1. Data Controller

The data controller responsible for processing your personal data is:

LetsGather

Address: 1801 NE 123rd Street, Suite 307, Miami, Florida 33181, United States

Email: [email protected]

Website: https://letsgather.io

For payment-related data, Stripe may act as an independent data controller.

2. Categories of Personal Data We Collect

2.1 Host Users

• Name
• Email address
• Password (hashed)
• Stripe Connect account information
• Event data
• Communication records

2.2 Attendees

• Email or phone number
• Event application details
• Attendance status (if provided by the Host)

2.3 Automatically Collected Data

We use Umami for our site analytics on our main SaaS application, a privacy-first and self-hosted solution that does not use any cookies. We use this to understand how users interact with the app, which helps us to improve or fix features.
However, for our enterprise clients on dedicated instances (e.g., enterprise-name.letsgather.io), Umami tracking is disabled by default. Beyond this, we also collect minimal technical logs

3. Legal Basis for Processing (GDPR Article 6)

We do not rely on consent unless explicitly required (e.g., optional marketing communications).

4. How We Use Personal Data

• Providing event booking functionality
• Sending confirmations, reminders, and updates
• Facilitating payments through Stripe Connect
• Maintaining Host business records
• Improving platform security and functionality

5. Data Storage & Location

All personal data is stored exclusively on EU-based services:

• Hetzner (EU servers)
• Xata (EU database)
• RabbitMQ (EU)
• Brevo (EU transactional email)

Certain payment-related personal data may be transferred outside the European Union when processed by Stripe, our payment service provider. Stripe operates globally and may store or process data in the United States or other non-EU jurisdictions. These transfers are protected by the EU Standard Contractual Clauses (SCCs) and Stripe's internal compliance commitments, ensuring a level of data protection consistent with GDPR requirements.

For enterprise-hosted databases, LetsGather does not have access to personal data stored by the enterprise. LetsGather acts only as a processor and processes data strictly according to the enterprise customer's instructions. The enterprise is responsible for compliance with GDPR, CCPA, and other applicable privacy laws.

6. Sharing Personal Data

We only share data when necessary to operate the Platform:

• Hosts — attendee contact information for event management
• Stripe — payment processing and identity verification
• Brevo — for sending transactional emails
• Internal infrastructure providers — hosting, queues, databases

We do not sell personal data to third parties for marketing or commercial purposes.

In the event that the Platform is sold, merged, or acquired, personal data may be transferred to the new owner, who will continue to protect it in accordance with GDPR.

7. Data Retention

We retain data only as long as necessary:

Hosts

• Account data retained while the account is active
• Upon deletion, all personal data is anonymized except legally required records

Attendees

• Contact info retained for event management
• Shared with Hosts for legitimate post-event business needs
• Anonymization available upon request unless legally required otherwise

8. Your Rights

You have the following rights regarding your personal data, depending on your location:

• Access: Request access to your personal data we hold.
• Correction: Correct any inaccurate or incomplete data.
• Deletion: Request deletion of personal data, where applicable.
• Restriction: Restrict processing of your personal data.
• Objection: Object to certain types of processing, including direct marketing.
• Data Portability: Receive your data in a structured, commonly used format.
• Withdraw Consent: Withdraw previously given consent at any time.
• Lodge a Complaint: File a complaint with an EU supervisory authority if you believe your data rights have been violated.

Categories of personal data covered: account information (name, email), attendee contact information (email, phone), transactional/payment data, and any other personal data you provide while using the Platform.

We will respond to your requests within one month, in accordance with GDPR.

California Privacy Rights

California residents have additional rights under the California Consumer Privacy Act (CCPA):

• Request information about the personal data we collect and how it is used.
• Request deletion of personal information.
• Opt-out of any sale of personal information. (We do not sell personal information.)

We do not discriminate against users who exercise their privacy rights, including California residents.

To exercise any of these rights, please contact us at: [email protected]

9. Security Measures

We implement technical & organizational measures to protect data:

• Encrypted transmission (HTTPS)
• Access controls and permissions
• No unnecessary personal data logging
• Regular security monitoring

10. Children’s Data

The Platform is not intended for individuals under 16. We do not knowingly collect information from minors.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated through the Platform. Continued use of the Platform constitutes acceptance of the updated policy.

12. Contact Information

Email: [email protected]

Address: 1801 NE 123rd Street, Suite 307, Miami, Florida 33181, United States

Website: https://letsgather.io