JENDAYAPrivacy Policy

JENDAYA

Privacy Policy

Effective Date: 30 May 2026

Platform: JENDAYA — Fashion Week Operating System

Built by: TechAviatorLabs

1. Introduction

This Privacy Policy describes how JENDAYA ("we," "us," or "our") collects, uses, stores, and protects personal information when you access or use the JENDAYA platform ("Platform"), a private fashion week operating system built by TechAviatorLabs.

By registering for or using the Platform you acknowledge that you have read and understood this Privacy Policy. If you do not accept the practices described here you must not use the Platform.

This Privacy Policy should be read alongside the Terms & Conditions, which govern your overall use of the Platform.

2. Information We Collect

We collect the following categories of personal information:

Account and Profile Data

Full name and email address
Phone number (optional, provided at registration)
Profile avatar image (where uploaded)
Language preference
Unique QR code token (system-generated access credential)

Authentication Data

Authentication tokens and session data managed by Supabase Auth
Apple OAuth identity data (name and email, including private relay email where selected) when you sign in with Apple
Google OAuth identity data (name, email, profile image) when you sign in with Google
Access code used at onboarding and the resulting role and access tier assigned

Event and Assignment Data

Event assignments, invitation status, and seating tier
Check-in records including timestamp and check-in method (QR scan, manual, or admin)
Attendance status and attended timestamp
Coordinator assignment records

Guest Request Data

+1 guest requests including guest name, guest email, and any accompanying message
Request status, administrative response, and review timestamps

Content Uploads

Photos and videos submitted to the Platform
Captions, hashtags, and category metadata associated with uploads
File size and MIME type
Upload status (pending, approved, rejected)

Mission and Campaign Data

Mission submission records and points awarded
Campaign participation history

Referral Data

Referral attribution linking a referred user to their referrer
Referral codes used at registration

Operational and Technical Data

Audit logs recording administrative actions (actor, action type, resource affected, IP address, timestamp)
Application event logs (QR scan attempts, check-in events, upload events, authentication errors)
Engineering logs recording application-level errors and diagnostics
IP address associated with certain authenticated requests

3. How We Use Information

We use the personal information described above for the following purposes:

To create and manage your account, authenticate your identity, and assign your role and access tier
To generate and validate your personal QR credential for event entry
To manage event assignments, check-ins, and attendance records
To process and review +1 guest requests
To receive, store, moderate, and display your uploaded content within the Platform
To operate missions, campaigns, and the associated points system
To track referral attribution for platform growth purposes
To maintain audit and application logs for security, accountability, and platform reliability
To diagnose and fix technical issues
To enforce the Terms & Conditions and protect the rights of users, staff, and brand partners
To comply with applicable legal obligations

4. Authentication and Account Data

4.1

Supabase Auth.Authentication is handled by Supabase, a third-party infrastructure provider. When you sign in, Supabase manages session tokens, refresh tokens, and related credential data. Your use of Supabase-backed authentication is subject to Supabase's own privacy practices.

4.2

Apple and Google OAuth.If you sign in using Apple, Apple may transmit your name and email address, including a private relay email address if you choose to hide your email. If you sign in using Google, Google transmits your name, email address, and profile image to us as part of the OAuth flow. We store the email address and name in your JENDAYA profile. We do not retain Apple or Google OAuth tokens beyond the session.

4.3

Access Codes.Your access code is consumed and its length is recorded in diagnostic logs. The actual code value is redacted from all application logs. The resulting role and access tier assigned to your account are retained as part of your profile.

4.4

Profile Data.Your name, email, phone number (if provided), avatar, language preference, and role are stored in your user profile. You can update your profile information within the Platform settings.

4.5

Account Deletion.You can initiate account deletion from Profile or Settings. Account deletion removes your personal profile data and authentication account. Historical operational records may be retained only after personal identifiers are removed where needed for event integrity, abuse prevention, security, or legal compliance.

5. Event Participation Data

5.1

We record which events you have been assigned to, your assignment status (invited, confirmed, scheduled, active, declined, waitlisted), your seating tier, and any coordinator notes associated with your assignment.

