Privacy Policy

1. Information we collect

When you create an account on Evvy, we collect your name, email address, and password (stored in hashed form). If you sign in with Google, we receive your name and email from Google.

We also collect information about the events and calendars you create (title, dates, location, description, colour), and statistics about interactions with your public pages (page views and calendar link clicks).

When guests respond to an RSVP, we collect the name, email address (optional), response status, and any message they choose to provide. This data is stored on your behalf and is visible to you as the event organiser.

If you subscribe to the Premium plan, Stripe processes your payment information directly. We do not store your card details; we only retain a Stripe customer ID and subscription status.

2. How we use your information

We use the information we collect to provide, maintain, and improve Evvy. This includes creating and managing your events and calendars, generating shareable links, tracking statistics at your request, enabling RSVP functionality, and processing your subscription.

We may send you transactional emails related to your account: email address verification, password resets, payment confirmations, and subscription status changes. If you have enabled RSVPs on an event, guests who provided their email address may receive automated reminder emails (24 hours and 7 days before the event). We do not send marketing emails without your explicit consent.

We do not sell or share your personal data with third parties for advertising purposes.

3. Third-party services

Evvy uses the following third-party processors:

• Stripe — payment processing for Premium subscriptions. Stripe's privacy policy applies to card data.
• Resend — transactional email delivery (verification, payment confirmation, RSVP reminders).
• Vercel — hosting and infrastructure.

4. Cookies

Evvy uses essential cookies to keep you signed in and remember your preferences (such as language). We also use a cookie-based deduplication system to count unique calendar link clicks (30-day cookie per event and service). These cookies contain no personally identifiable information.

5. Data retention

Your account data and events are stored as long as you maintain an active account. You can delete individual events at any time (Premium plan). You can permanently delete your account and all associated data directly from the Profile page — this action is immediate and irreversible, and cancels any active subscription.

6. Your rights (GDPR)

If you are located in the European Economic Area, you have the right to access, correct, or delete your personal data, object to or restrict processing, and data portability. You can exercise most of these rights directly from your account settings. For any other request, please contact us via the Contact page.

7. Security

We take reasonable measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. Passwords are hashed using bcrypt before storage. Authentication sessions use secure, httpOnly cookies.

8. Contact

If you have questions about this Privacy Policy or wish to exercise your rights, please use the contact form.