Privacy Policy

Who we are

Festi — the festi.gr website and the Festi app — is operated by Arche Digital IKE, Greece, the controller of the personal data described in this policy.

What we collect

We collect only what we need to run Festi:

• Account details: name, email, phone, address, profile photo, preferred language and notification settings.
• Sign-in: if you use Google, Apple or Facebook, we receive your name, email, profile photo and an account identifier from them.
• Bookings and messages: your booking requests, contracts, reviews and the messages you exchange with vendors.
• Your event: invitation, event website, guest list, replies, registry, seating and wishes. Guests’ details are added by the host or by the guests themselves.
• Photos and other content you upload.
• Vendors who connect a calendar: the times their calendar events are busy, so those dates show as unavailable on Festi. Never the titles or other details of the events.
• Contacts: if you import guests from your phone, only the contacts you select are uploaded.
• Payments: payments are handled by Stripe. We never receive your full card number. We keep the payment status and, for purchases from Festi, the card brand and last four digits.
• Vendors: business name, tax and contact details, listings, subscription and the status of your Stripe account.
• Devices and security: IP address, browser or app version, a push notification token if you allow notifications, and sign-in records that keep accounts safe.

How we use it

• To provide Festi: your account, bookings, messages, your event and payments. This is necessary for our contract with you.
• To keep Festi safe: preventing fraud and abuse, protecting accounts and fixing errors. This is our legitimate interest.
• To meet legal obligations, such as keeping payment records.
• To send service messages by email, SMS and push, and occasional product news by email, which you can turn off at any time in your notification settings.

We do not sell your personal data, and we do not use it for advertising or to track you across other apps and websites.

Calendars vendors connect

A vendor can connect a Google Calendar, or paste an Apple, Outlook or other calendar link, so their existing bookings block those dates on Festi and customers cannot book them twice. From a connected Google Calendar we read, for the calendars the vendor picks, only each event’s start and end time, whether it is cancelled or marked free or busy, its type and its colour. We never request event titles, descriptions, locations or guests, and we never change the calendar. We keep only the blocked time ranges, and delete them when the vendor disconnects the calendar, which also revokes our access at Google.

Festi’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, do not sell it, and do not let people read it.

Who we share it with

Other users see what they need. When you book or message a vendor, they see your name, email, photo and booking details, and a contract includes your name and address. We also use these service providers:

• Stripe — payments and vendor payouts
• Resend and Postmark — email
• Sinch — SMS
• Google Firebase Cloud Messaging — push notifications
• Google Firebase Crashlytics — app crash reports, not linked to you
• Google, Apple and Facebook — sign-in, when you choose it
• Cloudflare — bot protection on sign-in forms
• Mapbox — maps and address search
• Lulu — printing and shipping the keepsake books you order
• Sentry — error monitoring, with a numeric account ID and no names or emails
• Plausible — cookieless website statistics, with no personal data
• Hetzner — hosting

We disclose data to authorities only where the law requires it.

International transfers

Some of these providers process data outside the European Economic Area, mainly in the United States. Those transfers rely on safeguards recognised by the GDPR, such as the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

How long we keep it

• Account data: for as long as your account is open.
• When you delete your account, we remove or anonymise your personal details. Records the law requires us to keep, such as payment records, are kept for the period the law sets.
• Server logs: up to 14 days. Backups: up to 2 years, after which they are overwritten.

Your rights

Under the GDPR you can ask to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw any consent you gave. Email [email protected] and we will reply within one month. You can also complain to the Hellenic Data Protection Authority (www.dpa.gr).

Deleting your account

You can delete your account from your account settings, in the app or on festi.gr. Vendor accounts are deleted on festi.gr.

If a host added you as a guest

Hosts can add their guests’ names and contact details to plan their event. We use them only to send the host’s invitations and messages and to show your replies to the host. To be removed, ask the host or email us.

Cookies

We use only the cookies needed to keep you signed in, remember your language and protect our forms. Our website statistics use no cookies. The payment, map and bot-protection services may set their own cookies on the pages where they run.

Children

Festi is not intended for children under 16, and we do not knowingly create accounts for them.

Security

Data travels encrypted over HTTPS, passwords are stored as one-way hashes, and inside Festi only the staff who need personal data can access it.

Changes to this policy

When we change this policy, we update this page and the date at the top. For significant changes we will also tell you by email or in the app.