Documents

Privacy Policy

Effective from August 19, 2026

This Privacy Policy (the “Policy”) describes how Shareday collects, uses, stores, transfers, and otherwise processes personal data in connection with the website shareday.io, the application app.shareday.io, the invitation site builder, the personal invitation pages hosted on shareday.site subdomains, the guest response (RSVP) features, and other related services and features (together, the “Service”).

The Service is provided by the operator identified in the Terms of Service (the “Operator”). In this Policy, “Shareday”, “we”, “us”, and “our” refer to that Operator. The terms “User”, “Guest Data”, and “Customer Content” have the meanings given in the Terms of Service unless this Policy expressly provides otherwise.

We process personal data in accordance with the requirements of the law of Ukraine, including the Law of Ukraine “On Personal Data Protection”, and, where the processing is subject to European Union or United Kingdom law, in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR) and the UK GDPR.

1. Scope

This Policy applies to the processing of personal data of the following categories of individuals:

  • visitors to the shareday.io website and to public invitation sites on shareday.site subdomains;
  • individuals who create an account in the Service or use it (“Users”);
  • agencies, event planners, individuals organizing their own events, and other users of the Service;
  • individuals whose personal data has been uploaded to, or otherwise entered into, the Service by Users;
  • contractors, service providers, and other third parties whose details Users enter into the Service while preparing events;
  • individuals who access invitation pages, view them, or submit responses through the RSVP features (“Guests”).

This Policy does not apply to third-party websites, applications, software, or other services that may be accessible through links placed in the Service. We do not control those resources and are not responsible for how they process personal data. We recommend reviewing the privacy policies of the relevant third parties before using their services.

2. Our Roles in Data Processing

2.1 Data of Users and Website Visitors

For account data, Service usage data, security records, support requests, and the information needed to operate Shareday, we determine the purposes and means of the processing.

In these cases, Shareday acts as the controller of the personal data (within the meaning of both the Law of Ukraine “On Personal Data Protection” and the GDPR).

2.2 Guest Data

The User independently decides:

  • which Guests to invite;
  • what Guest Data to upload;
  • what invitation content each Guest sees;
  • what questions to ask in the RSVP form;
  • how to use the Guests’ responses.

For this Guest Data, the User is the controller, and Shareday processes the data on the User’s instructions as a processor (within the meaning of both the Law of Ukraine “On Personal Data Protection” and the GDPR) — solely to provide the Service.

The User is responsible for:

  • having a valid legal basis for processing Guest Data;
  • giving Guests the notices required by law;
  • obtaining consent where it is required;
  • limiting data collection to what is reasonably necessary for the event;
  • responding to Guests’ requests about their data;
  • avoiding excessive collection of sensitive information.

Shareday may process limited information about Guests in its own right where necessary for the security of the Service, investigating abuse, preventing fraud, complying with legal requirements, or bringing or defending legal claims.

3. What Personal Data We Process

3.1. Account Data

When an account is created, used, and administered, we may process the following categories of personal data:

  • email address and its verification status;
  • first name, last name, or other name provided by the User;
  • a cryptographic hash of the password and information related to the User’s authentication;
  • the country specified for the organization or workspace;
  • the agency logo or other image uploaded by the User;
  • account, workspace, interface language, and Service usage settings;
  • account status, account creation date, and other information needed to administer the account;
  • details of people to whom the User grants access to a workspace or to individual projects, including the invited person’s email address, assigned role, access level, and invitation status.

3.2. Customer Content

As part of providing the Service, we process information and materials that the User creates, uploads, enters, imports, or otherwise adds to the Service, including:

  • event names, descriptions, and other event details;
  • event dates, schedules, locations, and venue information;
  • invitation texts and other text content;
  • photos, images, videos, logos, brand assets, and other media files;
  • templates, themes, and other visual settings;
  • custom domain name settings;
  • content personalization rules;
  • questions, answer options, and other guest form settings;
  • event budget information, expense categories, planned and completed payments, their amounts, dates, reminders, and other related details;
  • contact details and other information about contractors, service providers, or other people the User adds to a project, including their names, contact details, the status of arrangements, and the history of interactions and payments;
  • any other materials, files, data, or settings the User uploads, creates, enters, or stores in the Service.

