Privacy Policy

Who is responsible

Eventloom is responsible for the personal information it collects to run the service: host accounts, billing, security, support and reports. Eventloom is based in Ontario, Canada; our privacy contact is hello@eventloom.co.

RSVP replies are different. The host of each event decides what to ask guests and why, so the host is responsible for guest replies (the "controller"). Eventloom stores and processes replies for the host (as a "processor" or "service provider") under our Creator Data Processing Addendum. Each event's RSVP form shows the host's own privacy contact.

Information we collect about hosts

• Account: email address, name, password (stored only as a secure hash by our authentication provider; we never see it), Google sign-in identifiers if you sign in with Google, multi-factor authentication settings, your 18+ confirmation, and records of which policy versions you accepted (version, time, a keyed hash of your IP address and your browser type).
• Event content: what you tell the page builder, page text, schedule, location, RSVP questions, your event privacy notice, version history, and photos you upload. We resize uploaded photos and remove their hidden metadata, such as GPS location.
• AI use: the instructions you give the AI and a record of AI credit granted and used.
• Payments: order and payment records (amount, currency, date, status and Stripe reference numbers). Stripe collects your card and billing details; we never receive your full card number.
• Support, feedback and requests: messages you send us, product feedback, and privacy requests (stored encrypted).

Information we collect about guests

When a guest replies to an event, the host receives:

• name, whether they are attending, and party size;
• names of other people in their party;
• email address and phone number, only if the host asks for them;
• meal choices or dietary notes, answers to the host's own questions, and any note to the host.

Dietary notes can reveal health or religious information; share only what you are comfortable sharing. To stop spam we also keep a keyed hash of the IP address (not the address itself) with each reply attempt, and the RSVP form runs a Cloudflare Turnstile bot check. We do not send guest replies to OpenAI.

Information about everyone who visits

• Technical and security data: our hosting provider (Vercel) processes IP addresses, browser details and the pages requested in order to deliver pages and protect the service. Where we keep IP information in our own database (rate limits, abuse logs, reports, policy acceptance) we store a keyed hash, not the address.
• Content reports: what you report, why, any details you add, your email address if you choose to give it, and a keyed hash of your IP address.
• We do not use analytics, advertising cookies, tracking pixels or cross-site tracking. Event pages ask search engines not to index them.

How we use information

• To provide Eventloom: accounts, building and hosting pages, collecting RSVPs, showing replies to the host, exports and deletion.
• To run AI features: we send your instructions, page text and photos you choose to use to OpenAI to generate or edit your page.
• To keep Eventloom safe: automated moderation of event text and uploaded images (OpenAI), bot checks (Cloudflare Turnstile), rate limiting, reviewing reports, suspending pages that break our rules, and investigating misuse.
• To take payments and keep tax and accounting records.
• To answer support, privacy and legal requests, and to meet legal obligations.
• To improve Eventloom using feedback you send us.

We do not sell personal information, use guest replies for our own marketing, show advertising, or use your content or guest replies to train AI models. Our AI provider's API terms say API data is not used to train its models by default.

We send account emails (such as sign-in links and password resets). We don't send marketing emails unless you have agreed to receive them, and every marketing email will have an unsubscribe link.

Legal bases (EU and UK)

If EU or UK data protection law applies to you, we rely on: performing our contract with you (providing the service); our legitimate interests in keeping the service secure, preventing abuse and improving it; legal obligations (such as tax records and lawful requests); and consent where we ask for it. For guest replies, the host decides the legal basis.

Who we share information with

• The host: guest replies are shared with the host of that event, who can view and export them.
• Service providers that run parts of Eventloom for us, under contracts that limit how they use the information: Supabase (authentication, database and photo storage), Vercel (hosting and delivery), OpenAI (AI generation and content moderation), Stripe (payments), Cloudflare (Turnstile bot checks) and ImprovMX (forwarding email sent to our addresses). Our Subprocessors page has details.
• Authorities or others when the law requires it, or when needed to protect someone's safety, investigate fraud or abuse, or enforce our Terms.
• A buyer or successor if the business is sold or reorganized, who must keep protecting the information as this policy describes.

Fonts on Eventloom pages are served from our own domain, so loading a page does not send your information to Google.

Where information is stored

Eventloom is based in Canada, but our providers store and process information in the United States and other countries (for example, our database is hosted in the United States and Vercel and Cloudflare operate worldwide). Information stored abroad is subject to the laws of those countries and may be accessible to their courts and authorities. We rely on our providers' contractual safeguards, such as standard contractual clauses, for transfers from the EU and UK.

How long we keep information

• Guest replies: automatically deleted 90 days after the event's end date, by a daily job, unless a legal hold applies. They are deleted sooner if the host deletes the reply, the event or their account.
• Hashed IP records used for RSVP rate limits: deleted after 30 days. The hashed IP on product feedback is removed after 30 days.
• Event pages, drafts and photos: kept until you delete the event or your account. A published page goes offline when its paid hosting ends; the draft stays in your dashboard until you delete it.
• Your account: kept until you delete it. When you delete your account we delete your events, photos and guest replies. We keep order, payment and policy-acceptance records, separated from your account, for as long as tax and accounting law requires (generally six years after the end of the tax year in Canada).
• Security and audit logs: kept up to 12 months unless needed for an ongoing investigation.
• Content reports and enforcement records: kept as long as needed to handle the report, prevent repeat abuse and meet legal obligations.
• Privacy requests: kept as long as needed to show how we handled them.
• Backups: deleted information can remain in our providers' backups for a limited time until it is overwritten.

Your rights and how to make a request

Depending on where you live, you can ask to access, correct or delete your personal information, withdraw consent, or (in the EU and UK) object to or restrict processing and receive your data in a portable format. Making a request is free.

• Hosts: you can export guest replies, delete events and delete your account from your dashboard, or use the privacy request form.
• Guests: the quickest route is the host, whose privacy contact is shown on the RSVP form. You can also use our privacy request form at /privacy/request. Because the host is responsible for replies, we may pass your request to them, and we will help them answer it.

We verify your identity before showing or changing information and aim to reply within 30 days, as Canadian law requires (we will tell you if we need an extension the law allows). You can also complain to the Office of the Privacy Commissioner of Canada or, in the EU or UK, your local data protection authority.

Children

Hosts must be at least 18, and Eventloom is not directed at children. Guest replies may include the names of children attending an event, entered by a parent, guardian or the host; hosts should ask only for what they need. If you believe a child has given us personal information without a parent's or guardian's consent, contact us and we will delete it.

Security

We use HTTPS everywhere, encryption at rest by our providers, access controls that keep each host's data separate, extra verification (multi-factor authentication) for sensitive actions such as paying, exporting guest data and deleting an account, keyed hashing of IP addresses, private photo storage with metadata removed, encrypted privacy requests and signed payment notifications. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify affected people and the Privacy Commissioner of Canada as the law requires, and other regulators where their laws apply.

Changes and contact

We will post changes here with a new version number and effective date (this version: 2026-10-09, effective October 9, 2026) and ask hosts to accept material changes the next time they sign in. Questions or complaints: Eventloom, 335 Webb Dr, Mississauga, ON L5B 4A1, Canada. Email: hello@eventloom.co.