Privacy policy

1. What data we process

• Data sent through forms (contact, demo request, waitlist): name, email, phone, WhatsApp, message.
• Account and order data: name, email, phone, billing details.
• Event and guest data entered by the host.
• Minimal technical data needed to run the site (for example, IP address in server logs).

2. Why, and on what basis

• To answer your messages and requests: your consent and steps taken before entering a contract (Art. 6(1)(a) and (b) GDPR).
• To provide the service you ordered and issue invoices: performance of a contract and legal obligations ((b) and (c)).
• To tell you about our launch if you joined the waitlist: your consent ((a)), which you can withdraw at any time.
• To keep the site secure: our legitimate interest ((f)).

3. Guest data

For guest data entered by a host, the host is the controller and espressimo acts as processor, following the host's instructions and only for the event. We do not sell this data or use it for advertising.

4. Who we share data with

We use providers that help us run the service: web hosting (Vercel), database (Supabase), the payment processor and our email provider. They process data only on our behalf. If data leaves the European Economic Area, the transfer is covered by appropriate safeguards such as standard contractual clauses.

5. How long we keep data

• Messages and requests sent through forms: up to 24 months.
• Waitlist: until launch plus 12 months, or until you withdraw consent.
• Event and guest data: up to 30 days after the invitation's display period ends, then deleted.
• Accounting records: for the period required by law.

6. Your rights

You have the right to access, rectify, erase, restrict and port your data, to object, and to withdraw consent. Write to us at [email]. If you are not satisfied with our answer, you can complain to the Romanian data protection authority (ANSPDCP) or to the authority in your country of residence.