DaYou (搭友, "we", "us" or "the service") is operated by Guangzhou Junying International Culture Communication Co., Ltd. ("ThatsLab"). We take your personal information and your privacy seriously. This policy explains how we collect, use, store, share and protect your personal information when you use the DaYou app, our WeChat Mini Program and related websites, and how you can exercise your rights. Please read it before you use the service. If you do not agree, please do not continue.
1. Who is responsible
Personal information handler: Guangzhou Junying International Culture Communication Co., Ltd. (operating the DaYou brand, a ThatsLab product). Website filing number: 粤ICP备20064570号-10. Privacy contact: privacy@thatsdayou.com.
2. What we collect, and why
We follow the principles of lawfulness, fairness, necessity and good faith, and collect only what each feature needs.
- Account and sign-in information: phone number (for SMS code sign-in) and WeChat OpenID/UnionID (when you sign in with WeChat). Used to create and protect your account. Every account has one phone number confirmed by SMS: the first WeChat sign-in asks you to confirm yours, and if that number already has an account, WeChat is linked to it.
- Profile: display name, avatar, bio, city, food preferences (foods you do not eat) and topics you like. Used to show you to other guests and to suggest tables that suit you.
- Email address (optional): when you add one, we email a confirmation link to it, and we only send booking confirmations and receipts to an address you have confirmed.
- Content you post: photos, moments, reviews and chat messages. Used to display content, 搭友 (Companion) matching and community features.
- Identity verification: before attending or hosting, you verify your identity through Aliyun Real-ID (ID document recognition and a face liveness check). The ID document and face images are processed directly by Aliyun; we do not collect or store them and receive only the result.
- Location: precise or approximate location, only while the app is in use and only with your permission, to suggest nearby cities and tables. You can turn it off in system settings and still pick a city by hand.
- Device and log information: device identifier (X-Device-Id), device model, OS version, app version, client platform, IP address, access times, and behavior logs such as screens viewed and taps. Used to keep accounts and payments safe, fix faults, run statistics and improve recommendations.
- Orders and payments: bookings, order numbers, amounts, payment status, voucher and credit ledger entries. Payments are completed with WeChat Pay, Alipay or Airwallex; we never see your card number or payment password.
- Notifications: a push token (on iOS via APNs) so we can send event, match and chat alerts. You can turn notifications off in system settings.
- Camera, photo library and microphone permissions: used only when you take or choose photos or complete face verification. You may decline, and other features keep working.
3. Legal bases for processing
Under Article 13 of PIPL we process personal information on these bases: (1) your consent: location, camera/photo/microphone permissions, push notifications, personalised recommendations, the sensitive personal information used in identity verification, and your agreement to this policy at first launch; (2) necessity to conclude or perform a contract with you: account and sign-in information, profile, orders and payments, and what bookings and attending a table require; (3) necessity to meet legal obligations: identity verification, log retention and lawful requests from authorities.
4. Sensitive personal information
The following is sensitive personal information under Article 28 of PIPL, because leaking or misusing it could harm your dignity or your personal or property safety: biometric data such as your face, identity document information, precise location, and personal information of children under 14 (whom we do not allow to register and do not knowingly collect from). We process it only for a specific purpose, where it is genuinely necessary, with strict protection, and with your separate consent.
- Face and ID document: the purpose is to verify you are a real person with a real identity so that guests and hosts are safe; it is necessary because tables mean strangers meeting offline, with alcohol. Aliyun Real-ID processes it directly; we do not store the document or face images and receive only a passed / not passed result. Impact on you: a "verified" badge is shown to other members.
- Precise location: the purpose is to suggest nearby cities and tables; it is collected only with your permission and while the app is in use, and you can switch it off in system settings and pick a city by hand.
- You may refuse to provide this information. Refusing only blocks features that require verification (attending or hosting a table); you can still browse tables, cities and content.
5. How we use information
- To provide, maintain and improve the service, including table discovery, booking, 搭友 matching, chat and the content community;
- To verify identity, prevent fraud and abuse, and keep guests safe;
- To process payments, refunds, vouchers and credits;
- To send verification codes, booking confirmations and event reminders;
- To personalise recommendations (which you can turn off in Settings) and run analytics based on your browsing and interactions; we will not use your information for unrelated purposes without your separate consent;
- To comply with law and to handle complaints and disputes.
6. Sharing, transfer and disclosure
We do not sell your personal information. We share it only in these cases:
- Visible to other people: your display name, avatar, bio, verification badge, the tables you attend and content you post are shown to the host and guests at your table and to other members. You choose who can see each post when you share it.
- Service providers: we engage third parties to deliver the features above (see section 7). We agree on purpose, method and security duties with them and allow processing only as needed.
- Legal disclosure: where required by law or by a court or government authority.
- Business changes: in a merger, acquisition or asset transfer we will require the recipient to remain bound by this policy and will notify you.
