Privacy Policy
Effective: 8 October 2026
This notice describes how PAP NOÉMI E.V. ("we", "daya") handles personal data on the daya website and mobile app. It reflects how the system actually works, and satisfies the information duty under Articles 13-14 of the General Data Protection Regulation (GDPR).
The short version, before the detail:
We do not sell your data and we do not use it for advertising. What we collect, we collect so that booking works. Usage statistics are measured only if you separately agree to it. You can delete your account from the app at any time: your personal data is then removed, not merely hidden. Section 6 sets out exactly what remains and why.
1. Who controls your data - and why there are two parties
Worth settling up front, because it determines who you go to.
The platform operator. We run the service. We are an independent controller for your user account data: your registration, your sign-in, your notification settings, error logs, and salons' account and billing data.
The salon you book with. The salon is an independent controller for its own customer data: it decides what services it offers, what it asks at booking, how long it keeps customer history, and who goes on its block list. In that scope we act as a processor on the salon's instructions - we store and technically handle the data, but we do not decide its fate. The beauty service itself is provided by the salon, not by daya.
What this means in practice: for anything about your bookings, the history a salon keeps on you, or the questions answered at booking, go to the salon first. If you get no answer, come to us - we can also carry out your request in our own systems.
How to reach us
- Controller: PAP NOÉMI E.V., 1135 BUDAPEST, TATAI UTCA 20.
- Registration number: 62737177 - VAT: 92321146-1-41
- Privacy matters: info@daya.now
- General contact: hello@daya.now
We are not required to appoint a data protection officer under Article 37 GDPR; privacy matters are handled at the address above.
2. Who this notice covers
Three groups, with different content:
- Customers - anyone booking an appointment, with or without a registered account.
- Salons and their staff - those using the system on the salon side.
- Visitors - anyone browsing the website or app without booking.
If you are both a customer and a salon. You can create a customer account and a salon account with the same email address. These are two separate accounts: separately verified, with separate passwords, separate notification settings and separate processing. In your customer account you act as a customer as described in section 1; in your salon account you act on the salon's behalf. Bookings you make as a customer do not appear in your salon account and vice versa, and deleting one account does not affect the other. One exception: your decision on usage statistics is tied to the device, so on the same browser or phone it applies to both accounts.
3. What data we process
As a customer
| Category | What it covers | Source |
|---|---|---|
| Account data | first and last name, email address, phone number, password (stored only as an irreversible hash), profile photo, language, appearance preference | you |
| Birthday | optional; used by month and day only, if the salon sends birthday reminders | you |
| Booking data | salon, service, staff member, time, price, payment method, status, whether and when it was cancelled, discount code | you and the salon |
| Questionnaire answers | free-text answers to questions written by the salon and, if the salon asks for it, uploaded photos | you |
| Salon notes | salon staff may attach an internal note to a booking; the salon is responsible for its content and lawfulness | the salon |
| Loyalty data | stamp card progress, redeemed rewards, referral code | generated by the system |
| Group membership | a salon may put your email address in an early-access group so you can book there before others. The group applies only at that salon | from the salon |
| Notification data | email and push preferences, a device token used to deliver push | you and your device |
| Technical data | sign-in sessions, IP address in security and anti-abuse logs, error logs | automatic |
| Bug reports | if you report a fault: the description, any screenshots you attach, your contact details, and the platform and app version. Used solely to investigate the fault | from you |
| Location | only if you allow it: your approximate position, so the map can show nearby salons. It is not stored and never sent to our servers. | your device |
Salons and their staff
Company and contact details, salon profile (name, address, description, images, opening hours), work schedules, service catalogue and prices, subscription and billing data, and system usage logs.
What we do not process
- Card details. Subscription payments happen on Stripe's surface; card data never enters our systems. Customers do not pay on the platform - the service is paid directly to the salon.
- Special category data, including health data. See section 4 - this is a contractual prohibition on salons.
