Privacy Policy

This policy covers Personalidy, operated by [ENTITY NAME] (“we”, “us”), of [ENTITY ADDRESS]. It explains what personal data we collect when an organiser orders event badges and when their attendees submit a photo, and what happens to it afterwards.

What we collect

• From the organiser (order form): organisation name, contact name, email, phone (optional), event name and date, expected headcount, style choice, and any notes. The contact email is shown to that event’s attendees, on their badge page and in our emails to them, as the address for questions about the event.
• About attendees, from the organiser’s guest list (uploaded, or sent by their ticketing platform — Luma, Eventbrite, KonfHub, or an automation such as Zapier or Make): name, email, role, company, ticket type or group (such as Speaker or VIP), the ticketing platform’s own ID for them and, where the organiser includes them, phone number and photos (files they upload, or links to photos in their list). If the organiser’s list includes phone numbers, they’re only shown to the organiser so they can send guests their link from their own WhatsApp. Personalidy doesn’t send WhatsApp messages itself.
• From attendees themselves (their badge page): the name as it should print, role, company, pronouns, an “Ask me about” line, a link for their badge QR code, and — only if they choose to add one — a photo, along with the time they agreed to how it’s used, and how they’d like it to look (in the badge’s style, a softer version, or as photographed). If they send a “Still stuck?” message about their photo, it goes by email to Personalidy staff only, never the organiser, with their name, email and a link to their badge; it isn’t kept in the app. We count these choices per art style, never by person, to fix styles that don’t suit someone’s face.
• Automatically: a sign-in cookie that keeps you signed in to your badge page (no tracking or advertising cookies), and standard server logs such as IP address and browser type. If something fails to save or send, the error log can also hold the email address or details involved, so nothing is lost. Our host (Vercel) keeps these logs under its own retention settings; we don’t keep them as a record.

Whose data it is

For attendee data, the event’s organiser decides why it is collected; we process it on their behalf, only to make that event’s badges. For the organiser’s own order details, we are responsible for them. An organiser can add co-organisers to help manage their event; they see the same guest list, photos and badge links, and the organiser answers for them.

Why we collect it

Order details are used to quote, plan, and produce your event's badges. Attendee names and photos are used solely to render that attendee's own badge — never sold, never reused for another event, and never used to train any model. Submitting a photo is optional; a badge still prints without one.

Who we share it with

We use the following services to run Personalidy, and send each only what it needs for its part:

• Supabase (storage) — hosts attendee photos and event rosters in a private bucket, not publicly readable.
• Resend (email) — sends attendees their sign-in codes, badge links, reminders and a confirmation when they save their badge, and organisers their order, event and sign-in emails.
• Vercel (hosting) — runs the application and its server logs, and counts page views with Vercel Web Analytics (cookieless, no cross-site tracking).
• Google and jsDelivr — when an attendee picks a photo, their browser downloads the face-framing model from these. Framing happens on their device; the photo is not sent to either.

These services may store data on servers outside India. We do not sell personal data, and we do not share attendee photos with anyone other than the organiser who requested that event’s badges and the co-organisers they add — on their event’s admin page and inside the print files we deliver for their printer.

How long we keep it

Attendee photos and event rosters are deleted 30 days after the event date supplied for that order — enough time for reprints or a dispute, not longer. For an order that is never confirmed, everything uploaded with it goes sooner: 30 days after the order or the day after the event, whichever comes first, unless we’ve sent a quote, in which case the 30-days-after-the-event rule above applies. Order enquiry records (organiser name, email, organisation) and a log of actions taken on each event’s admin page (which organiser or staff email did what, and when) are kept longer as our business and accounting record. Our email provider keeps its own delivery logs under its own policies.

Children

Personalidy is not meant for anyone under 18 without a parent’s or guardian’s consent. An organiser whose event includes under-18s must collect that consent before sending us their details. If we learn we hold a child’s data without it, we delete it.

Your rights

You can ask us to access, correct, or erase your personal data, or to tell you who we've shared it with, by writing to the contact below. Attendees can also ask their event's organiser to forward a deletion request on their behalf. If you agreed to something, such as adding a photo, you can withdraw that at any time: until badges go to print, removing your photo on your badge page deletes it straight away; after that, write to us. We reply within 30 days.

Grievance Officer

Under India's Digital Personal Data Protection Act, 2023, our Grievance Officer is [GRIEVANCE OFFICER NAME], reachable at [ENTITY CONTACT EMAIL]. If you’re not satisfied with how we handle a complaint, you can take it to the Data Protection Board of India.

Security

Attendee photos are stored in a private, access-controlled bucket. Access is limited to what the application needs to render a badge; we don't publish attendee photos or rosters. If a breach affects your personal data, we will tell you and the Data Protection Board as the law requires.

Changes

If we change this policy, we update the date at the top. If a change affects how we use data we already hold, we tell organisers with an active order before it takes effect.

Contact

Questions about this policy, or a request to access/correct/erase your data: [ENTITY CONTACT EMAIL].