7. Third-party SDKs and services
The table below lists the third-party SDKs and services the service uses. Services marked "planned" collect nothing until they go live. We will update this policy when the list changes.
| SDK / service | Platform | Purpose | Information shared or collected | Provider |
|---|---|---|---|---|
| Aliyun Real-ID (Cloudauth, financial-grade identity verification; includes APSecuritySDK, FaceGuard, Toyger components) | iOS, Android | Identity verification: ID document recognition and face liveness check | ID document data, face images, device information, processed directly by Aliyun. We receive only the result (passed / not passed) and never store the ID document or face images | Alibaba Cloud Computing Ltd. |
| Aliyun SMS (DySmsApi) | Server-side | Send login codes and service notification texts | Phone number, message content | Alibaba Cloud Computing Ltd. |
| Aliyun Object Storage (OSS) | Server-side | Store the avatars and event photos you upload | Images you choose to upload, and their metadata | Alibaba Cloud Computing Ltd. |
| Apple Push Notification service (APNs) | iOS | Deliver event, match and chat alerts to your device | Push token, notification content | Apple Inc. |
| Apple location services (CoreLocation) | iOS | Obtain your location while the app is in use to suggest nearby cities and tables | Precise location (only while the app is in use, and only with your permission); handled by the operating system | Apple Inc. |
| Android location services | Android | Obtain your approximate location to suggest nearby cities and tables | Approximate location (only while the app is in use, and only with your permission) | Device operating system vendor |
| WeChat Pay | Server-side (planned) | Process payments and refunds for table bookings | Order number, amount, payment status. Payment credentials are handled by WeChat Pay; we never see your card or payment password | Tenpay Payment Technology Co., Ltd. |
| Alipay | Server-side (planned) | Process payments and refunds for table bookings | Order number, amount, payment status. We never see your payment account password | Alipay (China) Network Technology Co., Ltd. |
| Airwallex | Server-side (planned) | Accept international card payments | Order number, amount, currency, payment status. Card details are handled by Airwallex directly | Airwallex group |
| WeChat Open Platform SDK (iOS: WechatOpenSDK; Android: wechat-sdk-android) | iOS, Android | Sign in with WeChat: WeChat opens to confirm it is you and hands a one-time authorization code to our server | WeChat OpenID / UnionID. The permission we request would allow reading your WeChat nickname and avatar, but we do not read or store them, and will update this policy first if that ever changes. The first WeChat sign-in still confirms your phone number by SMS code. The SDK starts only after you agree to this policy | Shenzhen Tencent Computer Systems Co., Ltd. |
| WeChat Mini Program | Mini Program (planned) | Sign in to the mini program with WeChat | WeChat OpenID / UnionID (with your permission) | Shenzhen Tencent Computer Systems Co., Ltd. |
We do not currently use any advertising SDK and do not sell or share your personal information with advertisers.
8. Storage, retention and transfers abroad
- Where: your personal information is stored in the People's Republic of China (Aliyun Guangzhou region).
- Transfers abroad: to deliver push notifications to iOS devices, your push token and the notification content are provided to Apple Inc. (the recipient, whose servers may be outside mainland China) so that event, match and chat alerts can be delivered, by transmission through the APNs interface; the data types are the push token and notification content. You can stop this by turning notifications off in system settings. Airwallex is an international card payment service that is not live yet; once it is, and only when you choose to pay by international card, we will provide the order number, amount, currency and payment status to Airwallex to complete the payment. These transfers are based on your separate consent, which we will ask for explicitly before the first one happens. You can exercise your rights of access, correction and deletion against the overseas recipients through section 10 and privacy@thatsdayou.com.
- How long: account information is kept while your account is active. When you delete your account we anonymise your personal information immediately. Order and payment records are kept for at least three years as required by law; security and access logs for at least six months. After these periods, and unless the law says otherwise, we delete or anonymise the data. If your account is suspended for breaking the user agreement, we keep your phone number and WeChat ID only as a keyed one-way hash, used solely to stop the same identity registering again, including after you delete your account. We delete it if the suspension is lifted.
9. How we protect information
We use transport encryption (HTTPS), access controls, least-privilege access and rotating tokens, and we require authorisation to view media files. No internet service is completely secure. If a personal information incident occurs we will notify you and report to the authorities as the law requires.
10. Your rights
Under the Personal Information Protection Law (PIPL) you may exercise the following rights in the app or by emailing privacy@thatsdayou.com:
- Access, copy, correct and complete your personal information (Me → Edit profile);
- Delete your personal information and close your account (Me → Settings → Delete account). Once confirmed we anonymise your profile, remove your phone number and WeChat identifiers, revoke your sign-ins, cancel your upcoming bookings, and withdraw or cancel the upcoming tables you host;
- Personalised recommendations: turn them off in Settings → Personalised recommendations, after which the feed is no longer personalised and is ranked by time and general popularity; you can also object by emailing privacy@thatsdayou.com;
- Withdraw consent: turn off location, camera, photos and notifications in system settings, or delete your account to withdraw consent to this policy. Withdrawal does not affect processing already carried out on the basis of consent;
- Ask us to explain our processing rules and obtain a copy of your information;
- Ask for an explanation of, and refuse, decisions made solely by automated means that significantly affect you.
We will reply within fifteen working days. If you are not satisfied with our reply you may complain to the competent authority.
11. Minors
DaYou is for adults aged 18 or over with full legal capacity, because tables involve dining and drinks. We do not allow children under 14 to register or use the service and do not knowingly collect their personal information. If you are a guardian and believe a minor has given us information without consent, email privacy@thatsdayou.com and we will delete it promptly.
12. Changes to this policy
When we update this policy we will change the version and effective date at the top and notify you in the app with a prompt or other prominent notice. For material changes we will ask for your consent again.
13. Contact us
Privacy contact: privacy@thatsdayou.com. Operator: Guangzhou Junying International Culture Communication Co., Ltd.