Skip to content

Privacy Policy — BirthdayDeals mobile app

Last updated: 14-10-2026

This policy covers the mobile app specifically. For the website, see our general privacy policy.

1. Who we are

BirthdayDeals offers free birthday deals through a website and a mobile app. BirthdayDeals is a service of Jasny BV, Johan Huizingalaan 763a, 1066 VH Amsterdam, the Netherlands. Jasny BV is the controller for the data described in this policy.

Privacy contact: privacy@birthdaydeals.eu. Other questions: support@birthdaydeals.eu.

2. What data we collect

When you create an account

  • Name — for personalisation and how we address you (required)
  • Email address — to sign in and communicate with you (required)
  • Date of birth — the core function: showing deals around your birthday, and checking your age (required, also when you sign in with Apple or Google)
  • Country and city — to show deals in your region (required)
  • Language preference — to show the app in the right language
  • Consent of a parent or guardian — only for users aged 13 to 15: that consent was confirmed, the time (recorded by our server) and the version of the text under which it was given, and whether it was recorded by the user themselves or by an administrator
  • Acceptance of the terms and privacy policy — that you accepted them, the time (recorded by our server) and the version of the terms; when you register with email you accept them with the required checkbox, and when you sign in with Apple or Google, right after your first sign-in
  • Sign in with Apple or Google — if you choose this, Apple or Google sends us your email address and, if you share it, your name

Automatically while using the app, when you are signed in (diagnostic, first party)

  • Device model, make, operating system and version — for support and troubleshooting
  • App version, language, time zone and screen size — to display the app correctly
  • Network type (wifi or mobile), battery status and memory class — to diagnose performance and loading issues. This is a snapshot, not continuous tracking
  • How often the app was opened and when you were last active — for support
  • A device identifier provided by the operating system (the "identifier for vendor" on iOS, the Android ID on Android) — to recognise your device for support and to prevent duplicate registrations. This identifier cannot be linked to other apps and is not an advertising ID
  • On Android: how the app was installed (the install referrer) — to see which link or campaign brought you to us

Push notifications

The app only asks for permission to send notifications after an explanation screen has told you what they are for. If you give permission, we link an Expo push token to your account. In the app you choose per type of notification:

  • Birthday reminders — on by default
  • Offers and promotions — off by default; we only send them if you switch them on yourself

If you switch off both birthday reminders and offers and promotions, we delete the push tokens of your account and the push token of this device, even if it was still linked to a previous account on this device.

Activity in the app

  • Deals you viewed — for more relevant recommendations
  • When you open and close the app (session length), linked to a session ID — to understand how the app is used
  • Interests you choose — so you see suitable deals
  • Claimed deals and their voucher or claim codes — to redeem your gifts on location
  • Wishlists you create — if you share a list, anyone with the link can view it
  • Your birthday calendar and your party — the names, birthdays and relationship of people you add yourself, and the details and guest list of your party. Only add people you know are happy with this
  • Your personal invite link and the number of friends and businesses that signed up through it. Chances and the grand prize campaign run only on the website; the app does not show them

Reports

If you report a deal or a shared wishlist, we store who made the report (your account), the category, any explanation you give and the time — to assess reports and prevent abuse.

Blocking

If you block a business or the owner of a shared wishlist, we store that choice with your account (for a wishlist, also the title of the list at that moment) so that the app no longer shows that content. You can see and lift blocks under Settings → Blocked; they are also removed when you delete your account. The business or list owner is not shown that you blocked them.

If you represent a business

Your role at the business, the business details, the deals and deal photos you enter and the claim codes you scan. Deals are checked automatically when submitted (for prohibited words and alcohol) and then reviewed by an administrator. The app only uses the camera while you scan a claim code, and your photo library only when you pick a photo yourself.

Crash and performance data

When the app crashes we automatically send technical error data (via Sentry) to improve the app. Personal data is filtered out as far as possible before it is sent. This contains no messages or passwords.

What we do not collect

No precise GPS location, no advertising ID, no access to your contacts and no access to your device's calendar. We do not track you across other companies' apps or websites.

3. Using the app without an account

You can browse public deals and gift inspiration without an account. No Supabase user account is created for this. Personal features — claiming deals, wishlists and birthday details — require you to register or sign in. We never sell this data and never share it with advertisers.

4. Purposes, legal bases and recipients

What for, and on which legal basis (GDPR Art. 6)

  • Your account and the app's features (showing and claiming deals, wishlists, birthday calendar, party, business features) — performance of our contract with you (Art. 6(1)(b))
  • Consent of a parent or guardian for users aged 13 to 15 — required under Art. 8 GDPR
  • Push notifications about your birthday — performance of the contract, and only after your device has asked for your permission
  • Push notifications with offers and promotions — your consent (Art. 6(1)(a)), which you give in the app by switching them on
  • Diagnostics, crash reports, usage statistics and security — our legitimate interest in a stable, secure app (Art. 6(1)(f))
  • Fraud prevention after account deletion — our legitimate interest in preventing abuse of the free birthday deals (Art. 6(1)(f))
  • Moderating deals, checking shared wishlists for prohibited terms, blocking and handling reports — our legitimate interest in a safe platform (Art. 6(1)(f))
  • Invoices and payment data of businesses — legal obligation (tax record-keeping, Art. 6(1)(c))

