Release-review draft
These documents are being reviewed before release. They do not certify EU compliance; required operator disclosures and the service’s privacy practices still need to be verified.
The short version
Gatherory uses your information to provide a shared place for planning events. Your event content is visible to the people you invite according to their role and the visibility you choose. We do not sell your personal information.
1. Who we are and scope
Gatherory is operated by Guide Systems LLC, established in the United States. In this policy, “we,” “us,” and “our” mean Guide Systems LLC. We are the data controller for the account and service processing described here: we decide why and how that information is used. Contact us at [email protected] for privacy matters.
This policy covers Gatherory’s marketing website, web application, iPhone application, and related services. Separate notices may apply to a specific feature. Services you choose to connect to or visit have their own policies.
An organization using Gatherory may also have responsibilities for the participant information it supplies. Its notice does not replace your rights in relation to our processing.
2. Information we collect
We collect information you provide, information created as you use Gatherory, and limited technical information needed to operate and improve the service.
- Account information. Your name, email address, profile image, authentication details, account preferences, and workspace memberships. If you use Google or Apple to sign in, we receive the account details that provider makes available with your permission.
- Event and planning content. Event names, dates, locations, schedules, ideas, decisions, notes, budgets, expenses, registry items, participant roles, attendance responses, and other details you add to a gathering.
- Invitations and collaboration. Contact details used to invite someone, invitation status, and activity connected to hosts, collaborators, and guests.
- Media. Images and related file information you upload for an event, idea, registry item, or invitation.
- Communications. Messages you send to us, including support requests and feedback.
- Launch-update requests. If you opt in, we store your email address, language, the page type where you joined, an optional campaign label, and the time and version of your consent. This list is separate from app accounts and event invitations. We do not treat joining an event or creating an account as permission for launch marketing.
- Usage and device information. Browser and device type, IP address, approximate location derived from an IP address, pages and features used, timestamps, diagnostic data, and similar log information.
Other people may provide information about you when they invite you or add you as a participant. If you supply someone else’s details, you must have an appropriate lawful basis and provide any privacy information required of you. Permission or consent is not the only possible lawful basis, but an invitation is not permission for unrelated marketing.
You do not need an account simply to read the marketing website. An email address and sign-in credentials or a supported sign-in provider are needed for an account. Images, many planning details, and optional device permissions are not required for basic account access; declining them may limit the associated feature.
Device permissions and connected features. When you choose them, location and map features can use a selected place or device location, Apple Music can supply playlist and song details, and notification access can deliver reminders. Images you choose and their file metadata may be uploaded to our private storage. You can change system permissions in your device settings. A device permission is not blanket consent to unrelated processing.
Please avoid adding unnecessary sensitive information, such as medical, religious, or identity-document details, to event notes or images. If someone else added your details, you can contact us without creating an account to ask about that information or exercise your rights.
3. How we use information
We use information to:
- create and secure accounts, verify email addresses, and maintain sessions;
- provide event planning, invitations, collaboration, media, and attendance features;
- apply event roles and permissions so people see and change only the parts available to them;
- send transactional messages such as verification, password reset, sign-in, and invitation emails;
- respond to support requests and communicate about the service;
- send Gatherory launch updates when you separately request them; you can withdraw that request by emailing [email protected] from the address you used;
- monitor reliability, prevent abuse, troubleshoot problems, and improve Gatherory; and
- comply with law and protect the rights, safety, and integrity of Gatherory and its community.
4. Legal bases for European personal data
Where the GDPR applies, each purpose needs an appropriate lawful basis. The basis depends on the processing, not simply on accepting the Terms:
- Contract. Account access, requested event planning, synchronization, sharing, and essential service messages, to the extent needed to provide the service you request.
- Legitimate interests. Proportionate account security, abuse prevention, essential reliability diagnostics, handling support, and facilitating invitations supplied by event organizers. Our interests are running a secure, reliable collaborative service; they must be balanced against your rights and reasonable expectations.
- Consent. Optional analytics or marketing when consent is required. It must be a separate, informed choice, and you may withdraw it. Signing up or continuing to browse does not itself give that consent.