5.2

Event assignment data is visible to JENDAYA coordinators, managers, and administrators within their designated platform views. It is not shared publicly.

5.3

Import records — including the filename, row count, and status of bulk user, event, or assignment imports — are retained for operational audit purposes. Import data is accessible only to administrators.

6. QR Credentials and Check-In Data

6.1

A unique QR code token is generated for your account at registration and stored securely. This token is the sole authoritative credential for event entry. It is cryptographically random and not derived from any personal information.

6.2

Each time your QR code is scanned at an event, a check-in record is created containing your user ID, the event ID, the timestamp, the check-in method (QR scan, manual, or admin), and the identity of the JENDAYA representative who performed the check-in. QR scan attempts and check-in outcomes are also recorded in application event logs.

6.3

Check-in records are retained as part of the attendance history for each event and are accessible to coordinators, managers, and administrators.

7. User Content and Uploads

7.1

Storage.Photos and videos you upload are stored in Supabase Storage, a cloud object storage service. We store the storage path, public media URL, file size, MIME type, and the metadata you provide (caption, hashtags, category).

7.2

Moderation.All uploaded content is reviewed by JENDAYA administrators before it is made available within the Platform. Content remains in a pending state until approved. Rejected content is retained in our records for accountability purposes but is not displayed.

7.3

Signed URLs.Private media is served using time-limited, cryptographically signed URLs generated by Supabase Storage. These URLs expire automatically and are tied to your authorised session. You must not share signed URLs with unauthorised parties.

7.4

Visibility.Approved content may be displayed to other authorised Platform users in designated sections of the Platform in accordance with Platform settings. Pending and rejected content is visible only to you and JENDAYA administrators.

7.5

Recovery Records.Interrupted or failed uploads may create a temporary recovery record containing the storage path, MIME type, file size, and metadata. Recovery records are automatically resolved once the upload is recovered or confirmed failed.

8. Guest Requests and Event Access

8.1

When you submit a +1 guest request you provide the guest's name, guest's email address, and an optional message. This information is stored and made available to the JENDAYA coordinators and administrators who review your request.

8.2

Guest names and email addresses submitted in +1 requests are used solely to process your request. We do not create accounts for guests or contact guests unless separately required to fulfil their access.

8.3

Request review records — including who reviewed the request, the administrative response, and the review timestamp — are retained as part of the event operations record.

9. Administrative Audit Logs

9.1

JENDAYA maintains audit logs of all significant administrative actions performed within the Platform. Each audit log entry records: the administrator who performed the action, the action type, the resource type and resource ID affected, relevant metadata, the IP address from which the action was performed, and the timestamp.

9.2

Audit logs are accessible only to users with the DEVELOPER role. They are maintained for security monitoring, compliance, and accountability purposes.

9.3

Application event logs record system-level events such as QR scan attempts, check-in outcomes, upload events, authentication errors, and referral creation. These logs may reference user IDs and event IDs but are used exclusively for operational diagnostics and are not disclosed externally.

10. Data Sharing and Third Parties

10.1

No Sale of Personal Data.JENDAYA does not sell, rent, or trade your personal information to any third party.

10.2

Infrastructure Providers.We use the following third-party infrastructure providers to operate the Platform. These providers process personal data solely on our behalf and in accordance with our instructions:

Supabase — database, authentication, and storage
Vercel — hosting and serverless compute
Apple — OAuth authentication (when used)
Google — OAuth authentication (when used)

10.3

Brand Partners.Event data associated with brand partner events may be visible to authorised JENDAYA staff managing those events. We do not share personal user data directly with brand partners without your knowledge.

10.4

Legal Requirements.We may disclose personal information if required to do so by law, court order, or regulatory authority, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of JENDAYA, its users, or others.

11. Data Retention

11.1

We retain your account data for as long as your account remains active. If you request account deletion, we will remove your personal profile data subject to the exceptions in clause 11.2.

11.2

Certain data may be retained after account deletion where required for legitimate purposes including: audit logs required for security or compliance, event attendance records that form part of the operational record, and data required to honour legal obligations or resolve disputes.

