DaysLive — Privacy Policy

DaysLive is operated by Ehsaan Abdul Sami, an individual operator based in India. DaysLive is not represented in this Privacy Policy as an incorporated company or other registered legal entity.

For anything described in this Privacy Policy, including privacy requests, questions and complaints, the operator can be reached at ehsaan.suhail20@gmail.com.

DaysLive has not appointed a Data Protection Officer. The operator named above is the person responsible for the processing described in this Privacy Policy, and is the person to contact about it.

DaysLive does not currently represent itself as a Significant Data Fiduciary. If applicable law or a competent authority requires DaysLive to comply with additional obligations applicable to a Significant Data Fiduciary, DaysLive will take the required steps.

This Privacy Policy applies to the DaysLive website at dayslive.co and the features offered through it, including public birthday pages, birthday profiles, rankings, search, accounts and contributions.

It does not apply to services operated by other organisations, even where DaysLive links to them or depends on them. In particular, payments are completed on PayPal, and PayPal handles the personal data you give it under its own privacy policy rather than this one.

This Privacy Policy should be read together with the DaysLive Terms of Service and Refund Policy.

Most of the personal data DaysLive holds is data you chose to submit. Depending on what you do, that may include:

• an email address and password, if you create an account with an email address;
• an optional display name for your account;
• the name, birthday month and day, and any optional description, location, handle or Instagram username you submit for a birthday profile;
• photographs or video you upload for a birthday profile; and
• the content of any message you send to the contact address in this Privacy Policy.

You do not need an account to browse DaysLive, and you do not need an account to make a contribution.

DaysLive does not ask for, and has no field for, your postal address, telephone number, date of birth, government identifier, or payment card details.

An account is required to create or manage a birthday profile. Accounts are handled by Supabase Authentication on behalf of DaysLive.

If you register with an email address and password, your email address is stored so that you can sign in, confirm your address and recover access. Your password is stored only in hashed form by the authentication service. DaysLive does not receive, store or have any way to display your password.

A confirmation email is sent when you register, and account-related emails such as a password reset are sent when you ask for them. DaysLive does not send marketing email and has no mailing list.

Where DaysLive offers sign-in through a third-party provider and you choose to use it, that provider tells DaysLive that your sign-in succeeded and supplies basic account information, which may include your email address, a name and a profile picture URL. At the time this Privacy Policy was published, third-party sign-in was not enabled on DaysLive and email sign-in was the only method available. If it is enabled, the provider concerned is Google, and Google's own privacy policy governs what Google does with your data.

An optional display name you give your account is stored with your account record. It is used to identify you in the account area. It is not published on a birthday page merely because you have set it.

A birthday profile is content submitted for publication. It records a name and a birthday month and day, and may record an optional short description, a location, a handle and an Instagram username.

A birthday profile records the calendar date only. DaysLive has no field for a year of birth and does not collect one, so a birthday profile does not record or reveal a person's age.

A birthday profile is linked internally to the account that created it, so that the account holder can manage it. That link is not shown on the public page.

A birthday profile may concern you or another person. If you submit information about another person, the Terms of Service require you to have the authority or permission necessary to submit it and for DaysLive to display it.

Photographs and video you upload for a birthday profile are stored in a private storage bucket operated by Supabase. They are not stored in a publicly listable location, and they are not served from a permanent public address.

When media needs to be displayed, DaysLive generates a temporary signed link to it. The storage rules permit a link for public display only while the birthday profile concerned is published. A link that has been generated continues to work until it expires, so anyone you send that link to can open the file for as long as it remains valid.

Uploads are restricted by file type and file size. DaysLive does not extract, index or use any location data, camera data or other metadata that an image or video file may contain, but it also does not strip such metadata, so anything embedded in a file you upload remains in the file that is stored and displayed.

When you remove a media item, or delete a birthday profile, the underlying file is deleted from storage.

An Instagram username may be submitted for a birthday profile. It is optional, and a profile works normally without one.

