Privacy Policy

1. A Quick Summary

• We collect only the information needed to run the Service.
• We never sell your data and we never use it to train AI models.
• We never contact the people on your guest list.
• We use a small number of trusted providers (Supabase, Stripe, Google, Resend, Vercel) to run the Service.
• We only use essential cookies. No ad trackers, no third-party analytics.
• You can access, export, or delete your data at any time.

The sections below explain each of these points in detail.

2. Information We Collect

We collect information in three ways: information you provide directly, information you create inside the app, and a small amount of technical information that is automatically collected when you visit the Service.

Information you give us

• Account information. When you sign in with Google, we receive your name and email address from Google.
• Payment information. When you purchase Arranged, our payment processor (Stripe) collects and processes your payment details. We receive a confirmation and the last four digits of your card, but we never see or store your full card details.
• Support messages. If you email us, we keep a copy of your message and our reply.

Information you create inside Arranged

• Event data. The floor plans, tables, seating arrangements, and notes you build in Arranged.
• Guest list data you upload. Guest names and, optionally, email addresses, phone numbers, dietary notes, or any other fields you choose to include when importing a guest list.

You decide what goes into your guest list. The minimum we need from you is a name per guest. Everything else is optional.

Information collected automatically

• Device and browser information. Browser type, operating system, screen size, language, and similar technical details that help us serve the app correctly.
• Log information. IP address, approximate location based on that IP address (usually just a city or region), timestamps, pages visited inside the app, and error reports.
• Session cookies. A small set of essential cookies used to keep you signed in. See Section 8 for details.

We do not collect precise geolocation (your GPS coordinates), and we do not use third-party advertising or analytics trackers.

3. How We Use Your Information

We use the information above for the following purposes:

• To provide the Service. Sign you in, save your work, display your events and guest lists back to you.
• To process your purchase. Send your payment to Stripe for processing and confirm your access once payment succeeds.
• To communicate with you. Send account emails (receipts, password resets, service updates), respond to support requests, and notify you about material changes to the Service or this policy.
• To keep the Service safe and working. Detect bugs, prevent fraud and abuse, enforce our Terms of Service, and improve reliability and performance.
• To comply with the law. Respond to lawful requests, keep required tax and payment records, and protect our legal rights.

We do not use your information for targeted advertising, and we do not use any of your information, event data, or guest data to train AI or machine learning models.

Legal bases (for users in the EU, UK, and Switzerland)

If you are in the European Union, United Kingdom, or Switzerland, we process your personal information under the following legal bases of the GDPR and UK GDPR:

• Contract. To deliver the Service you purchased.
• Legitimate interests. To keep the Service secure, prevent abuse, and make the product better, in ways that are balanced against your privacy rights.
• Legal obligation. To comply with tax, accounting, and other legal requirements.
• Consent. Where required by law. You can withdraw consent at any time.

4. A Special Promise About Your Guest List

When you upload a guest list to Arranged, you are trusting us with other people’s personal information. We take that seriously. Our promises:

• We will never email, message, call, market to, or otherwise contact anyone on your guest list.
• We will never sell, rent, or share guest data with third parties for their own use.
• We will never use guest data for advertising, marketing, or AI training.
• Guest data is used only to let you build and manage your seating plan inside Arranged.
• When you delete an event or your account, the associated guest data is deleted with it.

You are responsible for having the appropriate authority to upload guest information to the Service, and for telling your guests, where required, that their details are stored with a planning tool you use.

5. Third Parties We Work With

Arranged is a small operation. We rely on a short list of trusted providers to run the Service. Each one is contractually required to protect your information and to use it only to provide services to us.

• Supabase stores your account, event data, and guest data. See Supabase’s privacy policy.
• Stripe processes your one-time payment when you purchase Arranged. See Stripe’s privacy policy.
• Google handles sign-in via Google OAuth. We receive only your name and email address. See Google’s privacy policy.
• Resend sends our transactional emails (receipts, account emails, support replies). See Resend’s privacy policy.
• Vercel hosts the application and serves it to your browser. See Vercel’s privacy policy.

We may also disclose information if required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of Arranged, our users, or the public.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

6. How Long We Keep Your Data

We keep your account and event data for as long as your account is active. When you delete an event, the event data and its guest list are removed from our active systems promptly and from backups within 30 days.

