Privacy Policy

1. What we process

User data (organisers): e-mail, name, hashed password, workspace ID, role, IP address and login metadata.

Guest data: name, e-mail, phone, entourage size, check-in status, check-in time and notes — to the extent uploaded by the organiser.

Technical data: error logs, IP, user agent, audit records of account actions.

2. Purpose & legal basis

• Providing the service (contract, Art. 6(1)(b) GDPR).
• Account security, abuse prevention, audit (legitimate interest, Art. 6(1)(f) GDPR).
• Statutory obligations (accounting, tax) — organiser data only.

With respect to guest data the Provider acts as a processor; the organiser is the controller.

3. Retention

• Guest data: while the event exists + 30 days after archival, then deleted.
• User account: until deletion + 30 days.
• Security and operational logs (audit, errors, delivery records): 90 days.
• Conversations with the Gina assistant: 90 days.
• Status as of 30 Sep 2026: automatic deletion according to these periods is not active yet. Until it is enabled, we delete data on request of the event organizer or the data subject (see Contact).

4. Recipients & processors

Supabase (database, authentication), Cloudflare (hosting, CDN), Resend (email delivery), Sentry (error reporting), Lovable AI Gateway and OpenAI (Gina assistant replies; chat messages are passed to them for processing). Some processors are located outside the EU/EEA (database in Japan, other services in the USA). We do not sell data to third parties.

5. Your rights

You have the right to access, rectify, erase, restrict processing, data portability and to object. Send requests via our contact form. You may lodge a complaint with the Privacy Commissioner for Personal Data (pcpd.org.hk).

6. Cookies

We use only strictly necessary cookies for authentication and language preference. No analytics or marketing cookies are used without consent.

7. Changes

Material changes will be communicated by e-mail or in-app at least 14 days in advance.