If one is submitted, it is stored and displayed on the public birthday page as part of that profile. Publishing it makes an intentional public connection between the birthday profile and that Instagram account, and anyone who sees the page can follow it.

DaysLive does not connect to Instagram, does not use Instagram or Meta login, does not read anything from the linked account, and does not send anything to Instagram or Meta. The username is stored as text you supplied and nothing more.

Do not submit another person's Instagram username unless you have the authority or permission to publish it.

When you make a contribution, DaysLive records the birthday profile it relates to, the amount, the currency, the status of the payment and the times at which the status changed. DaysLive also records internal references that identify the payment attempt, so that a double-submitted checkout is not charged twice and so that a payment can later be reconciled or disputed.

If you are signed in when you contribute, the contribution is linked internally to your account. That link is not part of the public activity feed. If you are not signed in, no account is linked to the contribution.

A contribution may carry an optional name to be shown with it on the public activity feed. Where no such name is recorded, the contribution is displayed as anonymous. At the time this Privacy Policy was published, the DaysLive checkout did not ask for a name to display, so contributions appeared as anonymous.

DaysLive never receives your card number, card expiry, card security code, bank details or PayPal password. Those are entered on PayPal, not on DaysLive, and no part of DaysLive is able to read them.

Payments are processed by PayPal. It is worth being precise about who receives what.

What DaysLive sends to PayPal, when it asks PayPal to open a payment, is the amount and a short human-readable description of the date being backed. DaysLive does not send your name, your email address, your account identifier or any internal DaysLive reference to PayPal.

What PayPal receives directly from you is whatever you provide to PayPal in order to pay, including your PayPal credentials or card details and the technical information PayPal collects when you use its checkout. PayPal processes that information for its own purposes as an independent controller, under PayPal's privacy policy and payment rules. DaysLive has no access to it.

What DaysLive stores about the transaction is the payment status, the transaction and order identifiers PayPal issues, the amount, and any failure reason PayPal reports. DaysLive also stores the verified notification records PayPal sends to confirm what happened to a payment, so that a settlement can be proved, a duplicate notification can be ignored and a refund or dispute can be traced. A notification record is stored as PayPal sends it, so it may contain limited information about the payer that PayPal chose to include in that notification.

These records are held privately. They are not published, and the database is configured so that they cannot be read by a browser or by an ordinary signed-in user.

Some information is generated by the act of using the site rather than submitted by you.

• Your IP address and ordinary request information reach the hosting platform whenever you load a page, which is unavoidable in delivering a website and is used to serve the request and to protect the service.
• To limit abuse of the contribution flow, DaysLive keeps a short-lived counter of recent attempts. For a signed-in user the counter is keyed to the account; for a visitor who is not signed in it is keyed to the IP address. These counters hold no payment data and no content, and are automatically deleted a short time after they stop being used.
• Diagnostic logs are produced when something fails. They record what went wrong and internal references such as a record identifier. They are not designed to profile users, and DaysLive does not put email addresses, IP addresses, payment notification contents or credentials into them.

DaysLive does not build advertising or behavioural profiles, does not track you across other websites, and does not sell or rent personal data to anyone.

DaysLive sets cookies only to keep you signed in. When you sign in, the authentication service sets session cookies that are marked so that they cannot be read by JavaScript in your browser, and those cookies are refreshed as you move around the site. Without them, signing in would not work.

DaysLive does not use analytics cookies, advertising cookies, social-media cookies or any other cookie that is not required to operate sign-in. There is no analytics tool, tag manager, advertising pixel or session-recording tool installed on DaysLive.

DaysLive does not store personal data in your browser's local storage or session storage.

PayPal's checkout is loaded from PayPal when you reach the payment step, and PayPal may set its own cookies or similar identifiers at that point under its own policy. DaysLive does not control those and does not receive anything from them.

You can block or delete cookies in your browser. If you block the sign-in cookies described above, you will not be able to stay signed in, but you can still browse public pages.

