Privacy Policy

If you do not sign up:

• Your seating chart is stored only in your browser's local storage. It is automatically deleted at midnight and never transmitted to our servers.

If you email yourself a link to your chart:

When you ask us to email you a link to continue your chart on another device, we send that one email and keep the address with the chart, along with when we sent the link. We email you again only if you tick the box to agree and then open the chart from the link in that email, which confirms the address is yours. We record when you ticked the box and when you confirmed.

Once you have confirmed, we send at most two more emails about that chart: one when its free 48 hours end, and one two days before we delete it. A chart that has an address kept with it is deleted 30 days after it was last edited instead of 7. Each of these emails has an unsubscribe link, which stops them for every chart you asked about. We delete the address when its chart is deleted, unless you confirmed and have not unsubscribed, and you can ask us to delete it at any time.

If you sign up for an account:

• We collect the following guest information you choose to enter:
• • Name
• • Email address
• • Dietary requirements
• • Comments
• We also collect your account details through our authentication provider when you sign in.

If you use subscription features (templates, events, collaboration):

• Templates and events you create, including event names, dates, and room configurations.
• Guest seating data within your templates (names, dietary requirements, table assignments).
• Collaboration invitations: email addresses of clients you invite to view or edit your seating charts.
• Email engagement data: when collaboration invitation emails are opened or links are clicked.

If you use Guest Photos:

Guest Photos is an album a host buys for one seating chart, or an Event Manager buys for one event. Guests reach it through the seat finder QR code or their personal seat link, find their name, and share photos and short videos.

• From guests who share: the photos and videos they upload; the name they pick from the guest list and its table; the date and time their phone reports for each photo or video, so the album can be sorted; a hashed device identifier, so their phone can manage its own uploads; and, for 48 hours only, a hashed form of their IP address to limit abuse. Guests do not create an account.
• Location and camera details are removed. Every photo is re-encoded and stored without its embedded metadata (EXIF, XMP, IPTC), so GPS location and camera make and model are dropped. Every video is rewritten without its location, device and creation-time tags.
• Who sees what: the host sees every upload, with the name of the guest who sent it. Guests see their own uploads and the photos the host chose to share with everyone, which show the sender's first name. Nothing in an album is public or indexed by search engines.
• Event albums: an album bought for an event belongs to that event. Anyone who edits events in the Event Manager's organisation can manage it. The Event Manager may also give their client access by entering the client's email address; we keep that address to send the client single-use sign-in links, until the access is revoked or the album is deleted.
• Hosts and buyers: we keep who bought the album and the payment details Stripe returns, as for any other purchase.

Cookies we use:

• Essential cookies: Required for the site to function (authentication, session management). These cannot be disabled.
• Guest Photos cookies (essential): each one is limited to a single album. gpc_<album> is a signed record of which guest you picked, so your uploads are filed under your name. gph_<album> keeps an event's client signed in for up to 7 days after they open their emailed link.
• Analytics cookies (optional): When enabled, PostHog may set cookies for richer analytics and session replay, and we may load the Pinterest Tag, TikTok Pixel, Meta Pixel and Google Ads tag for ads measurement. Whether these are off or on by default depends on where you are located (see below); your explicit choice always takes precedence.

Where you are located:

• EEA, United Kingdom, Switzerland, Turkey, and China: optional analytics and advertising cookies are off until you accept them via the cookie banner, which we show on your first visit.
• Everywhere else (for example the United States): optional analytics and advertising cookies are enabled by default under an opt-out model, and we do not show the banner unless you ask for it. You can opt out at any time via the Cookie Preferences link in the footer and choosing Essential Only.
• If we cannot determine your location, we treat you as if prior consent were required.
• We honor the Global Privacy Control (GPC) signal: when your browser sends it, optional cookies stay off until you explicitly accept them.

Cookieless analytics (PostHog):

Whether or not you accept analytics cookies, we use PostHog for privacy-focused audience measurement. If you choose Essential Only or dismiss the banner, PostHog runs in cookieless mode: it does not set analytics cookies and uses a daily rotating identifier instead of tracking you across sessions.

• Cookieless mode collects high-level usage such as page views, referrers, browser, device type, and country-level location, plus a limited set of funnel events.
• We respect your browser's Do Not Track setting.
• We keep standard campaign parameters (UTM tags) for attribution and exclude other URL search parameters and hash fragments before tracking.
• Personal data (guest names, emails, event names, and similar) is removed before any data is sent.

