Privacy Policy

Last Updated: December 18, 2023

Introduction

YayDay is committed to explaining how we gather and use your information, keeping it secure and handling it in accordance with our legal obligations.  This Privacy Policy (“Policy”) is designed to help you understand how we use your data. It also explains your rights and choices. 

This Policy applies to these services (which we call the “Services” in this Policy):

• the YayDay website at com;
• our social media pages; and
• anywhere else we gather information about you and refer to this Policy.

How we handle your information depends on which Services you use, and how you use them.  This Policy is grouped into these sections:

about us and this Policy;

information we collect and how we use it;

when we disclose information to others; and

your rights and controls. 

We encourage you to read this Policy carefully.  If you have questions, please contact us.

About us and this Policy

Who we are

Four Thousand Weeks, LLC operates the Services and is referred to in this Policy as “YayDay”, “we”, “our” and “us”.  This Policy supplements and is governed by our Terms of Service (“Terms”).  Capitalized terms that are used but not defined in this Policy are defined in our Terms.  The Terms describe how the Services works in general, and establishes a contract between you and us governing your use of the Services.

Contact us

If you have any questions or feedback about this Policy, contact us on our support page, at team@myyayday.com or PO Box 7671 Chatsworth Ave. Larchmont, NY 10538.

When this Policy applies

This Policy applies to you when you use the Services, effective as of the Last Updated date above.  However, some collection and use of information falls outside this Policy:

• Third-party services: Outside Materials (as defined in our Terms) are not part of the Services, so this Policy doesn’t apply to any information you may exchange with providers of Outside Materials or other third parties.  If you follow a link to a third-party website, your use of that website is governed by that website’s privacy policy, and is not covered by this Policy.
• Our personnel: If you are a current or former employee or contractor of ours, this Policy does not apply to you. Reach out to your human-resources partner or supervisor with any inquiries about your personal information.
• When we don’t control your information: If we receive your information in our role as a service provider to another business, our agreement with that business governs our use of your information.  We will refer any questions or concerns of yours to that business.

Because the Services changes often, this Policy may change over time.  Anytime we modify the Policy, we will post a revised version on the Services and update the Last Updated date .  If YayDay is going to use your personal information in a manner materially different from that stated at the time of collection, we will notify you before the material changes take effect, so you have time to review them.  We will notify you via email (if you have given us your email), by posting a notice on the Services and/or by any other means to the extent required by law.

We encourage you to review the Last Updated date periodically to ensure you’re aware of the current Policy.   By using or accessing the Services, you signify that you have read, understand and agree to be bound by this Policy and the Terms. 

Location-specific sections

The Services operate from the United States, but this Policy applies worldwide.  Our practices generally do not differ based on your location, but your rights and choices depend in part on the law where you live. 

As a result, certain sections of this Policy apply to you only if you reside in a particular location: 

• Residents of California and other U.S. states with data privacy laws should consult the Rights under U.S. state laws If you reside in a U.S. jurisdiction that has enacted a data privacy law similar to CCPA or GDPR, we extend the same rights CCPA grants to California residents to you, except where we specify otherwise. 
• Residents of jurisdictions where GDPR applies – such as U.K., EU and Swiss residents – should consult the Rights under GDPR and International Data Transfers

If a location-specific section applies to you, those sections override any contrary descriptions elsewhere in the Policy as they relate to you.  If you have questions about your rights under other data privacy laws, please contact us. 

Information we collect and how we use it

The table below describes, in a comprehensive manner, the types of personal information that we may collect when you use the Services, whether provided by you, a third party or automatically as you use the Services.

Before you review the comprehensive table, here’s a summary of (1) information you may provide and (2) information about you we may collect from third parties.

Information you provide

• Necessary information: To provide you with many of our Services, we need some of your personal information.  Without it, we may not be able to provide all services requested.  For example, your personal information is necessary to establish an Account or make a purchase. 
• Sensitive info: We ask that you not provide us with any sensitive personal information, whether in your Customer Data, Your Content or in your other interactions with us.  If you provide sensitive personal information to us, we use it only for our operational business purposes, and we do not disclose it to others for any other purpose.  We attempt to limit the amount of sensitive personal information we collect.  For instance, if you make a purchase through our Services, your payment information, like your full credit card number and any payment-related security information, is only collected and processed our payment processor.