Personal data is processed for the following purposes and no others:

• to operate the service, including publishing birthday profiles, calculating and displaying rankings, and running search;
• to create and administer accounts, authenticate you and let you manage what you have submitted;
• to process contributions, confirm settlement with the payment provider and keep an accurate record of each transaction;
• to handle refunds, reversals, chargebacks and disputes, and to reconcile payments that need attention;
• to prevent, detect and investigate fraud, abuse and misuse of the service, and to keep the service and its users secure;
• to respond to your requests, including privacy requests and content complaints;
• to keep records that are needed for accounting, evidence of a transaction and the resolution of a possible future claim; and
• to comply with law and to respond to a valid legal requirement.

Personal data collected for these purposes is not repurposed for advertising or profiling.

DaysLive processes personal data in accordance with applicable privacy and data-protection laws. This section explains the grounds relied on, in ordinary terms, rather than asserting compliance with any particular certification.

• Information you submit for publication, such as a birthday profile, a photograph or an Instagram username, is processed because you submitted it for that purpose. Publication is the purpose you asked for.
• Account and contribution data is processed because it is necessary to provide the service you have asked DaysLive to provide.
• Security, abuse-prevention, reconciliation and record-keeping data is processed because it is necessary to run a service that takes money safely and to be able to answer for a transaction afterwards.
• Some processing is required in order to comply with law, or to establish, exercise or defend a legal claim.

India's data-protection framework is being brought into force in stages. That means some requirements already apply to DaysLive, and others will apply from a later date. Indian law on information technology and on reasonable security practices applies to DaysLive now.

DaysLive will comply with applicable data-protection requirements as they become applicable to the Service, including requirements that come into force under India's Digital Personal Data Protection framework. Where this Privacy Policy describes rights or protections before a particular statutory provision becomes mandatory, DaysLive may provide them as part of its current privacy practices.

DaysLive does not claim that a requirement which has not yet come into force already binds it, and does not claim any certification or formal finding of compliance under any privacy law.

This distinction matters more on DaysLive than on most services, because the product is a set of public pages.

The following is PUBLIC once a birthday profile is published. It can be seen by anyone, with no account and no sign-in:

• the name on the birthday profile;
• the birthday month and day;
• any description, location or handle submitted for the profile;
• any Instagram username submitted for the profile;
• the photograph or video submitted for the profile;
• the total amount contributed to that profile and its rank on its date; and
• settled contributions in the activity feed for that date, showing the amount, the currency, the time and the display name recorded with the contribution, or anonymous where no name was recorded.

The following is PRIVATE. It is not published anywhere on the site:

• your account email address and your password;
• which account created a birthday profile;
• which account made a contribution;
• payment attempt records, transaction and order identifiers, failure reasons and refund records;
• notification records received from the payment provider;
• abuse-prevention counters and diagnostic logs; and
• the contents of messages you send to the contact address.

Because public pages are meant to be found, information on them may be indexed, cached, copied, screenshotted, archived or reposted by search engines and other third parties. DaysLive does not control that. If a birthday profile is later unpublished or deleted, it stops appearing on DaysLive, but copies that a third party has already made independently may continue to exist, and DaysLive cannot remove them.

Please decide what to publish on that basis. Do not submit anything to a public birthday profile that you would not want to be permanently public.

DaysLive does not sell personal data, does not rent it, and does not share it with advertisers or data brokers.

Personal data is shared only in these situations:

• publicly, where you submitted it for publication, as described in the section on public and private information;
• with the payment provider, to the limited extent needed to take and settle a payment;
• with the service providers that operate the infrastructure DaysLive runs on, which process data on the operator's behalf and under their agreements;
• where required by law, or in response to a valid legal or regulatory requirement; and
• where reasonably necessary to investigate suspected fraud or abuse, to protect the rights or safety of users or the operator, or to establish, exercise or defend a legal claim.

If the operation of DaysLive were ever transferred to another person or entity, records necessary to continue operating the service, including transaction records, could be transferred as part of that. This Privacy Policy would continue to apply to data transferred until a reader was told otherwise.

PayPal is the payment provider for DaysLive. When you reach the payment step, PayPal's checkout is loaded into the page from PayPal, and completing a payment involves interacting with PayPal directly.

