This Privacy Policy explains what personal data Wayfolio collects, why we collect it, who we share it with, and the choices you have. Wayfolio is operated by Seth Phat, an individual trading as Wayfolio. We are the data controller for the personal data described here. You can reach us at [email protected].
1. What we collect
Information you give us
- Account details: your name, email address and password. We store passwords only as a secure hash, never in plain text.
- Google sign-in: if you sign up or sign in with Google, we receive your name, email address and profile picture from Google. We don't get your Google password.
- Profile and blog: your blog name, subdomain, profile picture, short bio, home country, and your site and page settings.
- Your content: the travel logs, blog posts, pages, photos and other content you create, including drafts.
- Messages: what you send us when you contact support.
Billing information
Payments are handled by Paddle, our Merchant of Record. Paddle collects your payment details and billing address. We never see or store your full card number. From Paddle, we receive your customer ID, subscription status, plan and billing dates so we can switch Pro features on and off.
Information collected automatically
- Technical data: your IP address, browser and device type, and the pages you request. We keep this in server logs to run, secure and debug the Service.
- Cookies: see the Cookies section below.
Visitors to Wayfolio blogs
When someone reads a blog hosted on Wayfolio, our servers process their IP address and browser details to deliver the page and protect against abuse. For Pro blogs, we turn these visits into aggregated statistics, such as page views, referring sites and approximate country, for the blog's owner. We don't use visitor data for advertising, and we don't sell it.
2. How we use your data
- To provide the Service: creating your account, hosting and showing your blog, and enforcing plan limits. Our legal basis is performance of our contract with you.
- To send you account emails: password reset codes, subscription confirmations and important notices about the Service. Our legal basis is performance of our contract.
- To keep the Service safe and working: preventing fraud and abuse, fixing bugs and improving features. Our legal basis is our legitimate interest in running a secure, reliable service.
- To meet legal obligations: for example, responding to lawful requests from authorities.
We don't sell your personal data, and we don't use it for third-party advertising.
3. Who we share it with
We share personal data only with service providers that help us run Wayfolio, and only as much as they need:
- Paddle, which processes payments, taxes, invoices and refunds as our Merchant of Record.
- Hosting and storage providers, which run our servers, database and file storage for your photos.
- Email delivery providers, which send account and notification emails.
- Google, if you choose to sign in with Google.
We may also disclose data if the law requires it, to protect the rights and safety of our users or the public, or as part of a sale or reorganization of the Service. If that happens, we will tell you and this policy will continue to apply.
4. Cookies
Wayfolio uses only the cookies it needs to work. These include a session cookie that keeps you signed in, and a security cookie that protects forms. When you open checkout or manage your subscription, Paddle may set its own cookies, as described in Paddle's Privacy Policy. We don't use advertising or tracking cookies.
5. How long we keep it
- We keep your account and content for as long as your account is open.
- When you delete your account, we delete your profile, blog, content and uploaded files right away. Copies in backups are removed within 30 days.
- Server logs are kept for up to 90 days.
- Paddle keeps billing and tax records for as long as the law requires.
6. Your rights
Depending on where you live, including under the GDPR and UK GDPR, you have the right to access, correct, delete or export your personal data. You can also object to or restrict how we use it, and withdraw consent where we rely on it. You can update most of your information yourself in Settings, and you can delete your account from Settings → Account. For anything else, email [email protected]. We will reply within 30 days. You also have the right to complain to your local data protection authority.
7. International transfers
Our service providers may process data in countries other than your own. When we transfer personal data outside the EEA or the UK, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses.
8. Security
We protect your data with encryption in transit (HTTPS), hashed passwords and limited access to production systems. No system is completely secure, so please use a strong, unique password.
9. Children
Wayfolio isn't intended for anyone under 16. We don't knowingly collect personal data from children. If you think a child has given us their data, contact us and we will delete it.
10. Changes to this policy
We may update this policy from time to time. If a change is significant, we will tell you by email or in the dashboard before it takes effect.
11. Contact
Questions about your privacy? Email us at [email protected].