Privacy Policy

HAFLAH ("the Service"), operated by Sykari LLC ("we", "us", or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application.

By using the Service, you agree to the collection and use of information in accordance with this policy.

Account Information: When you create an account, we collect your email address and password. If you sign in via Google, we receive your name and email from Google.

Profile Information: You may optionally provide your first name, last name, date of birth, phone number, city, country, and a short bio.

Event Data: When you create or participate in events, we collect event details (name, date, venue, capacity), guest lists, member names, ticket allocations, and check-in records.

Usage Data: We automatically collect information about how you access and use the Service, including your browser type, device type, IP address, pages visited, and timestamps.

Design Gallery Data: When you use the design preview features available at myhaflah.com/designs, whether or not you hold an account, we collect the information you enter into those features, which may include an event name, the name of a host, an event date and time, and location details, together with records of your interactions with that page, such as the designs you view, the searches and filters you apply, the pages you browse, and the duration of your visit. This information is associated with an identifier stored on your device and, should you subsequently create an account, with that account. We process it to provide the preview features, to transfer the information you entered into event creation at your direction, and to analyze and improve our designs and the Service.

Cookies and Local Storage: We use browser cookies and local storage to maintain your session, remember your language preference, and store your cookie consent choice.

We use the information we collect to:

• Provide, operate, and maintain the Service
• Authenticate your identity and manage your account
• Process event creation, guest registration, RSVP responses, dish coordination, and QR code check-ins
• Send transactional communications (e.g., ticket request approvals)
• Improve, personalize, and expand the Service
• Monitor and analyze usage trends and preferences
• Detect, prevent, and address technical issues or fraud

Beyond the core event data described above, the Service collects data from the RSVP and dish board features. We treat all of it as the host's data — they decide what to do with it, we just store and serve it.

RSVP responses (attending / maybe / declined / not yet answered) are stored at both the household level (one invite) and the named-member level when the host or guest provides member names. Per-member RSVPs are visible to the host of the event and to the inviter on the household's own invite page. Other guests may see overall counts (e.g. "3 of 5 going"), never another guest's individual answer.

Dish board data — dish name, dietary tags, the category it's in, and which guest brought it — is visible to everyone on the event's invite. We do not share it outside that event. Hosts can soft-remove dishes; removed dishes are hidden from guests but retained in the host's history (see below).

Hosts have access to a per-event history view that captures dish board changes (added, renamed, recategorized, dietary changes, removed, restored) with timestamps and the actor's name or email. This audit log exists so hosts can answer "who changed what." It is visible only to the host (and admins for support). Entries are kept for the lifetime of the event row; deleting the event removes them.

When a host deletes an event, all related rows — guests, members, dishes, dish categories, RSVP statuses, and the dish history — are deleted with it via cascading foreign keys. Backups follow the same retention schedule as the rest of our data (see Data Retention).

Photos guests add to an event are seen only by the guest who added them, the host, co-hosts the host allows to manage photos, and people the host sends a photos-only link to. Other guests never see them.

On an event split into two sides, a family with people on both sides may be able to switch between the two sides' guestbook notes, if the host allows it. When someone switches to the other side's notes, we record who did it and when, and the host can see that record.

We do not sell, rent, or trade your personal information to third parties. We may share information in the following circumstances:

• With Event Hosts: When you register as a guest for an event, the host and their co-hosts can see your name, ticket status, and check-in status.
• With Service Providers: We use third-party services to operate the platform, including Supabase (database and authentication), Vercel (hosting), Google (OAuth authentication), Resend (transactional email), and Stripe (payment processing). These providers have access to your information only to perform services on our behalf and are contractually obligated to protect it.
• Legal Requirements: We may disclose your information if required by law, regulation, legal process, or governmental request.
• Event Links: An event can have its own link name (such as name.myhaflah.com). Anyone who has or guesses an event's link name can open that event's invitation.

Your data is stored securely using Supabase, which uses PostgreSQL databases with encryption at rest and in transit. We implement Row Level Security (RLS) policies to ensure users can only access data they are authorized to view.

HAFLAH staff may view your account and event information, including guest lists and messages, when needed to provide support, fix problems, or keep HAFLAH safe and secure. Staff cannot change your event while viewing it, and we keep an internal record of these views.

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

In the event of a security incident affecting your personal data, we will notify you and any applicable regulators without undue delay and in accordance with applicable law.

Essential Cookies: We use essential cookies to maintain your authentication session. These are necessary for the Service to function.

Preference Storage: We use browser local storage to remember your language preference, cookie consent choice, and cached profile data for faster page loads.

Analytics: We collect usage data to understand how people use the Service. Usage data includes your approximate location (your city, worked out from your IP address), your device and browser, the pages you visit and the page that referred you to us. If you sign up for an account later, it is linked to your account. We use it for support, security and improving the Service.