Because that checkout is served by PayPal, PayPal receives technical information about your device and connection at that point, and receives the payment information you give it. PayPal acts as an independent controller for its own purposes in respect of that data.

DaysLive sends PayPal only the amount and a short description of what is being backed, and receives back the status of the payment, the identifiers PayPal issues for the transaction, and PayPal's notifications about it.

Your use of PayPal is also governed by PayPal's own terms and privacy policy, which DaysLive does not control. If you have a question about what PayPal holds about you, PayPal is the right place to ask.

DaysLive is a small service and runs on infrastructure operated by others. The providers actually used, and what each one does, are:

• Supabase — the database that stores accounts, birthday profiles, contributions and payment records, the authentication service that handles sign-in, and the storage service that holds uploaded photographs and video.
• Vercel — hosting for the website and its server-side code, delivery of pages to your browser, the scheduled job that checks payment records for problems, and the diagnostic logs those produce.
• PayPal — payment processing, as described in the previous section.
• Google — only if third-party sign-in is enabled on DaysLive and you choose to use it, in which case Google authenticates you and supplies basic account information. This was not enabled at the time of publication.

That list is complete. DaysLive does not use an analytics provider, an advertising network, a customer-messaging tool, an error-tracking service or any other processor beyond those named above.

DaysLive takes reasonable technical and organisational measures to protect personal data, described here at a level that does not help an attacker.

• Traffic to and from the site is encrypted in transit, and data is stored on managed infrastructure operated by the providers named above.
• Passwords are handled only by the authentication service and are stored hashed. DaysLive cannot read them.
• Access to data in the database is restricted by rules enforced by the database itself rather than only by application code, so records such as payment attempts and provider notifications are unreachable from a browser.
• Privileged operations are limited to a small number of narrow, single-purpose database functions, each of which validates what it is asked to do, rather than granting broad access to the underlying tables.
• Uploaded media is kept in a private location and can be reached only through temporary signed links, and only while the profile it belongs to is published.
• The contribution flow is rate limited to make automated abuse impractical.
• The payment record is treated as the authority on whether money moved: a contribution counts only once the provider has confirmed settlement to the DaysLive servers, so a manipulated browser cannot create a settled payment.
• Security-relevant headers are set on responses, and administrative credentials are held as configuration rather than in the code.

No service can promise perfect security, and this Privacy Policy does not. If DaysLive becomes aware of a personal data breach, it will act on it and will give the notifications required by law as and when the provisions requiring them apply.

If you believe you have found a security problem in DaysLive, please report it to ehsaan.suhail20@gmail.com.

DaysLive retains information for as long as reasonably necessary for the purposes described in this Privacy Policy, including operating your account, publishing what you asked to have published, processing payments, preventing fraud, maintaining security, resolving disputes, complying with law and keeping records.

This Privacy Policy does not state a fixed number of months or years, because DaysLive does not operate an automatic timed deletion of accounts, profiles or transaction records, and quoting a period that no process enforces would be inaccurate. What is described below is what actually happens.

• Account data is kept while the account exists, and until a deletion request is acted on.
• A birthday profile and its media are kept until it is deleted, as described in the next section.
• Contribution and payment records are kept as described in the section on payment and financial records.
• Abuse-prevention counters are short-lived and are automatically deleted a short time after they stop being used.
• Diagnostic logs are retained by the hosting platform for a limited period under its own retention settings and then discarded.

You can unpublish or delete a birthday profile you created from the account area at any time. Unpublishing removes it from public pages, rankings and search immediately, and stops new links to its media from being issued.

What deletion does depends on whether money has been contributed to that profile:

• if nothing has been contributed to it, the profile record is deleted outright, and its photographs and video are deleted from storage;
• if anything has been contributed to it, the profile is archived instead. Its photographs and video are deleted from storage, and it disappears from every public surface of DaysLive, but the record is retained together with the contributions that were made to it, because deleting it would destroy the other party's record of their own payment.

