Xenia Privacy Policy

1. Information We Collect

Account and profile information

Name, email address, phone number, and password.

Transaction information

Purchases, reservations, gift card purchases and redemptions, order contents, amounts, dates, and the businesses involved. Payment card details are collected and processed directly by Stripe; we do not store full payment card numbers.

Location information

Approximate location derived from your IP address, and precise location if you grant permission, used to show nearby businesses. You can disable precise location in your device settings.

Device and usage information

Device type, operating system, browser, IP address, pages and listings viewed, searches and questions submitted to our AI features, and interactions with the Service.

Content you submit

Reviews, ratings, photographs, and messages.

Cookies and similar technologies

See Section 6.

2. How We Use Information

• To provide the Service, process transactions, and fulfill orders, reservations, and gift cards
• To communicate with you about orders, support requests, and account matters
• To power discovery and our AI features, including answering questions about local businesses
• To personalize listings and recommendations
• To detect, investigate, and prevent fraud, abuse, and security incidents
• To calculate, collect, and remit applicable transaction taxes
• To analyze and improve the Service, including developing and training our models and features
• To comply with legal obligations and enforce our Terms
• To send marketing communications, where permitted, which you can opt out of at any time

3. Aggregated and Deidentified Information

We create aggregated and deidentified data from transaction, usage, and business information. This data is combined across many consumers and businesses and does not identify you, your household, or any individual business. Examples include visitation and spending patterns across a town, category-level demand trends, and seasonal activity.

We use, license, and sell this aggregated and deidentified data to third parties, including government agencies, tourism and economic development organizations, and enterprise customers.

We publicly commit to the following with respect to deidentified information: we maintain and use it only in deidentified form; we do not attempt to reidentify the information, except solely for the purpose of determining whether our deidentification processes satisfy applicable legal requirements; we take reasonable measures to ensure the information cannot be associated with a consumer or household; and we contractually obligate any recipients of the information to comply with all of these provisions.

We do not sell personal information. The data described in this section is deidentified information and aggregate consumer information, which under California law is not personal information. It relates to groups or categories of consumers, individual identities have been removed, and it is not linked or reasonably linkable to any consumer, household, or device.

4. How We Share Information

Participating businesses

When you place an order or make a reservation, we share the information the business needs to fulfill it, such as your name, order contents, and reservation details.

Service providers

Payment processing (Stripe), hosting, analytics, communications, customer support, and tax calculation providers, who process information on our behalf under contract.

Aggregated data recipients

As described in Section 3, in deidentified and aggregated form only.

Legal and safety

When required by law, subpoena, or legal process, or to protect the rights, property, or safety of Yo-Do, our users, or others.

Business transfers

In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We do not share your personal information with third parties for their own independent marketing purposes.

5. AI Features

Questions you submit to our AI discovery features are processed to generate responses and to improve the accuracy and usefulness of those features. We do not include personal information in outputs shown to other users, and we do not provide your personal information to third-party AI providers for their own model training.

6. Cookies and Tracking

We use cookies and similar technologies for essential functionality, preferences, analytics, and measurement. You can manage your preferences through our cookie consent tool, available on our website. A current, itemized list of the cookies we use is available in the cookie declaration on that page. You can also control cookies through your browser settings.

We honor Global Privacy Control (GPC) signals where required by law.

7. Your Choices

• Account information: review and update it in your account settings
• Marketing email: unsubscribe using the link in any marketing message
• Location: disable precise location in your device settings
• Cookies: manage through our consent tool or your browser
• Deletion: request deletion of your account and associated data at admin@yo-do.com

8. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended, gives you the rights described below.

Categories of personal information we have collected in the past 12 months:

• Identifiers (name, email, phone, IP address, account identifiers)
• Customer records (payment-related information; card numbers are held by Stripe)
• Commercial information (purchases, reservations, gift card activity)
• Internet or network activity (browsing, search, and interaction data)
• Geolocation data (approximate; precise geolocation only if you permit it — treated as sensitive personal information)
• Audio, electronic, or visual information (photographs you submit)
• Inferences drawn from the above (preferences and interests)

Sources.

Directly from you, automatically from your device, and from participating businesses in connection with your transactions.

Business and commercial purposes.

As described in Section 2.

Categories disclosed for a business purpose.

We disclose the categories above to participating businesses and service providers as described in Section 4.

Sale or sharing.

We do not sell or share personal information as those terms are defined under California law, including for cross-context behavioral advertising. The aggregated and deidentified data described in Section 3 is not personal information.

Sensitive personal information.

If you grant permission, we collect precise geolocation, which is sensitive personal information under California law. We use it solely to show you nearby businesses and relevant listings — a purpose for which the law does not require us to offer a right to limit. We do not use or disclose precise geolocation, or any other sensitive personal information, to infer characteristics about you, and we do not sell or share it. You can disable precise location at any time in your device settings.

Retention.

See Section 10.

Your rights.

• Right to know what personal information we collect, use, and disclose
• Right to delete personal information we have collected from you
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing (we do not sell or share)
• Right to limit use of sensitive personal information (we use precise geolocation only to provide the Service, a use for which the law does not require a limit option)
• Right to non-discrimination for exercising your rights

To exercise these rights, contact us at admin@yo-do.com or yo-do.com/privacy-rights. We will verify your identity before responding, typically by confirming information associated with your account. You may use an authorized agent, who must provide proof of authorization.

9. Other State Privacy Rights

Residents of states including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana have comparable rights to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising, sale, and certain profiling. We do not engage in targeted advertising or profiling that produces legal or similarly significant effects. To exercise these rights, or to appeal a decision, contact us at admin@yo-do.com.

10. Data Retention

We retain personal information only as long as needed for the purposes described in this Policy, using the following general criteria:

• Account and profile information: for the life of your account, then deleted or deidentified within 90 days of account closure.
• Transaction, gift card, and tax records: seven (7) years, to meet tax, accounting, audit, and marketplace facilitator obligations.
• Payment card data: not retained by us; held by Stripe under its own retention practices.
• Customer support communications: three (3) years.
• Device, log, and usage data: up to twenty-four (24) months.
• Marketing preferences: until you withdraw consent; we retain a suppression record indefinitely so we can honor your opt-out.
• Aggregated and deidentified data: retained indefinitely, as it no longer identifies you.

We may retain information longer where required by law, or where needed to resolve a dispute, enforce our agreements, or prevent fraud.

11. Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information. No system is completely secure, and we cannot guarantee absolute security. If a security incident affects your personal information, we will notify you and any applicable regulator without undue delay and within the timeframes required by applicable law. If you believe your account has been compromised, contact us at admin@yo-do.com.

12. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If we learn we have collected such information, we will delete it. Users between 13 and 17 may use the Service with the consent and involvement of a parent or legal guardian, as described in our Terms of Use. We limit the information we collect from users we know to be under 18 to what is necessary to provide the Service, and we do not use it for marketing. If you believe a child under 13 has provided us information, contact admin@yo-do.com.

13. Third-Party Services

The Service links to and integrates with third-party services, including participating businesses' own sites and Stripe. Their handling of your information is governed by their own privacy policies, not this one.

14. Changes to This Policy

We may update this Policy. The current version is always available at https://yo-do.com/legal/xenia-privacy-policy with a "last updated" date. For material changes we will provide notice through the Service or by email before the change takes effect.

15. Contact Us