Information we receive from others

• Via cookies and similar technology

We and third party partners collect personal information on the Services using cookies, pixel tags or similar technologies.  Our third party partners, such as analytics and advertising partners, may use these technologies to collect information about your online activities over time and across different services.  We may use both session cookies (which are deleted from your device when you exit the Services) and persistent cookies (which remain on your device for longer or until you delete them manually).  We may also receive information about you from our advertising partners where Forever Voices ads are published on a partner’s service (in which case they may pass along details on a campaign’s success).  Finally, we may infer new information from other data we collect, including using automated means to generate information about your likely preferences or other characteristics (“inferences”).

 

What we collect	How we use it	Why we process it	Legal basis	Retention
Account Data – info you provide when creating an Account	We collect, analyze, process, and store your Account data.	To create and maintain an Account at your direction.	» Account & Profile Data is processed as part of performance of a contract.	Account lifetime, or as applicable law requires
⤷ Contact information – among Customer Data, like your name, email address, phone number	We collect, process and store the contact information you provide.  When we create a Profile may contain contact information.  We associate your phone number with your Account or Profile when you place calls to interact with our Personas	To send you marketing and transactional emails, and to send you reminders. To create an Account at your direction. We do not use Contact information for personalized ads	» Transactional emails are sent as part of performance of a contract. » Marketing communications are sent only if you consent.	Account lifetime
⤷ Commercial information – your purchases of paid Services and payment-related information	We store records of how you buy paid Services, which you buy and truncated information about your payment method	To provide our paid Services to you and ensure valid payment, including through our Payment Processor.	» Performance of a contract with you when you buy paid Services.	Account lifetime, or longer, when required by law or our compliance policies
Activity data – Products you interact with, and when and for how long the activity occurred, including account-related metadata (such as logs of when your account is created, how long you use the Services)	We collect, analyze, process, and store activity data via automated means.	For fraud prevention. To improve our Services. We do not share Activity data for personalized ads.	» our legitimate interests in understanding how users interact with and use our Services; and keeping our Services safe and secure. » Activity data is monitored to prevent malicious and fraudulent activity and unauthorized use on our Services as part of performance of a contract.	Periodically deleted in the ordinary course, or Account lifetime, if associated with an Account
Device and visit information – IP address, device identifiers, user agent, browser identifiers, times of visit, entry and exit paths.	We collect, process and store your device information and visit information when you visit our websites or connect with our apps.  We do not collect precise location information.	For personalized ads.  For fraud prevention.   To administer your account.	» our legitimate interests in keeping our Services safe and secure and to provide a valid and relevant service to our users.	For no more than two (2) years, or Account lifetime, if associated with an Account
Feedback and satisfaction data – including ratings and text feedback on how we can improve our services.	We process, monitor, review, store, and analyze such content, including via automated means.	To improve our Services and ensure your satisfaction.	» our legitimate interest in operating, managing, and improving our Services and services.	Account lifetime

Security

We and the Services implement technical, administrative and physical security measures to protect your information from unauthorized access, use or disclosure. Still, no data transmission over the Internet is 100% secure, so we cannot promise that your information will remain absolutely secure in all circumstances.  You provide information at your own risk.  We are not responsible for the circumvention by any other party of any privacy settings or security measures we use or provide.

Purposes

We rely on the following purposes to collect and use your information as described in this Policy:

• Commercial purposes: At times, we process your information to advance your economic interests or our economic interests. These purposes include performing the contract that you have with us, as embodied by our Terms, which advance our economic interests and yours.  For instance, if you order products from us, we use your information to complete your payment and provide your product to you. 
• Business purposes: Most often, we process your information for operational reasons, in a reasonably necessary and proportionate manner (i.e., for business purposes under CCPA). For instance, we analyze users’ behavior on our services to continuously improve our offerings, we suggest offers we think might interest you and promote our own services, we process information to help keep our members safe and we process data where necessary to enforce our rights, assist law enforcement and enable us to defend ourselves in the event of a legal action.
• Comply with applicable laws and regulations: We also process your information for purpose 6 above where it is necessary for us to comply with applicable laws and regulations and evidence our compliance with applicable laws and regulations. For example, we retain traffic data and data about transactions in line with our accounting, tax and other statutory data retention obligations and to be able to respond to valid access requests from law enforcement. 
• Consent: From time to time, we may ask for your consent to collect specific information, such as your precise geolocation, or use your information for specific reasons, like messaging your email address or phone number for direct marketing purposes. In general, you may withdraw your consent by changing your settings (such as browser or device settings) or following instructions provided with information we send you on a consent basis (such as clicking ‘unsubscribe’ in any email or replying ‘STOP’ to any text we send you).  You may always withdraw your consent at any time – just contact us.

