Privacy Policy

Last updated: 28 September 2026. Data controller: Jubelbud AS, Møllergata 6, 0179 Oslo, Norway. Org. nr. 836 329 252. Contact: VC orders contact@daymaker.com.

1. Scope

This policy describes the personal data we collect when you visit daymaker.com or use the Daymaker service, why we collect it, how we use it, and the rights you have under the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (Personopplysningsloven).

"We", "us", and "our" refer to Jubelbud AS. By using the site or placing an order, you agree to the practices described here.

2. Information we collect

We collect the following categories of personal data, directly from you and through automated means when you interact with the site:

  • Account and order information, including name, email, billing address, payment details, the message and design files you submit for your cake, and the recipient and shipping address you provide.
  • Communications, including any emails, support tickets, chat messages, voice messages, and other correspondence you send to us.
  • Device and connection data, including IP address, browser type and version, operating system, device identifiers, language settings, time zone, screen size, and approximate location derived from IP.
  • Usage and behavioural data, including pages visited, time on page, scroll depth, clicks, hover events, referral source, search queries, sessions, conversion events, and interactions with on-site features.
  • Cookies and similar technologies, including first-party and third-party cookies, pixel tags, web beacons, local storage, session storage, and software development kits used by analytics, advertising, and product partners. See section 5.
  • Inferences drawn from any of the above for personalisation, marketing, fraud prevention, and product improvement.
  • Information received from third parties, including identity verification providers, fraud-prevention vendors, advertising platforms, social networks, business partners, and publicly available sources.

3. How we use it

We use personal data, alone or in combination, to:

  • Provide, operate, fulfil, and improve the Daymaker service.
  • Process payments, prevent fraud, and meet our legal and accounting obligations.
  • Communicate with you about your orders, our service, and changes to our policies.
  • Personalise content, recommendations, and offers; measure and improve user experience; A/B test new features.
  • Conduct analytics, research, and statistical analysis to understand usage and trends.
  • Carry out marketing, remarketing, advertising, and lookalike audience targeting on our own properties and on third-party platforms (including but not limited to Meta, Google, X, LinkedIn, TikTok), and measure the effectiveness of those campaigns.
  • Build, train, and improve internal tools, including machine-learning models.
  • Establish, exercise, or defend legal claims.
  • Any other purpose disclosed to you at the point of collection or for which you have given consent.

The legal bases under GDPR Art. 6(1) are, depending on the activity, performance of a contract with you (b), compliance with a legal obligation (c), our legitimate interests in operating, securing, marketing, and improving our service (f), and where required, your consent (a).

Watch lists and gift research

A Daymaker customer can ask us to research a person they want to send a gift to, and can add that person to a watch list. For a watch list we read, on a schedule the customer chooses, what the person publishes on public professional profiles and feeds (for example LinkedIn, X, GitHub, a personal website or newsletter, a public hackathon profile), public news about their company, and the public headline on their LinkedIn profile. We read Instagram only to understand a person's interests, never to react to their private life. We do not access private accounts, we do not guess a profile that our research did not find, and we never react to posts about health, family, grief, religion, politics, identity, or a setback such as a layoff or a lawsuit; a post of the person's own about grief, health or a setback pauses the watch for that person for sixty days. From a post that is not a moment we may note an interest the person states in their own words (a book they finished, a sport they follow) so that a later gift suits them; we note nothing from a post we set aside for the reasons above. The purpose is to suggest to the customer a well-timed, relevant gift, and the legal basis is our and the customer's legitimate interest in business relationships (Art. 6(1)(f)), balanced against the fact that the data is already public and professional. We keep the posts we read for as long as the person is on a watch list and delete them when the person is removed; interests noted from them stay with the customer's research on that person until the customer deletes it. If you are on a customer's watch list and would rather not be, write to the address in section 12 and we will remove you from every list and stop reading your profiles.

Gmail, if you connect it

You can choose to connect your Gmail account to Daymaker (Moments, then Your accounts). You then give us read-only access to your mailbox through Google (the gmail.readonly permission). We cannot send, delete, label, or change anything in it. About every 15 minutes we look at conversations from the last few days that you had with people outside your organisation. Chats, spam, and mail that Gmail files under Promotions, Social, Forums, or Updates are left out before anything is read, and so are automated mail, newsletters, and threads with only your colleagues in them. For each remaining thread, the most recent messages (at most four, each cut to 1,500 characters) are sent to our AI processor, Anthropic, which tells us whether someone in the thread shared good news that is worth a gift, such as a new role, a funding round, a launch, or a new baby. We never treat grief, illness, or a setback as a reason for a gift.

