Privacy policy

The distinction matters, so it comes first.

Information about you. You are our customer, you gave it to us, and this policy governs it.

Information about your guests. You uploaded it. Your guests are not our customers and have no relationship with us. We hold that list on your behalf and on your instructions, we never use it for anything of our own, and you remain responsible for having been entitled to collect it and to give it to us.

Because you have an account:

• Your email address and the name you enter.
• Your password, stored only as a cryptographic hash. We cannot read it.
• A session cookie that keeps you signed in, and a cookie remembering whether you read the site in English or French.

Because you built an event:

• The event title, the venue name, the date, and any note you write for your venue.
• The room: its dimensions, tables, seat counts and fixtures.
• Your guest list: each guest's name, the table they are seated at, and optionally a household name and a category you define.
• Counts you confirm, who confirmed them, when, and the reference code derived from them. A confirmation cannot be edited once made; that is the point of it.

Because you wrote to us:

• The address and message you send, the page you were on, and the event you were looking at, so a reply does not need a round trip.
• From a venue enquiry: the name, venue, email and any phone number given. A floor plan you attach is emailed to us and never stored in our database.

Because you bought something:

• Payments are processed by Stripe. We never see or store your card number.
• We keep the fact that an event was paid for, when, and the date the payment covers.

Automatically:

• Guest searches are counted, never recorded. When a guest looks for their name we add to a per-day counter and note whether anything matched. The words they typed are never stored and never sent to us.
• Page views, through Vercel Analytics, with the identifying parts removed in your browser before anything is sent: event addresses are reduced to a pattern, and pages reached by a count link are not reported at all, because that link is itself a credential.
• Short-lived counters used to limit abuse.

• We never show guest names to a venue. A venue sees totals, a per-table breakdown and the floor plan. There is no setting that changes this.
• We do not sell personal information, and we never use your guest list to market to anyone.
• We do not use your data to train machine-learning models.

To run the product you bought: to show a guest their table, to give your venue the numbers and the floor plan, to record what was agreed, to take payment, to answer you when you write, and to keep the service secure. We do not hold personal information for any purpose you would not expect from that list.

• Supabase, the database. Hosted in Canada.
• Vercel, hosting and analytics. United States.
• Stripe, payments. United States.
• Resend, sending email. United States.

Three of those are outside Quebec. Before personal information is communicated outside the province we assess whether it would receive protection equivalent to that required here, and we record that assessment. We will not add a processor outside Quebec without doing so.

• Your events stay until you delete them or close your account. An event becomes read-only a few days after its date, but is not deleted.
• Deleting your account removes it and everything it owns: events, guest lists, room layouts, confirmations and share links. This is immediate and cannot be undone.
• Messages you send us, and venue enquiries, are kept for 24 months.
• Counters and analytics, which hold no names, are kept for 14 months.

You may ask us to:

• show you what we hold about you;
• correct anything inaccurate;
• delete your account and its contents. You can also do this yourself under Account;
• give you a copy in a structured, commonly used technical format;
• stop using your information, or withdraw a consent you gave.

Write to georges.boum18@gmail.com. We answer within 30 days. The person responsible for the protection of personal information is Georges Boum, Owner, at that address.

If a confidentiality incident creates a risk of serious injury, we will notify the Commission d'accès à l'information and the people affected, and we keep a register of incidents, as the law requires.

We use no advertising or third-party tracking cookies. We use:

• a session cookie, so you stay signed in;
• a cookie holding your language choice;
• local storage in your browser for conveniences such as a remembered language. This never leaves your device.

If we change this policy we will update the date above and, for a change that materially affects you, tell you directly.

georges.boum18@gmail.com. Georges Anthony Boum, 176 rue Angora, Dollard-des-Ormeaux, Quebec H9B 2G8, Canada. You may also complain to the Commission d'accès à l'information du Québec.