Privacy Policy

CakeMyDay ("we", "us", "our") is committed to protecting your personal data. This policy explains what data we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD).

1. Who we are

The data controller is CakeMyDay, operating from Barcelona, Spain. For data protection enquiries, contact us at info@cakemyday.ai.

2. Data we collect

Company & HR accounts

• ✓Company name, address, and contact details
• ✓HR admin name and email address
• ✓Hashed account password (we never store your password in plain text)
• ✓Subscription and billing information (processed by Stripe — see Section 5)

Employee data

• ✓Employee names and birthdays
• ✓Dietary preferences and allergen restrictions (where provided)
• ✓Delivery address associated with the company

Baker accounts

• ✓Business name, address, and contact details
• ✓Menu items, pricing, and availability
• ✓Hashed account password

Usage data

• ✓Log-in timestamps and IP addresses
• ✓Order history and activity logs
• ✓Browser type and operating system (for security purposes)

3. Why we collect it and our legal basis

• ✓Providing the cake ordering service (scheduling, delivery, notifications) — Performance of a contract (GDPR Art. 6(1)(b))
• ✓Processing payments and managing subscriptions — Performance of a contract (GDPR Art. 6(1)(b))
• ✓Sending order confirmations, reminders, and service emails — Performance of a contract (GDPR Art. 6(1)(b))
• ✓Preventing fraud and ensuring platform security — Legitimate interests (GDPR Art. 6(1)(f))
• ✓Retaining financial and transaction records — Legal obligation (GDPR Art. 6(1)(c))

4. Employee data and your responsibility

When you upload employee records (names, birthdays, dietary preferences) to CakeMyDay, you act as a data controller for that data and are responsible for ensuring you have a lawful basis to share it with us. We act as a data processor on your behalf for this data and will only use it to fulfil orders. We recommend informing your employees that their birthday and dietary information is used for this purpose.

5. Third-party processors

We share data only with the processors necessary to operate the service. All processors are bound by data processing agreements.

• ✓Stripe — payment processing. Card data is handled directly by Stripe and is never stored on our servers. See stripe.com/privacy.
• ✓Microsoft Azure — cloud hosting and blob storage (EU data centres). See Microsoft Privacy Statement.
• ✓Resend — transactional email delivery (order confirmations, notifications). Email addresses are shared only to deliver emails you would expect to receive.
• ✓OpenRouteService — geolocation and distance calculations used to match companies with nearby bakers. Only delivery addresses are shared, not personal names.

6. How long we keep your data

• ✓Account data: retained while your account is active. On account deletion, personal data is removed within 30 days, except where required by law.
• ✓Order and financial records: retained for 7 years to comply with Spanish tax law.
• ✓Usage logs: retained for up to 12 months for security and fraud detection, then deleted.
• ✓Employee records: deleted when removed from your account or when your account is closed.

7. Your rights

Under GDPR you have the right to:

• ✓Access the personal data we hold about you
• ✓Rectify inaccurate or incomplete data
• ✓Erase your data ("right to be forgotten"), subject to legal retention obligations
• ✓Restrict processing in certain circumstances
• ✓Data portability — receive your data in a structured, machine-readable format
• ✓Object to processing based on legitimate interests
• ✓Lodge a complaint with the Spanish Data Protection Authority (AEPD) at aepd.es

To exercise any of these rights, email us at info@cakemyday.ai. We will respond within 30 days.

8. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or via the platform. The date at the top of this page shows when it was last updated.

9. Contact

CakeMyDay · Barcelona, Spain · info@cakemyday.ai