Our disclosures of information to others

This section describes how and why we exchange personal information with contractors and third parties.  It also describes exchanges made for certain purposes, like advertising, legal reasons and consensual direct marketing.  We may also disclose deidentified and/or anonymized data for these purposes.

Functional disclosures

In addition to the use of trackers described above, we contract with companies or individuals to provide certain services related to the functionality and features of the Services, including payment processing, email and hosting services, software development, shipping and fulfillment, data management, and administration of contests and other promotions.  We refer to them as “contractors.” 

We may disclose information about you, such as Personal Identifiers, Commercial Information, Internet Activity and Device Information, to contractors as necessary for them to perform their services.  Contractors are not permitted to use information about you for any other purpose.  In the past twelve (12) months, we have disclosed these types of information to the following types of contractors:

• Analytics providers, namely Google Analytics and Shopify, to tell us how the Services is doing, such as which parts interest visitors and how long they visit before leaving. Among other data, they may receive your IP address.
• Payment providers, namely Shopify Payments and PayPal, to process payments between you and us, such as for subscriptions or products. These providers receive information about your order in order to tie your payment process to your order.  We don’t receive all of the information you may provide to them as part of that process (for instance, we don’t receive full payment-account numbers).
• Support providers, namely Gorgias and Klaviyo, to provide assistance to you when you request it. They are able to retrieve information about you that is relevant and necessary to your requests, such as account information and order details.

For personalized ads

We share information with advertising partners to make the advertising presented to you more relevant to you.  We also market the Services to you through ads facilitated by marketing vendors. 

• For example, we use Shopify Audiences to create audience lists, which may include information about you if you have visited myyayday.com or interacted with our advertising. Shopify and its advertising partners use cookies or unique device identifiers, in combination with their own data, to show you ads based on your visits to our webpages and to other sites.
• We try to limit how our third-party advertising technology vendors use information they collect from you. Most providers require us to enter contracts that allow them to optimize their ad services and products.  Essentially, they combine any information they may gather about you through our Services with information they receive from their other clients.  This helps them target ads to you on behalf of their other clients, not just us.

In the past twelve months, we have shared these categories of personal information with third parties to personalize advertising:

• Device Information (including Personal Identifiers)
• Commercial Information
• Internet Activity
• Geolocation

For legal reasons

Finally, we may disclose personal information:

• In response to subpoenas, court orders, or other legal process; to establish or exercise our legal rights; to defend against legal claims; or as otherwise required by law. In such cases we reserve the right to raise or waive any legal objection or right available to us;
• When we believe it is appropriate to investigate, prevent, or take action regarding illegal or suspected illegal activities; to protect and defend the rights, property, or safety of our company, our users, or others; and in connection with the enforcement of our Terms and other agreements; or
• In connection with a corporate transaction, such as a divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy.

With your consent or at your request

We may periodically ask for your consent to disclose your information to third parties.  Whenever we ask your consent for this reason, we will summarize the purpose and scope of the disclosure.  For example, we may offer discounts to you if you consent to join our mailing list or participate in a promotion involving direct marketing communications. 

• In those cases, the Services will display a tickbox near an email-entry field explaining that by submitting your information, you agree to share your email with the content provider.
• To be clear, we only exchange information about you with third parties for direct marketing purposes if you opt in, and will only do so until you opt out.

How long we retain your information

We retain your information only as long as we need it for the purposes described under Information we collect and how we use it, except when longer retention is required by our compliance policies and efforts toward applicable legal, tax, accounting and regulatory requirements. 

How long we need information for those purposes varies by category, and even within categories.  These retention determinations always consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from its unauthorized use or disclosure, whether we can achieve those purposes without using the personal information.

For example, we delete some Internet Activity at some soon as you exit the Services, whereas we may retain records of your orders for services and products for several years as required by law or contract, such as agreements with our payment processors or under our accounting standards.    

Your rights

In General

As a user of the Services, you have rights and choices about your personal information.  We want you to be in control of your information, so we want to remind you of the following options and tools available to you:

• Content opt-outs: you may opt-out of any newsletters or promotional communications from us by following the unsubscribe instructions in the communication you receive.  We may continue to send you communications regarding the Services, such as notices about administrative updates, transaction reports, and changes to the Services, this Policy or the Terms.
• Exercising rights: If any of the location-specific rights listed below apply to you, see Requesting information.
• Disallowing Location Data Collection. You may change your location sharing settings at the browser or device level at any time.
• Personalized ads: For more about targeted advertising, and how to opt out with your specific browser and device, go to the DAA Webchoices Browser Check and NAI Opt Out of Interest-Based Advertising. You can download the AppChoices app to opt out in mobile apps.

