Privacy Policy

Last updated on October 27, 2026.

This Privacy Policy explains how SFJ Capital UG (haftungsbeschränkt) ("we," "us," or "our") processes personal data when you use the Sunny Days Ahead iOS app (the "App") and this website (together, the "Services"). We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Controller

SFJ Capital UG (haftungsbeschränkt)
Dhauner Straße 42, 67067 Ludwigshafen am Rhein, Germany
Email: hello@hejsfj.com

For our full company details, see our Imprint.

2. Data we process

Depending on how you use the Services, we process:

  • Account data — your email address and authentication details when you create an account or sign in.
  • Profile and travel preferences — your first name, home city and travel styles (for example slow days, food, outdoors, cities, beach), where you choose to provide them.
  • Trip and favorites data — the destinations you save, the trips you create, and the trip details you enter so we can generate and store your plans.
  • Purchase data — a record that you purchased a Trip Credit and the associated transaction confirmation. We do not receive or store your full payment-card details.
  • Email and support content — the content of messages you send us.
  • Technical data — server log data such as IP address, date and time of access, and device/browser information, processed by our hosting provider for security and delivery.

Weather and climate information shown in the App is based on aggregated historical weather records and does not identify you.

3. How and why we use your data (legal bases)

  • To provide the Services — creating your account, saving your trips and favorites, and delivering App features (Art. 6(1)(b) GDPR, performance of a contract).
  • To plan trips — when you ask the App to plan or refine a trip, the trip details you provide are processed to generate travel suggestions (Art. 6(1)(b) GDPR).
  • To process purchases — handling your one-time Trip Credit purchase (Art. 6(1)(b) GDPR).
  • To contact you — sending transactional emails such as email confirmation and password resets, and replying to your messages (Art. 6(1)(b) and Art. 6(1)(f) GDPR).
  • To keep the Services secure and working — logging, abuse prevention and troubleshooting (Art. 6(1)(f) GDPR, our legitimate interest in a safe, reliable service).
  • Where you give consent — for any processing that requires it, which you may withdraw at any time (Art. 6(1)(a) GDPR).

4. Service providers (processors) and recipients

We use carefully selected service providers who process data on our behalf under data processing agreements, and only as needed to run the Services:

  • Supabase — account authentication and database storage for your account, profile and trip data.
  • Vercel — hosting and delivery of this website, including technical server logs.
  • Apple — the App Store and in-app purchases; Apple processes your payment for Trip Credits purchased on iOS under Apple's own privacy policy.
  • Stripe — payment processing where a purchase is made outside the App Store; Stripe processes the payment and we receive only a confirmation, not your full card details.
  • Resend — delivery of transactional emails such as confirmation and password-reset messages.
  • AI provider — a third-party AI service that processes the trip details you submit in order to generate travel suggestions. We do not use your data to train third-party AI models.

We may also disclose data to authorities or advisors where we are legally required to do so. We do not sell your personal data.

5. International transfers

Some of our providers are based in, or process data in, countries outside the European Economic Area (such as the United States). Where that is the case, transfers are safeguarded by appropriate measures under Chapter V GDPR, such as the EU Standard Contractual Clauses and, where applicable, the EU–U.S. Data Privacy Framework.

6. Retention

We keep personal data only for as long as necessary for the purposes described above or as required by law. When you delete your account, we delete or anonymize the associated account, profile and trip data within a reasonable period, unless we must retain certain records (for example purchase records) to meet legal obligations.

7. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict or object to certain processing;
  • receive your data in a portable format;
  • withdraw consent at any time, without affecting prior processing.

To exercise any of these rights, contact us at hello@hejsfj.com. You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate (LfDI Rheinland-Pfalz).

8. Children

The Services are not directed to children under 16, and we do not knowingly collect their personal data.

9. Security

We use appropriate technical and organizational measures to protect your data, including encryption in transit (HTTPS/TLS). No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above, and material changes will be communicated as appropriate.

11. Contact

Questions about this policy or your data? Email us at hello@hejsfj.com.