Privacy Notice

MyDiafa is a hospitality and event-operations service operated by Cloud Motion Technologies LLC (“Cloud Motion,” “MyDiafa,” “we,” “us,” or “our”). This notice explains how we handle personal information when you visit mydiafa.com, create or use a MyDiafa account, participate in an event, communicate with a venue through MyDiafa, or use a connected service.

MyDiafa provides the application. The host who invites you and the venue that serves your event may be separate people or businesses, each with its own responsibilities. Using the same application does not give every host or venue access to your information.

The host and their contact list. A host, or the organization the host represents, retains ownership of the contact lists and event content they provide, subject to the rights of the people concerned. The host decides whom to invite, manages the guest relationship, and is responsible for having permission or another lawful basis to provide contact details, send invitations, and use their event records. MyDiafa stores and processes those records to provide the service; uploading a contact does not transfer the host's contact list to MyDiafa or make that person a marketing contact for MyDiafa or a venue.

MyDiafa, the application. Cloud Motion Technologies LLC operates MyDiafa. For customer-controlled contact lists and event records, we generally act on the customer's authorized instructions as a processor or service provider, where those legal terms apply. We separately determine how information is used for our own account administration, authentication, security, support, billing, website operation, and service improvement, and are responsible for that processing. We do not use private hospitality information for advertising.

The venue. A restaurant, venue, or hospitality business uses the information it is authorized to receive to manage bookings, prepare and serve the event, accommodate guests, handle feedback, and maintain its business and legal records. It is responsible for the purposes it determines and its own privacy obligations; its privacy notice may also apply. Providing the venue for an event does not give it ownership of the host's contact list, access to a guest's entire private profile, or permission to send offers. A venue may also be the host, but those roles do not combine separate sharing and marketing choices.

You, the guest. Ownership of a contact list does not mean ownership of a person or unrestricted rights over their personal information. You retain your applicable privacy rights and control the optional profile and sharing choices described below. Accepting an invitation or verifying your email does not transfer control of your private MyDiafa profile to a host or venue, merge their separate records about you, or subscribe you to marketing.

Where privacy law uses terms such as “controller,” “business,” “processor,” or “service provider,” the role depends on who determines the purpose of the particular use and on applicable law and agreements. One organization can have different roles for different activities.

The information we collect depends on your relationship with MyDiafa and the features that are enabled. It may include:

• Identity and account information: name, email address, profile image, authentication identifiers, organization membership, role, permissions, and account preferences.
• Event and hospitality information: inquiries, proposals, dates, venues, spaces, menus, timelines, guest lists, attendance, accommodations, dietary or allergy details, accessibility needs, and other event-care instructions.
• Business and relationship information: company, household, vendor, contact, contract, approval, invoice, and authorized-representative information.
• Communications and content: email, messages, call details, attachments, support requests, notes, feedback, Event Folio photos, videos, memories, comments and reactions, and records of commitments or approvals.
• Preferences and choices: optional private hospitality preferences, the selected copies you share with named hosts or venues, separate email choices, and records of consent and withdrawal.
• Transaction information: pricing, invoices, payment status, refunds, disputes, provider references, bank-connection status, and reconciliation evidence. MyDiafa is designed not to store raw card numbers, card verification codes, or online-banking credentials.
• Location information: venue, event, delivery, or address information you provide, together with map, place, distance, or routing results when a mapping feature is used.
• Device and usage information: IP address, browser and device type, pages and features used, timestamps, session and security events, diagnostic data, and cookie or similar identifiers needed to operate and protect the service.
• AI interaction information: prompts, instructions, source material, generated drafts or summaries, feedback, and records needed to explain or audit an AI-assisted action.

We receive information from you, the organization or host responsible for an event, invited participants, connected providers, and the devices and systems used to access MyDiafa.

We use personal information to operate and secure MyDiafa; authenticate users; enforce organization roles and event permissions; prepare and manage inquiries, proposals, contracts, events, guest care, communications, payments, and operational follow-up; provide support; maintain audit and reconciliation records; prevent fraud and misuse; comply with law; and improve the reliability and usefulness of the service.

We may also use information to customize what you see, remember authorized preferences, recommend next steps, prepare drafts, organize event details, and make the experience more relevant to your role and event. We do not use private dietary, allergy, accessibility, or accommodation information for advertising.

When you are on an event's guest list, we use your name and email address to send you messages about that event from its host, co-hosts, and venue team, and from MyDiafa on their behalf—for example invitations, updates, reminders, and changes to timing or location. These are transactional messages, not marketing, and each one names the event. We keep a record of what was sent and whether it was delivered, so the host and venue can confirm you were told. If you choose to receive text messages, we use the mobile number you provide only for event texts, keep a record of your choice, and stop when you reply STOP. We do not use your guest-list membership to send you marketing from MyDiafa or other organizations.

