Privacy policy

1. What data we process

• Data sent through forms (contact, demo request, waitlist): name, email, phone, WhatsApp, message.
• Account and order data: name, email, phone, billing details.
• Event and guest data entered by the host.
• When someone replies to an invitation: the date and time of the reply, the type of device and browser, and the approximate city (derived from the IP address, which is not stored), so the host can keep track of replies.
• For partners (service suppliers): the business details in the profile (name, description, city, phone, e-mail, website) and service photos, shown to signed-in clients. When you request a quote, your name, e-mail, phone, event date and message are shared only with the partner you contact.
• Minimal technical data needed to run the site (for example, IP address in server logs).
• Anonymous visit statistics for the presentation pages (Vercel Web Analytics): page, country, device type and where the visit came from, without cookies and without identifying you.

2. Why, and on what basis

• To answer your messages and requests: your consent and steps taken before entering a contract (Art. 6(1)(a) and (b) GDPR).
• To provide the service you ordered and issue invoices: performance of a contract and legal obligations ((b) and (c)).
• To tell you about our launch if you joined the waitlist: your consent ((a)), which you can withdraw at any time.
• To keep the site secure and for anonymous visit statistics that show us which pages are useful: our legitimate interest ((f)).

3. Guest data

For guest data entered by a host, the host is the controller and espressimo acts as processor, following the host's instructions and only for the event. We do not sell this data or use it for advertising.

4. Who we share data with

We use providers that help us run the service: web hosting (Vercel), database (Supabase), the payment processor and our email provider. They process data only on our behalf. If data leaves the European Economic Area, the transfer is covered by appropriate safeguards such as standard contractual clauses.

5. How long we keep data

• Messages and requests sent through forms: up to 24 months.
• Waitlist: until launch plus 12 months, or until you withdraw consent.
• Event and guest data: up to 30 days after the invitation's display period ends, then deleted.
• Accounting records: for the period required by law.

6. Your rights

You have the right to access, rectify, erase, restrict and port your data, to object, and to withdraw consent. Write to us at gv.ionut@gmail.com. If you are not satisfied with our answer, you can complain to the Romanian data protection authority (ANSPDCP) or to the authority in your country of residence.

7. AI assistants (MCP)

You can connect your account to an AI assistant through an MCP (Model Context Protocol) server. The connection starts from the assistant, but it does not happen until you sign in to espressimo and explicitly approve the permissions requested on a consent screen.

• Data reaches the assistant only after this consent, within the permissions you chose: reading events, changing events, reading guest names, guests' contact details (phone, e-mail) and adding guests. Contact details are shared only with the separate contact permission.
• We do not send your data to AI providers in any other way. Without a connection you approved, no assistant has access to your account.
• The assistant's provider (for example Anthropic, OpenAI, Google or xAI) is an independent controller for the data it receives through the assistant and processes it under its own privacy policy. Read it before you connect an assistant.
• You can disconnect an assistant at any time in your Profile, under connected assistants; access stops immediately. We cannot delete data the assistant's provider has already received; ask the provider directly.
• We keep a technical log of the actions taken through an assistant (which permission, which action, when) for security and troubleshooting. Events created through an assistant are marked internally with the assistant's name.
• If you arrived through a link given by an assistant, we save the name of that assistant as the source of your account when you sign up (see the Cookie policy). We use it only for internal statistics.