Privacy Policy

This Privacy Policy explains what personal information the operator of Count Me There (“Count Me There”, “we”, “us”, “our”) collects through the Service, why, how it is used and shared, how long it may be kept, and the choices you have. It applies to hosts (who have accounts) and to guests (who use personal links), and to anyone who visits countmethere.com. By using the Service you accept the practices described here. Capitalised terms have the meaning given in the Terms of Service.

1. Who is responsible

The operator of Count Me There is the controller of the personal information described in this policy, except for the information hosts enter about their guests, for which the host is the controller and we act as the host's service provider (processor) as described in section 5. Contact details are in section 13.

2. Information we collect

From hosts

• Account details: name, email address, password (stored only as a salted hash) or passkey public key, language, time zone, notification preferences, and the record of your consent to the Terms and this policy (version and time).
• Everything you enter in your gatherings: gathering details, host notes, messages to guests, questions, tables, costs, integrations you connect, and any other content.
• Payment records you enter (amounts, references and notes about payments you have received). We do not collect card or bank details and do not process payments.
• Device and technical information: IP address, browser and device type, operating system, language, referrer, the pages and features you use, push-notification subscription endpoints you create, timestamps, and diagnostic and error information.

About guests, entered by hosts

• Whatever the host enters: name, phone number, email address, household or party, guest type, language, plus-one allowance, dietary notes, table, host notes and any custom fields. Hosts are responsible for entering this information lawfully.

From guests, on their personal page

• Responses: attendance, companions you add, parts you will attend, meal choices, dietary or accessibility needs, answers to the host's questions, contributions, transport and accommodation details, and your language choice.
• A record that the page was opened, when responses changed, and technical information as described above.

From everyone

• Messages you send us, and our replies.
• Server logs and security records, which include IP addresses, request details and timestamps.

We do not knowingly collect special categories of information (such as health, religion or biometric data) except where a host asks guests a question that calls for it, such as dietary or accessibility needs.

3. Why we use it, and on what legal basis

• To provide the Service — creating accounts, running gatherings, showing guests their pages, calculating headcounts and costs, sending the notifications hosts asked for, and connecting integrations a host chose. Legal basis: performance of a contract with hosts; for guests, the legitimate interests of the host and of us in running the gathering the guest was invited to.
• To keep the Service secure and running — authentication, rate limiting, detecting and preventing abuse, fraud and attacks, debugging, monitoring, backups and capacity planning. Legal basis: legitimate interests; legal obligations.
• To communicate — sign-in codes, security alerts, service announcements, notifications you enabled, and replies to your messages. Legal basis: contract; legitimate interests; consent where required.
• To comply with the law — responding to lawful requests, enforcing our Terms, protecting rights, safety and property. Legal basis: legal obligation; legitimate interests.
• To improve the Service — understanding how features are used, in aggregate and without profiling individuals. Legal basis: legitimate interests.

We do not sell personal information, we do not share or use it for advertising, and we do not build profiles or make automated decisions that have legal or similarly significant effects on you.

4. Cookies and similar technologies

We use only cookies and browser storage that are needed for the Service to work: a session cookie for signed-in hosts, a language cookie, a theme preference, a pre-launch preview cookie for the team, and the guest page's own preferences. There are no advertising cookies, no analytics cookies and no third-party trackers. See the Cookie Notice for the list.

5. Hosts and guests

When a host enters information about guests, the host decides what is collected and why; we store and process it on the host's instructions to run the gathering. Guests' information is visible to the hosts and co-hosts of the gathering they were invited to, to helpers the host adds, to anyone a host shares a responses link with, and to us where needed to operate the Service. Sensitive answers such as dietary or accessibility needs are not shown to other guests unless a host publishes a section that includes them. When a host shares a plan of who drives whom, each guest in a car sees the names of the others in it and where each is picked up or leaves from, as they gave it.

Guests who want their information corrected or removed should ask the host, who can do this from the dashboard.

Hosts must comply with the privacy and anti-spam laws that apply to them, including when they send invitations, reminders and updates from their own devices. We do not send messages to guests on a host's behalf.

6. Who we share information with

We may share personal information:

• With the hosts, co-hosts and helpers of the gathering a guest was invited to, as described above.
• With anyone a host shares a responses link with: a host can share a read-only page of a gathering's responses, showing guests' names, whether they are coming and which parts they chose, and their answers if the host includes them. Anyone with the link can see it until the host stops sharing.
• With service providers that we use to run the Service, acting on our instructions: the hosting provider whose servers run the Service; our own email server for delivering the emails we send; the place search service that suggests places as a host or guest types one (Photon, operated by komoot, using OpenStreetMap data), which receives the text typed into a place field and the approximate area of the gathering, sent from our servers rather than from your device; and, when you enable push notifications, the push-notification services operated by your browser or device maker (such as Apple, Google or Mozilla), which receive an encrypted payload and your subscription endpoint.
• With the map services you choose to open: a link to open a place, or a route, in Apple Maps or Google Maps takes you to that service with the place in the link, and it handles what it receives under its own policies.
• With third-party services a host chooses to connect, such as Donairo for payments. Those services handle what they receive under their own policies.
• When required by law or to respond to a lawful request by public authorities, to enforce our Terms, to detect, prevent or address fraud, security or technical issues, or to protect the rights, property or safety of us, our users or the public.
• In a business transfer, if the Service or its operator is involved in a merger, acquisition, financing, reorganisation or sale of assets, in which case the information may be transferred subject to this policy.

We may publish aggregated or de-identified statistics that cannot reasonably identify anyone.

7. Where information is kept

The Service runs on servers operated for us by a hosting provider. Those servers may be located outside the country where you live, and your information may be transferred to, stored in and processed in other countries whose laws may differ from yours. By using the Service you acknowledge these transfers.

8. How long we keep it

We keep information for as long as we choose, which may be indefinitely. We may also delete it at any time, including if we discontinue the Service or a feature.

• Accounts and gatherings: finished gatherings are archived rather than deleted, and a host can delete a gathering, or the whole account, from Settings.
• Account deletion: deletion takes effect after a grace period during which signing in cancels it. Copies of the account and the gatherings it owns, including the guest information in them, may persist indefinitely in backups, logs and archives.
• Logs and security records may be kept indefinitely.
• Messages to us may be kept indefinitely.

9. Security

We try to follow industry best practices to protect personal information. No system is completely secure. We do not guarantee the security of any information, and you use the Service at your own risk.

10. Your choices, and rights the law may give you

Depending on where you live, the law may give you rights to access, correct, update, export, restrict or delete your personal information, to object to certain processing, and to withdraw consent where processing is based on consent. To make a request, contact us at support@countmethere.com.

• Hosts can see and change their details, export everything in their account, manage notifications, review and revoke sessions, and delete their account from Settings.
• Guests can update their responses and language from their personal page and ask the host to correct or remove their details.
• Notifications: hosts choose what they receive in Settings, and every notification email says how to change or stop it. Sign-in codes and security notices are part of running the Service and cannot be turned off while you have an account.
• Push notifications can be turned off in the app or in your device settings.

We may need to verify your identity before acting on a request, and we may decline a request where the law allows us to.

11. Children

The Service is not directed at children, and we do not knowingly collect information from anyone under 18 as an account holder. Hosts may enter children's names and details as guests; those details are controlled by the host, who is responsible for having the right to enter them. If you believe a child has created an account or that information about a child has been entered without appropriate authority, contact us.

12. Changes to this policy

We may change this policy at any time, with or without notice. Changes take effect when we post them here, and your continued use of the Service after a change means you accept it.

13. Contact

Questions and requests about this policy: support@countmethere.com.