Privacy Policy

This policy explains what Eventyy (eventyy.com) does with personal data. It covers two different roles: data we hold about you as a user of the platform, and data you store in the platform about your own clients, guests and suppliers.

1. Who controls what

For your account details we are the data controller. For the event data you enter about your clients, guests and suppliers, you are the controller and we act as your processor, handling that data on your instructions and only to run the service for you.

2. What we collect

Account data: name, email address, optional phone number and profile photo, your organisation and role, and your language preference.

Google sign-in data: if you sign in with Google, we receive your name, email address and profile photo from Google. We use this only to create your account, identify you inside Eventyy and keep your account secure. We do not use Google sign-in data for advertising, we do not sell it, and we do not access Gmail, Calendar, Drive or other Google product data.

Content you create: events, notes, tasks, timelines, messages, uploaded photos, videos and audio, supplier records, quotations, contracts and invoices.

Technical data: sign-in timestamps, IP address and device information for security, and basic error and usage diagnostics to keep the app working.

Location data: only when you explicitly tap the arrival button on an event-day screen. It is stored with that arrival record and nowhere else. There is no background tracking.

3. Why we use it

To provide the service and its features; to authenticate you and keep accounts secure; to send transactional messages such as reminders and notifications you have configured; to bill paid plans; to diagnose faults and improve reliability; and to comply with legal obligations.

We do not sell personal data, and we do not use your event content to advertise to you or to anyone else.

4. Separation between organisations

Every record in the platform is tied to one organisation, and access rules are enforced by the database itself rather than only by the interface. One organisation cannot read another organisation’s data.

External participants (a client, a supplier, a temporary staff member) see only the specific event they were invited to, and only the parts of it you allow.

5. Processors we use

Supabase for database, authentication, file storage and server functions. Cloudflare for hosting and delivering the web app. Where enabled by your organisation: an email provider for outbound email, a payment provider for online payments, an AI provider for optional assistance features, and error/analytics tooling for diagnostics.

Content you send to an optional AI feature is processed by that provider to generate the response. AI features are off unless your organisation turns them on.

6. Retention

We keep your data while your account is active. Deleting your account removes your profile immediately, and removes your organisation and its content when you are the last remaining member. Backups age out on their normal cycle. We keep the minimum records required for accounting and legal obligations.

7. Your rights

Depending on where you live you may have rights to access, correct, export, restrict or delete your personal data, and to object to certain processing. Most of this is available directly in the app; for anything else write to eventyyapp@gmail.com and we will respond within the time the law allows.

If we process data on behalf of an organisation you belong to, we will refer requests about that data to the organisation.

8. Security

Data is encrypted in transit and at rest by our infrastructure providers. Access rules are enforced at the database level, file access is scoped per organisation and per event, and server-side operations re-check authorisation independently of the interface.

No system is perfectly secure. If a breach affects your data we will notify you and, where required, the relevant authority.

9. International transfers

Our providers may process data in regions other than your own. Where that happens we rely on the safeguards those providers offer, including standard contractual clauses.

10. Changes and contact

We will post any update to this policy here and change the date at the top. Material changes will also be announced in the app.

Privacy questions: eventyyapp@gmail.com.