Last updated: 10 October 2026
This policy explains how Tadayay handles personal data. It covers the Tadayay website (tadayay.com), the Tadayay web app, the Tadayay mobile apps and our accounts on social media.
Who we are
Tadayay is a service of Triple 8 Labs, a sole proprietorship (eenmanszaak) registered in the Netherlands. Triple 8 Labs is responsible for your personal data. Our company details are on the Statutory and Regulatory Disclosures page. You can contact us at [email protected].
What we collect and why
To suggest gifts, we handle what you tell us about the person you are shopping for. With an account we also keep what you choose to save:
- Your account: your email address, a display name you may set, and your password (stored only as a hash, never readable by us).
- People you save: a name you choose for them, how they are related to you, their birthday and country, their interests, personality, things they already own, a default budget, your notes, and important dates you add.
- Gifts you tell us you have given, so we can avoid repeating them.
- Your requests and the ideas we returned: the description you wrote, your budget, the occasion and the language, with the suggestions.
- Your preferences: currency, number and date format, and language.
- Your signed-in sessions, so you stay signed in on each device until you sign out.
You can use Tadayay without an account. Then your request and its ideas are stored under a temporary anonymous session identified by a token kept on your device, and your internet (IP) address is used to limit how many requests one address can make.
If you email us, or contact or message us on social media, we keep what you send and use it to reply. The social media platform’s own privacy policy applies to your use of that platform.
Why we are allowed to use it
We use your data to provide the service you asked for, and to send the emails that go with an account (confirming your address, resetting a password, telling you about a change): this is necessary to do what you ask of us. We also use limited data to keep the service secure, prevent abuse, apply fair-use limits and keep backups, which is in our legitimate interest in running a safe service. We do not send marketing email. If we ever add analytics or advertising cookies, or marketing email, we will ask for your consent first where the law requires it.
Who we share it with
To write the suggestions we send your request to an AI provider (currently Google, Anthropic, Mistral and OpenAI), through an automation service we run. The AI provider receives the description you wrote, your budget, the occasion and the language. When you use a saved person it also receives:
- how they are related to you
- their age (worked out from the birthday; the birthday itself is never sent)
- their country
- their interests
- interests you share
- personality traits
- things they already own
- your free-text notes about them
If you ask us to avoid repeating past gifts, the descriptions of the gifts you logged for that person are sent too. We do not send a saved person’s name or birthday, or your own email address or name. Anything you type into a free-text box is sent as you typed it, so if you write a name there, it is included. Each AI provider handles the request under its own terms and privacy policy.
The automation service, which is hosted in the European Union, also receives your IP address and a technical identifier for your account or anonymous session, to apply fair-use limits. It keeps a short log of requests, deleted automatically after about seven days. A successful request is not kept in its execution history; a failed one is, for debugging, for up to two weeks.
We also use these service providers, who process data on our behalf:
- Our hosting provider, whose servers are in the European Union, which runs the website, the app’s back end and its database.
- Cloudflare, which carries and protects requests to the website and the app, and so sees IP addresses and standard request information.
- Resend, which delivers the emails we send you, and so receives your email address and the content of those emails.
- Our email hosting provider, which handles the messages you send to our support address.
- Amazon Web Services, where backups of the website database are stored in the European Union.
If you follow a gift link, you leave Tadayay and go to Amazon. The links are affiliate links: Amazon tells us about purchases made through them and we may earn a commission at no cost to you. Amazon’s own privacy notice applies once you are on its site. We do not sell your personal data.
Where your data goes
Our servers, our automation service and our backups are in the European Union. Some of the providers named above, including the AI providers, Resend and Cloudflare, are based outside the EU or operate globally, so your data may be processed outside the EU. Where that happens we rely on the safeguards the law provides for, such as the EU–US Data Privacy Framework for certified US providers, or the standard contractual clauses approved by the European Commission.
Cookies and storage on your device
When you sign in on the web, we use a secure cookie that only our server can read, to keep you signed in. In the mobile apps the sign-in token is kept in the phone’s secure storage (Keychain on iPhone, Keystore on Android) instead. Without an account, the app keeps an anonymous session token on your device (in browser storage on the web, in the app’s own storage in the mobile apps), and with one it keeps a note that you are signed in. These are needed for the service to work. We do not set advertising or analytics cookies.
How long we keep it
- With an account: we keep what you saved until you delete it or delete your account. Deleting your account permanently removes your saved people, requests, gift history, dates and sessions, and then the account itself. If you do not use your account for 24 months, we email you to say it will be deleted. If you have still not signed in 3 months after that email, we permanently delete the account and everything saved under it.
- Without an account: requests and the ideas returned are deleted automatically after 48 hours. If you create an account before then, they can move into it instead.
- Sign-in sessions: deleted once they have expired.
- Request log (IP addresses): about seven days. Failed requests in the automation service: up to two weeks.
- Backups: the most recent ten daily backups of the website are kept, so something you delete can remain in a backup for up to about ten days.
- Messages to us: kept for as long as we need them to deal with your request and any follow-up.
Our service providers also keep some data under their own policies.
Automatic suggestions
The gift ideas are generated automatically by artificial intelligence. They are suggestions you are free to ignore, and they do not make any decision about you with legal or similarly significant effects. See also our Statutory and Regulatory Disclosures.
Children
Tadayay is not directed at children and we do not knowingly collect their personal data. If you think a child has given us personal data, contact us and we will delete it.
Your rights
You can see and correct what we hold in the app, download a copy of it (Settings, Your data), and delete your account and everything saved under it from the same place. You can also ask us to access, correct or erase your data, to restrict or object to how we use it, or to move it to another service. Write to [email protected]. If you are unhappy with how we have handled your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or to the data protection authority where you live.
Changes to this policy
When we change this policy we update the date at the top, and if a change matters to you we will tell you in the app or by email.