Privacy policy for AYA

Your account email (for login and receipts), the alias or name you choose for a product, GPS location on scan (from the finder only, never from the child), and device details for push notifications. We don't require a phone number to activate a wristband or name label. If you provide a phone number at checkout, for delivery or as a luggage callback number, we store it to complete your order.

We use your data solely to provide the AYA service: email login, push notifications on scan, showing the finder's location on a map, and order processing via Stripe.

GPS location is collected ONLY from the finder (the person scanning the QR code) - never from your child. The location is used to show you exactly where your child is. GPS data is automatically deleted after 30 days.

We only use strictly necessary cookies: aya_sid (session), NEXT_LOCALE (language choice) and Stripe payment cookies. No tracking and no advertising cookies. See our cookie policy for details.

We share data with the following third parties: • Twilio - SMS delivery where still used • Stripe - payment processing • MobilePay (via Stripe) - Danish mobile payment • Sentry - error tracking and performance monitoring • Hetzner - hosting • Upstash - Redis cache and rate limiting • Stalwart SMTP - transactional emails (receipts, notifications) • Meta - ad measurement via the Conversions API (hashed email and phone, server-to-server; no cookies, no browser pixel) Analytics run cookieless on our own servers. For ad measurement we share hashed purchase data server-to-server with Meta via the Conversions API - no cookies and no browser pixel. We never sell your data.

Most scan logs and GPS data are deleted automatically after 30 days (the activation point and last known location for each product are kept). Wristband aliases are anonymised 30 days after they expire; labels and luggage tags keep the name you chose. Your account email is stored for as long as the account is active. You can request deletion at any time.

Under GDPR you have the right to: access your data, rectification, erasure, data portability, restriction of processing and objection. Contact us via the support page to exercise your rights.

We only store the child's first name - never surname, photos or other personal information. The child never interacts with AYA directly. All data is managed by the parent.

We may update this policy from time to time. We'll announce significant changes by email or on the website. The latest version is always available on this page.