- Advertising profiles. We build no behavioural profile and pass no data to ad networks.
4. Questionnaires and photos - an important limit
A salon can attach its own questions to the booking form, and can ask for a photo - for example of your hair's current state or the result you want.
What a salon may not ask for. Salons contractually undertake not to request special category data in questionnaires or photo requests. Special category data is data under Article 9(1) GDPR: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data and biometric data used for identification, health data, and data concerning sex life or sexual orientation.
Examples, because in practice health data is the typical risk. A salon may not ask, for instance, about illness, allergies, medication, pregnancy, disability, or skin, nail or scalp conditions under treatment. It may ask, for instance, about hair length, previous colouring, the style you want, or for a reference picture - none of these is special category data.
The salon is warned about this when editing a questionnaire. Because questions are free text, the system cannot enforce the prohibition automatically: the salon is responsible for complying, and we act on reports.
If you meet such a question anyway: do not answer it, and tell us at info@daya.now. We will delete the answers and require the salon to remove the question.
Uploaded photos are not public: only you and the staff of the salon concerned can see them, and only when signed in. They cannot be reached by guessing a file name.
5. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) | Note |
|---|---|---|
| Creating and running your account, signing in | contract - (1)(b) | no account, no service |
| Creating, changing and cancelling bookings | contract - (1)(b) | as processor for the salon |
| Verifying your email address | contract - (1)(b) | required to sign in |
| Booking confirmations and reminders (email, push) | contract - (1)(b) | transactional, not marketing |
| Reminders and offers from a salon (e.g. "time for a visit", birthday discount) | legitimate interest - (1)(f), existing customer relationship | can be switched off at any time; only from a salon you have actually visited |
| Preventing abuse, fraud and overload | legitimate interest - (1)(f) | keeping the service available |
| Debugging, operations, backups | legitimate interest - (1)(f) | logs are kept briefly |
| Usage statistics, product improvement | consent - (1)(a) | nothing starts until you allow it |
| Collecting subscription fees, invoicing | contract and legal obligation - (1)(b) and (c) | applies to salons |
| Accounting retention | legal obligation - (1)(c) | for the statutory period |
You may object at any time to processing based on legitimate interest (section 10). Consent can be withdrawn at any time, with effect for the future.
Specific features in detail
For the four features below, we set out in one place what each does, for what purpose, on what legal basis and who is involved.
| Feature | What it does | Purpose and legal basis | Who is involved |
|---|---|---|---|
| Push notifications | if you allow them, we store your phone's notification address and send booking notifications to it | booking notifications: contract - (1)(b); offers from salons: legitimate interest - (1)(f), can be switched off | Expo, Apple, Google (section 7) |
| Crash reports (mobile app) | on a crash, sends a technical report: device model, OS and app version, where the error occurred. It contains a user identifier only if you have consented to usage statistics | fixing faults and keeping the service working: legitimate interest - (1)(f) | Google (Firebase Crashlytics) |
| Automated image screening | images shown publicly (e.g. salon photos) are automatically screened for prohibited content; a flagged image stays hidden until a person decides. Customers' non-public booking photos are not affected | filtering illegal content: legitimate interest - (1)(f), and our obligations under the Digital Services Act (DSA) | Google (section 7) |
| Support sign-in to a salon account | to fix a fault, handle a support request or investigate a report, an authorised member of the platform team may sign into a salon account for at most 30 minutes after two-factor authentication. They can then also see the salon's customer data. Every sign-in is logged | as processor for the salon, under the contract with the salon (Salon Terms section 10) | the operator only |
6. How long we keep data
Not indefinitely. The system runs automatic daily deletion jobs:
| Data | Retention |
|---|---|
| Registered account | for as long as the account exists; on deletion, immediately |
| Bookings made without an account | 90 days after the last booking, then automatic deletion |
| Booking history | 3 years from the appointment; after that the booking stays anonymised in the salon's statistics |
| Copies of sent email | 2 days (30 days if delivery failed) |
| Sign-in sessions | 30 days after expiry |
| Password reset and verification codes | 30 days after use or expiry |
| Read notifications | 90 days; unread 180 days |
| Search logs | 180 days |
| Usage statistics | compacted into daily aggregates; raw events are deleted after 14 days |
| Billing and accounting records | for the statutory period (in Hungary 8 years under the Accounting Act) |
| Backups | a full database backup is taken daily and kept for 30 days; the one taken on the first day of each month, and any one-off backup, is kept for 12 months. The backup copy of an uploaded file is kept for at most 12 months after the original is deleted |
What happens when you delete your account. Deletion runs immediately when you confirm it; there is no waiting period. Four things are worth telling apart:
- Deleted immediately from our main systems: your name, email address, phone number, profile picture, questionnaire answers and the photos uploaded with them, your loyalty data, notifications, devices and sign-in sessions.