Archiving is one-way and cannot be undone from the account area.

At the time this Privacy Policy was published, DaysLive did not provide a self-service button to delete your whole account. To have your account deleted, email ehsaan.suhail20@gmail.com from the address associated with the account, or otherwise allow the request to be verified. Your account and its authentication record will be deleted, along with your account display name and profile picture reference, subject to the retention of transaction records described in the next section.

Deleting an account or a profile does not withdraw a contribution that has already settled and does not by itself create a right to a refund. That is dealt with in the Terms of Service and the Refund Policy.

Records of contributions and of the payments behind them are retained even where an account or a birthday profile has been deleted or archived. This includes the amount, the currency, the status, the times at which the status changed, the identifiers issued by the payment provider, refund records and the provider's notifications.

They are retained because they are needed to prove what was paid and to whom, to process or defend a refund, reversal, chargeback or dispute, to detect and investigate fraud, to reconcile the ledger against the payment provider, and to satisfy accounting and legal record-keeping obligations.

A request to delete personal data will therefore not remove a financial record where retaining it is necessary for one of those purposes or is required by law. Where a record must be retained, DaysLive will retain no more of it than is necessary for that purpose.

Subject to applicable law, and to the limits described in this Privacy Policy, you may:

• ask what personal data DaysLive holds about you and how it is being processed;
• ask for inaccurate or incomplete personal data to be corrected, completed or updated;
• ask for personal data to be deleted;
• withdraw a consent you have given, where the processing rests on that consent;
• raise a grievance about how your personal data has been handled; and
• in the case of a birthday profile or other content that concerns you, ask for it to be removed.

These rights are offered as a matter of practice now. As the corresponding provisions of India's data-protection framework commence, they also apply as a matter of law, and nothing in this Privacy Policy is intended to limit a right that cannot lawfully be limited.

Rights have limits. DaysLive may decline or partly decline a request where acting on it would prevent it from meeting a legal obligation, would destroy a record needed for a payment dispute or for fraud prevention, would affect another person's rights, or where the request cannot be verified.

Send your request to ehsaan.suhail20@gmail.com. There is no form to fill in and no account required.

To make a request easier to act on, please include:

• what you are asking for, in plain terms;
• the email address associated with your account, if you have one;
• the DaysLive page address of any birthday profile, contribution or content the request concerns; and
• anything else that helps identify the right records.

DaysLive may need to verify that a request really comes from you, or that you are authorised to make it on someone else's behalf, before acting on it. That is a protection for you: acting on an unverified deletion or disclosure request would itself be a privacy failure. Verification will be kept proportionate, and DaysLive will not demand identity documents where a simpler check will do, such as replying from the email address on the account.

DaysLive is operated by one individual and does not promise a guaranteed response time. Requests are dealt with as promptly as reasonably possible, and within any period required by applicable law once such a period is in force.

You can correct much of your information yourself. Your account display name can be changed in the account area, and the name, birthday date, description, Instagram username, photograph and video on a birthday profile you created can be edited or replaced there.

For anything you cannot change yourself, including your account email address, email ehsaan.suhail20@gmail.com and say what is wrong and what it should be.

Some information cannot be corrected because it is a record of what happened rather than a description of you. The amount, status and timing of a payment, and the notifications received from the payment provider, are examples: an error in one of those is corrected by recording the correction, not by rewriting the original record.

You may ask for personal data to be deleted by emailing ehsaan.suhail20@gmail.com, or by using the deletion controls in the account area for content you created.

When a deletion request is acted on, DaysLive deletes what it can and tells you what it is retaining and why. In practice that means content and account data are deleted, and financial records are retained to the extent described in the section on payment and financial records.

If your request concerns a birthday profile that you did not create, say so, and DaysLive will treat it as a content complaint as well as a privacy request. Content complaints and takedowns are also covered by the Terms of Service.

Removal from DaysLive does not remove copies held independently by third parties, including search-engine caches and archives. See the section on public and private information.

Where DaysLive processes personal data because you consented to it, you may withdraw that consent at any time.

