Privacy Policy — Festvo

1. Who we are

Festvo ("we", "us", or "our") is an event management platform operated by Festvo Labs. Our registered email is hello@festivolabs.com. This Privacy Policy explains how we collect, use, and protect your personal data when you use our website and services at festvo.app.

2. What data we collect

Account data: your name, email address, and password (stored as a secure hash) when you register.
Event data: event names, dates, venues, guest lists, schedules, seating layouts, and budgets you create within the platform.
Guest data: names, email addresses, phone numbers, dietary requirements, and RSVP responses of guests you add to your events.
Vendor enquiries: messages, contact details, and event information shared when you contact a vendor.
Usage data: your IP address, browser type, pages visited, and actions taken within the platform, collected automatically for security and performance purposes.
Uploaded files: photos and images you upload for event websites and vendor profiles.

3. How we use your data

To provide and operate the Festvo platform and its features.
To send transactional emails such as email verification, RSVP notifications, planning reminders, and vendor enquiry confirmations.
To detect and prevent fraud, abuse, and security incidents.
To improve the platform based on aggregate usage patterns (no individual profiling).
To comply with legal obligations.

We do not sell your personal data to third parties. We do not use your data for advertising.

4. Guest data responsibilities

When you add guests to your event, you are the data controller for their personal information. You are responsible for ensuring you have the right to share their data with us and that guests are aware their information is being stored. We process this data solely on your behalf to operate the features you use.

5. Data sharing

We share your data only in the following limited circumstances:

Resend (email delivery service) — receives recipient email addresses and email content to deliver transactional emails on our behalf.
Vendors — when you send an enquiry, your name, email, phone, and event details you choose to share are forwarded to the vendor.
Legal requirements — if required by law, court order, or to protect the rights and safety of users.

6. Data retention

We retain your account and event data for as long as your account is active. If you delete your account, your data is permanently deleted within 30 days, except where we are required by law to retain it longer.

7. Security

We protect your data using industry-standard measures including encrypted sessions (JWT with HS256), bcrypt password hashing, HTTPS in production, rate limiting on authentication, and server-side ownership verification on all data mutations.

8. Your rights

You have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your account and associated data.
Export your guest and event data.

To exercise any of these rights, email us at hello@festivolabs.com.

9. Cookies

We use a single session cookie (festvo-session) to keep you signed in. This cookie is HTTP-only and is not accessible by JavaScript. We do not use advertising cookies or third-party tracking.

10. Changes to this policy

We may update this policy from time to time. We will notify registered users by email of any material changes. Continued use of Festvo after changes are published constitutes acceptance of the updated policy.

11. Contact

For any privacy-related questions or requests, contact us at hello@festivolabs.com.