Rights under GDPR

This section applies to you only if you reside in a jurisdiction where GDPR applies. 

For GDPR purposes, the data controller is Four Thousand Weeks, LLC at PO Box 7671 Chatsworth Ave. Larchmont, NY 10538. 

Lawful bases

If we are aware that you reside in a GDPR jurisdiction, we only collect, use or share information about you when we have a valid reason. This is called a ‘lawful basis.’ Our lawful bases generally map to the Purposes above, but specifically include:

• The consent you provide to us at the point of collection of your information
• The performance of the contract we have with you
• The compliance of a legal obligation to which we are subject, or
• The legitimate interests of Four Thousand Weeks, LLC or a third party.

We have a legitimate interest in gathering and processing personal data, for example: (1) to ensure that our networks and information are secure; (2) to administer and generally conduct our business; (3) to prevent fraud; and (4) to conduct our marketing activities.

GDPR Rights

Depending on your jurisdiction’s enactment of GDPR, you may have these rights:

• Request access (commonly known as a ‘data subject access request’). This enables you to receive a copy of the personal data we hold about you.
• Request correction. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure. This enables you to ask us to delete or remove personal data where there is no good reason for us to continue to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised objected to processing (see below), where we may have processed your personal data unlawfully, or where we are required to erase your personal data to comply with local law. We may not always be able to comply with your request of erasure for specific legal reasons.  If so, we will notify you at the time of your request.

Object to processing where we are relying on a legitimate interest (or those of a third party) and you object to particular processing due to a perceived impact on your fundamental rights and freedoms. You also have the

• right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information that override your rights and freedoms.
• Request restriction of processing during the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful, but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise, or defend legal claims; or (d) you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your personal data to you or a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. This right only applies to automated information that you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data. If you withdraw your consent, we might not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. For clarity, withdrawal is not retroactive.

We do not charge for access to your personal data or to exercise any of the other rights.  However, we may refuse to comply with your request or charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. 

International Data Transfers

If you reside outside the United States, we transfer information about you for processing in the United States.  By providing your information to us, you consent to the processing of the information in the United States.  The transfer of this information to the United States is necessary for the performance of our contract for use of the Services.

When we transfer personal data subject to GDPR outside of YayDay, we use standard contract clauses approved by the EU for this purpose, or another appropriate transfer mechanism. 

Note that U.S. law is not equivalent to GDPR.  As of the Last Updated date, the U.S. has not been deemed an ‘adequate’ jurisdiction under GDPR for the purposes of international data transfers.  However, the EU and the U.S. are negotiating the terms of an adequacy determination that may go into effect in the years to come.

Rights under U.S. state laws

This section applies to you only if you reside in California or another U.S. state where applicable law provides for some or all of these rights, or substantially similar rights.  Except as noted in this section, we extend these California rights to residents of those states regardless of whether applicable law in those states includes all of these rights.  Please contact us if you feel that you are not able to exercise your rights under your state’s law.

Rights under CCPA

The California Consumer Privacy Act (“CCPA”) provides California consumers with additional rights regarding their personal information (as defined in CCPA).  When we use terminology defined in CCPA in the California-specific sections of this Policy, that terminology has its meanings under CCPA.

The categories of personal information we collect depend on how you use the Services.    They’re generally described in under Information we collect and how we use it.  For clarity, we have collected personal information for these CCPA categories of business and commercial purposes in the last twelve months:

• Advertising and Marketing
• Error Management
• Internal Research
• Provide Products or Services
• Quality Assurance
• Security
• Short-Term Transient Use
• We also "share" and "sell" (as defined in the CCPA) personal information for commercial purposes, including to advertise and market our products.

The disclosures under Purposes describe with business purpose or commercial purpose for those disclosures of information. The categories of third parties to whom we disclose and sell or share personal information are under for personalized ads and with your consent or at your request above. 

Under CCPA, California consumers have the following rights:

Rights to Know, Access, Correct and Delete.

You have the right to request that we disclose, correct and delete personal information about you that we have collected.  Your right to know includes the personal information we have sold or shared or disclosed for a business purpose or a commercial purpose. 

