Data processing agreement
DRAFT — awaiting legal review
The facts on this page are accurate and read from the application itself. The wording has not yet been reviewed by a lawyer, so for now this is not a legally binding document.
This is a draft data processing agreement between the venue using the app and us, who maintain it. Every fact in it was read from the application itself.
Who is who
The venue decides whose data it enters and why — it is the controller. We only store and process that data on the venue's instructions, as far as is needed for the app to work — we are the processor.
What is processed, and why
Client data (inquiries, offers, contracts and payments), guest data from the portal (name, child's age, attendance, accommodation, dish choices, and allergies with consent) and venue staff data (name, e-mail address, role). It is processed only so the venue can run its events — for nothing else, and it is never sold to anyone.
For how long
For as long as the venue uses the app. Guest allergies are deleted the day after the event. When the venue deletes its account, all data and all images go immediately and irreversibly.
Who the data is passed to
Only those listed below, and only for what is stated next to each one. Anyone who adds another must add them to this list too — the app checks that with every code change.
- Neon · Database · Frankfurt, Germany (European Union) · All venue data
- Resend · Sending email · European Union / USA · Only the email address and the sign-in link
- Cloudflare R2 · Image storage · European Union · Only the invitation image the host uploads
- Anthropic · AI assistance · United States · Only the text you send to the AI yourself: a client inquiry, a pasted e-mail, a guest list, or the list of changes to a work order. Never allergies. Active only while AI assistance is switched on.
How the data is protected
- One venue's data is separated from every other venue in the database itself — not only by the application code.
- Who may do what is set out explicitly per role. Every page and every button checks it, and a check that none was left unguarded runs with every code change.
- Passwords are never stored, only their hash. Every sign-in is verified against the database, so revoked access takes effect immediately.
- Of the links for clients and guests, the database holds only a hash — not even we can read them. A new link invalidates the old one.
- Guest allergies are health data: they require explicit consent, only the kitchen can see them, and they are deleted the day after the event.
- A data export contains only the fields listed explicitly. Passwords and sign-in tokens never leave.
- Deleting a venue deletes all of its rows in the database and all of its images in storage, immediately and irreversibly.
What the venue can do itself
At any time the venue can download all of its data as a file and delete the venue or the account, with no questions and no waiting. Both are in the app, under “Your data”. If a guest asks the venue for their data or its deletion, the venue can handle it itself.
What this draft does not cover
Jurisdiction and governing law, liability and damages, deadlines and the procedure for reporting an incident, the right to audit, and the terms for transferring data outside the European Union for AI assistance. That is a lawyer's work, not a program's, and until it is done this remains a draft.