Privacy Policy

1. Who we are

HappyQuince ("we", "us") operates the HappyQuince marketplace, a website and mobile application at happyquince.com where people planning a quince celebration can find and book vendors, and vendors can list and manage a business.

For questions about this policy or your personal data, contact us using the details on our contact page.

2. What this policy covers

This policy applies to the HappyQuince website and mobile application (together, the "Service"). It describes the personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it.

It does not apply to third-party websites we link to. Vendors may include their own website address in their listing. Once you follow such a link you are on that provider's site and their policy applies, not this one.

3. The lawful bases we rely on

We process personal data under the following bases:

• To perform a contract with you — to create and manage your account, your events, your guests and your bookings.
• For our legitimate interests — to keep the Service secure, prevent fraud and abuse, and understand how the Service is used so we can improve it. We balance these against your rights.
• With your consent — for analytics cookies where consent is required, and for any marketing email. You may withdraw consent at any time.
• To meet a legal obligation — where we are required by law.

4. What we collect

4.1 Account information you give us

• Your email address, and a securely hashed password if you register with a password.
• Whether you have confirmed your email address.
• Your account role (customer, vendor or administrator) and the dates your account was created and last updated.
• If you sign in with Google or Facebook, the identifier and basic profile details that provider returns to us — typically your name, email address and profile picture. We do not receive your contacts or your social media activity.

We never ask for, and you must never send us, payment card numbers. Card details are entered on Stripe's own secure pages and we do not store them.

4.2 Content you create

Depending on how you use the Service, this may include:

• Events — the title, date, location, description and total budget of an event you create, plus its tasks and expenses.
• Guests — the name, email address and attendance response of guests you add to one of your events.
• Messages — the content of messages you send a vendor, and a short preview of the conversation shown in your inbox.
• Bookings — the vendor you request, the date, any pricing option you choose, and any message you include with the request.
• Vendor listings — if you are a vendor, the business name, description, contact details, address, website and categories you submit, along with the photos and pricing options you upload.

Important: if you add other people to an event, you are giving us their personal data. You should only add people who have agreed to it, and you are responsible for telling them how their details are used.

4.3 Technical data collected automatically

• IP address, browser type and version, device and operating system, screen size, and preferred language.
• The pages you view, the links you follow and general interaction data.
• Approximate location, derived from your IP address, used to show vendors and listings near you.
• Session and security data, including a session cookie, the records of your sign-ins, and password reset and email verification tokens.
• The vendor identifier and the customer identifier associated with each booking, so we can show the right person the right booking.

5. How we use your personal data

• To create, secure and operate your account, and to keep it usable.
• To display vendor listings and vendor details to you, and to show vendors the booking requests and messages customers send them.
• To send service emails — for example, email verification, password resets, booking confirmations and declines, and new messages. These are transactional and are not marketing.
• To process vendor subscriptions through Stripe and to invoice you.
• To detect, prevent and investigate fraud, abuse, spam and security incidents.
• To understand usage so we can improve the Service, using aggregated or de-identified information where we can.
• To send marketing email, only where you have asked for it.
• To comply with our legal obligations and enforce our terms.

We do not sell your personal data, and we do not share it for other companies' advertising.

6. Who we share your data with

We share only what is necessary, and only with:

• Stripe, our payment processor, which handles subscription payments and card details. Stripe acts as an independent controller for the payment data it processes.
• Google and Facebook, if you use them to sign in. They provide us with your profile details and see that you signed in to HappyQuince.
• Our email delivery provider, which sends transactional email on our behalf.
• Service providers that host our infrastructure, store our database, or host uploaded images, under contract and only on our instructions.
• Other users of the Service, where it is inherent to the service. A vendor sees the date, description and pricing option of a booking request, and the messages sent to them. A customer sees the business name and contact details of the vendor they book. Booking records are not shown to other customers.
• Authorities or third parties where disclosure is required by law, or necessary to protect our rights, our users' safety, or the Service.

We do not sell, rent or trade personal data. We have not knowingly sold personal data and we do not knowingly share the personal data of anyone under 16.

7. Analytics and cookies

We use Google Analytics to understand how the Service is used. Google Analytics sets cookies and may share data with Google, which may use it to serve ads. You can opt out with Google Analytics Opt-out Browser Add-on, or by enabling Ghostery.

Where the law requires it, we set non-essential analytics cookies only after you consent. You can also clear or block cookies in your browser settings; blocking cookies will not stop you browsing vendors, but it may affect how the Service behaves.

Essential cookies we set, which are not subject to consent because the Service cannot work without them:

• Session cookie — keeps you signed in and protects against cross-site request forgery.

8. International transfers

Some of our providers process data in countries other than your own. Where your data is transferred outside the EEA, the UK, or another country with an equivalent level of protection, we rely on an adequacy decision or standard contractual clauses, together with a risk assessment of the destination country.

9. How long we keep your data

We keep data only for as long as we need it for the purposes described here.

• Account data — for as long as your account is open, and for a reasonable period afterwards so we can identify and remove it if an account is reinstated.
• Messages and bookings — for as long as the conversation is active, and for a limited period afterwards for dispute handling and abuse prevention.
• Uploaded photos and listing content — for as long as your vendor listing is published.
• Security and access logs — for a limited period, typically up to 12 months, to investigate incidents.
• Billing records — for as long as required by tax and accounting law.

When the period ends we delete the data, or anonymise it so it can no longer identify you.

10. Your rights

Depending on where you live, you may have the right to:

• Access — get a copy of the personal data we hold about you.
• Correct — have inaccurate data fixed.
• Delete — have your data erased ("right to be forgotten").
• Restrict or object — to some or all processing, and to processing based on legitimate interests.
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent — at any time, where processing relies on it, without affecting processing already carried out.
• Complain — to your local data protection authority.
• Not be subject to automated decision-making — we do not use your data for automated decisions with legal or similarly significant effects.

To exercise any of these, contact us. We may ask you to verify your identity first. We respond within the timeframe the law requires, and we aim to respond within 30 days. If you are unhappy with our response you can complain to your regulator.

Some data cannot be deleted straight away — for example, where we must keep records to meet tax or fraud-prevention obligations, or where a record is needed to establish or defend legal claims. We will explain this if it applies.

11. Security

We take reasonable steps to protect your data: data in transit is encrypted with TLS, passwords are stored as salted hashes and never in plain text, access to personal data is limited to staff and contractors who need it, and we review the practices of our providers. No system is completely secure, so we cannot promise absolute security.

12. Children

The Service is intended for adults. A quince celebration may involve guests who are minors, but those guests' details are entered by an adult organiser and are not used to create accounts. We do not knowingly collect data directly from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Third-party services

The Service depends on, and may link to, independent services. Their own terms and privacy policies apply to you when you use them, including:

• Google Analytics — usage measurement. Google's privacy policy.
• Stripe — payments. Stripe's privacy policy.
• Google and Facebook sign-in — authentication. Google and Meta privacy policies.
• Google Maps — maps displayed on vendor listings.

14. Changes to this policy

We may update this policy as the Service or the law changes. If a change materially affects how we use your data, we will tell you — by email, or by a notice in the app — before it takes effect. The "last updated" date at the top always reflects the current version, and we keep previous versions available on request.

15. Contact

Questions, requests or complaints about privacy can be sent to us using the details on our contact page. If you are in the EEA or the UK and are unhappy with how we have handled your data, you may also complain to your local supervisory authority.