Privacy policy
Your plans, your data, your choices. Questions or requests? Write to hello@what2do.lol.
Last updated 2026-09-30
Who we are
What2Do is made by Vagabonder. This policy covers the What2Do app, what2do.lol, the waitlist and pages opened from shared app links.
The data controller is Senne Van Heghe, a sole proprietor operating under the Vagabonder brand, enterprise number 0745.714.422, VAT BE 0745.714.422. Our business address is Langenakker 26, 9340 Lede, Belgium. Contact us at hello@what2do.lol.
Accounts and profiles
We process your account identifier, email, sign-in credentials or provider identifiers, and session information to create and secure your account. We also store the profile information you provide, such as your first name, handle, photo, interests and home area.
We use this information to provide your account, help people recognise you and support the features you choose. The legal basis is performance of our agreement with you. Account security and abuse prevention also rely on our legitimate interest in keeping What2Do safe.
Plans, friends and messages
We store the plans, lists, trips, invitations, RSVPs, polls, friend connections and chat messages you create or take part in. We also keep your activity history and Momo progress to provide those features. The legal basis is performance of our agreement with you.
Other people see information according to the audience you choose and the feature you use. Hosts and participants see the details and responses needed to organise their plan; chat participants see messages. Public profiles and public plans are visible to their public audience. Anyone who receives a shared link may open it and pass it on, so avoid sharing private details through public pages or links.
Location and recommendations
Your selected area, interests, mood, budget and activity choices help us suggest things to do and organise your feed. We use your interactions with suggestions, such as saves and dismissals, to make recommendations more relevant. This processing provides the personalised service you request under our agreement.
Device location is optional and requires your permission. You can turn it off in device settings and choose an area manually. We do not publish your precise device location to other users. On the website, we may use your browser time zone or an approximate city supplied with the request to show local examples. Recommendations do not make decisions with legal or similarly significant effects on you.
The waitlist
If you request a launch notification, we process the following information to send a confirmation and the launch email you asked for:
- your email address
- whether you want iPhone or Android notifications
- the language of the page
- the page you signed up on
- the selected or approximate city used for the signup
You join the list only after clicking the confirmation link, which expires after seven days. Resend sends the emails and stores your email address and confirmed platform preference. The confirmation email and our confirmation logs also contain language, city and source context. The legal basis is your consent. Withdraw it by emailing hello@what2do.lol or using the unsubscribe link in a launch email; this does not affect earlier lawful processing. Joining What2Do does not subscribe you to other Vagabonder products.
RSVPs without an account
When you answer a plan invite on the website, we process the name you enter, your answer (going, maybe or cannot) and the plan identifier, and make the response available to the host and relevant participants.
We keep the response while the plan exists, unless it is deleted earlier. The legal basis is taking the step you requested to organise the plan. You do not need to join the waitlist or consent to marketing to RSVP.
Contact, safety and deletion requests
If you write through a form or by email, we process your name, email, message and request topic to answer you. Form messages are sent through Resend; incoming mail is forwarded by Cloudflare Email Routing to our Google-hosted business inbox.
Support connected with your account relies on our agreement with you. General enquiries and investigating safety reports rely on our legitimate interest in helping people and protecting the community. Responding to statutory privacy requests and legally required disclosures relies on our legal obligations. Reports may include information about other people, and only people who need it to handle the report have access.
Security and operational logs
Our routine website access logs record request time, method, page path, result and duration. They omit IP addresses, query strings and browser details. A page path can contain a public profile handle or a plan identifier. Confirmation logs record platform, language, city and signup source without the email address or confirmation token.
The website holds an IP-based rate-limit counter in memory to limit form abuse, without writing that counter to disk. Hosting and email providers also process connection and delivery metadata, which can include IP addresses, for delivery, security and abuse prevention. These uses rely on our legitimate interest in operating a secure, reliable service.
How long we keep data
Account data and content are kept while needed to provide your account and the features you use. When you delete your account it disappears immediately; we delete its data within 30 days and remove it from backups within 90 days, as described on our account-deletion page.
Waitlist contacts are kept until you withdraw consent, receive the requested launch notification or the list closes. Unconfirmed links expire after seven days. Resend retains email content and delivery logs for 30 days on our free plan; expiry of a confirmation link does not immediately erase the email record.
Support conversations are kept while needed to resolve and follow up on the request. Routine website logs are rotated as new logs arrive within bounded storage. Safety records and information needed to meet legal obligations are kept only for the applicable requirement; we restrict access to retained records. Email and security providers may retain limited records under their own schedules; Google鈥檚 general processing terms allow up to 180 days to complete some email deletion operations. These email records are distinct from the app-account data and backups described above.
Your choices and rights
Email hello@what2do.lol to exercise your rights. Depending on the applicable conditions, you can ask us to:
- access the personal data we hold about you
- correct inaccurate data
- delete data
- restrict processing or object to processing based on legitimate interests
- receive portable data where that right applies
- withdraw consent, including consent to launch emails
We may ask for information reasonably necessary to verify your identity. We respond within one month; if a request is complex or there are several requests, the law may allow an extension of up to two further months, and we will explain it within the first month. Requests are normally free. Withdrawing consent does not affect processing that was lawful before withdrawal.
You can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorit茅 de protection des donn茅es), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, or to the authority where you live, work or believe an infringement occurred.
Information you choose to provide
An email address and sign-in information are needed for an email-based account; without them we cannot create or authenticate that account. An email address is needed to receive a waitlist notification. A name and answer are needed to submit a web RSVP. Contact details and a message are needed to answer a contact request.
Optional profile details and device permissions are your choice. Declining them can limit the related feature, but does not subscribe you to marketing or prevent unrelated features from working.
Minimum age
What2Do is for people aged 16 and over. We do not knowingly collect personal data from younger children. If you believe a younger child has provided data, contact hello@what2do.lol so we can investigate and remove it.
Changes
We update this page and its date when the policy changes. If a change materially affects how we use your data, we will bring it to your attention through the app or another appropriate channel before it takes effect.