Privacy Policy

eventflair is operated by Hashtag Events. For organiser account data we are the data controller. For the event, attendee and customer data an organiser uploads, the organiser is the controller and we act as their processor.

• Account data: names, email addresses and sign-in credentials for users.
• Organiser content: events, attendees, customers, orders, documents and images that organisers upload — processed only on their instructions.
• Usage data: pages visited, actions taken and device/browser information.
• Billing data: handled by Stripe; we store subscription status, not card details.

We use essential storage to keep you signed in and remember your preferences. Optional analytics cookies (Google Analytics) only load after you accept them in the cookie banner. You can change your choice at any time by clearing site storage.

Each organisation's data is isolated and access-controlled at the database level. Data is encrypted in transit and at rest. Access to production data is limited to authorised personnel and logged.

• Lovable Cloud — application hosting and database infrastructure.
• Stripe — payment processing and subscription billing.
• Lovable email delivery — transactional and campaign email sending.
• Lovable AI Gateway — optional AI features such as outreach drafting.
• Google Analytics — optional, consent-based usage analytics.

Organiser data is kept while the account is active. After cancellation it is retained read-only for 90 days, then deleted. Organisers can export their data at any time. Attendee-level rights requests (access, correction, erasure) should be made to the event organiser; we assist them in fulfilling requests.

Under UK GDPR you have rights of access, rectification, erasure, restriction, portability and objection. To exercise them for your account data, contact privacy@eventflair.app. You may also complain to the Information Commissioner's Office (ICO).

Privacy questions and requests: privacy@eventflair.app.