Privacy policy

What we collect

We collect only what the service needs to run:

• Account information — your email address and preferred language. You sign in with an emailed magic link, so we never store a password.
• Business profiles — the information brands and hosts publish about their business: names, logos, descriptions, addresses, and sample catalogs. This may include the name and contact details of the person operating the account.
• Events and requests — event details, sample requests, approvals, declines, and shipping notes exchanged between brands and hosts on the platform.

What we never collect

Event attendees stay anonymous. Eventful never collects, stores, or transfers personal information about the people who receive gift bags — no names, no addresses, no email lists. Samples ship in one carton to the event host, never to individuals, so the platform has no attendee data to hold. This is a design decision, not just a policy.

Why we use it

We use this information to operate accounts and the request workflow between brands and hosts, to send transactional email (sign-in links and updates on requests you are involved in), to verify that brands and hosts are genuine businesses, and to respond when you contact us for support.

We do not sell personal information, and we do not use it for advertising.

Service providers

A small number of providers process data on our behalf:

• Neon — database hosting (Postgres), located in the eastern United States.
• Vercel — application hosting.
• Postmark and Resend — transactional email delivery.
• Cloudflare R2 — image storage (logos and sample photos).
• PostHog — measurement of how the site is used, hosted in the United States.
• Sentry — error reporting, hosted in the United States. It receives a technical description of what failed, never the content of a request.

Because our database is hosted in the United States, account and business information may be communicated outside Québec and Canada. No attendee personal information exists on the platform, and each provider is bound by its own data-processing terms.

Cookies and local storage

We use cookies only to run the service: to keep you signed in and to protect the sign-in forms against cross-site request forgery, and to remember your language. Staff accounts also carry a cookie recording that a second-factor check was passed. Your light-or-dark theme choice is kept in your browser's local storage rather than in a cookie. There are no advertising cookies.

We measure how the site is used with PostHog, configured to run without cookies: no analytics identifier is stored on your device. The measurement is not used to identify visitors and never for advertising.

Retention

We keep account and business information for as long as your account is active, and event and request records for as long as they are needed to run the service and keep an accurate history between brands and hosts. When you close your account, we delete or anonymize your personal information unless the law requires us to keep it longer.

Your rights

You can ask to access the personal information we hold about you, to correct it, or to have it deleted. You can also withdraw consent where our use relies on it. Write to us at support@eventful.club and we will respond within the timelines the law sets.

Eventful acts as the person in charge of the protection of personal information under Québec law and can be reached at the same address.

Confidentiality incidents

Eventful complies with Québec’s Act respecting the protection of personal information in the private sector, as amended by Law 25. If a confidentiality incident involving personal information presents a risk of serious injury, we will notify the Commission d’accès à l’information and the affected persons, as the law requires.

Changes to this policy

If we change this policy, we will post the new version here with a new effective date and flag material changes on the site or by email.