11.3

Application and engineering logs are retained for a limited operational period and are subject to periodic review.

12. Security Measures

12.1

Access to the Platform is role-based. Users may only access data and features permitted by their assigned role. Role assignments are controlled by JENDAYA administrators.

12.2

Row-level security policies are enforced at the database layer. API routes validate authenticated session tokens on every request before returning any data.

12.3

Private media is served via time-limited signed URLs. Media files are not publicly accessible by URL without a valid signed token.

12.4

All administrative actions are logged with actor identity and IP address. Access code values are redacted from diagnostic logs.

12.5

While we implement industry-standard security measures, no system is entirely immune to risk. We cannot guarantee absolute security of data transmitted over the internet.

13. User Rights

Subject to applicable law, you have the following rights regarding your personal data:

Access — you may request a copy of the personal data we hold about you
Correction — you may request correction of inaccurate or incomplete personal data
Deletion — you may request deletion of your account and personal data, subject to the retention exceptions in Section 11
Restriction — you may request that we limit how we process your data in certain circumstances
Objection — you may object to certain processing activities where permitted by applicable law

To exercise any of these rights, please contact the JENDAYA team through the Platform or using the contact details in Section 17. We will respond to verified requests within a reasonable timeframe.

14. International Users

JENDAYA is operated from the United Kingdom. If you access the Platform from outside the UK or European Economic Area, your personal data may be transferred to and processed in jurisdictions whose data protection laws differ from those in your country. By using the Platform you consent to such transfers in accordance with this Privacy Policy.

Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards such as standard contractual clauses or the adequacy decisions of relevant authorities.

15. Children's Privacy

The Platform is intended for users who are at least 18 years of age. We do not knowingly collect personal information from individuals under 18. If you believe we have inadvertently collected information from a minor, please contact us immediately at the details in Section 17 so that we may delete that information.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When material changes are made, the updated policy will be posted on the Platform with a revised effective date. Your continued use of the Platform after any update constitutes your acceptance of the revised Privacy Policy. If you do not accept the revised policy, you must cease using the Platform.

17. Contact Information

For questions about this Privacy Policy, to exercise your data rights, or to report a privacy concern, please contact the JENDAYA team through the Platform or reach out directly to JENDAYA. You may also submit data requests by emailing legal@jendaya.com.

JENDAYA

Terms & Conditions·Privacy Policy·Built by TechAviatorLabs · Effective 30 May 2026

I have read and understood the JENDAYA Privacy Policy

Effective 30 May 2026

JENDAYA

JENDAYAPrivacy Policy

JENDAYA

Privacy Policy

Effective Date: 30 May 2026

Platform: JENDAYA — Fashion Week Operating System

Built by: TechAviatorLabs

1. Introduction

By registering for or using the Platform you acknowledge that you have read and understood this Privacy Policy. If you do not accept the practices described here you must not use the Platform.

This Privacy Policy should be read alongside the Terms & Conditions, which govern your overall use of the Platform.

2. Information We Collect

We collect the following categories of personal information:

Account and Profile Data

Full name and email address
Phone number (optional, provided at registration)
Profile avatar image (where uploaded)
Language preference
Unique QR code token (system-generated access credential)

Authentication Data

Authentication tokens and session data managed by Supabase Auth
Apple OAuth identity data (name and email, including private relay email where selected) when you sign in with Apple
Google OAuth identity data (name, email, profile image) when you sign in with Google
Access code used at onboarding and the resulting role and access tier assigned

Event and Assignment Data

Event assignments, invitation status, and seating tier
Check-in records including timestamp and check-in method (QR scan, manual, or admin)
Attendance status and attended timestamp
Coordinator assignment records

Guest Request Data

+1 guest requests including guest name, guest email, and any accompanying message
Request status, administrative response, and review timestamps

Content Uploads

Photos and videos submitted to the Platform
Captions, hashtags, and category metadata associated with uploads
File size and MIME type
Upload status (pending, approved, rejected)