- Legal obligation. Information necessary to meet an applicable legal requirement or respond to a legally binding request.
We do not treat optional tracking as necessary to perform the account contract. Withdrawing consent does not invalidate processing already lawfully carried out on that basis.
7. Retention and security
Retention is determined by the purpose and category of information, rather than a single indefinite period:
- Accounts and planning content. Kept while needed for your account and active shared plans, subject to deletion requests and any applicable exception.
- Invitations and sessions. Needed for admission, account security, and invitation history; an expired invitation or session is no longer usable for access. Expiry alone does not mean its database record has been erased.
- Support and security records. Retention depends on resolving the specific request or incident and any applicable legal claim or recordkeeping duty.
- Backups and provider logs. These can persist beyond removal from active systems according to the relevant backup or provider retention cycle. They are not an exception permitting unlimited reuse.
You can request account deletion in the app or contact us. Shared plans may remain for other participants; that is not a blanket exception to your right to erase personal information. We assess any retained information against its actual lawful purpose. Copies held independently by other participants are outside our direct control.
We use administrative, technical, and organizational safeguards designed to protect information. Private event media is stored with restricted access and is delivered through time-limited access methods. No system is completely secure, so we cannot guarantee absolute security.
8. Your privacy rights and requests
Where the GDPR applies, you can request:
- access to your personal data and information about its use;
- correction of inaccurate or incomplete information;
- erasure or restriction of processing in the circumstances provided by law;
- a portable, machine-readable copy of data you provided where automated processing is based on consent or contract, and transmission to another controller where technically feasible; and
- withdrawal of consent, without affecting earlier lawful processing.
You may object to processing based on legitimate interests because of your particular situation. You may object to direct marketing at any time.
Send requests to [email protected]. We may seek proportionate information to verify identity, not unrelated personal documents. GDPR requests are normally free. We respond without undue delay and within one month; if complexity or the number of requests justifies an extension of up to two further months, we explain that within the first month. If we cannot fulfill a request, we explain why and your available remedies.
You may complain directly to the supervisory authority where you habitually live, work, or believe an infringement occurred. You do not need to contact us first. Find the authority through the European Data Protection Board’s authority directory. Other applicable privacy laws may give you additional rights.
9. Children and age requirements
Gatherory is not directed to children under 13. A higher minimum age or parental authorization may be required in your country. In the EEA, the age for a child’s own consent to relevant online-service processing varies between 13 and 16. Being 13 does not automatically satisfy those rules or the separate requirements for entering a contract.
Where verified parental consent is required, ordinary permission to use a phone is not a substitute. Do not use a feature requiring that consent unless an appropriate verification process is available and completed. If you believe we have processed a child’s information unlawfully, contact us so we can investigate and take appropriate action.
10. International transfers
Guide Systems LLC is established in the United States. Gatherory and its providers may process data there and in other countries where their infrastructure operates. Laws and government-access rules may differ from those in your country.
Transfers subject to the GDPR need a valid transfer mechanism, such as an applicable adequacy decision or appropriate contractual safeguards with any necessary supplementary measures. A provider’s brand name or the existence of a standard contract template does not establish that a particular transfer is covered.
Contact [email protected] to ask which recipients, countries, and safeguards apply to your information, or to request a copy of applicable safeguards, with lawful confidentiality redactions. This draft does not claim that Gatherory is certified under the EU–US Data Privacy Framework or that any unverified transfer agreement is already in place.
11. Automated decisions
The app’s planning decisions and votes are choices made by participants. Gatherory does not currently make decisions about you based solely on automated processing that produce legal or similarly significant effects. A new feature involving such processing would require a separate explanation of its purpose, basis, and your rights.
12. Changes and contact
We may update this policy as Gatherory changes. If an update materially affects how we use personal information, we will provide notice through the service or another appropriate channel. The date at the top shows when this policy was last revised.
Privacy requests and questions about this policy should be sent to Guide Systems LLC at [email protected]. A policy update does not retroactively create consent or waive your statutory rights.