Advertising measurement (Pinterest, TikTok, Meta and Google):

When analytics cookies are enabled (by your acceptance, or by regional default as described above), we may load the Pinterest Tag, the TikTok Pixel, the Meta (Facebook and Instagram) Pixel and the Google Ads tag to measure ad effectiveness and conversions. Pinterest, TikTok, Meta and Google may process a hashed form of your account email (and, for TikTok and Meta, your phone number if you added one) when you are signed in, and our servers may report sign-ups, checkouts and purchases directly to Pinterest, TikTok, Meta and Google with the same hashed details, the ad click identifiers from your visit, your IP address and your browser's user agent. This follows the same choice as the tags: on by default where no prior consent is required, and only after you accept where it is. None of this happens if you choose Essential Only.

Full analytics (PostHog with cookies):

When analytics cookies are enabled (by your acceptance, or by regional default as described above), PostHog (hosted in the US) may also set cookies to collect richer anonymised usage data such as features used and interaction patterns. This helps us improve SeatPlan.io.

• We respect your browser's Do-Not-Track signal.
• All personal data (names, emails, dietary information, guest details, table names, event names) is stripped before any data is sent to PostHog.
• URL query parameters and fragments are removed before tracking.

Session recording:

Session replay is available only when analytics cookies are enabled (by your acceptance, or by regional default as described above). PostHog may record anonymised session replays to help us understand user experience issues. These recordings have the following safeguards:

• All text on the page is masked — no guest names, emails, dietary information, or other personal data is visible in recordings.
• All element attributes are masked — form values, input contents, and HTML attributes are hidden.
• Recordings capture interaction patterns (clicks, scrolls, navigation) only, not your actual data.

Managing your preferences:

You can make or change your cookie choice at any time via the Cookie Preferences link in the footer, which re-opens the cookie banner. Your explicit choice is remembered and always overrides any regional default.

Basic account data:

• Guest data is stored for 7 days after the expiry of your access.
• If you do not extend your account, we delete your account and all associated guest data within 7 days.
• If you have not signed up, your data is deleted automatically at midnight from your browser.

Subscription features (templates, events, collaboration):

• Templates and events are stored while your subscription is active, plus 7 days after expiry.
• Collaboration tokens expire after the duration you set (1-90 days).
• Client email addresses from collaboration invitations are deleted immediately when the collaboration token expires.
• Email engagement data (opens and clicks) is deleted along with the collaboration token.

Guest Photos:

• An album is online for 12 months from its 11th photo or video. You can then view and download it for 30 more days, after which its photos, videos and guest names are deleted.
• An album that never reaches its 11th photo or video is deleted 24 months after you bought it. A refunded album is deleted 7 days after the refund.
• While an album is kept, your account is kept too. Your seating chart and guest list are still deleted 7 days after the chart's access ends. Only each guest's name and table stay with the album, so every photo keeps its name.
• Your account is deleted 7 days after your last album is deleted, unless another plan keeps it. We email you before an album closes and before it is deleted.
• For guests who share photos we keep the photo or video, the name they picked from the guest list, a hashed device identifier so their phone can manage its own uploads, and, for 48 hours only, a hashed form of their IP address to limit abuse.
• An event album follows the same clock as a chart album. It stays available to the organisation's editors even if the Event Manager plan lapses, until the album is deleted.
• When a host removes a guest from an album, or we erase a guest at their request, their photos, videos and name are deleted. We keep only a marker made of the album and the guest-list entry's random identifier, with no name, so the guest cannot be added back by mistake.

Operational retention and cleanup:

• We may delete design sessions that are not linked to a user account after they have been inactive for a period (for example 7 or 30 days), as part of routine maintenance.
• We may remove historical layout snapshots when they no longer relate to an existing session, for example after a session has been deleted.
• We may delete user accounts that have no remaining paid or trial access after an extended period following expiry (for example more than 7 days), subject to safeguards such as outstanding billing checks.
• We may delete accounts that have never purchased persistence or subscription features when they show no meaningful activity for at least 7 days.
• If you started a checkout that did not complete, we exclude your account from routine cleanup of unpaid accounts for 30 days after that attempt so we can help you finish it. After those 30 days, the rule above applies again. We may then delete the account only if it has no paid or trial access and shows no meaningful activity for at least 7 days.
• When you create a free account, we send you a short series of emails over about two weeks. While that series is running, we exclude your account from routine cleanup of unpaid accounts, for at most 21 days after the series starts. If you unsubscribe, or once the series ends, the 7-day rule above applies again.