Privacy Policy

1. Data Controller Information

EventHub is developed and operated by Denis Fedorovici, str. Studenților 5, MD-4839 Stăuceni, mun. Chișinău, Republic of Moldova. For account, payment, security, support, and service-operation data, Denis Fedorovici is the controller. For personal data that organizers enter or collect about other people — guests and their replies, clients and leads, contractors — the organizer is the controller, and EventHub processes that data on the organizer’s behalf under the Data Processing Agreement. Privacy inquiries can be sent to privacy@geteventhub.app.

2. Scope and Legal Bases

This policy applies to the EventHub website and mobile application. We process data to perform our contract with users (Art. 6(1)(b) GDPR), based on consent for optional features such as push notifications, device permissions, and the AI assistant (Art. 6(1)(a) GDPR), to comply with legal obligations (Art. 6(1)(c) GDPR), and for legitimate interests such as service security, fraud prevention, and the feedback and business e-mails described in section 3 (Art. 6(1)(f) GDPR). Where applicable, users in the European Economic Area and the United Kingdom have the rights provided by the GDPR and UK GDPR. Requests about data an organizer holds about you — for example as a guest or a client — are best sent to that organizer; we forward such requests we receive and help the organizer answer them. Individuals planning a personal celebration are generally outside the GDPR for their own use of guest data, but EventHub applies the same protection to it.

3. Data We Collect

We collect the minimum necessary amount of data required to provide our service:

• Account and authentication data: name, email address, password hash, and identifiers received from Google Sign-In or Sign in with Apple when those options are used.
• Event and planning data: event details, locations, schedules, tasks, budgets and expenses, seating plans, gift lists, polls, quizzes, invitations, and team information.
• Guest and communication data: names, contact details entered by organizers, attendance reply status, custom guest fields, comments, wishes, guestbook entries, and chat messages.
• Menu choices and dietary requirements that guests give in reply to an invitation. They can reveal health information, such as allergies, or religious beliefs; they are used only for that event, and the organizer who asks for them is responsible for the lawful basis.
• Organization workspace data: the organization’s name, contacts, address, and public page; team members and their access; clients and leads — names, phone numbers, email addresses, Instagram usernames, messages, and notes entered by the organization or sent by people themselves through the lead form on the organization’s public page or by Instagram direct message; meetings, tasks, contract amounts, payments, and payouts; contractors and the estimates shared with them by private link; and the organization calendar, including its private subscription link.
• Device contacts (mobile apps, only when you use “pick from contacts”): with your permission, EventHub can read a contact you select so you can fill a guest name and phone number. We do not upload your full address book.
• Media and device sensors: event covers, gallery images, invitation images, chat attachments, wishlist images, and photos or videos you capture or upload. On supported devices, camera access is used only when you take or attach media.
• Microphone and speech input (optional): when you use speech recognition or voice features, audio is processed to convert speech to text for the feature you requested. We do not use microphone audio for advertising.
• Approximate device location (optional): when you choose to use the map or “current location” controls, we may access approximate location to help place an event venue. Event addresses you type are also stored as event data.
• AI assistant inputs: messages you send to the EventHub AI assistant and the event context needed to answer (for example guest lists, tasks, schedule, or budget summaries for that event).
• Payment and entitlement data: transaction or purchase identifiers, product, price, currency, payment status, timestamps, and access rights received from Paddle, Google Play, or Apple when the applicable channel is used. EventHub does not receive or store full payment-card details.
• Technical and security data: IP address, browser and device information, app/device identifiers, push notification tokens, security logs, essential cookies, and local-storage values.
• E-mails: besides service e-mails (account messages, invitations, and the notifications you choose), we may send a one-time feedback e-mail when an event you created is left unused — sometimes with a personal discount — and business e-mails about EventHub to event organizers at the business contact details they publish. Each of these e-mails has an unsubscribe link, and we honor an objection immediately.
• We do not use marketing analytics or advertising pixels. If we ever turn them on, it will be only with your consent and with an update to this policy.

