01Who is responsible for your data
The data controller is Dasyt, tax ID 18-54455128P, Online office, Spain. Contact: privacy@dasyt.com.
For any privacy question, write to us at privacy@dasyt.com.
02What data we collect
- Account data: email address, username, display name, password (stored only as a hash), and your language and theme preferences.
- Sign in with Google: if you choose it, the name, email address and profile picture that Google shares with us.
- Profile and social data: profile photo, bio, titles and cosmetics, followers and following, the Crews you create or join, duels, reactions and boosts.
- Activity data: goals, life areas, difficulty, completions, XP, levels, streaks and streak pauses, Daily Chest rewards, journal entries, time capsules, insights and Weekly Wrapped recaps.
- Purchase data: your plan, billing history and Sparks transactions. Card details are handled by our payment provider and never reach our servers.
- Technical data: IP address, device and browser type, time zone, app version, security and error logs, and the tokens that keep you signed in.
- Communications: messages you send to our support team and your notification settings.
We do not ask for special categories of data, such as health information. Some goals may relate to your health or wellbeing: if you choose to record such details, we process them only to provide the Service to you, based on your explicit consent, which you can withdraw at any time by editing or deleting that content.
03Why we use it, and on what legal basis
- To provide Dasyt (your account, goals, XP, streaks, Crews, duels and Plus): performance of our contract with you (Art. 6(1)(b) GDPR).
- To keep Dasyt safe by preventing fraud, cheating, abuse and security incidents: our legitimate interest in protecting users and the Service (Art. 6(1)(f) GDPR).
- To improve Dasyt using aggregated or pseudonymised usage statistics: our legitimate interest in understanding how features are used (Art. 6(1)(f) GDPR).
- To send service messages such as security alerts, receipts and important changes: performance of our contract and compliance with legal obligations.
- To send news and offers, only if you opt in: your consent (Art. 6(1)(a) GDPR and Art. 21 LSSI-CE). You can unsubscribe at any time.
- To comply with the law, for example keeping invoices or answering authorities: legal obligation (Art. 6(1)(c) GDPR).
Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time. The insights and coaching tips in Dasyt are generated automatically from your activity to help you; they do not produce legal effects or similarly significant effects on you.
05Where your data is stored
Dasyt’s servers are located in Europe, and your personal data is stored in the European Union.
We choose providers that process data within the European Economic Area (EEA). If a provider ever needs to access data from outside the EEA, for example for technical support, we make sure the transfer is covered by a European Commission adequacy decision or by Standard Contractual Clauses with additional safeguards (Chapter V GDPR). You can ask us for a copy of these safeguards.
06How long we keep it
- Account and activity data: while your account is active. When you delete your account, we delete or anonymise it within 30 days.
- Backups: overwritten on a rolling basis within 35 days.
- Security logs: up to 90 days, unless needed to investigate an incident.
- Invoices and purchase records: 6 years, as required by Article 30 of the Spanish Commercial Code, or longer where tax law requires it.
- Marketing preferences: until you withdraw your consent.
07Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, and to withdraw your consent at any time without affecting processing carried out before.
You can edit your profile and settings, or delete your account, directly in the app. For anything else, including a copy of your data, write to privacy@dasyt.com. We will reply within one month and may ask you to confirm your identity.
Under Article 96 of the LOPDGDD, the heirs of a deceased user may ask us to access, rectify or delete their data, unless the user expressly prohibited it.
If you believe we have not handled your data properly, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or with the supervisory authority of your EU country of residence.
08Children
Dasyt is not intended for children under 14. In Spain, people aged 14 or over can consent to the processing of their data (Art. 7 LOPDGDD); other EU countries may set a higher age. If we learn that we hold data of a child below the applicable age without the consent of a parent or guardian, we will delete it.
10How we protect your data
We encrypt data in transit (HTTPS/TLS), store passwords only as salted hashes, limit access to personal data to the people who need it, and review our security measures regularly. If a personal data breach is likely to put your rights at risk, we will notify you and the supervisory authority as required by law.
11Changes to this policy
We will publish any changes on this page and update the date above. If a change is significant, we will also notify you by email or in the app before it applies.
12Contact
Questions about your privacy? Write to privacy@dasyt.com or to Dasyt, Online office, Spain.