Privacy notice

What we collect

If you make an account: your name, email address, a scrambled (hashed) version of your password, whether you've confirmed your email address, and which emails you've chosen to get. If you join an event as a guest: the name you type, and your email address only if you ask for updates. Then whatever you add: replies, messages (including messages and photos for a group card), votes, tasks, gift collections, payment requests and expenses.

If an organiser sends a gift card by email, we keep the name and email address of the person it's for, and any message, so it can be delivered. Only the organiser can see them.

If an organiser asks us to email a group card to the person it's for, we keep that email address to send it. Only the organiser can see it, and we delete it 30 days after the card is sent.

If you register interest in Ottsy for Teams: your name, work email, organisation, its rough size and whether you'd like to join the pilot.

If your workplace uses Ottsy for Teams (being tested now): the name, work email, team, location, start date and birthday it adds for you. A birthday is only ever a day and month, never a year, and you can choose not to have it celebrated. Your workplace decides what it adds; ask them to change or remove it.

We do not collect card details, bank details or identity documents. Money features are simulations.

Why we use it

To run the events you take part in, show organisers who has replied, send the emails you asked for, and keep the service secure. Account emails (confirming your address, resetting your password, security alerts) always go; everything else only if you switch it on, and every guest update has a link to stop it. We use your Ottsy for Teams details only to tell you about Ottsy for Teams, no more than once a month.

To stop abuse, we count how often things are done from each network, using a scrambled form of the network address, and remember browsers you've signed in on. We record simple usage events (for example “an event was published”) without names or messages. If something breaks, an error report is made without names, email addresses or private links.

Who can see it

Organisers see their guest list, replies and messages. Guests see event details and, depending on settings, who is coming. Your data is not sold. These companies process it on our behalf: Vercel (hosting), Supabase (database, in London), MailPace (sending email, in the EU) and Sentry (error reports, in the EU, without names or email addresses).

Cookies and your browser

We use essential cookies only: one to keep you signed in, one per event you join as a guest so you can come back without an account, one that remembers the name you gave as a guest, and one that remembers this browser is yours, so mistyped passwords elsewhere can't lock you out. A half-filled form is kept in your browser tab until you send it. No advertising cookies.

How long we keep it

Your account and what you add: until you delete your account. Guests' email addresses for updates: until 30 days after the event. Notifications: 1 year. Usage events and Ottsy for Teams interest: 2 years. Sign-in records: a few days. Copies of emails sent: 30 days. Backups: 7 days. When you delete your account, your name and messages go; amounts paid stay without your name, so other people's totals still add up. Test data may be reset at any time during the prototype.

Your rights

Under UK GDPR you can ask to access, correct or delete your data, or object to how it's used. You can download your data and delete your account yourself from your profile. Or email hello@ottsy.co.uk. You can also complain to the Information Commissioner's Office (ico.org.uk).