Chaya
Privacy Policy
Effective date: 8 October 2026
This policy explains which personal data we process when you use Chaya, why we process it, and what your rights are. It has been prepared in accordance with the EU General Data Protection Regulation (GDPR). We do not sell your data and we do not use it for advertising.
2.1 Controller
AYSANTE LLC, 7901 4th St N, Ste 27289, St. Petersburg, FL 33702, USA. Contact: info@aysante.com
As we do not have an establishment in the EU, our EU representative under Article 27 GDPR is: Tolga Kaya (info@aysante.com, +49 151 72147326). You can also contact our representative about data protection matters.
2.2 What data we process and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email, phone number, date of birth | Creating your account, sending login codes, checking you are 18+ | Performance of contract (Art. 6(1) (b)) | Until your account is deleted; deleted immediately when your account is deleted |
| Profile photos, university, interests, city | Showing your profile to other users, suggestions in Discover | Performance of contract (Art. 6(1) (b)) | Until you delete them or your account is deleted; deleted immediately when your account is deleted |
| Student certificate, letter of admission or ID card | Approving your account, "Verified student" badge | Performance of contract (Art. 6(1) (b)) | Deleted immediately once your account is approved or rejected; only the approval result and date are kept |
| Approximate location | Showing you to your friends on the map at neighbourhood level, showing students near you in Discover | Consent (Art. 6(1) (a)); you can withdraw it at any time | Only your latest location is kept and it is overwritten each time it is shared; deleted when ghost mode is turned on and when your account is deleted. Discover and the map do not use locations older than 24 hours. No location history is kept |
| Messages with friends | Chat service | Performance of contract (Art. 6(1) (b)) | Until your account is deleted; deleted immediately when your account is deleted. The other person's copy remains in their account |
| Non-permanent matches and their chats | Random matching and getting to know each other | Performance of contract (Art. 6(1) (b)) | Automatically deleted after 24 hours |
| Events (title, location, time, participants) | Organising and joining events | Performance of contract (Art. 6(1) (b)) | Until the organiser deletes the event or the account is deleted |
| Game history, scores, Çay balance, friendships | Running the games and the Çay system, showing statistics on your profile | Performance of contract (Art. 6(1) (b)) | Until your account is deleted; deleted immediately when your account is deleted |
| Invite code and number of invited users | Granting invite rewards (Çay) | Performance of contract (Art. 6(1) (b)) | Until your account is deleted |
| Reports, chat excerpts in reports, moderation decisions, administrator action log | Protecting users, detecting repeated abuse, evidence in legal claims, DSA obligations | Legitimate interest (Art. 6(1) (f)) and legal obligation (Art. 6(1)(c)) | 2 years, then deleted automatically |
| Device information, IP address, error logs | Security, fraud prevention, troubleshooting | Legitimate interest (Art. 6(1) (f)) | Up to 90 days in system logs |
| Notification device token | Push notifications | Consent (Art. 6(1) (a), your device's notification permission) | Until you log out or uninstall the app |
We do not ask for sensitive data (ethnic origin, religion, health, etc.). Information you choose to share on your profile is visible to everyone; please think before sharing it.
2.3 Who can see your profile
- Your profile (name, photos, university, interests, game statistics) is visible to other Chaya users.
- In a random opponent match, your opponent sees your profile when the game ends.
- Only your friends can see your approximate location; while ghost mode is on, nobody can.
2.4 Who we share data with
We share your data only with the service providers needed to run the Service, and wherever possible under a data processing agreement (DPA):
| Provider | Purpose | Server location |
|---|---|---|
| Supabase (infrastructure: Amazon Web Services) | Database, login system, photo and document storage, server functions | Frankfurt, Germany (EU) |
| Resend | Login code emails (noreply@chayapp.com) | Ireland (EU) |
| Google Firebase Cloud Messaging (Google LLC) | Push notifications | USA |
| Apple Push Notification service (Apple Inc.) | Delivering notifications to iPhones | USA |
| OpenFreeMap (Hyperknot Software Kft., Hungary) / OpenStreetMap | Map images; your IP address reaches this provider when map tiles are requested, your location is not sent | Operator in the EU (Hungary); server location not disclosed, may be served worldwide via the Cloudflare CDN |
Data in backup copies is deleted when the backup retention period expires (at the latest after 30 days).
We may share data with competent authorities where required by law (for example, a court order).
2.5 Transfers of data to the USA
Chaya is a US company. Your data is primarily stored on servers in the EU, but our team in the USA and some of our providers can access it. We protect these transfers with the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework certification. You can request a copy of these safeguards at info@aysante.com.
2.6 Your rights
Under the GDPR you have the following rights; to exercise them, write to info@aysante.com. We will reply within one month at the latest.
- Access to your data and a copy of it (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure (Art. 17) — you can also close your account yourself via Settings > Delete account
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Objection to processing based on legitimate interest (Art. 21)
- Withdrawal of consent at any time (Art. 7(3)) — for example by turning off location permission or notifications
- Lodging a complaint with a data protection supervisory authority (Art. 77) — for example, in Bavaria the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), or the authority in your country of residence
2.7 Automated decisions
Suggestions in Discover and random game matches are generated automatically based on city, university and interests. These suggestions are not decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22). Decisions to restrict accounts are made or reviewed by a human.
2.8 Age limit
Chaya is not open to people under 18. If we become aware of an account belonging to someone under 18, we will close it and delete their data.
2.9 Security
We protect your data with encryption in transit (TLS), access restrictions and regular backups. Only team members who need access for their work can access your data. If a data breach occurs, we will inform the authorities and, where necessary, you within the statutory deadlines.
2.10 Changes
If we make significant changes to this policy, we will notify you in the app.