- Kept in anonymised form: the fact of your past bookings in the salon's revenue records - the salon still sees that a haircut happened that day at that price, but not that it was yours.
- Kept because of a legal obligation or legitimate interest: accounting records for the statutory period, and entries in security and moderation logs, which we keep to investigate abuse and to defend legal claims.
- Kept temporarily in backups: in backups taken before the deletion, your data remains until the end of the backup cycle above. Backups are used only for restoring the system; if we ever had to restore one, accounts already deleted would be deleted again after the restore.
The Delete account page explains the steps as well.
7. Who we share data with
The salon you book with - that is the point of the service. The salon sees your name, contact details, booking details and questionnaire answers. No other salon sees your data.
Processors providing the technical services we run on. Each is under a written data processing agreement and may only act on our instructions:
| Provider | Role | Location |
|---|---|---|
| Railway Corp. | application and database hosting, and storage of uploaded images and files | Európai Unió (EU) |
| Vercel Inc. | website delivery (server-side rendering runs in the United States) | EU / USA |
| Cloudflare, Inc. | network protection and caching in front of the API; processes IP addresses in doing so | EU / global |
| Stripe Payments Europe, Ltd. | collecting subscription fees (salons only) | EU / USA |
| Brevo SAS | sending transactional email | EU |
| Google Ireland Ltd. / Google LLC | maps and address lookup; automated content screening of uploaded public images (to detect prohibited content); usage statistics where consented; crash reporting | EU / USA |
| 650 Industries, Inc. (Expo) | relaying push notifications | USA |
| Apple Inc. / Google LLC | delivering push notifications to the device | USA |
| Functional Software, Inc. (Sentry) | error logging | USA |
To your own calendar, if you ask for it. A salon staff member can follow their schedule by subscribing to a calendar address. If they add that address to an external calendar provider (Google Calendar, say), the schedule data reaches that provider too - their decision, not a transfer by us. The address contains a secret key and can be revoked at any time.
Authorities, where the law requires it - but only to the extent required, and we review every request.
We do not sell data, and we pass none of it on for advertising or data-brokerage purposes.
8. Transfers outside the European Union
Some providers also process data in the United States. Where that happens, the transfer relies on the European Commission's adequacy decision under the EU-US Data Privacy Framework (where the provider is certified), and otherwise on the European Commission's Standard Contractual Clauses (SCCs) with supplementary safeguards.
The database and uploaded files are primarily stored in Európai Unió (EU).
9. Cookies, analytics and tracking
We use cookies that are strictly necessary for the site to work: keeping you signed in, remembering your language, and security protection. These need no consent, because without them the site does not function. Each cookie is listed by name, purpose and lifetime in the separate Cookie and Local Storage Notice.
Everything else starts only with your consent. You decide in the banner shown on your first visit, and you can change that decision at any time. Until you allow it, no statistical data leaves your device.
What we measure with your consent: which screens are viewed, where booking stalls, and how many bookings are created - always in a form that cannot identify you. Names, email addresses and phone numbers are never sent to any analytics system.