Mission and Campaign Data

Mission submission records and points awarded
Campaign participation history

Referral Data

Referral attribution linking a referred user to their referrer
Referral codes used at registration

Operational and Technical Data

Audit logs recording administrative actions (actor, action type, resource affected, IP address, timestamp)
Application event logs (QR scan attempts, check-in events, upload events, authentication errors)
Engineering logs recording application-level errors and diagnostics
IP address associated with certain authenticated requests

3. How We Use Information

We use the personal information described above for the following purposes:

To create and manage your account, authenticate your identity, and assign your role and access tier
To generate and validate your personal QR credential for event entry
To manage event assignments, check-ins, and attendance records
To process and review +1 guest requests
To receive, store, moderate, and display your uploaded content within the Platform
To operate missions, campaigns, and the associated points system
To track referral attribution for platform growth purposes
To maintain audit and application logs for security, accountability, and platform reliability
To diagnose and fix technical issues
To enforce the Terms & Conditions and protect the rights of users, staff, and brand partners
To comply with applicable legal obligations

4. Authentication and Account Data

4.1

4.2

4.3

4.4

Profile Data.Your name, email, phone number (if provided), avatar, language preference, and role are stored in your user profile. You can update your profile information within the Platform settings.

4.5

5. Event Participation Data

5.1

5.2

Event assignment data is visible to JENDAYA coordinators, managers, and administrators within their designated platform views. It is not shared publicly.

5.3

6. QR Credentials and Check-In Data

6.1

6.2

6.3

Check-in records are retained as part of the attendance history for each event and are accessible to coordinators, managers, and administrators.

7. User Content and Uploads

7.1

7.2

7.3

7.4

7.5

8. Guest Requests and Event Access

8.1

8.2

8.3

Request review records — including who reviewed the request, the administrative response, and the review timestamp — are retained as part of the event operations record.

9. Administrative Audit Logs

9.1

9.2

Audit logs are accessible only to users with the DEVELOPER role. They are maintained for security monitoring, compliance, and accountability purposes.

9.3

10. Data Sharing and Third Parties

10.1

No Sale of Personal Data.JENDAYA does not sell, rent, or trade your personal information to any third party.

10.2

Supabase — database, authentication, and storage
Vercel — hosting and serverless compute
Apple — OAuth authentication (when used)
Google — OAuth authentication (when used)

10.3

10.4

11. Data Retention

11.1

We retain your account data for as long as your account remains active. If you request account deletion, we will remove your personal profile data subject to the exceptions in clause 11.2.

11.2

11.3

Application and engineering logs are retained for a limited operational period and are subject to periodic review.

12. Security Measures

12.1

Access to the Platform is role-based. Users may only access data and features permitted by their assigned role. Role assignments are controlled by JENDAYA administrators.

12.2

Row-level security policies are enforced at the database layer. API routes validate authenticated session tokens on every request before returning any data.

12.3

Private media is served via time-limited signed URLs. Media files are not publicly accessible by URL without a valid signed token.

12.4

All administrative actions are logged with actor identity and IP address. Access code values are redacted from diagnostic logs.

12.5

While we implement industry-standard security measures, no system is entirely immune to risk. We cannot guarantee absolute security of data transmitted over the internet.

13. User Rights

Subject to applicable law, you have the following rights regarding your personal data:

Access — you may request a copy of the personal data we hold about you
Correction — you may request correction of inaccurate or incomplete personal data
Deletion — you may request deletion of your account and personal data, subject to the retention exceptions in Section 11
Restriction — you may request that we limit how we process your data in certain circumstances
Objection — you may object to certain processing activities where permitted by applicable law

To exercise any of these rights, please contact the JENDAYA team through the Platform or using the contact details in Section 17. We will respond to verified requests within a reasonable timeframe.

14. International Users

Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards such as standard contractual clauses or the adequacy decisions of relevant authorities.

15. Children's Privacy

16. Changes to This Privacy Policy

17. Contact Information

JENDAYA

Terms & Conditions·Privacy Policy·Built by TechAviatorLabs · Effective 30 May 2026

I have read and understood the JENDAYA Privacy Policy

Effective 30 May 2026