Privacy notice

Pingle is an event invitation and RSVP service operated by LuxVibeWeb, in the United Kingdom. For the purposes of UK data protection law we are the data controller for the personal data described here.

If you use Pingle for a private celebration — a birthday, a christening, a barbecue — you are acting in a personal capacity and the law does not treat you as a controller of your guests' data. We take that responsibility. If you use Pingle in the course of a business (an event planner, a venue, a club), that changes: see clause 5 of the Terms.

Contact us about anything in this notice at privacy@pingleapp.co.uk.

You can use Pingle to create and share an event without an account and without giving us your email. If you do that, we hold the event and nothing about you beyond what you typed into it.

Pingle is built for family celebrations, so events often involve children, and guests often tell a host about an allergy so a child is kept safe. We want to be straight with you about what that means.

Pingle is for adults. The service is intended to be used by people aged 18 or over. A child may be named on an invitation by their parent or guardian, and a child may be brought to an event, but we do not intend for children to create events or accounts themselves.

If you are a parent or guardian and you would like a child's name, age or allergy details removed from an event, email privacy@pingleapp.co.uk and we will remove it. You do not need to explain why, and we will not charge you.

Where we rely on legitimate interests we have weighed our interest against your privacy. You can object to either of those uses by emailing us, and we will stop.

You may have landed here because someone invited you to something. You did not sign up to Pingle and you do not have an account. Here is your position:

• Your name is on that event because the host put it there, or because you typed it in when you replied.
• The host can see everything you enter — your reply, your headcount, any allergy note, and any message you leave. That is the point of an RSVP.
• Other guests cannot see your reply. The invitation page shows a guest their own reply only.
• You do not have to give an email address or a phone number to reply. Those fields are optional.
• If you give an email address, you may get one confirmation of your reply and, at most once ever, one email suggesting you could host your own event. You will not be added to a mailing list.
• You can ask us to remove your details at any time, whether or not you go back to the host. Email privacy@pingleapp.co.uk.

We use a small number of suppliers to run the service. Each only sees what it needs to.

We will disclose personal data if we are legally required to — a court order, or a request we are obliged to comply with. If Pingle were ever sold or transferred, event and account data would transfer with it, and we would tell hosts with an account first.

Some suppliers may process data outside the UK. Where they do, transfers are covered by the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

Pingle works through links rather than passwords, so it is worth understanding what each one does.

Links are long random strings and are not guessable. We ask search engines not to index any of them, but a link you publish somewhere public can still be found. If a host link is exposed, ask us to replace it and the old one stops working.

Under UK data protection law you can ask us to:

• Show you what we hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete it. We will, unless we are legally required to keep something.
• Restrict or object to how we use it.
• Port it — receive it in a machine-readable format. Hosts can also export any event to CSV or PDF themselves, at any time.
• Withdraw consent you previously gave, including for allergy details and for analytics.

Email privacy@pingleapp.co.uk. We will respond within one month. There is no charge.

We make no automated decisions about you that have a legal or similarly significant effect, and we do not profile you.

The site is served over HTTPS. Links use long random tokens generated by a cryptographic random number generator. Host and guest data is only reachable through checks on the server, not by trusting the browser. Access to the database is limited to what each request needs.

No service can promise it will never be breached. If a breach happens that is likely to affect your rights, we will tell the ICO within 72 hours and tell you without undue delay.

If we change how we use personal data we will update this page and change the date at the top. If a change is significant, and you have an account or have given us your email for an event, we will email you about it rather than relying on you noticing.