You can manage your cookie preferences at any time using the "Cookie Preferences" link in the footer of every page.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate personal data
• Request deletion of your personal data
• Object to or restrict the processing of your personal data
• Request portability of your personal data
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at the email address below. We will respond within the timeframe required by applicable law.

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the rights described in Section 8 above (access, deletion, correction, and portability), as well as the right to know what categories of personal information we collect, why, and to whom we disclose it.

We do not sell or share your personal information for cross-context behavioral advertising, and we have not done so in the preceding twelve (12) months. We will not retaliate against you for exercising any CCPA right.

To submit a CCPA request, email legal@myhaflah.com from the email associated with your account or include sufficient information to verify your identity.

The following supplemental notices apply to users resident in the listed countries, in addition to the rights described in Section 8 above.

United Kingdom (UK GDPR)

If you are in the United Kingdom, our processing of your personal data is governed by the UK General Data Protection Regulation and the Data Protection Act 2018. Our lawful basis is (a) contract — to provide the Service to you; (b) legitimate interests — to operate, secure, and improve the Service; and (c) consent — for any optional marketing communications.

You have the right to access, rectify, erase, restrict processing of, port, and object to processing of your personal data, and to withdraw consent at any time without affecting the lawfulness of prior processing. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk.

Canada (PIPEDA)

If you are in Canada, our handling of your personal information is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. We collect, use, and disclose your personal information only with your knowledge and consent, except where authorized or required by law.

You have the right to request access to and correction of your personal information, and to challenge our compliance with PIPEDA. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca.

Australia (Privacy Act 1988)

If you are in Australia, our handling of your personal information is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We collect personal information only by lawful and fair means, use it only for the purposes for which it was collected (and related purposes you would reasonably expect), and disclose it only as described in this Policy.

You have the right to access and correct your personal information and to make a complaint about our handling of it. Complaints should first be directed to legal@myhaflah.com; if not resolved, you may complain to the Office of the Australian Information Commissioner at https://www.oaic.gov.au.

United Arab Emirates (PDPL)

If you are in the United Arab Emirates, our processing of your personal data is subject to Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). We process personal data only for legitimate purposes disclosed in this Policy and apply appropriate technical and organizational safeguards.

You have the right to request access to, correction or deletion of, and restriction of processing of your personal data. Personal data is transferred to and stored on servers in the United States as described in our "International Data Transfers" section below; you consent to that transfer when you use the Service. To exercise your PDPL rights, email legal@myhaflah.com.

We retain your personal information for as long as your account is active or as needed to provide the Service. Event data (guest lists, RSVPs, check-in records) is kept until the host deletes the event or their account; we do not delete it automatically after the event date. Unfinished event drafts that were never saved to an account are deleted automatically. Payment records are retained as required by tax and accounting laws (typically seven years). You may request deletion of your account and associated data at any time, subject to retention obligations described above.

The Service is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will take steps to delete it promptly.

Your information may be transferred to and maintained on servers located outside of your country of residence, including in the United States where Sykari LLC operates. By using the Service, you consent to the transfer of your information to countries that may have different data protection laws than your jurisdiction.

If a host turns on song requests for an event, guests who are attending can suggest songs by title and artist and upvote other guests' suggestions. Each request and upvote is stored with that guest's entry on the event. The host can see the requests; other guests see the song, the artist and the number of upvotes, but not who asked. HAFLAH does not connect to any music service and does not send song requests outside the Service.

Song requests and upvotes are kept for the life of the event and are deleted when the event is deleted.

If a host adds a raffle, we store its prizes (including any photo the host adds), the host's settings, who left the raffle, and each draw: who won, their name at that moment, the time, how many entries it was drawn from, and whether the prize was collected or the draw was stopped or redrawn. We also store when the host agreed to the raffle terms. Entries are worked out from the guest list at the moment of each draw; we don't keep a separate list of entrants.

Cheers are counted per raffle and per prize, not stored per person. The number of people watching is counted from screens that are open, using a random code that isn't linked to anyone, and forgotten within a minute. Your sound setting stays on your device.

Other guests see a winner's first name and the first letter of their last name (for example "Sara H."), and the live draw spins through the first names of people in the draw. The host, and co-hosts allowed to run the raffle, see the winner's full name, their party and their check-in time. The person who replied for a party sees results for people in their party. Draws appear in the host's event activity. We never publish raffle results outside the event, and we never use them for marketing.

We send an alert when a raffle starts, when you or someone in your party wins, and when the host asks you to name your guests, following your notification settings.

Raffle data is kept for the life of the event and deleted with it. Leaving a raffle removes you from future draws; past results stay on the event's record. If you delete your account, your name in past results is replaced with "A guest".

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date and, where appropriate, communicated by email or in-app notice. Continued use of the Service after changes constitutes acceptance of the revised policy.

This Privacy Policy may be offered in several languages. If a translation conflicts with the English version, the English version controls.

If you have any questions about this Privacy Policy or our data practices, or to submit a privacy or CCPA request, please contact us at:

Sykari LLC
Email: legal@myhaflah.com