Privacy Policy

This Privacy Policy explains how Vayatu collects, uses, shares, and protects information when you use our services. At launch, some pages may be visible without login, such as legal pages, contact and account-deletion information, public business pages, and some public invite or context surfaces. Most account, chat, rewards, redemption, and private room features require sign-in. At launch, our services are available only in selected countries: United States, Canada, Mexico, Puerto Rico, Colombia, Peru, Brazil, Costa Rica, Panama, Dominican Republic, and Jamaica. Availability may change over time and may vary by feature.

We collect information you provide and information generated when you use the services, including:

• Public profile data you choose to share, such as name, username, display name, photo, bio, public tags, links, languages, and social handles
• Private account and eligibility data, such as email, linked phone, date of birth or age-gate details, country eligibility, onboarding status, legal acceptance markers, notification preferences, and push-device registrations
• Content and interactions, such as messages, DMs, room, group, or event participation, uploads, reports, feedback, follow activity, invite activity, Moments contributions, and related moderation or safety records
• Business and offer data, such as business claim or creation submissions, contact details, website or social proof, business memberships, published business pages, offer creation or edits, claims, rewards, redemption history, and related business interactions
• Presence and activity signals, such as online status, typing indicators, room presence, recent or read activity, and nearby participation signals
• Usage and diagnostics, such as interactions, feature usage, crash or performance events, and limited analytics about page views, offer clicks, claims, redemptions, directions, or link actions
• Device and network data (browser/device type, OS version, IP address)
• Location and place data, including precise location if you enable it, event or venue labels, Google Places search or selection data, place IDs, and place details used for event or business location flows

We use information to operate, maintain, and improve the services, including:

• Providing core functionality such as chat, room access, discovery, events, business profiles and pages, offers, rewards, claims, redemptions, and account controls
• Rendering public and private surfaces, including public business pages or invite and context pages, and signed-in account, chat, and reward surfaces
• Processing follows, in-app notifications, and push delivery where enabled; some activity such as follows may appear only as in-app notifications at launch
• Supporting location-based features, including nearby discovery, event joins, and venue selection using Google Places when you request it
• Security, fraud prevention, abuse detection, moderation, and investigating reports or suspicious activity
• Customer support, service communications, account export and deletion flows, and responding to legal or safety issues
• Improving performance, reliability, and business reporting features, including limited or pilot analytics summaries that may be delayed, partial, or incomplete

Visibility and sharing depend on context. We share information only as needed to operate and protect the services, including:

• Public-facing surfaces: information you choose to publish, approved business profile details, and some public business-linked event or context details may be visible on public pages or shared links. Public invite, contact, legal, and delete-account pages may also be visible without login
• Limited-context sharing: room, DM, group, event, presence, and shared-media data are shown only to participants or viewers authorized for that surface
• Businesses and authorized business operators may see information reasonably needed to manage their business pages, published offers, claims or redemptions, reports about their public business surface, and limited or pilot activity summaries related to their business surfaces
• With service providers and infrastructure partners that help us run the services, such as hosting, storage, databases, messaging, push delivery, security, Google/Firebase services, and Google Places
• To comply with law or respond to valid legal requests
• To protect rights, safety, investigate abuse, or prevent fraud

If you enable location, we may process precise location to place you into nearby experiences, support proximity or join rules, and improve local relevance. Event flows may use different location modes: a saved place selected through Google Places, your current location when you explicitly choose it, or a virtual or no-location mode. When you search for or select a place, place queries and place details may be sent to Google Places, and normalized place details may be stored with the related event or business flow.

You can disable location at any time in your device or browser settings, but nearby and proximity-based features may be limited or unavailable. Virtual events do not use physical coordinates for nearby physical discovery, while events or businesses that intentionally publish venue or place details may show those details on their relevant surfaces.

We may use AI-assisted features and third-party AI providers (such as OpenAI or Google Gemini) to help draft, summarize, translate, or organize content, and to support spam, abuse, fraud, and policy-violation detection.

AI outputs may be inaccurate or incomplete and should be reviewed by you. We do not use AI to make solely automated decisions that produce legal or similarly significant effects about you.

We use permissions and similar technologies (including cookies, local storage, and service workers where applicable) to keep you signed in, remember preferences, and enable features like location, camera, notifications, and push delivery. You can manage most permissions in your device or browser settings.

We use administrative, technical, and physical safeguards designed to protect information, such as encryption in transit, access controls, rate limits, monitoring, and account or app-integrity checks where appropriate.

No system is perfectly secure. If you believe your account has been compromised, contact us.

We retain information as long as needed to provide the services and for legitimate business and legal needs such as security, fraud prevention, abuse handling, moderation, transaction history, analytics, disputes, and compliance. Account export and deletion tools are available in-app for supported accounts, but deletion does not promise a full hard delete of shared or audit-oriented records. Shared records such as messages, redemptions, reports, moderation data, analytics, and shared business or event history may be retained or anonymized where removing them would break safety, fraud prevention, transaction integrity, legal compliance, analytics, or shared-history needs. Some shared media surfaces (such as Moments recap media) are designed to be temporary and may expire or be removed based on lifecycle and moderation policies.

Depending on your country, you may have rights to access, correct, delete, or export certain personal information, and to object to certain processing. We currently provide in-app export and delete tools for supported accounts.

These rights are not absolute. We may deny or limit requests where permitted by law or required to protect security, prevent fraud, investigate reports, preserve moderation or transaction records, comply with legal obligations, or maintain shared history integrity. We may need to verify your request, ask you to re-authenticate, or require active business owners or admins to transfer or close active business profiles before deletion can be completed.

The services are intended only for people who are 18 years of age or older. You may not create or use an account if you are under 18. If we learn that someone under 18 has provided personal information, we may suspend the account and take steps to remove or limit related data.

Your information may be processed in the United States and other countries where we or our service providers operate. Data protection laws may differ between jurisdictions.

We may update this policy from time to time. If changes are material, we will provide reasonable notice.

Questions about privacy? Contact us at support@vayatu.com.