Privacy Policy

Last updated: October 2026

1. Who We Are

Yawmak is a birthday cake subscription for companies in Lebanon. Contact: [email protected].

2. What Data We Keep

• Employees: name, birthday as month and day only (never the year), office, department, dietary needs and cake preferences. If you turn on work anniversaries, the start date. When a company shares its team link, each person enters these details themselves and agrees to them being used for their cake; we record when they agreed.
• Offices: office names, delivery addresses and delivery windows.
• Contact details: the email address of each account, and the WhatsApp number of each partner bakery.
• Quote requests: what you send through our quote form: company, name, WhatsApp number, email, city, team size and your message.
• How you found us: the ad, search engine or website that brought you to Yawmak, if any (for example "Instagram, paid, October campaign").
• Account security: passwords are stored only as a bcrypt hash, never in plain text.
• Payments: the amount, date and payment reference of each invoice. No payments are taken yet. When card payments open, you will enter your card on our payment processor's page; Yawmak never stores card numbers.
• Orders and messages: each order's history, and the WhatsApp messages exchanged with bakeries about orders.
• Cake photos and feedback: a photo of a delivered cake if the bakery sends one, shown only to the company, the bakery and the Yawmak team, and what the company tells us about each cake.

3. Why We Keep It

• Names, birthdays and offices: to book each cake and deliver it to the right office on the right day.
• Dietary needs: so the bakery makes a cake each person can eat.
• Email: to send order updates, invoices and account notices.
• Payment records: to keep accounts and answer questions about invoices.
• Quote requests: to answer you and send you a price.
• How you found us: to know which of our ads and posts work, so we spend less on the ones that do not.

4. How Long We Keep It

• Account and team data: while your account is active.
• Employee records: removed at once when you delete your account in Settings, or within 30 days of a deletion request by email.
• Payment records: 7 years, for tax and accounting.
• Quote requests: while we are in touch about them, and deleted whenever you ask.

5. Who Processes It

• Partner bakeries: only what one cake needs: the name for the cake, dietary needs, the delivery address and time.
• Supabase: our database, hosted in Frankfurt, Germany, encrypted at rest.
• Fly.io: runs the Yawmak application, in Frankfurt, Germany.
• Cloudflare: delivers our website securely, protects it from attacks, and counts visits to our website's pages without cookies (not inside the Yawmak phone app).
• Resend: sends our emails.
• Meta (WhatsApp Business): carries order messages to partner bakeries, and our chats with you when you message our WhatsApp number.
• OpenStreetMap: when you place an office on the map, the map and the address search are loaded from OpenStreetMap, and the map library from unpkg.com.

We do not sell your data to anyone.

6. Your Rights and Deletion

You can ask us to show you the data we hold, correct it, give you a copy, or delete it. Email [email protected] from your account's email address and say what you need. Company admins can also edit or remove employees at any time from the Team page, and any account can be deleted from Settings. See how to delete your account.

7. Cookies

We use a cookie to keep you signed in, and one cookie ("ysrc", kept 90 days) that remembers which ad, search engine or website brought you to Yawmak. No advertising or analytics cookies.

8. Security

All traffic is encrypted with HTTPS. Passwords are hashed with bcrypt. Our hosting provider keeps standard server logs (IP address, page requested, time) for security and troubleshooting.

9. Changes to This Policy

We will tell account holders by email if this policy changes in a material way.