Privacy Policy

1. Introduction

the team behind JOYA ("JOYA", "we", "us") is committed to protecting the personal data of all individuals who interact with our Platform at joyers.space. This Privacy Policy explains what personal data we collect, how we use it, with whom we share it, and the rights you hold in respect of it.

This Policy is drafted in compliance with Lebanese Law No. 81 of 2018 on Electronic Transactions and Personal Data Protection, and takes into account the principles of the European General Data Protection Regulation (GDPR) to the extent applicable to our international users.

2. Data We Collect

From Vendors:

• First name, last name, and business name;
• Email address and WhatsApp number(s);
• Business description, photographs, and package details;
• Country and city of operation;
• Instagram handle and Google Business link (optional);
• Price range and starting price (optional).

From Joyers:

• First name, last name, and email address (waitlist registration);
• Event preferences and saved Vendor profiles (once the Platform launches).

Automatically collected data:

• Profile view counts, WhatsApp click counts, and save/favourite counts (aggregated analytics);
• Browser type, device type, and general geographic location derived from IP address.

3. How We Use Your Data

• To create and manage Vendor and Joyer accounts;
• To display Vendor Listings to Joyers on the Platform;
• To send transactional emails (account confirmation, approval/rejection notifications, dashboard invites);
• To send marketing communications about the Platform's launch and updates, where you have given consent;
• To provide Vendors with analytics on their Listing performance;
• To improve the Platform and detect fraudulent or prohibited activity;
• To comply with our legal obligations under Lebanese law.

4. Legal Basis for Processing

We process personal data on the following legal bases:

• Contractual necessity: to fulfil our obligations to Vendors and Joyers under our Terms of Service;
• Legitimate interests: to operate, secure, and improve the Platform;
• Consent: for marketing communications, which you may withdraw at any time;
• Legal obligation: where required by Lebanese law.

5. Data Storage and Security

Your data is stored on servers provided by Supabase (PostgreSQL-based cloud infrastructure). Supabase maintains industry-standard security measures including encryption at rest and in transit.

Transactional and marketing emails are sent via Zoho Mail. JOYA implements access controls to ensure that personal data is accessible only to authorised personnel.

While we take all reasonable precautions, no system is completely secure. In the event of a data breach that is likely to result in a risk to your rights, we will notify affected individuals as required by applicable law.

6. Data Retention

We retain personal data for as long as your account is active or as necessary to fulfil the purposes set out in this Policy. Vendor data is retained for the duration of the Vendor's active Listing plus a period of three (3) years thereafter for legal and audit purposes. Joyer waitlist data is retained until the Platform's commercial launch, after which it is migrated to active user accounts or deleted upon request.

7. Sharing of Personal Data

We do not sell, rent, or trade your personal data to third parties. We may share data with:

• Service providers: Supabase (database), Zoho (email), Netlify (hosting) — solely to operate the Platform;
• Legal authorities: where required by Lebanese law or a valid court order;
• Business transfers: in the event of a merger, acquisition, or sale of all or part of JOYA's assets, subject to confidentiality obligations.

Vendor contact information (WhatsApp number(s)) is displayed publicly on the Platform for the purpose of allowing Joyers to contact Vendors directly. Vendors acknowledge and consent to this by submitting their profile.

8. Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your personal data (the "right to be forgotten"), where no legal obligation requires us to retain it;
• Restrict processing in certain circumstances;
• Object to processing based on legitimate interests;
• Data portability — receive your data in a structured, machine-readable format;
• Withdraw consent at any time for processing based on consent, without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at hello@joyers.space. We will respond within thirty (30) days.

9. Cookies and Tracking

The Platform uses minimal tracking. We do not currently use third-party advertising cookies. We may use session cookies strictly necessary for the Platform to function (for example, to maintain login state). We may in the future introduce analytics tools; we will update this Policy and seek your consent where required before doing so.

10. Children's Privacy

The Platform is not directed at persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us immediately and we will delete it promptly.

11. International Transfers

Your data may be transferred to and processed in countries outside Lebanon (including the United States, where Supabase and Netlify infrastructure may be located). We ensure that such transfers are subject to appropriate safeguards consistent with applicable data protection law.

12. Amendments

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email and will post the updated Policy on this page with a revised effective date.

13. Contact and Complaints

For any privacy-related questions or to lodge a complaint, please contact our Data Protection contact at hello@joyers.space.

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection authority in your country of residence.