Joyala exists so grown-ups can play, not so data can be harvested. We keep what we need to run Joyala, nothing more: no ad trackers, no selling, no creepiness. Here is the whole picture.
1. Who is responsible
Joyala (KVK 97988340, Amsterdam, the Netherlands) is the "controller" in GDPR terms. Reach us any time at info@joyala.club.
2. What we collect, and why
- Your account: first name, email, password (stored hashed, we can never read it), city, birthday (day and month only: cake, not data), and your answers to the joining questions (what you loved playing as a kid, weeknights or weekends, how you heard of us). Used to run your membership and host you well. Legal basis: our contract with you.
- Your membership and payments: which plan you chose, payment status, receipts. Card numbers go directly to Stripe; we never see or store them. Legal basis: contract and legal (bookkeeping) obligations.
- Event reservations: which events you reserved or bought a ticket for, so the door list works, and which table you were seated at. Legal basis: contract.
- Booking a Taster Night without an account: first name and email only. No password, no card. We use them to hold your spot, email you the details and the venue, and let you cancel. Legal basis: the steps you asked us to take before any contract. One free Taster per email address, which is also why we remember that an address has used one.
- Optional emails about Joyala: only if you tick the box when booking. Ticking it is never required to book. Legal basis: your consent, which you can withdraw with the unsubscribe link in any of those emails, or by emailing us. Withdrawing is as easy as giving it and takes effect immediately.
- Why you left, if you delete your account: we ask one optional question. The answer is stored without your name or email: only the reason, your city, your plan and how many nights you came. It cannot be traced back to you, and it survives the deletion precisely because it is no longer personal data.
- On your device: your chosen city, your language, your sign-in session and, if you booked a Taster without an account, that booking, all live in your browser's local storage. The booking is kept on your device on purpose: it means nobody can type your email address into our website and find out where you are going. On your very first visit we ask a lookup service (ipapi.co) which city your connection is in, only to preselect your city; we don't store the result server-side. No advertising cookies, no analytics trackers.
3. Who processes it for us
We use a small set of processors, each doing one job:
| Service | What it does with your data |
|---|---|
| Memberstack | Runs member accounts: your profile, joining answers and login sessions. |
| Stripe | Handles every payment and holds your card details; sends payment receipts. |
| Airtable | Holds the events calendar, reservations, table seatings and Team enquiries. |
| Resend | Sends our emails: booking confirmations, reminders, the venue reveal and your table for the night. |
| Netlify | Hosts this website and the web app, and runs the small programs behind them. |
RSVP pages (Luma) and the community chat (WhatsApp) are optional doors you choose to walk through; their own privacy policies apply there. We share data with processors only as needed to run Joyala, and with authorities only when the law requires it. We never sell your data.
4. Cameras and photos
Photos and video may be taken at events. We always ask before pointing a camera at anyone, and you can opt out at any event, no questions asked. If a photo of you slips through anyway, one email and it's gone.
5. How long we keep things
Your account and answers: for as long as you're a member, then deleted or anonymised within 12 months. Invoices and payment records: 7 years, because Dutch tax law says so. Photos where you're recognisable: until you ask us to remove them.
Taster bookings without an account: your first name and email are kept for 12 months after the night, so the one-free-Taster rule still works and so we can answer questions about your booking. After that only the fact that the address has used its free night remains. If you asked for emails about Joyala, we keep your address until you unsubscribe, and we stop the moment you do. Why you left: kept indefinitely, but only in the anonymous form described above.
6. Your rights
GDPR gives you the full set: see your data, correct it, download it, delete it, restrict or object to processing, and withdraw consent at any time. Email info@joyala.club and we act within a month. The Delete account button in your Account runs the erasure instantly: your membership stops renewing, your account is removed, and your personal data is deleted per this policy. Not happy with us? You can complain to the Dutch supervisor, the Autoriteit Persoonsgegevens, though we'd love the chance to fix it first.
7. Changes
If this policy changes in a way that matters, members hear about it by email before it takes effect. The date at the top always tells you which version you're reading.