3.3. Guest Data and Invitation Responses

Guest Data processed in the Service may include:

  • first and last name;
  • email address, phone number, or other contact details;
  • preferred language;
  • membership of a family, household, table, category, or other guest group;
  • invitation status and access rights;
  • the Guest’s personal link or access token;
  • information about opens of the invitation page;
  • delivery information for emails sent through the Service (including the statuses: sent, delivered, bounced, spam complaint, delivery error);
  • information about opens of those emails, where the Guest’s email client automatically loads external content;
  • email opt-out status;
  • RSVP confirmations and the responses submitted through the RSVP form;
  • information about accompanying guests;
  • meal preferences;
  • food allergy information;
  • accessibility needs;
  • transportation and travel information;
  • arrival and departure times;
  • accommodation information;
  • responses to additional questions created by the User;
  • notes, messages, wishes, and other data the User chooses to collect as part of organizing the event.

Because Users can import data from spreadsheets and create their own fields and questions, the actual scope of Guest Data depends on the specific event and the settings chosen by the User.

Users must not use the Service to collect personal data that is not necessary for the lawful organization of an event — including passwords, payment details, banking information, copies of identity documents or their details, biometric data, full medical records, criminal record information, or other excessive or disproportionate information.

Information about food allergies, accessibility needs, religious dietary restrictions, and similar details may constitute special categories of personal data or allow such data to be inferred. The User must request and process such information only where a valid legal basis exists, only to the extent necessary to achieve the legitimate purpose of organizing the event, and in compliance with data protection law.

3.4. Technical and Usage Data

When the Service is used, we may automatically process technical and usage data, including:

  • IP address;
  • browser, device type, and operating system information;
  • date and time of access to the Service;
  • user session and authentication information;
  • pages viewed and Service features used;
  • actions performed in an account, workspace, or project;
  • access to invitation pages and the submission of responses through the RSVP form;
  • error logs, diagnostic logs, and security and audit logs.

To keep the Service working properly, we use essential cookies and other local data storage technologies, including Local Storage. These technologies are used solely for authentication, session management, maintaining the security of the Service, saving settings, and recording the User’s choice regarding analytics technologies.

Public invitation sites are hosted on a separate domain, shareday.site, distinct from the Service’s domain. The authentication cookies used in the User’s account are not shared with that domain: a Guest opening an invitation page does not need an account and is not authenticated.

On the website, we use analytics tools designed around data minimization and privacy protection, to analyze traffic and improve the Service.

Without the User’s consent, analytics information is collected only in anonymized form, without identifiers stored on the User’s device.

If consent is given, we may store a unique identifier in the User’s browser, used solely to count unique visitors more accurately; it is not intended for behavioral profiling or for tracking activity on third-party websites.

In the app.shareday.io application, we may use session replay technology to analyze the usability of the interface and diagnose errors. During such recording, the content of all input fields is masked automatically, and sections containing Guest Data, Guest responses, and the User’s financial figures are excluded from the recording. Session recordings are linked to an account only through the User’s internal identifier, are used solely to improve the Service, and are not used for advertising or profiling.

The User may withdraw consent at any time by changing their cookie settings, deleting the website data in their browser, or contacting us at privacy@shareday.io.

We do not use Guest Data or other personal data for behavioral advertising, building cross-site advertising profiles, or other personalized-advertising purposes.

3.5. Payment Data

Payments for the Service are processed by Paddle.

In connection with payment for the Service, we may receive from the payment provider only the information needed to confirm the payment, keep records, and provide the Service, including:

  • the payer’s email address;
  • the identifier of the payment transaction, order, or receipt;
  • the product, plan, or subscription purchased;
  • the payment amount and transaction currency;
  • the payment status;
  • information about refunds, payment disputes, or chargebacks;
  • billing or tax-related details, where the payment provider passes such data on.

