Privacy Policy

PartyVault ("PartyVault", "we", "us") provides software that helps event professionals run their businesses — leads, clients, quotes, contracts, invoices, inventory, scheduling, storefronts, and related tools. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to partyvaultapp.com, partyvault.lovable.app, and the PartyVault application.

1. Information we collect

Account information. When you sign up we collect your name, email, password (stored hashed), business name, and any profile details you choose to provide (phone, address, logo, photo, links).

Business data you create. Information you add to PartyVault — leads, clients, contacts, events, quotes, contracts, invoices, packages, inventory, messages, planner tasks, storefront content, reviews, and similar records.

Client and recipient data. Information you enter about your clients and their events. You are the controller of that data; we process it on your behalf to operate the service.

Uploaded files. Photos, inspiration images, documents, signed contracts, and other files you upload. Private files (contracts, invoices, portal attachments, internal documents) are stored in access-controlled storage and served through short-lived signed URLs. Public-facing assets (storefront photos, logos, marketplace listings, public profile imagery) are stored in publicly readable buckets so they can render on shareable pages.

Payment information. Card and bank details are handled by Stripe, our payment processor. We do not store full card numbers. We retain a record of charges (amount, status, last four digits, customer reference, Stripe session/intent IDs) to reconcile invoices and payouts. Stripe Connect is used to route client payments directly to your bank account; Stripe is the controller of payout account data.

AI processing. When you use AI-assisted features (photo-to-quote, planner generation, smart pricing, translation, mockups), the relevant inputs are sent to a model provider through the Lovable AI Gateway for the sole purpose of producing your output. We do not use your business data to train third-party foundation models.

Usage and device data. IP address, browser type, pages viewed, referrers, approximate location derived from IP, and basic interaction events. Used for security, analytics, and product improvement.

Cookies and similar technologies. We use a small number of strictly necessary cookies for authentication and session handling, plus first-party analytics to understand product usage. Cloudflare Turnstile is used on public forms to deter abuse; it does not use tracking cookies.

2. How we use information

• Operate, secure, and improve PartyVault.
• Authenticate you, prevent abuse, and detect fraud.
• Send transactional messages (account, billing, client portal, invoices, planner reminders, system updates).
• Provide customer support.
• Process payments and route payouts through Stripe.
• Generate AI-assisted outputs you request.
• Comply with legal obligations and enforce our Terms.

We do not sell your personal information. We do not use your business data or your clients' data for advertising.

3. Service providers we share with

We share data only with providers that need it to run the service:

• Supabase — database, authentication, file storage.
• Cloudflare — CDN, DNS, and Turnstile bot protection.
• Stripe — payments and Stripe Connect payouts.
• Resend — transactional email delivery.
• Sentry — error monitoring.
• Lovable AI Gateway — routing AI requests to underlying model providers (currently Google Gemini family).

These providers act as processors and are bound by their own terms and data-protection agreements. We may also disclose information when required by law or to protect rights, safety, or property.

4. International transfers

Our providers operate in the United States and the European Union. By using PartyVault you understand that information may be processed in countries other than your own.

5. Data retention

We retain account and business data for as long as your account is active. After you delete your account we delete or anonymise personal data within 90 days, except records we are required to keep for legal, tax, accounting, or fraud-prevention purposes (typically up to 7 years for financial records). You can export your data at any time from the app.

6. Security

We use industry-standard safeguards: encryption in transit (TLS), encryption at rest for the database and storage, row-level security policies that scope every record to its owner, signed URLs for private files, bot protection on public forms, rate limiting, and audit logging. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you and the appropriate authorities as required by law.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. To exercise these rights, email privacy@partyvaultapp.com from the address on your account, or use the in-app export and delete-account controls. You may also lodge a complaint with your local data-protection authority.

If you are a client of a PartyVault user (for example, you received a quote, contract, or invoice through the platform), your relationship is primarily with that business. We will forward verified requests to them.

8. Children

PartyVault is not directed to children under 16 and we do not knowingly collect personal information from them.

9. Changes to this policy

We may update this Privacy Policy as the product and the law evolve. When changes are material we will notify you by email or in-app and update the effective date above.

10. Contact

Questions or requests: privacy@partyvaultapp.com. For general support use the Contact page.

This policy is written in plain language for transparency. It is not legal advice and has not been reviewed by an attorney. If you require advice on how this policy interacts with your own legal obligations, consult qualified counsel.