Finally, we may deny deletion requests, in whole or in part, with respect to information we reasonably need to:

• comply with legal obligations;
• allow you, other consumers, or us to exercise free-speech rights or other legal rights;
• complete an obligation that you have requested (for instance, if a product you purchased carries a warranty or could reasonably be subject to recall under applicable law); or
• if we use the information only for internal purposes reasonably aligned with consumer expectations.

Rights to Limit and Opt-Out of Sharing/Sale

You also have the right to direct us (1) not to share or sell your personal information and (2) limit our disclosure and use of your sensitive personal information to purposes necessary to provide the Services to you. 

To opt out of the sharing of your information, please use our Data Request Form or the link on our homepage (when available).  We do not currently offer a mechanism to exercise the right to limit our disclosure of sensitive personal information, as we always limit our use of any sensitive information to necessary uses consistent with the purpose you consented to when you disclosed the sensitive information to us.

As of the Last Updated date, we have no knowledge of any use of personal information we collect from individuals under the age of 16 for ‘sale’ or ‘sharing’ purposes.

Right of No Retaliation

CCPA prohibits us from discriminating against you if you exercise rights under CCPA, except when you opted in to a financial incentive involving certain of your personal information, and subsequently restrict our use of that personal information through a CCPA rights request. 

• For example, if we offer you a discount code for consenting to receive marketing emails, and you then require us to delete your email address, we may not honor that discount code.

Your right of no retaliation doesn’t need to be exercised.  We never retaliate against anyone exercising their rights under this Policy or CCPA.

Preference signals

The Services’ Shopify configuration is designed to automatically respond to Global Privacy Control signal by opting out users from applicable jurisdictions from any sharing or sale of their personal information in a frictionless manner.  Please Contact us if you believe the Services collected or processed your information in a manner inconsistent with your opt-out preference signal.

Request process for CCPA rights

The process described under Requesting information generally applies to requests to exercise CCPA rights.  However, in addition:

• A California resident’s authorized agent may submit CCPA rights request.
  • Requests submitted by an authorized agent will still require verification of the person who is the subject of the request in accordance with the process described below. We will also ask for proof that the person who is the subject of the request authorized an agent to submit a privacy request on their behalf.
  • An authorized agent that has power of attorney pursuant to California Probate Code section 4121 to 4130 must submit proof of statutory power of attorney, but consumer verification is not required.
• We will acknowledge your request within 10 days, and our goal is to fulfill your request within 45 days. However, we may you that we will require up to 45 further days to fulfill your request, along with an explanation of why our response is delayed. 
• We provide responses in the manner we receive your request (i.e., with an email response to an email request).

Other California law

Because we only give your information to third parties for direct marketing purposes with your consent, and always allow you to opt out of direct marketing communications after opting in, we believe we are not currently required to comply with California Civil Code Section 1798.83. 

Requesting information

Submitting requests

To exercise any rights described in this Policy, please use our Data Request Form (when available) or contact us.  Your request must:

• provide sufficient information to identify you and the law that applies to you, such as your name, e-mail address, home or work address, or other information we maintain.
• not include social security numbers, driver’s license numbers, third-party account numbers, credit or debit card numbers, or health information.

Verifying requests

We verify requests by first confirming the source of the request and then by matching the information submitted to the information we maintain.  If your request is unclear or we are unable to authenticate your identity, we will respond with direction on how to remedy the deficiencies, in accordance with law that applies to you. 

If we cannot verify the identity of the individual making the request, we may deny it, in full or in part.

Responses to requests

We will respond to your request as quickly as we can, taking into account the nature of your request and the volume of pending requests.  The content of our response will vary with the nature of your request, but will always respond in accordance with any deadlines or requirements specified by the laws that applies to you.

Under certain circumstances, we may be unable to provide responsive personal information, such as when disclosure would create a substantial, articulable and unreasonable risk to the security of the information, customers’ account with us, or the security of our systems or networks.  We do not disclose account passwords or any other non-personal information that enables access to an account.

Please understand, however, that we reserve the right to retain an archive of any deleted information, to the extent permitted by law.  We may also retain deidentified or aggregate data derived from information about you.

Use by minors

The Services is intended for adult users.  We do not knowingly collect information from anyone under the age of 16, and we do not share or sell information about anyone under 16 without affirmative authorization.  If we learn that we have collected information from a person under age 16, we will delete that information as quickly as possible. 

• If you are under 16: sorry, but please leave the Services.  If you’ve already sent us information, please contact us first so we can delete it. 
• If you are a parent or guardian of a person under 16 years of age and you believe that person provided information to us, please contact us.