Shareday does not receive, process, or store full payment card details or other sensitive payment data needed to make a payment.

Paddle processes payment data in accordance with its own terms of use and privacy policy.

3.6. Data Received Through Communications

We may process information contained in messages and other communications sent to Shareday, including:

  • support requests;
  • requests to exercise data subject rights;
  • reports of security incidents, violations of the Service’s terms of use, or possible abuse;
  • refund requests;
  • claims, legal requests, and other legally significant correspondence;
  • any other communication between a User, a Guest, or another person and Shareday.

We process this information only to the extent necessary to handle the communication, respond to it, comply with legal requirements, protect Shareday’s rights and legitimate interests, and keep the Service operating properly.

4. Purposes of Processing

We process personal data only for purposes necessary to provide, maintain, protect, and improve the Service, including to:

  • create accounts, authenticate Users, and provide access to the Service;
  • administer accounts, workspaces, and User settings;
  • operate the invitation site builder and the preview and site publishing features;
  • host and maintain invitation sites;
  • personalize content for individual Guests;
  • create, manage, and verify Guests’ personal links or access tokens;
  • send event-related emails (invitations, reminders, updates, and other messages) on the User’s instructions;
  • ensure delivery of those messages, handle opt-outs, and keep the related logs;
  • collect, store, and display invitation responses;
  • provide event management tools, data export, and other Service features;
  • connect and maintain custom domain names;
  • administer subscriptions, payments, plan validity periods, and event hosting periods;
  • keep records of transactions and other information related to providing the Service;
  • provide technical support and handle user requests;
  • handle personal data requests, legal inquiries, and security reports;
  • send notices needed to operate the account, perform the contract, maintain security, or inform about changes to the Service;
  • monitor the Service’s health and detect and fix technical errors;
  • prevent fraud, abuse, phishing, unauthorized access, and other information security threats;
  • enforce the Terms of Service and other binding rules for using the Service;
  • comply with legal requirements and binding orders of competent authorities;
  • establish, exercise, or defend Shareday’s rights and legitimate interests;
  • analyze use of the Service, assess its reliability, and improve its functionality and user experience.

Shareday does not process personal data for purposes incompatible with those listed above. In particular, Shareday:

  • does not sell Users’ or Guests’ personal data;
  • does not use Guest Data for third-party marketing purposes;
  • does not buy, sell, or otherwise commercialize personal data as a data broker;
  • does not use Customer Content or Guest Data to train artificial intelligence models.

We process personal data only where one or more legal bases provided by law apply — including under the Law of Ukraine “On Personal Data Protection” and, for individuals covered by the GDPR or the UK GDPR, the legal bases set out in those regulations.

5.1. Performance of a Contract

We process personal data where the processing is necessary to enter into a contract with the User, to perform the Terms of Service, or to take steps at the User’s request before entering into a contract.

In particular, this legal basis applies to:

  • creating and administering an account;
  • authenticating the User and providing access to the Service;
  • providing purchased or requested Service features;
  • creating, publishing, hosting, and maintaining event pages and invitation sites;
  • providing technical support;
  • administering payments, subscriptions, plan validity periods, and other transactions related to providing the Service.

5.2. Legitimate Interest

We may process personal data on the basis of our legitimate interest, provided that interest is not overridden by the rights, freedoms, and legitimate interests of the data subject.

In particular, this legal basis applies to:

  • operating, maintaining, and developing the Service;
  • ensuring the information security, stability, and reliability of the Service;
  • preventing fraud, unauthorized access, abuse, and other violations;
  • analyzing use of the Service and improving its functionality;
  • communicating with Users about matters related to their use of the Service;
  • protecting the rights, legitimate interests, and property of Shareday, Users, and Guests;
  • establishing, exercising, or defending legal claims.

We rely on this legal basis only after assessing that our legitimate interest is not overridden by the rights and fundamental freedoms of the person concerned.

Where the law requires the data subject’s consent for processing, we carry out that processing only after obtaining the consent.

