Privacy & data retention
Effective November 3, 2026. Contact: hello@kindlyseatedco.com. Kindly Seated is based in Utah, USA.
What we collect, and why
| Data | Why | Kept until |
|---|---|---|
| Guest names and table assignments you upload | To make your files and run your guest page | 30 days after your event date (unpaid drafts: 14 days without activity), or when you delete the event |
| Event details you type (names on the chart, date, venue) | Same | Same |
| Your email address (collected by our payment provider at checkout) | Your receipt, sign-in links you request, and support | As long as needed for accounting and support |
| Payment record (amount, date). No guest names. | Accounting and tax law | As long as the law requires |
| Basic counts of pages viewed and steps reached (for example, "preview viewed"), with the kind of site a visit came from (for example "Google search") and the first page visited. Counted without cookies; no IP address, device ID or full web address is stored | Improving the service and measuring which pages help people | Not linked to your guest names. Linked to an event only as a step count and channel label |
If your file has extra columns (addresses, meals, emails), we read only the name and table columns you confirm. The original upload is discarded once you confirm the columns. Please don't upload more than you need to.
What we don't do
- We don't sell or share your data, or use it for advertising.
- We don't use advertising or tracking cookies.
Cookies
We use one strictly necessary cookie: a secure login cookie that keeps you signed in to your own event on your device. It's set only when you start an upload or open your management link; reading our information pages sets no cookies. There are no analytics or advertising cookies, so there's no cookie banner.
When you arrive from another site, links on our pages may carry a short label such as ?ch=organic-google&lp=home. It says only which kind of site you came from and which page you landed on, so we can tell which pages lead to orders. It contains nothing about you.
Who can see what
- Your management page is private. It opens only with your private management link, or on a device where you've already used it.
- The guest page (the QR code) can be opened by anyone with its link. It doesn't show the guest list. Visitors type a full name and see that guest's table. It's hidden from search engines and can't change anything.
Service providers
We use a few providers to run the service. Each one only processes data to do its job for us:
- Render: hosts the website and database (United States).
- Stripe: processes payments. We never see or store card details. See Stripe's privacy policy.
- Squarespace / Mailgun: delivers email sent to our support address.
- Resend: sends your receipt and sign-in links to the email address you gave at checkout (United States). It receives your email address, your event name and links, never your guest list.
Your choices and rights
- Delete any time: the "Delete event" button on your dashboard removes your guest list, files and guest page immediately.
- See, correct or delete your data: edit names in your dashboard, or email us and we'll respond within 30 days.
- Do Not Track: we don't track you across sites, so browser Do Not Track signals don't change anything here.
Customers in the EU, UK and similar regions
- Roles: for your guest list, you decide what's uploaded and why, so you're the "controller" and we act as your "processor". We process it only to provide your files and guest page, and delete it on the schedule above. For your own email and payment details, we're the controller.
- Legal basis: to perform our contract with you, plus legitimate interest for basic, non-identifying usage counts and fraud prevention.
- International transfer: data is stored in the United States. Our providers use standard safeguards such as the European Commission's Standard Contractual Clauses where required.
- Your rights: access, correction, deletion, restriction, objection and portability. Email us to use them. You can also complain to your local data protection authority.
Children
The service is meant for adults planning events and isn't directed to children under 13. We don't knowingly collect information from children.
Security
Connections are encrypted (HTTPS). Management links are long random codes, stored only in scrambled form. We keep only the data the service needs.
Changes
If we change this policy, we'll update the effective date above. Significant changes will be shown on the site.