Your private profile. You may choose to save dietary, allergy, accessibility, or other hospitality preferences in your MyDiafa profile. Saving a profile is optional and separate from signing in or attending an event. These saved preferences are for your own use and are not automatically shared with hosts, venues, or other guests.

Care for this event. When you provide care answers for an event, the form identifies the people who will receive them. They become part of that event's care record so its authorized hosts, concierge, venue, and kitchen team can serve you. Providing these answers does not, by itself, create a reusable profile or give permission to use them at other events.

Share with a named host or venue. Where offered, you can separately choose to share selected preferences with the host or organization identified on the form and with the named venue. Each receives its own selected copy for that hospitality relationship. Editing your private profile does not automatically update copies you previously shared. You can review, update, or stop each connection's sharing in your preferences. Stopping sharing clears the reusable preference copy held for that connection in MyDiafa; it does not recall information already seen or remove separate event records or exports.

Occasional offers and future events. Permission to share hospitality preferences is separate from permission to receive marketing email. When an email subscription is offered, the choice names the host, venue, or other sender and starts unchecked. You may decline it and still RSVP, attend, or share care information. A choice for one sender does not subscribe you to another sender or to MyDiafa marketing. You can withdraw the email choice independently; stopping email does not stop separately permitted preference sharing, and stopping sharing does not change an independent email choice. Private care details are not used to target advertising.

Essential account, security, and event messages are separate from optional marketing. We send sign-in verification messages only when requested through the relevant sign-in flow; saving preferences or changing consent does not itself send invitations, follow-ups, or marketing.

MyDiafa may use artificial intelligence and large language models, including the Habibi concierge, to personalize the experience and help retrieve, classify, extract, translate, summarize, draft, recommend, and route hospitality work. An AI feature may process the information you provide and authorized information already associated with your account, organization, or event.

We use approved technology providers under service and confidentiality controls when an outside model or tool is needed. MyDiafa's policy is not to permit those providers to train general-purpose models on customer data submitted through the service. We minimize the information sent for each task and do not place provider credentials, raw payment credentials, or unrestricted cross-organization data into model prompts.

AI output can be incomplete or wrong. It does not replace contracts, approved event plans, allergy or safety records, professional advice, or required human approval. MyDiafa is designed so that AI does not independently make legally significant decisions, move money, accept contracts, waive terms, infer protected or sensitive traits, decide privacy requests, or conceal uncertainty. Where an AI, recording, or transcription feature is optional, we provide a human or non-AI path when reasonably available.

A basic invitation link permits limited event access and an RSVP with a short private note while the link is valid. Possession of that link is not proof of the recipient's identity. Private guest features, including care answers, feedback, Event Folio viewing or contributions, and party changes, require a verified account, a current session, and permission for that event. Verification may create a basic sign-in account and associate the invitation with it after you confirm; a saved preference profile and marketing remain optional. Sign-in links are one-time and expire, and we may ask you to verify again when your session expires. If you cannot sign in and need to correct an urgent care instruction, contact the host or venue directly.

You may be able to sign in through Google OAuth, email authentication, or an enterprise single sign-on provider. These providers send MyDiafa the identity attributes needed to authenticate you, such as your name, email address, profile image, provider account identifier, and authentication status. Enterprise SSO may also provide organization and role-related attributes configured by your administrator.

MyDiafa's Google sign-in requests only the openid, email, and profile scopes. We use that Google user data to identify you, create or connect your MyDiafa account, display your basic profile, protect the service, and maintain your session. Google sign-in does not give MyDiafa access to your Gmail messages, Google Drive files, contacts, or calendar. If an organization administrator separately chooses Connect my Google Calendar, MyDiafa requests calendar event-write access and uses it only to push explicitly selected Diafa events to the administrator-selected calendar; it does not import Google events into Diafa. We do not sell Google user data or use it for advertising. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements where applicable.

Your identity provider controls its own collection and security practices. You can manage or revoke connected-app access from that provider, but revocation may prevent provider-based sign-in.

Optional attendance location: when offered on your invitation page, you may enable location to help record your arrival and departure. Your browser asks permission. This works only while the page is visible and can be stopped at any time. We process the coordinates briefly and do not store them for this feature or send them to a mapping provider. We retain your consent choices and resulting attendance times as part of the event record, visible to its authorized hosts and venue team. Missing or imprecise location does not mean you have departed; the host can record or correct attendance manually. A host may also keep their own private hospitality notes on your event-linked profile, visible only to that host. Attendance records and private notes remain for the event/host purpose and are subject to the privacy request process below.

