How your information is used

What happens to what you enter

What we keep: the names and needs you type, the time you sent them, and the country your connection came from (a two-letter code our network provider attaches; never an address). Food and drink needs count as health information, and access needs count as health and disability information, so we ask your permission first. If your host set a menu, we also keep which dishes each person chose, and any version of a dish they asked the kitchen for — that's a meal choice, not health information. Asking for the gluten-free version is an order, not a reason: it never becomes a need on your record, and we never read it as one. If you tell your host you can't make it, we keep your name and the fact that you can't come, and never a reason — there is nowhere to write one.
Why: so the host of your event can cater for you, and so you can get in and take part. Nothing else — never sold, never used for advertising. We only ask what you need, never why: there is no field anywhere for a condition, a diagnosis or a reason, and we never ask for proof of anything.
When a link is shared: your host’s invitation link shows a small card when it is pasted into a chat app or an email — the event name, the date, and who invited you. That is text your host already gave us, and the picture on the card is one we drew; nothing about you is in it, and it appears before anyone has opened anything. To build that card the app it was pasted into — WhatsApp, Slack, a work mail scanner — fetches the link from us, so the event name, the date and your host's name are visible to that company. If your host chooses to send one of their own photographs with the invitation, that picture goes straight from their phone into the message: it never reaches us and we never keep a copy.
Only what your host asked for: food, drinks and access are each asked about only if that host turned them on. If they didn't, we won't prompt you about them, and nothing you've saved on your own device is carried into the event automatically. You can still choose to tell your host something that would help you — that's your decision to make, not theirs to have anticipated.
What your host records back: your host can note what they've arranged for something you asked for — "step-free side entrance agreed", "seat reserved near the exit". Those notes stay with this event, are seen by the same people who can see the need itself, and are deleted with it on the same timetable.
Who sees it: the host of this event, and anyone they have asked to help run it, each through their own private link. Not other guests.
If your host gave us your name: a host can give us the list of the people they invited, so that replies can be told from invitations and they can see who hasn't answered. If they did, we hold your name as they wrote it and, if they gave one, your email address only as a hash that cannot be read back, for their event alone. We never write to you. It is deleted with the event, and your host can take you off it at any time if you ask them.
Signing in: to send a reply you can sign in with Google, Apple, or a code we email you. We keep what your sign-in gives us — your email address, the name on it if there is one, which way you signed in and the sign-in service's own reference for you — so the reply is yours to change and can't be sent twice; and for each browser you're signed in on, the day it was last used (a browser unused for 400 days is signed out). The sign-in itself is handled by Supabase, in London, which holds your email and which way you signed in; Google or Apple learn that you signed in to OffUrPlate, nothing about what you answered. The only email we ever send is that code; it goes through Mailgun, in the EU, and we keep no copy. If you press Next and don't finish signing in, what you typed is held on our side for up to an hour and then deleted. Or send without signing in: then we keep no contact details at all, your host holds your answer like one taken over the phone, and changing or deleting it is a request to them or to us.
Your account: one account, whether you're replying or running an event. From it you can see your replies and change them, add another way to sign in, sign out everywhere, or delete the account. Deleting it removes your email, your name, every way you sign in and what you kept of past events, here and — by our request to it — at the sign-in service; the replies stay with their events, under the same name, until the event's own deletion date. Beyond a sign-in email, we store no contact details: no phone numbers, no addresses.
Where and how long: your answers are stored in the EU, and the sign-in service's record of you in the UK. Answers are deleted automatically 14 days after the event (backups clear within about a month after that). The host can delete it sooner; you can delete yours any time.
If you run an event: once it has had its day and been deleted, we keep for you alone what you set up — its name, the day and time, how many you invited, which questions you asked and your menu — for 2 years from the day, so you can run it again. Nothing about your guests is kept. You can remove it from Your events at any time, and it goes with your account. While an event is running we also note when you last looked at its page, to show you what's new since. If you give us the names of the people you invited, we hold that list for you and your event alone — names, and emails only as a hash that cannot be read back — we never write to anyone on it, and it is deleted with the event.
If you pay for events: replying is always free, and so are your first three events in a year. When your next event is a paid one you can pay by card, or ask for an invoice. Both go through Stripe, which takes the payment on its own pages and sends its own emails: Stripe receives your sign-in email (or, for an invoice, the address you choose — one of your sign-in addresses, or another you give, such as your firm's accounts), the name and, if you add it, the firm's postal address you give for an invoice, the amount, and a reference for your account — never anything about your events or your guests. The postal address is kept by Stripe on the invoice, not by us. No card or bank detail ever reaches us. Stripe tells us when a payment is made and we record what you're entitled to — how many events, or until when — and, for an invoice, where it was sent and that it was sent and paid. Those records go with your account; a dealt-with invoice record is deleted a year on. If you take a year of events, Stripe holds the subscription — your card, each year's payment, and the cancelling, on its own page — and we keep its reference, its state and the day it runs to, so your account can say so; that goes with your account too. Stripe keeps its own records of payments, as the law asks of us both. Nothing a guest tells you is ever held back for payment.
Changed your mind: your own link has a Delete my answer button, and a reply you sent signed in has Delete my reply on the invitation itself — one tap, the same effort it took to agree.
Once the host has it: if they copy your answer into a message or a caterer's form, that copy is theirs and beyond our reach — ask them directly.
Telling us how it went: the page asking what worked and what didn't is optional. What you write is kept on its own, with the day it came and nothing else — never attached to your answer, your event, your account or anyone's needs — and we read it and delete it by hand; nothing deletes it for us. Please leave names and health details out of it; there's no need for either.

The legal bit

The formal wording, for the record.

Who's responsible (the "controller"): Legends Awaken Limited. Registered with the UK Information Commissioner's Office, reference ZC202242. Contact privacy@offurplate.com.
Lawful basis: allergy information is special-category health data, and access needs are special-category data about health and disability, so we rely on your explicit consent under UK GDPR Articles 6(1)(a) and 9(2)(a). Menu choices are ordinary personal data, not health data, and are covered by the same consent as the answer they are part of. Your account — the email, name and sign-in details above, and the link between you and your replies and events — is ordinary personal data we process to provide the account you asked for (Article 6(1)(b)).
Your rights: you may ask to see, correct or delete your data, or withdraw consent, at any time — through your own link, or by emailing privacy@offurplate.com (tell us the event and the name you used; we may ask for a little more so we don't act on the wrong person's data).
Complaints: you can complain to the Information Commissioner's Office at ico.org.uk.