Privacy Policy

Last updated: 30 October 2026

Every Gathering (previously ourbigwedding.day; "we", "us", "our") is an event website and guest management service operated by Lee James Apps, a sole trader based in the United Kingdom. We look after personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

This policy explains what we collect, why, who we share it with, how long we keep it and what your rights are.

1. Who we are

Data controller: Lee James Apps (sole trader)
Email: lee@leejamesapps.co.uk
Website: Every Gathering

For the guest data inside a hub, the host (our customer) is the data controller and we act as their data processor. For our own customers, website visitors and reviews, we are the controller.

2. What we collect

From hosts (our customers)

• Name(s) and the display name for the event
• Email address, for your account and messages about your hub
• Event type and date, and the hub web address you choose
• Venue name and address, your story, theme and settings
• Your admin password (stored hashed — we can't read it)
• Payment details are handled by Stripe; we never see your card number. We keep the payment reference, amount and date
• When you sign up we briefly keep your IP address to stop abuse (see section 5)

From guests (on the host's behalf)

• Guest names, households, and each household's contact email
• Access PIN (stored hashed — we can't read it)
• RSVP answers for each event, menu choices, plus-ones and age group (adult, child, infant)
• Dietary needs and allergies — this is health data (special category). Guests give it voluntarily, and it's used only so the event can cater for them safely
• Messages to the host, song requests and photos guests choose to upload (we remove location data from photos)

Reviews

• If you leave a review: your name, an optional second name, your rating and your message. Reviews are only shown after we've checked they come from a real customer

Website visits

• Our own visit counter records the page, the site that referred you, your browser type, your country and a hashed version of your IP address that changes every day. It sets no cookies
• Google Analytics runs only if you choose "Accept analytics" in the cookie banner (see section 7)
• Pages use fonts from Google Fonts, so your browser connects to Google's servers to download them

3. Why we use it (lawful basis)

Data	Purpose	Lawful basis
Host account data	Provide your hub	Contract
Host email	Sign-in, password resets, service emails (activation, reminders before your hub closes)	Contract
Reminder emails for unactivated hubs	Let you know your free hub is waiting	Legitimate interest (you can ask us to stop)
Guest names, emails, RSVPs, menus, messages	Run the event on the host's behalf	Host's legitimate interest in managing their event
Dietary and allergy data	Safe catering	Explicit consent (given by the guest)
Payment records	Take payment, refunds, accounts	Contract and legal obligation
Returning-customer record	Give you the returning-customer price next time	Legitimate interest
IP addresses, visit counter	Security, stopping abuse, understanding which pages help	Legitimate interest
Google Analytics	Understanding how the site is used	Consent
Reviews	Showing what customers think	Consent (you choose to submit one)

4. Who we share data with

We use these providers, only for the purposes shown:

Provider	Purpose	Data	Location
IONOS	Hosting our servers	All hub and website data	UK (London)
Stripe	Payments and refunds	Email, name, amount (card details go straight to Stripe)	US (UK adequacy / Data Privacy Framework)
Resend	Sending emails	Recipient email and the email's content	US (standard contractual clauses)
Google	Analytics (only with consent); web fonts	Usage data and IP address	US (UK adequacy / Data Privacy Framework)
Cloudflare	Bot checks on the signup and review forms, when switched on	Browser and IP information during the check	Global (standard contractual clauses)

We do not sell, rent or trade personal data. Ever.

Hosts and their venue: hosts can download guest data (names, RSVPs, menus, dietary needs) to share with their venue or caterer. That's the host's decision; once exported, how it's shared is up to them.

5. How long we keep it

• Hub data (host and guest data): until 6 months after the event date, then deleted. A backup archive of a deleted hub is kept for up to 30 days in case of mistakes, then deleted automatically.
• Unactivated hubs that haven't been opened for 90 days may be deleted after a warning email.
• Signups that are never confirmed, including the IP address, are removed after 7 days.
• Returning-customer record: after a hub is deleted we keep a one-way scrambled (hashed) copy of the host's email address so we can give the returning price later. It isn't readable as an email address. Ask us and we'll delete it.
• Payment records: kept as long as we need them for our accounts (normally 6 years), and by Stripe under their own policy.
• Email logs (recipient, subject and time, not the content): 12 months.
• Visit counter: 13 months.
• Login rate-limit records: 24 hours.
• Reviews: until you ask us to remove yours.

6. Your rights

Under UK GDPR you can ask us to:

• See the personal data we hold about you
• Correct anything that's wrong
• Delete your data
• Restrict how we use it, or object to uses based on legitimate interest
• Move it (hosts can download CSV exports at any time)
• Withdraw consent — for dietary and allergy information, clear it in your RSVP; for analytics, use "Cookie settings" at the bottom of our pages

Email lee@leejamesapps.co.uk and we'll reply within one month.

Guests: to be removed from a hub, ask the host (they can delete your household) or email us and we'll help.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO).

7. Cookies

We use a few cookies the site can't work without, plus Google Analytics cookies only if you agree. When you first visit we ask with a banner; you can change your mind at any time with "Cookie settings" at the bottom of the home page or any guide.

Name	Purpose	Type	Lasts
obd_…	Keeps a host signed in to their admin	Essential	Until you close the browser
wd_guest_session	Keeps a guest signed in to their invitation	Essential	1 year
_ga, _ga_…	Google Analytics: counts visits and how the site is used	Analytics (consent only)	Up to 2 years

Your cookie choice itself, and the theme you preview on our home page, are remembered in your own browser's storage, not sent to us.

8. Security

• Everything is sent over HTTPS
• Passwords and PINs are hashed — we can't read them
• Guest sign-in cookies are signed with a secret unique to each hub and set as HttpOnly, Secure and SameSite
• Sign-in attempts are rate limited to stop guessing
• Password reset links are stored hashed and expire after 30 minutes
• Data files can't be fetched directly from the web, and secrets are stored with restricted permissions

9. Children

Hosts may list children as guests (name and age group, for catering). We don't knowingly collect data directly from children under 13.

10. International transfers

Our servers are in the United Kingdom. Sending emails (Resend), taking payments (Stripe), Google services and Cloudflare's bot check involve transfers outside the UK, covered by UK adequacy regulations, the UK extension to the EU-US Data Privacy Framework or standard contractual clauses.

11. Changes to this policy

We may update this policy. The date at the top will change, and we'll email active customers about significant changes.

12. Contact

Email: lee@leejamesapps.co.uk
Operated by: Lee James Apps (sole trader), Kent, United Kingdom