Privacy policy

Who is responsible

YAY is operated by Palin, trading as YAY in New Zealand. Business and contact details. For a privacy question, Open a private YAY Discord support ticket.

Information we use

• Accounts: Discord user ID, display name, optional avatar reference, one-use login tokens, secure session records and creator applications you submit, accepted creator-payment agreements, video briefs, view-verification decisions and payout references.
• Orders: selected plans, prices, receipt email supplied to Stripe, provider transaction/subscription references, payment status and private key-delivery records. YAY does not receive full card numbers or card security codes.
• Licensing: licence status, product, activation and expiry times, device/installation identifiers and activation/session records needed to enforce the one-PC licence and prevent abuse. Hardware-derived identifiers are personal information when linkable to you.
• Support: your ticket messages, attachments and staff actions on Discord. Website account pages do not automatically send their contents to AI. In Discord tickets, the support bot may use OpenAI for bounded replies; screenshot analysis uses its separate approval flow. Avoid sending passwords, payment-card data or keys in chat or screenshots.
• Operation: IP addresses and technical security logs may be processed by hosting/network providers. Essential browser storage supports your requested account, cart, receipt and arcade features. Optional Discord avatars load only after your choice.

Purposes and choices

We use this information to supply purchases, verify payments, manage renewals/cancellations, deliver and validate licences, prevent fraud, answer support, review creator applications and meet legal obligations. Where applicable, the bases are performing your requested contract, legal obligations, proportionate security/administration interests and consent for optional processing. Buying does not opt you into marketing. We do not sell personal information or enable advertising trackers. Optional video repost permission is separate from applying.

Providers and international processing

Cloudflare handles network delivery and security; Stripe handles payments and its own financial records; Discord handles sign-in identity and support conversations. OpenAI processes content submitted through the Discord AI support/moderation features, under their bounded workflows. Optional Discord-hosted avatars disclose request information to Discord. Providers may process data outside your country and have their own notices: Cloudflare, Stripe, Discord, OpenAI. Links to TikTok and other sites open only when you choose them; they have their own practices. No Google Fonts request or production Lovable error-reporting upload is enabled by this site.

Retention and security

Website account sessions expire after seven days; guest receipt sessions after one year; one-use sign-in links expire after ten minutes. Cookie choices are remembered for up to 180 days. Browser cart data remains until changed or cleared. Relevant purchase, tax, fraud, dispute and licence records may need to be retained after a deletion request; these are not erased blindly while billing or a dispute is unresolved. Retention outside the session limits is reviewed during request handling rather than promised to follow an automatic deletion schedule. Discord AI ticket memory is bounded to 30 days; Discord messages and moderation records have separate retention. Restricted server access, secure cookies and encrypted private key delivery reduce risk but do not guarantee perfect security.

Access, correction and deletion

Use Privacy controls to submit an authenticated access, correction or deletion request and track it. Guest buyers can use the original purchase browser; otherwise contact support for ownership verification. Knowing an email, order ID or licence alone is not accepted as identity proof. We aim to respond within 20 working days and follow any applicable shorter legal deadline. We explain retained records, reasons and next steps. Deletion does not itself cancel billing: cancel renewals first or ask us to help. Provider-held information may need a separate request to that provider. You may complain to New Zealand’s Privacy Commissioner or the relevant authority where you live.

Children and young people

You must be at least 13 and meet the minimum age for Discord in your country. If you are under 18, a parent or guardian must review these terms and authorise the account and purchase. We do not knowingly offer accounts or purchases to under-13s. A parent may contact support about a child’s information. Do not submit a date of birth, identity document or a child’s details in public chat; staff arrange proportionate verification privately. The checkout age confirmation is a declaration, not an identity or parental verification service. Where local rules require further parental authorisation, contact support before supplying personal information.