When you delete your account, we remove your data within 30 days, except where we are legally required to keep records. For example, payment and tax records are retained for the period required by applicable financial and tax law (typically up to 7 years).

If you stop using Arranged without deleting your account, we may delete inactive accounts after an extended period of inactivity. We will email you before doing so.

7. Data Storage and Security

Your data is stored on servers operated by Supabase and Vercel, primarily in the United States. We use encryption in transit (HTTPS) and at rest, access controls, and reasonable administrative and technical safeguards to protect your information.

No system is perfectly secure. If we become aware of a security incident that affects your personal information, we will notify you and any regulators required by applicable law.

If you are located outside the United States, please be aware that your information will be transferred to, stored in, and processed in the United States. Where required by law (for example, for users in the EU, UK, or Switzerland), we rely on appropriate safeguards such as Standard Contractual Clauses for these transfers.

8. Cookies and Similar Technologies

Arranged uses only a small number of essential cookies. These are the cookies that make the Service work:

• Authentication cookies that keep you signed in between page loads.
• Session cookies used by Supabase to manage your login session securely.

We do not use advertising cookies, tracking pixels, third-party analytics, cross-site trackers, or abandoned-cart or marketing-automation tools.

You can disable cookies in your browser settings, but doing so will prevent you from staying signed in and will limit your ability to use the Service.

9. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights over your personal information. We honor these rights regardless of where you live, up to what is reasonably possible given the nature of the Service.

Rights that apply to everyone

• Access. Ask us what personal information we hold about you.
• Correction. Ask us to fix information that is wrong. You can also correct most information directly inside the app.
• Deletion. Ask us to delete your account and associated data.
• Export. Get a copy of your event and guest data in a portable format.
• Opt out of non-essential emails. Unsubscribe from any non-transactional emails at any time.

EU, UK, and Switzerland (GDPR and UK GDPR)

In addition to the rights above, you have the right to:

• Restrict or object to how we process your personal information.
• Withdraw any consent you previously gave.
• Lodge a complaint with your local data protection authority if you believe we have not handled your information properly. A list of EU authorities is available at edpb.europa.eu. For the UK, contact the Information Commissioner’s Office.

California

Under the California Consumer Privacy Act (CCPA/CPRA), California residents have the right to:

• Know what categories of personal information we collect and how we use them.
• Request access to, or deletion of, their personal information.
• Correct inaccurate information.
• Opt out of the sale or sharing of personal information. As noted, we do not sell or share personal information for cross-context behavioral advertising.
• Not be discriminated against for exercising these rights.

Other US states

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other US states with comprehensive privacy laws have rights similar to those above, including access, deletion, correction, and opt-out of targeted advertising or the sale of personal information. We do not engage in targeted advertising or sales.

Canada

If you are in Canada, you have rights under PIPEDA and provincial privacy laws, including the right to access your personal information and to challenge its accuracy. You may also file a complaint with the Office of the Privacy Commissioner of Canada.

10. How to Exercise Your Rights

The easiest way to exercise most of your rights is inside the app. You can edit your events, update your guest lists, and delete data at any time.

For anything you cannot do inside the app, email support@arrangedapp.co from the email address on your account. We will respond within 30 days. We may ask for information to confirm your identity before acting on certain requests, to protect you and other users.

You can also designate an authorized agent to act on your behalf, where permitted by law. We may require written authorization and identity verification.

11. Do Not Track and Global Privacy Control

Some browsers offer a “Do Not Track” signal or a Global Privacy Control (GPC) signal. Because Arranged does not engage in targeted advertising, the sale of personal information, or third-party tracking, these signals do not change how we handle your data. We already do not do the things these signals are designed to opt you out of.

12. Children

Arranged is not directed to children. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, please email hello@arrangedapp.co and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or an in-app notice before the changes take effect. The date at the top of this page shows when it was last updated.

14. Contact

For any privacy question, complaint, or request, email us at:

• General questions: hello@arrangedapp.co
• Privacy and data requests: support@arrangedapp.co

Arranged is operated by Arlen Bitsky (d/b/a Arranged). A postal address is available on request at the emails above.