Processors and other recipients

  • Supabase (database, sign-in and file storage, EU) — storage of your account and data
  • Vercel (hosting of the website and the server functions the app uses, EU) — for example to send notifications and to dissolve a business
  • Sentry (crash reporting) — technical error data
  • Expo (650 Industries) — delivers app updates (at start-up the app checks for an update; Expo receives your IP address and technical app details) and forwards push notifications to Apple and Google
  • Apple and Google — deliver push notifications (Apple Push Notification service and Firebase Cloud Messaging). If you sign in with Apple or Google, they process your data as independent controllers under their own privacy policies; if you delete your account, we revoke your Apple connection with Apple
  • Resend (email) — sign-in, confirmation and support emails
  • Brevo (email) — birthday emails and, if you signed up for them, newsletters
  • FlagCDN (flagcdn.com) — flag images in the language picker; this service receives your IP address, as with any image loaded from the internet
  • Stripe (payments) — only for businesses with a paid plan
  • Cloudflare Turnstile and Upstash — bot and abuse protection on the deletion form on the website: Cloudflare checks that you are not a bot, Upstash counts requests per IP address and email address
  • Participating businesses — only see that you claimed a deal (name and deal) when you redeem it on location; no other data

We never sell your data to third parties. An up-to-date list of our processors is available at /info/processors.

Transfers outside the EEA

Some of these parties are based in the United States or may process data there (including Sentry, Expo, Apple, Google, Resend, Cloudflare and Upstash). For such transfers we rely on the safeguards the GDPR provides: the EU-US Data Privacy Framework, where the recipient is certified under it, and otherwise the European Commission's standard contractual clauses. On request we will tell you which safeguard applies to each party.

5. How long we keep data

  • Account and activity: as long as your account is active. On deletion, your account is made unusable immediately and your profile and login details are erased. Your favourites, viewed deals, device details and push tokens are deleted.
  • Fraud prevention after deletion: to prevent someone from deleting their account and registering again to bypass the free-claim cooldown, we keep a copy of your account details on deletion, in restricted storage that only administrators can access. That copy contains: your email address, name, date of birth, country and city, the link to your profile photo, your language preference, your chances balance (from the campaign on the website) and referral code, the date your account was created, technical details of your devices (such as model, operating system and app version), your claim history including voucher codes, your favourite deals and the deals you viewed.
  • Retention of that copy: 12 months after deletion by default. Administrators can change this period, with a minimum of 6 months. Once the period has passed, the copy becomes eligible for permanent deletion.
  • Children under 13: if, after signing up with Apple or Google, you enter a date of birth that makes you younger than 13, we first ask whether that date is correct. If you confirm, your account is deleted immediately and we keep no copy in the restricted storage. If full deletion is not technically possible, we make the account unusable and erase your name, date of birth, phone number, profile photo and email address; other profile details, such as country, city and language preference, then remain in the unusable account. For an Apple account we also try to revoke the connection with Apple. Automatic deletion is not possible if you have already claimed deals or brought in other people through your invite link, if your account has no stored date of birth and is older than 7 days, if a different date of birth is stored, or for a business or administrator account; in that case, please contact customer service.
  • Employees and co-owners of a business: when you delete your account, you are unlinked from the business in the same step. The business itself remains.
  • Last owner of a business: you first transfer ownership to another representative, or you dissolve the business. On dissolution all deals go offline (archived), team members are unlinked and pending invitations revoked, and running Stripe subscriptions are cancelled; the link with Stripe is archived and kept for our records, and the customer record at Stripe itself remains. A business can only be dissolved once no money is outstanding (such as payouts, refunds, chargebacks, unpaid invoices or running paid promotions). From the business profile we erase the email address, phone number, address, postcode, website, description, logo, banner, photos, social media, opening hours, IBAN, account holder and notification preferences; the logo, business photos and deal photos are removed from storage.
  • Tax records: for a dissolved business we keep the business name, the business name used in its web address, the Chamber of Commerce and VAT numbers, country, city, category and plan details (with the status inactive and the date of dissolution), as well as invoices (with a snapshot of the business details), payouts, orders and commissions. We keep this data for at least 7 years because of the statutory tax retention obligation; it is not cleaned up automatically.
  • Reports: as long as needed to handle them and to account for moderation decisions. If you delete your account, your reports about deals are deleted and your account is unlinked from reports about wishlists.
  • Security logs: a few months, solely for fraud detection.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, including objection to processing based on our legitimate interest (GDPR). You can view and correct your data directly in the app.

You can delete your account in three ways:

  • in the app under Settings (for all accounts; BirthdayDeals' last super administrator must first make someone else a super administrator);
  • on the website, in your account settings;
  • without signing in via /account-verwijderen: you receive a verification email with a link that is valid for 48 hours, after which we handle your request as a support request.

You can withdraw consent at any time, without affecting processing that has already taken place. Switch push notifications off with the switches in the app or in your device settings. For other consents, email us.

Questions or a request? Email privacy@birthdaydeals.eu. We respond within one month.

Complaints: if you are not satisfied with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the data protection authority in your own country.

7. Children

The minimum age for an account is 13. If you are 13, 14 or 15, you need the consent of a parent or guardian; you confirm this with a checkbox at registration, and we record when that happened. Our server checks this, not just the app. If an existing account of a user aged 13 to 15 does not yet have that confirmation, we may ask you to tick the checkbox before you can claim deals or use other account features such as wishlists. When you sign in with Apple or Google we always ask for your date of birth; anyone who turns out to be younger than 13 does not get an account. As long as that confirmation is missing, or if you are younger than 13, we send no birthday email, no birthday push notification and no push notifications with offers and promotions.

8. Changes

We may update this policy. The date at the top shows the most recent change.