Privacy Policy

This Privacy Policy explains how Occyra (“Occyra,” “we,” “us”) handles personal information when you use occyra.com, its subdomains, the Occyra dashboard and studio, event pages published through Occyra, and related emails (the “Services”). It applies to:

• Hosts: people who create an account, build events, or belong to a workspace;
• Guests: people who visit an event page, RSVP, receive an invitation, or post a message or photo; and
• Visitors: people who browse our website, sign up for early access, or contact us.

This policy should be read together with our Terms of Service.

Each event page is created and controlled by a host. The host decides what information to request from guests (for example, meal choices or plus-ones), who to invite, and how to use the responses. For that guest information, the host is responsible for having a lawful basis to collect it and for telling guests how it will be used, and Occyra processes it on the host’s behalf to provide the Services.

Occyra is responsible for information about hosts and visitors, and for the limited guest information we use for our own purposes, such as security, preventing abuse, running our own analytics, handling unsubscribes, and meeting legal obligations.

If you are a guest with a question about an event or how your RSVP is used, please contact the host first. You can also contact us and we will help where we can.

From hosts and workspace members

• Account and profile: name, email address, password (stored by our authentication provider in a form we cannot read), profile photo, and bio. If you sign in with Google, we receive your name, email address, and profile picture from Google.
• Workspaces: workspace names, members, roles, and the email addresses of people you invite.
• Event content: event details, venues and addresses, schedules, text, images you upload, templates, settings, and page versions.
• Guest lists: names and email addresses of guests you add or import.
• AI usage: prompts, instructions, and the event context sent to AI features, the results, and usage counts used to apply plan limits.
• Payments: plan, amount, currency, and payment, order, and subscription identifiers from Razorpay. We do not receive or store your full card number.
• Support and feedback: messages you send us and feedback you submit in the product.
• Email preferences: notification settings and unsubscribe choices.

From guests

• RSVPs: name, email address (if requested), attendance response, number of guests, notes, and answers to any custom questions the host adds. We also record the IP address and browser details used to submit the RSVP, to prevent abuse and investigate problems.
• Personal invitations: if a host invites you by email, your name, email address, a private invitation link, and whether and when you were invited, reminded, or responded.
• Messages and photos: if a host enables them, the name and message you post, or the photo you upload with your name and email address. We store a one-way hashed version of your IP address to limit spam.

From visitors

• Your email address and any details you share when you request early access or contact us.

Collected automatically

• Event page analytics: when someone views or interacts with an event page (for example, opening the page, tapping RSVP, adding to calendar, or opening a map), we record a random session identifier, the interaction, device type, browser, referring website, and an approximate city, country, and coordinates derived from the IP address. Hosts see this in aggregated analytics.
• Website and app analytics: pages visited, features used, device and browser information, and similar usage data collected through Google Analytics and PostHog.
• Technical data: IP address, approximate country (used to show prices in the right currency), logs, and error reports.
• Email delivery data: whether emails we send are delivered, bounced, or marked as spam.

We use personal information to:

• provide the Services, including creating and publishing event pages, collecting RSVPs, sending emails, and showing analytics to hosts;
• create and secure accounts and workspaces;
• process payments, apply plan features and limits, and keep financial records;
• provide support and respond to requests;
• protect the Services, users, and guests, including preventing spam, fraud, and abuse, and enforcing our Terms;
• understand how the Services are used and improve them;
• send service messages and, where permitted, product news (which you can opt out of); and
• comply with legal obligations and respond to lawful requests.

We do not use guest information to advertise to guests, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Legal bases (EEA and UK). Where European or UK data protection law applies, we rely on: performance of our contract with you; our legitimate interests in operating, securing, and improving the Services and in communicating with business users; your consent, where we ask for it; and compliance with legal obligations.

When you use AI features, we send your prompt and the event information needed for the request (such as event details and existing page content) to one of our AI providers listed below. The provider returns generated content, which we store as part of your event. Please do not include sensitive personal information in prompts unless it is necessary. AI providers process this information under their agreements with us and their own terms.

• To hosts: account and security emails, publishing and domain updates, new RSVP and moderation notices, billing emails, and occasional tips and product updates.
• To guests, on the host’s behalf: invitations, reminders to people who have not responded, RSVP confirmations and updates, announcements, and event-day reminders. These are sent because the host added you or because you submitted an RSVP.

Marketing and non-essential emails include an unsubscribe link. Guests can unsubscribe from a host’s event emails, and we will stop sending them to that address. We may still send essential messages about your account or transactions.