The same rule applies in the app: nothing is measured until you give consent there. We do not use the advertising identifier (IDFA) and do not track you across apps or devices.
10. Your rights
Under the GDPR you have the rights below. Exercise any of them at info@daya.now and we will respond within one month at the latest. There is no charge.
- Access - get a copy of what we hold about you.
- Rectification - have inaccurate data corrected; most of it you can edit yourself in your profile.
- Erasure - start account deletion with one button in the app, or ask us by email.
- Portability - download everything we hold about you yourself, as a machine-readable (JSON) file: Profile → Download my data, on the web and in the app alike. You can also request it by email.
- Restriction - ask us to freeze processing for a period.
- Objection - object to processing based on legitimate interest. Reminders and offers from salons can be switched off with a single toggle in notification settings, and every such message carries the same route back to it.
- Withdrawing consent - withdraw analytics consent whenever you like.
Where a request concerns data held by a salon, we forward it to the salon, as they are its controller.
We carry out no automated decision-making or profiling that produces legal effects for you. Two automatic mechanisms do run, and it would be dishonest to leave them out:
- Image screening. Uploaded images are checked automatically for prohibited content. Anything the check flags is not published until a person has looked at it - the final decision is not made by a machine. If you believe it is a mistake, write to info@daya.now.
- Automatic block list. If you accumulate the number of late cancellations set by the salon within the salon's chosen window at that same salon, the system blocks further bookings at that one salon for the period the salon set. The threshold, the window and the length of the block are the salon's settings, the salon can lift a block at any time, it does not restrict you at any other salon, and we tell you before you start booking.
Complaints. If you believe we handle your data unlawfully, you may complain to a supervisory authority - in Hungary, the National Authority for Data Protection and Freedom of Information (NAIH), Falk Miksa utca 9-11, 1055 Budapest, naih.hu. If you live elsewhere, you can complain to your local authority - see section 14.
11. How we protect data
- Passwords are stored only as one-way salted hashes (bcrypt) - we cannot recover them either.
- Two-factor authentication secrets are encrypted with AES-256-GCM.
- All connections run over an encrypted channel (HTTPS).
- Customer photo uploads go to private storage and are reachable only when signed in.
- Platform-administrator sign-in requires two-factor authentication.
- If we sign into a salon's account for support purposes, it is logged, and the log cannot be altered afterwards.
- The system has built-in limits against bulk extraction and abuse.
If a data breach occurs, we notify the authority within the statutory deadline and, where the risk is high, we notify you directly.
12. Children
The service is not designed for anyone under 16, and we do not knowingly collect their data. Where a minor needs parental consent to use a service, obtaining it is a matter for the salon and the parent. If we learn that we hold data on someone under 16 without parental consent, we delete it.
13. Changes to this notice
If our processing changes materially, we publish the change on the website and notify signed-in users - always when a new processor or a new purpose is involved. The effective date is always shown at the top.
14. Country-specific provisions
daya is available in several countries. Where local law adds requirements beyond the above, we note them here. This section grows as the service expands.
Hungary. Supervisory authority: NAIH (details in section 10).
Germany, Austria. The supervisory authority is the state data protection authority for your place of residence. German law sets a stricter rule for newsletter- and push-type messages, so in Germany we send salon offers only after explicit consent.
Italy. Supervisory authority: Garante per la protezione dei dati personali, garanteprivacy.it.
Thailand, Indonesia, Malaysia, Vietnam. Local data protection law in these countries - Thailand's PDPA, Indonesia's UU 27/2022, Malaysia's PDPA and Vietnam's Decree 13/2023 - grants rights comparable to the GDPR, with partly different procedures. When we begin serving salons in a given country, we publish the supplementary country notice and, where required, the local representative's details here. In the meantime, you can exercise the rights listed above as a local resident at info@daya.now.
Questions? Write to info@daya.now - you will get a human answer, not a template.