Privacy Policy

This policy explains what data Occasi collects, how we use it, and what your rights are. We've kept it plain-English because privacy policies should be readable, not legalese.

1. Who we are

Occasi is a UK-based service that helps people create event websites and collect RSVPs for weddings, birthdays, baby showers and other private events. You can contact us at [email protected].

2. Data we collect about you (the host)

When you create an account, we store:

• Your email address and chosen password (passwords are securely hashed — we never see them in plain text).
• Your name (if you provide it during signup).
• Your purchase status, hosting dates, Stripe customer ID and billing details, plus subscription information where an earlier offer applies. Payment card details themselves are handled by Stripe — they never touch our servers.
• The event content you create: names, dates, venues, photos, optional music, domain enquiries, story, schedule, dress code, etc.
• Basic usage logs (when you sign in, errors that occur) to help us debug and improve the service.

3. Data we collect about your guests

When your guests submit an RSVP, we store the data they provide: their name, attendance, meal choice, dietary needs, song requests, transport preference, and any personal note. We do not ask guests to create an account.

Hosts can view guest replies in their dashboard and export them. Occasi and the service providers described below process this information to operate the invitation and RSVP service. Guests should contact their host to correct or remove an RSVP, or contact Occasi for help.

4. How we use this data

• To run the service — show your event website, store and display your RSVPs.
• To process payments (via Stripe).
• To send you essential service emails (account confirmation, billing receipts, important changes).
• To improve Occasi — we look at aggregate usage patterns, not individual events.

We do not sell your data, share it with advertisers, or use it to train AI models.

5. Where your data lives

Our primary Supabase project is configured in Frankfurt, Germany. We use Supabase for accounts, event records and uploaded files, Cloudflare for website hosting and delivery, and Stripe for payments. These providers operate internationally, so processing is not limited to the UK and EU. Their privacy information explains their processing locations and transfer safeguards: Supabase, Cloudflare and Stripe. External font and software delivery services may also receive ordinary connection information, such as an IP address, when your browser loads a page.

Invitation photos, optional music and memory-book photos are served using publicly accessible file links. Anyone who has a file link can access that file. Taking an invitation offline, removing its music or hiding a photo in the memory book does not by itself revoke the direct file link. Only upload photos and music you have permission to share.

6. Cookies

We use browser storage and essential cookies where needed to keep you signed in, remember preferences and run account and payment features. We don't use tracking cookies or third-party advertising cookies on Occasi.

7. Your rights (UK GDPR)

You can:

• Access all the data we hold about you — view it in your dashboard, or email us for a full export.
• Correct any inaccurate information — edit it directly in the dashboard.
• Delete your account through Account settings and its confirmation steps, or email us for help.
• Take your data with you — export RSVPs to CSV any time.
• Object to how we use your data — contact us and we'll discuss.
• Complain to the UK Information Commissioner's Office (ico.org.uk) if you think we've mishandled your data.

8. How long we keep data

We keep your invitation content, guest replies and memory-book data while your account remains open. The 12-month hosting period starts from confirmed payment. Hosting expiry takes an invitation offline; it does not automatically delete its content or your account. A successful account deletion removes your account, invitations, guest records and associated uploaded files from the active service. Copies may remain temporarily in provider backups and logs. Payment providers may retain billing records for their legal and accounting obligations. Contact us if a deletion does not complete or you need help with a data request.

9. Children's data

Occasi accounts are intended for adults arranging events. A host, parent or guardian may include a child's name or meal choice in an invitation or reply. Only provide the information needed to arrange the event, and only share children's details or photographs when you have authority to do so.

10. Changes to this policy

If we make material changes to this policy, we'll email you and update the "Last updated" date above. Minor wording tweaks happen without notification.

11. Contact

For any privacy question, email [email protected] and we'll get back within 5 working days.