In practice, the clearest way to withdraw consent to publication is to unpublish or delete the birthday profile concerned, which you can do yourself in the account area, or to ask for it by email. You may also withdraw consent by asking for your account to be deleted.

Withdrawing consent applies going forward. It does not make earlier lawful processing unlawful, it does not reverse a payment that has already settled, and it does not remove records that DaysLive must keep for the reasons described in this Privacy Policy. Withdrawing consent to processing that is necessary to operate an account will normally mean the account can no longer be provided.

If you are unhappy with how DaysLive has handled your personal data or your privacy request, raise it directly with the operator at ehsaan.suhail20@gmail.com. Grievances are handled by the operator named in section 1; DaysLive is not large enough to have a separate grievance department, and naming one that does not exist would not help you.

Please describe what happened, what you asked for, and what outcome you want. Complaints are investigated and answered as promptly as reasonably possible.

India's data-protection framework also provides for a Data Protection Board of India. At the time this Privacy Policy was published, the Board was established in law but was not yet operational and was not yet receiving complaints. Once it is operational, and as the relevant requirements become applicable, you may also be able to bring a complaint to it. Nothing in this Privacy Policy prevents you from exercising a statutory right or remedy available to you.

Two different situations have to be separated here, because DaysLive treats them differently.

Minors using DaysLive. The Terms of Service require you to be at least 18 years old to create an account or make a contribution. DaysLive is not directed at children, does not knowingly permit a person under 18 to create an account or contribute, and does not knowingly collect personal data from a child for that purpose. DaysLive does not verify age beyond that requirement, and does not collect a date of birth from account holders. If DaysLive learns that an account was created by a person under 18, it may suspend or remove the account.

Minors who are the subject of a birthday profile. A birthday profile may concern a person under 18, because a birthday page is about somebody rather than necessarily by them. Where that happens, the personal data is submitted by an adult account holder, who is required by the Terms of Service to have the authority or permission necessary to submit it and for DaysLive to display it. DaysLive does not seek out or independently collect information about children and has no way to confirm the age of a person named on a profile.

DaysLive does not use any personal data on a birthday profile for advertising, tracking or behavioural profiling, whoever the profile concerns.

If you are a parent or guardian, or a person named on a profile, and you want content concerning a minor removed, email ehsaan.suhail20@gmail.com with the page address. Requests of this kind are treated as a priority. Where a provision of applicable law imposes specific obligations regarding the processing of a child's personal data, DaysLive will comply with it as and when that provision commences.

DaysLive is operated from India, but the service providers named in this Privacy Policy are international organisations, and their infrastructure and support operations may be located outside India. Personal data processed through DaysLive may therefore be stored or otherwise processed outside India.

In particular, the database, authentication and file storage are provided by Supabase, hosting and delivery by Vercel, and payment processing by PayPal, and each of them may process data in or from countries other than India.

Where personal data is processed outside India, DaysLive relies on the arrangements and terms offered by those providers. DaysLive does not transfer personal data to a country in respect of which such a transfer has been restricted under applicable Indian law, and will comply with any such restriction that is notified and in force.

By publishing content to a public birthday page you are making it accessible from anywhere in the world, which is separate from, and additional to, the provider processing described above.

This Privacy Policy may be updated, including to reflect a change in how DaysLive works, a new service provider, or a change in the law or in the commencement of a provision of it.

When it is updated, the revised version is posted on this page with a new Last Updated date. Where a change is material, DaysLive will take reasonable steps to make it noticeable rather than relying on you to re-read the page.

Continued use of DaysLive after an update takes effect indicates that you have been informed of the updated Privacy Policy, to the extent permitted by law. Where applicable law requires fresh consent for a new purpose, DaysLive will ask for it rather than assume it.

DaysLive

Operated by: Ehsaan Abdul Sami

Country: India

Privacy requests, data-protection questions, content-removal requests, security reports and grievances:

ehsaan.suhail20@gmail.com

When you write, please include the relevant DaysLive page address where one applies, so that the request can be matched to the right records.