WoYab Privacy Policy
This policy explains how WoYab processes personal data across the public directory, user accounts, reviews, reports, business tools and support services.
Effective date: 20 July 2026
1. Controller and contact
The controller is the WoYab operator identified below. Privacy and data-subject requests may be sent to the published privacy email address.
2. Data we process
Depending on your use, we process account details, verified email status, password hashes, optional profile and saved-location data, reviews, favorites, reports, support requests, business claims, owner submissions, contact messages, authentication and security records, IP-derived anti-abuse identifiers, device and diagnostic information, and timestamps. Raw passwords, raw email-verification tokens and raw authenticator secrets are not stored.
3. Purposes and legal bases
We process data to create and secure accounts, provide requested directory and owner functions, publish approved contributions, respond to support and reports, prevent fraud and abuse, maintain evidence of moderation, comply with legal duties, and defend legal claims. The legal bases are Article 6(1)(b), 6(1)(c) and 6(1)(f) GDPR as applicable. Optional technologies are used only under Article 6(1)(a) where consent is required.
4. Email verification and account security
Password registrations require email verification before login. Administrator access additionally requires a TOTP authenticator code. Verification tokens are single-use, expire automatically and are stored only as hashes. Privileged authenticator secrets are encrypted at rest.
5. Public content
Approved business information and reviews may be visible publicly. Public responses do not expose a business owner's private account email or internal user identifier. If an account is anonymized, retained reviews no longer identify the account.
6. Reports and moderation
Reports may contain contact details, the reported target, reasons, evidence and technical anti-abuse information. Signed-in reporters can view status in their dashboard. Final report and moderation decisions may be sent by email. Internal moderator notes are not included in public notifications.
7. Recipients and service providers
Access is limited to authorized WoYab personnel and providers needed for hosting, database operation, authentication, email delivery, error monitoring, maps and location services. Data is disclosed to public authorities only when legally required or necessary for legal claims.
8. International transfers
Where a provider processes data outside the EEA, WoYab relies on an adequacy decision or appropriate safeguards such as Standard Contractual Clauses, together with supplementary measures where required.
9. Retention
Account data is kept while the account is active. Expired verification and anti-abuse records are deleted after their operational period. Closed reports and moderation records are retained only as long as needed for safety, disputes and legal obligations. Business-claim retention periods are described in the supplemental claim notice. Backups expire under the infrastructure backup cycle.
10. Account deletion and anonymization
Users may permanently erase their account and contributed reviews, or delete the account while retaining reviews without an author identity. Private profile data, credentials, saved locations, favorites, support tickets and local avatar files are removed. Claims, reports and audit evidence that must remain are detached and personal fields are redacted. Administrator accounts require a controlled removal process.
11. Cookies and local storage
Strictly necessary cookies and storage support sessions, security, language and privacy choices. Optional analytics or similar technologies are activated only according to the cookie choices available on the platform.
12. Your rights
Subject to the GDPR conditions, you may request access, rectification, erasure, restriction, portability or object to processing based on legitimate interests. You may withdraw consent for the future and lodge a complaint with the competent supervisory authority.
13. Automated safeguards and abuse prevention
WoYab uses rate limits, verification status and security signals to block automated or excessive requests. These controls protect users and infrastructure; significant moderation decisions remain reviewable by authorized staff.
14. Changes
Material changes will be published here and, where required, communicated through the account or email before they take effect.