Optional “time to leave” reminders, when available: if you choose this on your guest page, your browser asks your permission to share your device's location. Location is a permission you give your browser or phone—it is not a cookie—and you can withdraw it in your browser or phone settings at any time. We use your location, and send it to Google Maps Platform, to estimate how long the trip to the venue will take and when you should leave. So we can keep that estimate current and remind you by email without asking again, we may store the location you share, the travel estimate, and your leave-by time with your guest record until the event is over, and they may appear in our service and transaction logs. After the event we delete or de-identify them, although copies in logs and backups may remain for a limited period before they are removed. We do not use your location for advertising or share it with other guests. You never need to share your location to attend an event.

If Google Maps Platform or another mapping provider is enabled, MyDiafa may send addresses, place searches, map interactions, approximate device location if you allow it, and related technical information to that provider to display maps, suggest places, calculate distance or routing, and support event logistics. Google's Terms of Service and Privacy Policy apply to Google Maps features. Do not use map fields to submit private information that is not needed for the location task.

When payment features are enabled, Stripe or another approved payment provider may collect payment-method, identity, device, transaction, and fraud-prevention information directly through provider-controlled components. We receive status, amount, payer, provider reference, refund, dispute, and reconciliation information needed to manage the event transaction.

Payments and other sensitive actions may require additional identity verification. Event access, a saved preference, or consent to marketing does not authorize a charge.

If you choose to connect a financial account through Plaid or another bank-data provider, that provider may collect account credentials and retrieve the account, balance, ownership, or transaction information you authorize. MyDiafa receives only the information and connection tokens needed for the feature you selected. We do not ask you to place online-banking credentials into MyDiafa fields or AI prompts. Plaid's End User Privacy Policy also applies when Plaid is used. You can disconnect a financial connection, although we may retain transaction and authorization evidence required for accounting, security, disputes, or law.

We disclose personal information only as reasonably needed for the purposes described in this notice:

• to the organization, venue, host, planner, guest, vendor, or authorized collaborator involved in the event, according to permissions and the purpose of the information;
• to service providers that support hosting, authentication, databases, communications, email, AI, maps, payments, financial connections, voice, documents, monitoring, analytics, security, support, or professional services;
• at your direction or with your consent, including when you connect a third-party account or ask us to send information;
• to comply with law, legal process, or lawful government requests; enforce agreements; investigate fraud or security incidents; or protect people, rights, property, and the service; and
• as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of the business, subject to appropriate confidentiality and notice requirements.

Depending on the enabled feature, providers may include Cloudflare, Supabase, Postmark, Google, KaizenIS identity and Voice Engine services, Stripe, Plaid, communications providers, approved AI/model providers, accounting or calendar providers, and enterprise identity providers. A provider is given only the access needed for the enabled service and remains subject to its own terms and privacy notice.

Dietary, allergy, and accessibility answers are optional; no one is required to give them. If you choose to answer, your answers are shown with your name to the people who host and serve that event: the host, any co-hosts, the concierge, and the venue and kitchen team working it. They see them so they can prepare food and make the event accessible to you, and we tell you this on the form before you answer. Your answers are not shown to other guests and are not used for advertising.

Event Folio and feedback. Photos, short videos, memories, comments, reactions, and attribution you share in an Event Folio are available to that event's eligible invited guests and hosts, subject to its publication and moderation settings. Venue membership alone does not grant Folio access. A private note of thanks to hosts is available to the event's hosts; private venue feedback is available to the venue team and event hosts. Neither is automatically posted to the Folio or a public review site. If you follow a link to an external review service, that service's own notice applies.

Assigned concierges and authorized platform administrators may assist with host functions within their permitted event or support scope. Their actions are attributed to their own accounts. This does not let them sign in as a guest, change a guest's personal sharing or marketing choices as though the guest made them, or read another author's private hospitality notes. Limited service administration and legally required processing remain subject to the safeguards and purposes in this notice.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and we do not use event-care information for targeted advertising.

We keep information for as long as needed to provide the service, fulfill the purpose for which it was collected, follow an organization's configured retention period, protect the service, resolve disputes, maintain required transaction and audit evidence, and satisfy legal obligations. Retention varies by data type and relationship.

Your optional private profile is kept for your use until you change or remove it or account closure is completed. Removing it clears its preference values; limited technical and consent evidence may remain. Separately shared copies and event records have their own lifecycle. You can stop a connection's reusable preference sharing, and you can ask the host or us to delete event information, including care answers, notes, or contributions. We handle verified requests under applicable law, coordinate with the responsible host or venue, and explain any applicable retention exception. Host ownership of a contact list does not give the host a veto over your legal rights.

