Privacy
What this service collects, who can see it, and how long it is kept.
Two kinds of person, and you are probably the second
Buyers bought an invitation and have an account here.
Guests replied to an invitation somebody sent them. If that is you: you have no account with us, you did not sign up, and your details are held because the person who invited you asked for them. This page is mostly about you.
What is collected from a guest
Only what the reply form asks, and only what you typed into it:
- whether you are coming, and how many people you are bringing
- the answers you gave to the questions on the form, which usually include your name
- anything the hosts chose to ask, which commonly includes an email address and dietary requirements
No IP address, no browser or device information, no referrer, and no analytics or advertising trackers of any kind. The reply endpoint counts requests briefly, in memory, to stop automated abuse, and what it holds is a one-way hash that is discarded when the process restarts. Nothing about your device is written to the database. That is unusual and it is worth saying plainly.
Dietary requirements are health information, and read together they can suggest religious belief. They are treated as sensitive throughout: classified as such on the question itself, and erased on the schedule below by a job that reads that classification rather than the words you wrote.
Who can see a reply
- The hosts who sent you the invitation. They can read replies and delete them. They cannot edit what you wrote.
- Us, as the operator, for support and where the law requires it. This is technically unavoidable, because we run the database, and it is listed here rather than left implied.
- Nobody else. Replies are not public, not readable from the invitation page, not sold, and not shared with any advertiser. There is no third party analytics on the invitation page.
The hosts can download their replies as a spreadsheet, because a caterer needs a list. Once they do, that copy is theirs and the schedule below no longer reaches it. They are responsible for what happens to it.
How long it is kept
| When | What happens |
|---|---|
| Hosting ends | The invitation page keeps working for 30 more days. No new replies are accepted from this moment. |
| 30 days later | The invitation page stops showing the event. |
| 30 days after that | Every answer that is about a person is erased. Names, contact details, dietary notes and messages are set to empty and cannot be restored. What survives is the count: whether a reply said yes or no, how many people it was for, and any answer the hosts marked as being about nobody, such as a menu choice. |
| 365 days after the page stops serving | The event and everything under it is deleted outright. |
| If the hosts close their account | Everything under it is deleted immediately. |
The erasure job runs every day at 03:17 UTC and records that it ran, so a day it did not run is something we can see rather than something nobody notices. The database itself refuses to hold a half-erased reply, so a job that only half worked fails loudly instead of leaving convincing-looking rows behind.
Asking to be erased sooner
You can ask at any time and you do not have to give a reason. Write to not configured yet with the invitation link you replied to and the name you replied under.
We will answer within 30 days and usually within a few working days. Erasure is a delete rather than a flag: the reply stops existing.
You can also ask the hosts, who can delete your reply themselves. If you would rather not contact them, write to us instead.
Where it is stored
The database is hosted in the United States. If you and the hosts are in different countries, your reply crosses a border to get to them, which is true of any hosted service and is stated here because it should be.
Australian Privacy Act, GDPR and UK GDPR
This service is operated from Australia. Dietary requirements are health information under the Privacy Act, and read together with a name they can suggest religious belief; both count as sensitive information. A small business exemption may currently apply to us on turnover, and we are not relying on it: this document is written to the Australian Privacy Principles because the alternative is holding sensitive information about people who are not our customers on the strength of an exemption that is under active reform.
If a guest is in the EU or the UK: the hosts are the controller of their guests’ data and we are the processor acting on the hosts’ instructions. The processing terms between us and the hosts are in the terms. Guests may exercise their rights with either of us and we will route the request.
If a buyer asks a question they should not
Hosts choose the questions on their own reply form. They are told, in the terms, not to ask for anything they do not need, and never for government identifiers, payment details or health information beyond dietary requirements. A form is limited in how many questions it can ask and how long a question can be.
If you have been asked something that seems wrong, tell us at not configured yet. We can remove a question and erase the answers to it.
Changes, and the honest caveat
If the retention schedule above changes, it changes here and in the code that runs it at the same time, because the page reads its numbers from the same place the job does.
This document describes what the software actually does, and it has been written carefully. It is not legal advice and it has not yet been reviewed by a qualified practitioner. It should be before this service takes real money.