Privacy policy

This policy explains how [Company legal name] (“we”) handles personal data on the event platform. It covers two groups: organisers (people who create and run events), for whom we decide how data is used, and guests of an event, whose data we process on the organiser’s behalf. Each event site has its own guest privacy page.

Organisers

• What: your email address, name if you give it, the events you run and your role on each, sign-in times, and payment records (we do not store card numbers; the payment provider does).
• Why: to give you access, run your events, bill you, keep the service secure and tell you about your event (for example onboarding tips and reminders before your event).
• Legal basis: the contract with you, and our legitimate interest in security and service emails. You can stop non-essential emails at any time.
• How long: while your account is active and as long as accounting law requires for payment records.

Guests (processed for the organiser)

• What: name on the invitation, email if the organiser adds it, replies (including the organiser's own questions), songs, wishes, posts, photos and videos guests share, and whether notifications are switched on.
• Each reply is saved with a general device type and an approximate city; we do not store guests' IP addresses with their replies.
• The organiser decides why this data is collected and who sees it. We use it only to run that event, under the data processing terms.
• Guest data is deleted with the event, at the latest at the end of the plan's retention period, or earlier on the organiser's request.

Service providers (sub-processors)

Depending on configuration, the platform uses some of these providers. Each receives only what it needs for its task:

• Vercel — Hosting of the sites and their functions
• MongoDB Atlas — Database for events, guests and accounts
• Google Drive, or an S3-compatible storage provider (e.g. Cloudflare R2, Amazon S3) — Storage of photos, videos and backups
• Resend, or an SMTP email provider (e.g. Amazon SES) — Sending emails: invitations, reminders, sign-in links
• Upstash — Counters that limit abuse (rate limits)
• Sentry — Error reports
• Spotify — The event playlist (song search and the playlist itself)
• YouTube — Livestream video, embedded without tracking cookies (youtube-nocookie.com)
• Stripe — Card payments for plans and add-ons
• Web push services of the guest's browser (Google, Mozilla, Apple, Microsoft) — Delivering phone notifications guests asked for

Some providers are located outside your country; where required, transfers rely on appropriate safeguards such as standard contractual clauses.

Cookies

We use only cookies that are strictly necessary to keep you signed in and to keep sign-ins safe; no advertising or tracking cookies. See the cookie notice.

Security

Data travels over HTTPS; sessions are signed; stored service tokens are encrypted; access to each event is limited to its team; backups are kept and actions by staff are recorded in an audit trail.

Your rights

You can ask to access, correct, export or delete your data, or object to some uses. Guests should contact the event’s organiser first; we will help them answer. Contact: [contact email]. You can also complain to your data protection authority.