4. How We Use Data

We use data to create and secure accounts, provide event-planning, guest, and organization workspace features, authenticate users, process purchases, send service emails and requested push notifications, operate the optional AI assistant, provide support, prevent abuse, comply with law, and improve EventHub. Optional device permissions (contacts, camera, microphone, location) are used only after you grant them and can be revoked in system or in-app settings.

5. Service Providers and Data Sharing

• Google: optional Google Sign-In, Google Maps, Firebase services, Google Play distribution, Google Play Billing when offered, and Google Gemini / related AI models that process AI assistant prompts and the event context needed to respond.
• Google Cloud Text-to-Speech: when you use voice replies from the AI assistant Mira, the text of her reply is sent to Google to be read aloud.
• Google Drive: only when an organizer connects their own Google Drive to an event’s gallery — gallery photos are then copied into a folder in that Drive, and EventHub can reach only the files it creates there.
• Google Wallet and Apple Wallet: only when a guest saves their event ticket to a wallet. The ticket holds the event’s details (name, date, venue, programme), the guest’s name and party size, the table if one is assigned, the guest’s access and check-in codes, and a link to the guest app; for Google Wallet these details are sent to Google, and for Apple Wallet they are packed into a ticket file stored on the guest’s device.
• Apple: App Store distribution and, when offered, Sign in with Apple and Apple In-App Purchase.
• Firebase Cloud Messaging: delivery of push notifications to registered devices.
• Hetzner Online GmbH (Germany): the servers and databases that run EventHub.
• Cloudflare, Inc. (USA): delivery and protection of the website (content delivery, DNS, and defense against attacks and abuse) and storage of uploaded media in Cloudflare R2. Cloudflare also derives an approximate location — country and city — from the visitor’s IP address; we use it only to preset the phone code, the currency, and the map, and it stays in the browser for the session without being stored by us.
• OpenStreetMap data through the public Overpass API: to draw the map picture on an invitation, our server sends only the venue’s coordinates — no personal data.
• Paddle: merchant of record and payment processor for purchases made on the EventHub website, including checkout, tax, fraud-prevention, receipt, and refund processing.
• Sentry (EU data region): error and performance monitoring — technical data about failures (browser, device, page, and the organizer account ID). Session recordings, with text, input fields, and media hidden, are made only in the signed-in organizer area when something fails — never on guest pages, invitations, event websites, organizations’ public pages, lead forms, or shared estimates.
• Meta (Instagram): when an organization connects its Instagram account, direct messages sent to that account and the sender’s name, username, and Instagram ID are received by EventHub to become leads.
• Telegram: the name and message a visitor types into the support chat on the website are delivered to our support team through Telegram.
• Resend: delivery of e-mails — account e-mails, invitations, notifications, and the feedback and business e-mails described in section 3.
• Embedded content from Google Maps, YouTube, Vimeo, and Pinterest: a map, video, or pin loads only after the visitor clicks to load it; the provider then receives the visitor’s IP address and browser data and processes them under its own privacy policy.
• Authorities or professional advisers when disclosure is legally required or necessary to protect users, EventHub, or the public.

6. International Transfers and Security

Some providers may process data outside Moldova or the user’s country. Where required, we rely on contractual and other lawful transfer safeguards. We use HTTPS in transit, access controls, password hashing, restricted administrative access, secure token storage on supported mobile devices, and provider security measures. No system can guarantee absolute security.

7. Retention and Deletion

Account and event data are retained while the account is active and deleted when the user deletes the account, except for limited records retained where required by law, dispute resolution, fraud prevention, or security. Event photos and image attachments are scheduled for deletion 40 days after the event or a year after upload, whichever comes first, unless removed earlier or another displayed retention setting applies. Paddle and transaction records may be retained for legal, accounting, tax, refund, and fraud-prevention requirements. Backups and security logs are removed or overwritten according to operational retention cycles.

9. Children

EventHub is not directed to children. Organizers must not submit a child’s personal data without an appropriate legal basis and, where required, consent from a parent or legal guardian.