In particular, consent may be the legal basis for using optional analytics technologies, sending marketing communications, or other processing where the law requires it.

The data subject may withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

We may process personal data where the processing is necessary to comply with obligations imposed on us by law.

In particular, this legal basis applies to:

  • complying with tax, accounting, and other financial legislation;
  • complying with court decisions;
  • complying with lawful demands, requests, or orders of public authorities;
  • meeting regulatory requirements;
  • meeting obligations to retain documents and other information.

The legal basis for processing Guest Data that Shareday processes on the User’s behalf and instructions is determined by the User as the controller.

6. Communications

We may send Users messages needed to provide the Service, perform the Terms of Service, maintain security, or comply with the law. Among other things, such messages may concern:

  • confirmation of account creation or of an email address;
  • password changes, authentication, and account security events;
  • payments, subscriptions, and other transactions;
  • refunds, payment disputes, or chargebacks;
  • material changes to the Service or to this Policy;
  • event hosting periods, subscription expiry, or other important events related to use of the Service;
  • support requests;
  • legal, technical, or other operational matters.

If we send marketing, promotional, or other optional messages, they will include an option to opt out of receiving them where the law requires it. Opting out of such messages does not affect messages needed to operate the account, maintain security, perform the contract, or comply with the law.

If the User uses the features for sending emails to Guests, Shareday sends event-related messages on the User’s instructions, including invitations, RSVP reminders, change notifications, and other messages defined by the User. These messages are sent using email infrastructure and domains managed by Shareday.

The User determines the content, recipients, and timing of those messages, and decides whether to use automatic reminders or other automation features.

Every email sent through Shareday includes a mechanism for opting out of further messages where this is required by law or applies to the relevant type of message.

If a Guest has opted out of messages, or if an email address has become invalid, rejects messages, or has been the subject of a spam complaint, Shareday may add that address to a suppression list within the relevant User organization or project and stop sending further messages to it.

Users may also distribute Guests’ personal links through their own communication channels, including email, messaging apps, CRM systems, or other third-party services. In that case, Shareday does not control how those channels are used and is not responsible for the personal data processing carried out by the relevant third parties.

7. Sharing Personal Data with Third Parties

We may transfer or otherwise disclose personal data to third parties only to the extent necessary to provide the Service, comply with legal requirements, or protect our rights and legitimate interests.

In particular, personal data may be shared with the following categories of recipients:

  • providers of cloud infrastructure, databases, data storage, and backup services;
  • providers of network infrastructure, content delivery (CDN), protection against network attacks, and other information security services;
  • email delivery providers, which deliver service messages as well as event messages sent on the User’s instructions;
  • providers of analytics, diagnostics, and monitoring services;
  • providers of payment, accounting, tax, and anti-fraud services, including Paddle;
  • auditors, consultants, lawyers, accountants, and other professional advisers who are bound to keep the information they receive confidential;
  • courts, law enforcement agencies, public authorities, regulators, or other competent authorities in the cases provided by law;
  • prospective or actual investors, buyers, successors, financial advisers, or other participants in a corporate restructuring, financing, merger, acquisition, or disposal of the business or its assets;
  • other parties — at the User’s direction or with the data subject’s consent, where such consent is required.

We give third parties access only to the personal data that is objectively necessary for them to perform their functions or provide the relevant services.

Certain recipients of personal data, including payment providers, may independently determine the purposes and means of processing in accordance with the law applicable to their activities and their own terms of use and privacy policies.

8. International Data Transfers

Shareday operates from Ukraine but may use service providers whose infrastructure is located in various jurisdictions to provide the Service.

As a result, personal data may be processed in, or transferred to, Ukraine, the United States, and other countries where Shareday, its affiliates, or its service providers are located. The laws of those countries may differ from the laws of the data subject’s country of residence.

Cross-border transfers of personal data are carried out in accordance with the law applicable to the relevant processing, including the Law of Ukraine “On Personal Data Protection” and, where the GDPR or the UK GDPR applies, in accordance with those regulations.