We do not store the content of your email. When a thread contains such a moment, we keep a short card: who it concerns, the kind of moment, one sentence describing it, and a quote of at most 300 characters. Your teammates on the same Daymaker account can see the card's person, moment, and sentence. Only you can see the quote. For every thread we read we keep only its identifier, so that we do not read it twice. We keep your Google access token encrypted.

Daymaker's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, and notwithstanding anything else in this policy, for data we receive from your Gmail:

  • We use it only to show you gift suggestions in Daymaker.
  • We do not use it for advertising, marketing, remarketing, or building audiences, and we do not sell it.
  • We do not transfer it to anyone except the processors needed to provide this feature (our hosting and database providers, and Anthropic), where the law requires it, or as part of a merger, acquisition, or sale of assets, with notice to you.
  • We do not use it to develop, improve, or train AI or machine-learning models, ours or anyone else's.
  • Our staff do not read it unless you ask us to (for example, for support with a specific message), it is necessary for security, or the law requires it.

The legal basis is your consent (Art. 6(1)(a)), which you give by connecting and withdraw by disconnecting. For the people you correspond with, it is your and our legitimate interest in your business relationships (Art. 6(1)(f)). You can disconnect at any time from the same page. This revokes our access at Google and deletes the access we hold. You can also remove Daymaker at myaccount.google.com/permissions. To have the cards made from your email deleted, write to the address in section 12.

4. Sharing

We may share personal data with:

  • Service providers and processors that help us run the business, including payment processors (e.g. Stripe), bakery and delivery partners, hosting and infrastructure providers (e.g. Vercel, AWS, Cloudflare), email and messaging providers, customer-support tools, analytics platforms, and product-tooling vendors.
  • Advertising and marketing partners, including ad networks, social platforms, attribution and measurement providers, affiliate networks, and lookalike-audience tools. These partners may combine the data we share with data they hold to deliver and measure ads.
  • Professional advisors, including auditors, lawyers, and accountants.
  • Authorities and other parties when we believe disclosure is required by law, necessary to enforce our terms, or necessary to protect our rights, property, or safety, or that of users or the public.
  • In connection with a corporate transaction such as a merger, acquisition, financing, or sale of assets, in which case personal data may be transferred to the counterparty.
  • With your consent or at your direction, including when you ask us to share your data with a partner.

5. Cookies, analytics, and tracking

We and our partners use cookies, web beacons, pixels, SDKs, local storage, server logs, and similar technologies to operate the site, remember your preferences, measure performance, understand usage, deliver and measure marketing, and detect fraud. These technologies may be first-party (set by us) or third-party (set by our partners on our behalf).

By using the site you consent to the use of these technologies. Most browsers let you reject cookies; doing so may break parts of the service. We honour Global Privacy Control signals where required by law.

6. International transfers

Some of our processors and partners are located outside the European Economic Area, including in the United States. Where personal data is transferred internationally we rely on adequacy decisions, the EU-US Data Privacy Framework, or Standard Contractual Clauses adopted by the European Commission, with supplementary measures as appropriate.

7. Retention

We retain personal data for as long as it is needed to provide the service, operate the business, and meet our legal and accounting obligations. There is no fixed time after which data is automatically deleted.

You may request deletion at any time and we will comply, except where we are required to retain certain information (for example, to comply with the Norwegian Bookkeeping Act, to defend a legal claim, or to prevent fraud). To request deletion, see section 9.

8. Security

We use industry-standard technical and organisational measures appropriate to the sensitivity of the data, including HTTPS in transit, encryption at rest where applicable, role-based access controls, and ongoing security review. No system is perfectly secure, and we make no warranty that personal data will never be compromised.

9. Your rights

If you are in the EU, EEA, UK, or another jurisdiction with similar laws, you have the right to request access to your personal data, correction of inaccurate data, deletion (subject to the limits in section 7), restriction of processing, portability, and to object to processing based on legitimate interest. Where processing is based on consent you may withdraw that consent at any time. To exercise any of these rights, email contact@daymaker.com with the subject "Privacy Request". We will respond within the period required by applicable law.

You also have the right to lodge a complaint with your supervisory authority. In Norway that is Datatilsynet (datatilsynet.no).

10. Children

The service is not directed at children under 16 and we do not knowingly collect personal data from them.

11. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top reflects the current version. Material changes will be communicated where required by law. Continued use of the site or service after a change constitutes acceptance of the updated policy.

12. Contact

Questions or requests: contact@daymaker.com. Postal: Jubelbud AS, Møllergata 6, 0179 Oslo, Norway.