• With hosts and their workspace. Guest RSVPs, messages, photos, and invitation status are visible to the host and members of their workspace, who can export them.
• Publicly. Published event pages, and any guest messages or photos the host shows on them, can be seen by anyone with the link. Event pages on Occyra web addresses may be listed in our sitemap and indexed by search engines.
• With service providers who process information for us, as listed below.
• For legal reasons, if we believe in good faith that disclosure is required by law or a valid legal request, or is needed to protect the rights, safety, or property of Occyra, our users, guests, or the public.
• In a business transfer, such as a merger, acquisition, or sale of assets, subject to this policy.

Authorized Occyra staff may access accounts when needed to provide support, investigate problems or abuse, or meet legal obligations. This access is restricted and time-limited.

We do not sell personal information.

We use the following service providers. Each receives only the information it needs for its function.

• Supabase: Database, file storage, and account sign-in.
• Vercel: Website and application hosting, including event pages on Occyra web addresses.
• Cloudflare: Custom domain connection and security certificates, and Turnstile bot checks on guest messages and photo uploads.
• Razorpay: Payment processing for Event Passes and subscriptions.
• Resend: Sending emails and reporting delivery status (for example, delivered or bounced).
• Google: Google Sign-In (if you choose it), Google Analytics for website usage, and Gemini AI models for content generation and studio voice narration.
• Anthropic and OpenAI: AI models that may be used for content generation, depending on the feature.
• PostHog: Product analytics about how the website and app are used.
• ip-api.com: Converting a visitor’s IP address into an approximate city and country for event page analytics.
• OpenStreetMap Nominatim: Converting a venue address you enter into map coordinates.
• MET Norway: Weather forecasts for event pages, using the venue’s coordinates (no personal information is sent).

We may change providers over time and will update this list when we make significant changes.

We use cookies and similar browser storage for these purposes:

• Essential: keeping you signed in, remembering your active workspace and pricing region, and security features such as bot checks. The Services do not work properly without these.
• Preferences: remembering settings such as light or dark mode.
• Analytics: Google Analytics and PostHog use cookies or local storage to understand how our website and app are used.

You can block or delete cookies in your browser settings, although blocking essential cookies will stop sign-in from working. Google offers a browser add-on to opt out of Google Analytics.

• Account information is kept while your account is active. When you ask us to delete your account, we delete or anonymize it within a reasonable period, except where we need to keep it as described below.
• Event content and guest information are kept until the host deletes the event or account, or until we delete them under our Terms.
• Analytics are kept for as long as they are useful to hosts and to us, and may then be deleted or kept only in aggregated form.
• Payment and billing records are kept for as long as tax, accounting, and other laws require.
• We may keep limited information longer where needed to resolve disputes, prevent abuse, enforce our agreements, or comply with law. Backups are overwritten on a rolling basis.

We use administrative, technical, and organizational measures designed to protect personal information, such as access controls, restricted and time-limited staff access, hashed tokens for guest edit links, and rate limits and bot checks on public forms. No system is completely secure, so we cannot guarantee absolute security. If you believe your account or data has been compromised, contact us right away.

Our service providers operate in several countries, so your information may be processed outside the country where you live, including in countries whose data protection laws differ from yours. Where the law requires it, we take steps intended to ensure your information remains protected when it is transferred.

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy of it;
• correct inaccurate or incomplete information;
• ask us to delete your information;
• withdraw consent where we rely on it, without affecting earlier processing;
• object to or restrict certain processing, or ask for your data in a portable form;
• nominate another person to exercise your rights if you die or become incapacitated, where the law provides for this; and
• complain to us, and then to a data protection authority if you are not satisfied.

To make a request, email contact@occyra.com from the address linked to your account or RSVP. We may need to verify your identity, and we will respond within the time required by applicable law. Hosts can also edit or delete events, guest entries, and profile details in the dashboard.

If you are a guest, we may pass your request to the host, who controls the event information, and we will help them respond.

In India, you may complain to the Data Protection Board of India where the Digital Personal Data Protection Act, 2023 applies, after first using our grievance process. In the EEA or UK, you may complain to your local data protection authority.

Occyra accounts are for people aged 18 or over. We do not knowingly collect personal information from children through accounts. Hosts must not collect children’s personal information through RSVP forms unless a parent or guardian provides it or consents where the law requires. If you believe a child has given us personal information, contact us and we will delete it.

We may update this policy. We will post the new version here and update the “Last updated” date. If the changes are material, we will also notify hosts by email or in the product before they take effect.

Privacy questions and requests: contact@occyra.com.

Complaints and grievances: contact@occyra.com (subject line “Grievance”). We acknowledge and resolve grievances within the timelines required by applicable law.