Where the law requires additional safeguards for cross-border transfers of personal data, we apply, or require the application of, appropriate legal mechanisms, including:

  • contractual commitments to ensure an adequate level of personal data protection;
  • Standard Contractual Clauses (SCCs);
  • adequacy decisions or other mechanisms recognized by competent authorities;
  • other transfer mechanisms expressly provided by applicable law.

For questions related to cross-border transfers or processing of personal data, you can contact us at privacy@shareday.io.

9. Data Retention

We keep personal data only for as long as necessary to fulfill the processing purposes set out in this Policy, unless a longer retention period is required or permitted by law. When determining retention periods, we consider the nature of the personal data, the purpose of the processing, legal requirements, and the need to maintain information security, prevent fraud, resolve disputes, and protect our rights and legitimate interests.

Approximate retention periods for particular categories of data are as follows:

  • Published events — for the paid hosting period and any purchased extensions.
  • After an event’s hosting period ends — the data is kept in read-only mode so that it can be viewed, exported, or re-published, for as long as the related account exists. An account that remains inactive for an extended period may be deleted; in that case, we send notice of the planned deletion at least 30 calendar days in advance to the email address linked to the account.
  • Events deleted by the User — removed from active use without undue delay and deleted from primary systems, as a rule, within 30 calendar days.
  • Deleted accounts — deactivated without undue delay and deleted from primary systems, as a rule, within 30 calendar days, except for data that must be kept to comply with legal requirements, maintain security, prevent fraud, keep accounting records, or protect rights and legitimate interests.
  • Backups — purged or overwritten, as a rule, within 90 calendar days after the corresponding data is deleted from primary systems.
  • Service logs — as a rule, kept for up to 90 calendar days.
  • Security logs and abuse records — as a rule, kept for up to 12 months, and longer where necessary for an investigation, litigation, or compliance with legal requirements.
  • Email suppression lists (including records of opt-outs, delivery failures, and spam complaints) — kept for as long as necessary to honor the recipient’s choice, ensure proper email delivery, and prevent unwanted messages from being sent again, including after the related event is deleted.
  • Support requests and related correspondence — as a rule, kept for up to 24 months after the request is closed.
  • Payment and transaction records and accounting documents — kept for the periods required by tax, accounting, and other applicable legislation.
  • Analytics data — kept only for as long as needed to analyze use of the Service and improve it. Aggregated or irreversibly anonymized statistics may be kept indefinitely, as they do not allow any individual to be identified.

When a published event’s hosting period ends, the event stops being publicly available. The end of public availability does not, by itself, mean the immediate deletion of the personal data related to the event if that data continues to be stored in accordance with this Policy.

10. Data Security

We implement appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and other forms of unlawful processing.

In particular, depending on the nature of the processing and the infrastructure used, we may apply the following security measures:

  • encryption of data in transit using HTTPS/TLS;
  • encryption of data at rest, where the relevant infrastructure supports it;
  • cryptographic hashing of passwords;
  • authentication and access control mechanisms;
  • restricting access to production systems and personal data on a need-to-know basis;
  • security and audit logging;
  • data backups and recovery procedures;
  • monitoring of security events, unauthorized access attempts, and other possible abuse.

Personal links that give Guests access to invitation pages may function as confidential access credentials. Users and Guests should take reasonable steps to keep them confidential and should not share such links with anyone who is not entitled to access the corresponding information.

Despite the use of modern security measures, no information system, network, or method of transmitting data over the Internet can guarantee absolute security. We therefore cannot guarantee that personal data is completely protected against every possible threat.

If you become aware of a potential vulnerability or an information security incident involving the Service, please notify us at security@shareday.io.

11. Data Subject Rights

Data subjects have the rights provided by applicable data protection law, including the Law of Ukraine “On Personal Data Protection” and, for individuals covered by the GDPR or the UK GDPR, the relevant provisions of those regulations.