Event care answers are not automatically deleted after the event; they remain in the host's event record until the host or guest asks for deletion. A guest can ask MyDiafa directly. We delete those care answers and notify the host rather than requiring the guest to obtain the host's approval, subject to any applicable legal retention obligation that we explain.

Closing your account or withdrawing a choice does not automatically erase past event records, separate venue business records, required transaction or audit evidence, or information a recipient already downloaded. We cannot recall information already seen or copied outside MyDiafa; deletion requests can cover those recipients as appropriate. Withdrawal does not undo processing that was lawful before it. Location shared for a “time to leave” reminder is kept only until the event is over. Backups and provider systems may retain residual copies for a limited period before deletion is completed.

We use administrative, technical, and organizational safeguards designed to protect information, including tenant and role boundaries, encryption in transit, restricted secrets, private storage, expiring access, audit evidence, provider authentication, and incident-response controls. No system can guarantee absolute security. Protect your credentials, use only authorized accounts, and notify us promptly if you believe an account or event link has been compromised.

Depending on your location and relationship with MyDiafa, you may have rights to know or access information, correct it, delete it, receive a portable copy, withdraw consent, object to or restrict certain processing, limit certain uses of sensitive information, or appeal a decision. You will not receive discriminatory treatment for exercising a privacy right.

For a host's contact list or event records, you may contact that host or organization. For a venue's own booking, service, or marketing records, you may contact the venue. For your MyDiafa account, private profile, or our own processing, contact MyDiafa. You may always send a request directly to hello@mydiafa.com; you do not need to determine the legal role first. We will explain which organization is responsible and coordinate or route the request as appropriate. We may need to verify your identity and authority, and applicable law may permit or require some records to be retained.

California residents may request the categories and specific pieces of personal information collected, the sources and purposes, and the categories of recipients; request correction or deletion; and exercise any applicable rights to opt out of sale or sharing or limit use of sensitive information. Because MyDiafa does not sell personal information or share it for cross-context behavioral advertising, we do not currently offer a sale/share opt-out mechanism.

MyDiafa uses cookies and browser storage for sign-in, security, choices you make, and reliable operation. Sign-in cookies keep your session working and protect authentication. If you choose a language or time zone, preference cookies remember that choice for one year. Security cookies used when an administrator connects Google Calendar or Xero last up to ten minutes and are cleared when the connection returns.

Browser storage remembers whether you dismissed the cookie notice and, within the application, display choices such as open panels. A temporary record in a staff member’s browser tab also helps prevent sending the same email twice. Dismissing the cookie notice acknowledges this information; it does not give permission for advertising or other optional tracking.

We do not use advertising or cross-site tracking cookies. Our hosting provider, Cloudflare, processes traffic and security information to deliver and protect the service. To protect the site from bots and abuse, Cloudflare may set strictly necessary security cookies (such as “__cf_bm”, which lasts about 30 minutes, or “cf_clearance” after a security check). These cookies help distinguish people from automated traffic; they are not used for advertising or to track you across websites. Cloudflare Web Analytics, when enabled and permitted by the site’s security settings, uses a cookie-free performance beacon. It does not use cookies or local storage to track visitors across websites. Cookie-free analytics and server logs are still subject to applicable privacy requirements.

You can review this information at any time using Cookie details in the site footer. Your browser’s site-data controls let you view, block or clear cookies and local storage; clearing them may sign you out, reset your preferences or show this notice again. Closing a browser tab removes its temporary session storage. If your browser prevents storage, the notice can still be dismissed for the current page view.

If we introduce optional advertising, tracking or analytics technologies that require consent, we will explain their purpose, provide accept and reject choices, and prevent them from running until the required consent is given. We will also provide a way to change that choice and honor applicable opt-out signals. Essential service functions will remain available without agreeing to optional tracking.

MyDiafa is not directed to children under 18, and children may not create an account on their own. An adult host or organization may provide limited information about a minor when reasonably necessary to plan or safely fulfill an event. We ask that they provide only what is necessary and manage the information on the minor's behalf.

Cloud Motion and its providers may process information in the United States and other countries where they operate. Those countries may have different privacy laws. Where required, we use contractual and other safeguards for cross-border transfers.

We may update this notice as MyDiafa, its providers, and legal requirements evolve. We will post the revised notice with a new effective date and provide additional notice or consent when required for a material new use of previously collected information.

For privacy questions or requests, email hello@mydiafa.com with the subject “Privacy request.” You may also use the MyDiafa contact page. Please do not send passwords, raw payment credentials, bank credentials, or unnecessary sensitive records by email.

Cloud Motion Technologies LLC
Operator of MyDiafa
mydiafa.com