Privacy Policy

Last updated: 10 June 2026

CakeMyDay ("we", "us", "our") is committed to protecting your personal data. This policy explains what data we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD).

1. Who we are

The data controller is CakeMyDay, operating from Barcelona, Spain. For data protection enquiries, contact us at info@cakemyday.ai.

2. Data we collect

Company & HR accounts

Company name, address, and contact details
HR admin name and email address
Hashed account password (we never store your password in plain text)
Subscription and billing information (processed by Stripe — see Section 5)

Employee data

Employee names and birthdays
Dietary preferences and allergen restrictions (where provided)
Delivery address associated with the company

Baker accounts

Business name, address, and contact details
Menu items, pricing, and availability
Hashed account password

Usage data

Log-in timestamps and IP addresses
Order history and activity logs
Browser type and operating system (for security purposes)

3. Why we collect it and our legal basis

Purpose	Legal basis (GDPR Art. 6)
Providing the cake ordering service (scheduling, delivery, notifications)	Performance of a contract (6(1)(b))
Processing payments and managing subscriptions	Performance of a contract (6(1)(b))
Sending order confirmations, reminders, and service emails	Performance of a contract (6(1)(b))
Preventing fraud and ensuring platform security	Legitimate interests (6(1)(f))
Retaining financial and transaction records	Legal obligation (6(1)(c))

4. Employee data and your responsibility

When you upload employee records (names, birthdays, dietary preferences) to CakeMyDay, you act as a data controller for that data and are responsible for ensuring you have a lawful basis to share it with us. We act as a data processor on your behalf for this data and will only use it to fulfil orders. We recommend informing your employees that their birthday and dietary information is used for this purpose.

5. Third-party processors

We share data only with the processors necessary to operate the service. All processors are bound by data processing agreements.

Stripe — payment processing. Card data is handled directly by Stripe and is never stored on our servers. See stripe.com/privacy.
Microsoft Azure — cloud hosting and blob storage (EU data centres). See Microsoft Privacy Statement.
Resend — transactional email delivery (order confirmations, notifications). Email addresses are shared only to deliver emails you would expect to receive.
OpenRouteService — geolocation and distance calculations used to match companies with nearby bakers. Only delivery addresses are shared, not personal names.

6. How long we keep your data

Account data: retained while your account is active. On account deletion, personal data is removed within 30 days, except where required by law.
Order and financial records: retained for 7 years to comply with Spanish tax law.
Usage logs: retained for up to 12 months for security and fraud detection, then deleted.
Employee records: deleted when removed from your account or when your account is closed.

7. Your rights

Under GDPR you have the right to:

Access the personal data we hold about you
Rectify inaccurate or incomplete data
Erase your data ("right to be forgotten"), subject to legal retention obligations
Restrict processing in certain circumstances
Data portability — receive your data in a structured, machine-readable format
Object to processing based on legitimate interests
Lodge a complaint with the Spanish Data Protection Authority (AEPD) at aepd.es

To exercise any of these rights, email us at info@cakemyday.ai. We will respond within 30 days.

8. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or via the platform. The date at the top of this page shows when it was last updated.

9. Contact

CakeMyDay · Barcelona, Spain · info@cakemyday.ai