Privacy Policy
How we collect, use, and protect your personal information
Last Updated: October 18, 2026
Privacy Overview
At Laylaty, we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, store, and protect your data when you use our guest management platform.
Data Controller
Laylaty is a service operated by Rootroo Oy, a limited company registered in Helsinki, Finland (Business ID 3154674-3), which acts as the data controller for the personal data processed on the platform. If you have any privacy questions or want to exercise your rights, you can reach us through rootroo.com.
Information We Collect
Information You Provide
- Account details (name, email, password, profile information)
- Contact information you choose to provide
- Social login information when you use third-party authentication
- Event details and guest information you create
- Content you upload (photos, videos, messages, wishes)
- Guest responses and preferences (RSVPs, dietary requirements, etc.)
- Payment information processed by third-party payment processors
Information We Collect Automatically
- Usage data (how you interact with our platform)
- Device and browser information
- IP address and general location
- Cookies and similar tracking technologies
- Log data and analytics information
How We Use Your Information
- Provide and improve our services
- Communicate with you about your account and events
- Process transactions and deliver features you use
- Analyze usage to improve our platform
- Ensure security and prevent abuse
- Comply with legal obligations
Legal Basis for Processing
Contract Performance: Processing necessary to provide our guest management services.
Legitimate Interests: Analyzing usage data to improve our services, develop new features, enhance platform performance, ensure security, and provide better user experience. You have the right to object to processing based on legitimate interests.
Consent: Analytics and marketing communications where you have opted in.
Legal Compliance: Meeting legal and regulatory requirements.
Information Sharing and Third-Party Services
We do not sell your personal information. We only share data in these limited circumstances:
- Event Guests: Guest information shared only with event organizers as necessary for event management.
- Service Providers: Trusted third-party service providers who assist with cloud infrastructure, payment processing, email delivery, analytics, and other essential operational services.
- Legal Requirements: When required by law or to protect our rights and safety.
- Social Media and Identity Providers: When you choose to log in via Google, Facebook, or Instagram, we receive basic profile information (such as your name, email address, profile photo URL, and provider account identifier) solely to authenticate your identity, create or link your account, and pre-populate your profile. We do not receive or store your social network passwords, access your friends or contacts list, or publish content to your social feeds. You can revoke access at any time through your Google or Meta account security settings.
Third-Party Service Providers
We work with trusted third-party service providers for hosting, payments, email delivery, analytics, and other operational services.
These service providers only access your data to perform specific tasks on our behalf and are obligated to protect your information. Data is primarily processed within EU data centers, with some services processing data in other regions under appropriate safeguards.
Cookies and Tracking Technologies
We use cookies for essential functions, analytics, and advertising.
See our Cookie Policy for details and how to manage your preferences.
Data Retention
We retain your data as long as necessary for our business purposes, legal obligations, and dispute resolution:
- Account data: While active and as needed after closure
- Event data: Until you delete it or as required by law
- Uploaded content: kept while your event is active and for a reasonable period afterwards for backups, safety, and legal needs, then deleted or anonymized when it is no longer needed
- Payment records: As required by financial regulations (typically up to 7 years)
- Analytics and aggregated data: As needed for service improvement
- Security logs: As necessary for security and legal compliance
You can request deletion of your data at any time through your account settings or by contacting us. For accounts created via social login (Google, Facebook, Instagram), initiating account deletion permanently disassociates and removes your stored social profile data from our active systems.
Your Rights
You have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent where processing is based on it. Contact us to exercise any of these rights. You also have the right to lodge a complaint with a supervisory authority, in Finland the Office of the Data Protection Ombudsman (tietosuojavaltuutetun toimisto), or the authority in your own country.
If You Are an Event Guest
If you received an invitation, an RSVP request, or an event website through Laylaty, an event organizer added your details so they could invite you and manage their celebration. Laylaty (Rootroo Oy) processes this information to provide the invitation and RSVP service, and you have the same privacy rights described above. You can contact us directly to access or delete your information, and we will handle your request even though it was the organizer who invited you. In some cases we may keep limited information where it is needed for the integrity of the event or to meet a legal obligation.
Marketing Communications
You can opt out of marketing emails at any time by clicking the unsubscribe link in any email or adjusting your account preferences. This will not affect service-related communications.
Data Security
We use industry-standard security measures to protect your information, including encryption, secure authentication, and access controls. Payment processing is handled by PCI-compliant third-party processors.
No online system is 100% secure. Use strong passwords and keep your account secure.
Data Breach Notification
If a data breach affects your personal information, we will notify the relevant authorities and, where the law requires it, affected users, within the timeframes and in the manner required by applicable law.
International Data Transfers
Your data is primarily stored and processed within EU data centers. Some third-party service providers may process data in other regions for purposes such as analytics, advertising, and infrastructure services. When data is transferred internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and other legally recognized transfer mechanisms.
Automated Processing and AI
We use automated systems, artificial intelligence, and machine learning to operate, secure, improve, and develop the service, for example to moderate content, generate designs, provide recommendations, and build new features. To develop and train these systems we use aggregated or anonymized data that does not identify you. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing, and where such processing applies you can ask for human review.
California Privacy Rights (CCPA)
California residents have additional rights under the CCPA. We do not sell, rent, or share your personal information for monetary consideration. You have the right to know what personal information we collect, request deletion, and access your data. Contact us to exercise these rights.
Legal and Law Enforcement Requests
We may disclose your information in response to lawful requests by public authorities, including law enforcement. We may be prohibited from notifying you of such requests.
Age Requirement
Laylaty is intended for users aged 18 and over, who can create an account and make purchases. The service is not directed to children, and we do not knowingly collect personal information from anyone under 18. Organizers are responsible for the guest information they add, including any information about minors. If you believe a child has provided us with personal information, please contact us and we will remove it.
Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will let you know through the platform or by email before they take effect. Continued use after that means you accept the updated policy.
Electronic Communications
By using our service, you consent to receive communications from us electronically. You agree that all agreements, notices, and other communications satisfy any legal requirement that such communications be in writing.
Interpretation
Section headings are for convenience only and do not affect interpretation. "Including" means "including but not limited to." The terms "we," "us," and "our" refer to Laylaty and its operators.
Contact Us
If you have questions about this Privacy Policy or wish to exercise your rights, contact us at rootroo.com.
We will respond to your request within 30 days.