tadaya is for people aged 16 and over (Article 8 GDPR, German age limit). Younger people may only contribute if a parent or guardian uploads on their behalf.
• Email address, optional. It is used solely to send you a link for replacing or deleting your contribution later, and after the handover a link to your keepsake. The contribution works just as well without it; you simply cannot change it yourself afterwards.

The basis for the contribution and the name is Article 6(1)(b) GDPR, because without them there is no contribution. The basis for the optional email address is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time by deleting your contribution through that same link.

Uploaded files go straight into object storage, without passing through our API. Videos are converted into one common format on our server in Germany so they play everywhere. Original files are not publicly reachable; delivery only ever happens through addresses that expire after a short time.

7. Handover and watching

The finished wall lives behind a long, unguessable link that you pass on. Search engines are excluded from it. If a password is set, we check it and place a signed cookie in the browser for seven days so the wall doesn’t ask again on every visit.

Whoever holds the link can see the wall. That is intentional, because a gift should be passable. How far it travels is your decision when you share it.

8. Emails

We only send emails that belong to the process: the sign-in link, a note about new contributions, a reminder about a wall that is not unlocked yet, the order confirmation after a purchase, a note about a refund, a note about a printed card waiting for your approval, the reminders before the archive expires, the gift link to the recipient, the editing link and the keepsake link to contributors, and, if the recipient wants, a thank-you to everyone who contributed. We send no advertising, there is no newsletter, and we never hand out your address for advertising.

Delivery runs through Resend (section 11). For each message we record recipient, template, time and delivery status so we can spot delivery problems and avoid sending the same message twice. The basis is the contract (Article 6(1)(b) GDPR) and our legitimate interest in traceable delivery (Article 6(1)(f) GDPR).

9. Payments and shipping the card

Payment runs through Stripe. Card number, bank account and payment service are entered directly with Stripe; we never see them. What comes back to us is the order, the amount, the time, the payment status and a payment reference.

The basis is performance of the contract (Article 6(1)(b) GDPR). Tax and commercial law require us to keep records for ten years (§ 147 AO, § 257 HGB), so this data remains even after a wall has long been deleted. Stripe is an independent controller for processing payments; details are in Stripe’s own privacy policy.

If you add the printed card, Stripe asks for a delivery address during checkout. Your name, address, email address and, if you give one, your phone number then go to our print provider, together with the finished print file carrying your card text and the QR code. Without those details no envelope arrives.

The print provider is Prodigi (section 11). It processes the data on our behalf and only to print and ship the card. Printing happens at print shops in several countries, depending on where the card is going; for delivery Prodigi passes the address on to the shipping company. The basis is performance of the contract (Article 6(1)(b) GDPR).

On our side the delivery address sits with the card order and disappears together with the wall. Whatever Prodigi and the shipping company keep for their own records follows their retention periods.

10. Statistics and consent

We want to know which pages get opened, not who opens them. For that we use Umami, statistics software we run ourselves on a server in Germany. No data flows to an external analytics provider.

Umami sets no cookies and builds no cross-site profiles. Before anything is sent at all, we replace the secret parts of the address with placeholders: a wall’s slug, the tokens under “edit” and “keepsake”, internal identifiers. Query parameters are dropped and the page title is emptied, because it can carry the recipient’s name. The preview inside the design panel isn’t counted at all.

Measurement only starts after your consent (§ 25 (1) TDDDG, Article 6(1)(a) GDPR). Without it the script isn’t even loaded. You can withdraw your consent at any time with effect for the future:

Open cookie settings

Which cookies exist and how long they last is in the Cookie Policy.

11. Processors and recipients

We pass data only to service providers we need in order to run the service. With each of them we have a data processing agreement under Article 28 GDPR:

• Application hosting: Vercel Inc., USA. Transfer to the USA based on the EU-US Data Privacy Framework, alternatively on the European Commission’s Standard Contractual Clauses.
• Database and sign-in: Supabase, with servers located in the European Union.
• Object storage for videos, photos and audio: Hetzner Online GmbH, Gunzenhausen, data center in Nuremberg, Germany.
• Server for video conversion and statistics: netcup GmbH, Karlsruhe, Germany.
• Email delivery: Resend, USA. Transfer based on the Standard Contractual Clauses.
• Payments: Stripe Payments Europe, Ltd., Ireland, together with Stripe, Inc., USA.
• Printing and shipping the printed card: Prodigi (UK) Ltd, Unit 20, Caker Stream Road, Alton, Hampshire GU34 2QA, United Kingdom (company number 10844939). Transfer based on the European Commission’s adequacy decision for the United Kingdom.

Beyond that we only pass on personal data where the law requires it. We do not sell it and do not analyze it for advertising.

12. Moderation and reports

You can hide and delete contributions on your own wall. In addition, a contribution can be reported, with a reason and, if wanted, an email address for our reply.

When something is reported, a member of our team may view and delete the reported contribution. That is the only case in which we look at content, and every such access is logged. For troubleshooting we otherwise only see the technical state of a wall, meaning count, size and processing status, and we do not play contributions. The basis is our legitimate interest in a service free of abuse and compliance with legal obligations (Article 6(1)(f) and (c) GDPR).

13. How long we keep data

• A draft wall that is never unlocked, together with its contributions: deleted once it has clearly been abandoned.
• An unlocked wall: for as long as the chosen package provides. The duration is listed with the packages and can be extended. After that the wall is deleted along with every contribution and file.
• Contributions a contributor deletes themselves: immediately.
• Accounts: for as long as the account exists. On your request we delete it together with your walls.
• Email log: until the related wall is deleted.
• Payment records: ten years, as required by law.

Deleted means deleted: a wall takes its files in object storage with it, not just its database row. In our providers’ backups, data remains for as long as their retention periods run.

14. Your rights

You have the right to access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and to object to processing based on legitimate interests (Article 21). Consent you have given can be withdrawn at any time with effect for the future; processing up to that point remains lawful.

Write to us at hallo@tadaya.app. If your message is about a contribution you uploaded yourself, the link from the confirmation email helps us find it.

You can also lodge a complaint with a data protection supervisory authority. The one responsible for us is the Landesbeauftragter fuer den Datenschutz und die Informationsfreiheit Baden-Wuerttemberg.

Do you have to provide data? For a contribution we need the name and the contribution itself, for an account your email address, for an order the details in the payment flow. Without them, that particular step cannot happen. Everything else is voluntary, and leaving it out has no consequences.

Automated decision-making within the meaning of Article 22(1) GDPR, including profiling, does not take place.

15. Changes to this policy

When the service changes, this policy changes with it. The version published here applies; the date below it tells you how current it is. We provide earlier versions in text form on request.