Depending on the law that applies in your case, you may have the right to:

  • receive information about the processing of your personal data, its sources, the purposes of the processing, the location of the data, and the controller and processor of the personal data;
  • access your personal data;
  • have inaccurate or incomplete personal data corrected;
  • have personal data erased in the cases provided by law;
  • have the processing of your personal data restricted;
  • object to the processing of your personal data in the cases provided by law;
  • withdraw consent you previously gave to the processing of your personal data, where the processing is based on that consent;
  • receive your personal data in a structured, commonly used, machine-readable format, or have it transmitted to another controller, where the law provides that right;
  • have your personal data protected against unlawful processing, accidental loss, destruction, damage, or unauthorized access;
  • lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights, with a court, or — if you are covered by the GDPR or the UK GDPR — with the competent supervisory authority.

The User can view, change, update, or delete some of their personal data directly through the Service’s features.

Requests to exercise rights in relation to personal data controlled by Shareday can be sent to privacy@shareday.io.

Where Shareday processes Guest Data solely on a User’s behalf and instructions, requests concerning that data should be addressed to the relevant User as the controller. If we receive such a request, we may — where this does not conflict with the law — forward it to the relevant User or advise the requester to contact that User directly.

11.1. Guest Requests

Because Shareday generally acts as a processor of Guest Data, Guests are encouraged to contact, in the first instance, the event organizer or other User named in the invitation, who is the controller and determines the purposes and means of the processing.

If we receive a request directly from a Guest, we may:

  • verify the validity and substance of the request;
  • identify the User on whose behalf the relevant Guest Data is processed;
  • forward the request to that User for further handling;
  • provide the User with reasonable technical and organizational assistance in fulfilling the request, where applicable law or the terms of the Service so provide.

In the cases provided by law, or where Shareday is itself the controller of particular personal data, we may handle and fulfill the request ourselves.

Even after personal data is deleted, we may retain a limited amount of information where necessary to comply with legal requirements, maintain information security, prevent fraud, establish, exercise, or defend legal claims, or for other legitimate purposes.

12. Children’s Personal Data

Only individuals who are at least 18 years old and have the capacity to enter into contracts under applicable law may create a Shareday account.

The Service is not intended for accounts created by children, and we do not knowingly collect children’s personal data directly for the purposes of registration or use of the Service.

However, Guest Data may include information about minors where they are participants in, or guests of, an event. In those cases, the User, as the controller, is responsible for the lawfulness of collecting and processing that data, including obtaining the consent of parents or other legal representatives where the law requires it.

Users should limit the collection of children’s personal data to the information necessary for the lawful organization of the relevant event.

13. Third-Party Content and Services

Invitation pages created by Users may contain third-party content or integrations with third-party services, including:

  • links to third-party websites;
  • interactive maps;
  • videos;
  • audio content or music services;
  • embedded social media content;
  • widgets;
  • other embedded third-party services or components.

When you interact with such content, the relevant third parties may independently collect, use, or otherwise process personal data in accordance with their own terms of use and privacy policies. Shareday does not control those third parties and is not responsible for how they process personal data.

The User decides whether to use third-party content or services on their invitation pages and is responsible for complying with legal requirements, including giving data subjects the required notices and obtaining their consent where it is required.

14. Changes to This Policy

We may update this Policy from time to time in connection with changes in:

  • the Service’s functionality or capabilities;
  • our personal data processing practices;
  • applicable law;
  • information security requirements;
  • the structure or organization of our business;
  • other circumstances affecting how personal data is processed.

The current version of the Policy is published on the Shareday website together with its effective date.

If changes materially affect the rights or interests of data subjects, or if applicable law requires separate notice or consent, we will notify you of the changes and, where necessary, obtain the relevant consent in the manner provided by law.

15. Contact and Requests

For questions related to personal data processing, exercising data subject rights, or lodging complaints, you can contact us at:

We aim to acknowledge requests without undue delay and to handle them within the timeframes provided by applicable law or, where no such timeframes are set, within a reasonable time given the nature and complexity of the request.

If you believe that the processing of your personal data violates the law, you also have the right to lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights, the competent data protection authority, or another authorized body in your jurisdiction, and to use any other remedies provided by applicable law.