Privacy policy for AYA
Your trust is important to us. Here we describe what data we collect, how we use it, and your rights under GDPR.
Last updated: 8 September 2026 · Avira Apps ApS · CVR 46212738
What we collect
Account email (for login and receipts), the alias or name you choose for a product, GPS location when scanned (from the finder only, never from the child), and device information for push notifications. We do not require a phone number to activate a wristband or name label. If you provide a phone number at checkout, for delivery, or as a luggage callback number, we store it to fulfil the order.
How we use data
We use your data exclusively to deliver the AYA service: email login, push notifications when scanned, showing the finder's location on a map, and order processing via Stripe.
GPS data
GPS location is collected ONLY from the finder (the person scanning the QR code) — never from your child. The location is used to show you exactly where your child is. GPS data is automatically deleted after 30 days.
Cookies
We use only strictly necessary cookies: aya_sid (session), NEXT_LOCALE (language preference) and Stripe payment cookies. No tracking, no advertising cookies. See our cookie policy for details.
Third parties
We share data with the following third parties:
• Twilio — SMS delivery where still used
• Stripe — payment processing
• MobilePay (via Stripe) — Danish mobile payment
• Sentry — error tracking and performance monitoring
• Hetzner — hosting
• Upstash — Redis cache and rate limiting
• Stalwart SMTP — transactional emails (receipts, notifications)
Analytics run cookieless on our own servers. We never sell your data.
Data retention
Most scan logs and GPS data are deleted automatically after 30 days (the activation point and last-known location per product are kept). Wristband aliases are anonymised 30 days after expiry; labels and luggage keep the name you chose. An account email is kept for as long as the account is active. You can request deletion at any time.
Your rights
Under GDPR you have the right to: access your data, rectification, erasure, data portability, restriction of processing and objection. Contact us via the support page to exercise your rights.
Children's data
We only store the child's first name — never surname, photos or other personal information. The child never interacts with AYA directly. All data is managed by the parent.
Changes
We may update this policy from time to time. Significant changes will be communicated by email or on the website. The latest version is always available on this page.