Privacy

What we keep, and for how long

Out The GC is run by [YOUR NAME OR COMPANY], [YOUR ADDRESS]. For anything about your data, email [YOUR EMAIL].

If you're organising a party

When you create an invite we store the event details you type in, a password (stored hashed — we can't read it), and the replies your guests leave. There's no account and no email address attached, which means:

• Your password can't be reset. Lose it and the guest list is unreachable.
• We can't identify you, contact you, or send you marketing.

You're the one deciding what to collect from your guests, which under UK GDPR makes you the data controller for that guest list. We're the processor — we store it for you and delete it on schedule.

If you've been invited to something

When you RSVP we store what you type: your name, your reply, your mobile number if the host asked for one, and any allergies or dietary needs you tell us.

Allergy information is health data — a special category under UK GDPR. We ask for it only because caterers need it, we show it only to the person hosting your event, and it's deleted on the same schedule as everything else. If you'd rather not put it in writing, leave the box empty and tell the host directly.

Who can see what

• The host sees everything on their own guest list, after logging in with their password.
• Other guests see a headcount and initials on the invite page. Never names, numbers, allergies or payment status.
• Anyone with the link can see the invite itself and can RSVP. Invite pages are hidden from search engines, but a link that gets forwarded travels.
• We can technically reach the stored data as the operator, and won't except to fix a fault or where the law requires it.

Deletion

Every event has a deletion date: 10 days after the event date. On that date the event and every reply attached to it — names, numbers, allergies, payment status — are permanently deleted by an automatic job. Nothing is archived.

Move your event's date and the deletion date moves with it. Want it gone sooner? Remove the replies from your dashboard, or email us.

Payments

Money between you and your guests never touches us. You supply your own payment link (Monzo, PayPal, Revolut or similar) and guests pay you directly. We store only whether someone said they've paid and whether the host has confirmed it — never card details, bank details or transaction data.

If you upgrade an event to unlimited guests, that £40 is handled by Stripe, who process your card details under their own privacy policy. We receive confirmation that the payment succeeded, not your card number.

Where it's stored

On servers in the United Kingdom, through our hosting provider Vercel. Guest data is held in private storage that isn't reachable from the public internet.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete it before the automatic date. Email [YOUR EMAIL]. If you're a guest, the quickest route is usually to ask whoever invited you — they can remove you from the list themselves in seconds.

Unhappy with how we've handled it? You can complain to the Information Commissioner's Office at ico.org.uk.

Cookies

One cookie, set only when a host logs in, to keep them logged in for 30 days. No analytics, no advertising, no third-party trackers.

Last updated [DATE].