How festi collects, uses, and protects your information

This Privacy Policy explains how festi collects, uses, discloses, and protects information in connection with our websites, applications, and related services (the Service). By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.

Last updated: October 27, 2026

1. Information we collect

Account and profile information you provide, such as name, email address, and optional profile details.
Event information provided by Organizers and Attendees (e.g., event names, dates, invites, messages, media).
Content you submit, including posts, comments, files, and images.
Communications with us (support inquiries, feedback, survey responses).
Device and usage data such as IP address, browser type, app version, pages viewed, and timestamps.
Product analytics about what you do in the app and on the site, tied to your account, as described in "Analytics and diagnostics" below.
Cookies and similar technologies as described in our Cookie Policy.

2. Sources of information

Directly from you when you create an account or interact with the Service.
Automatically through your device and browser when you use the Service.
From third parties, where permitted by law (e.g., authentication or analytics providers).

3. How we use information

Provide, operate, maintain, and improve the Service.
Authenticate users, secure accounts, and prevent fraud and abuse.
Communicate with you about updates, features, and service notifications.
Personalize content and measure engagement and performance.
Comply with legal obligations and enforce our Terms of Use.

4. Legal bases for processing (EEA/UK)

Contract: processing necessary to perform our contract with you (e.g., account creation, event hosting).
Legitimate interests: to operate, secure, and improve the Service, including product analytics and error reporting, balanced against your rights. You can object to analytics at any time (see "Analytics and diagnostics").
Consent: for optional communications where required.
Legal obligation: where necessary to comply with applicable law.

Analytics and diagnostics

We use three service providers to understand how the Service is used and to fix problems:

PostHog (product analytics): records what you do in the app and on the site, tied to your account. This includes the screens and pages you view, the buttons and interface elements you click or tap (including their labels), the features you use (such as creating an event, RSVPing, adding guests, or uploading photos), sign-ins, sign-outs and unexpected session failures, whether you allow notifications and which ones you open, and page performance metrics, along with device, app, and browser information such as the version of the app you run. Your analytics profile includes your name and phone number so we can tell who an activity belongs to, and whether you host events. We do not record passwords, one-time passcodes, the body of your chat messages, or what a notification says.
PostHog (session recordings): on our website, PostHog also records how you move through the Service, such as the pages you visit, where you click or tap, and how you scroll, so we can see where things are confusing or broken. Before a recording leaves your device, all text, everything you type, and all images are hidden, so a recording does not show your messages, event names, guest names, phone numbers, or photos. Recordings are linked to your analytics profile and deleted after 30 days.
Vercel Analytics: aggregate page-view and performance statistics for our website.
Sentry: error, crash and session-failure reports linked to your account ID, so we can find and fix bugs. Session diagnostics do not include passwords, passcodes or authentication tokens.

We do not sell this data and we do not use it for advertising. These providers process it on our behalf.

To opt out of product analytics, or to ask us to delete your analytics profile and the data tied to it, contact us through our Contact page. We will act on your request within the timeframes required by law.

Connected AI tools

When you connect an AI assistant through our MCP server, Festi receives the tool arguments the assistant sends and returns the requested account or event data. This can include event plans, guest names and contact details, RSVPs, travel, room assignments, and the text or files supplied for an operation. Your Festi permissions continue to apply. OAuth connections grant the available tool permissions; Personal Access Tokens can be limited to selected permissions.

The connected assistant receives tool results and processes them under its own terms and privacy policy. Optional AI tools send task-specific text or event context to model providers through our AI service provider. Place, flight, weather, image, and document tools may contact the service providers needed for that operation. AI diagnostics may include request and response content when content recording is enabled. The connector does not request your assistant's full conversation history.

Changes made by tools are stored as ordinary Festi event or profile data and remain until those records are deleted, subject to the retention provisions below. We store Personal Access Token hashes and metadata, rather than the full token. Expiring or revoking a token prevents its use; it does not delete its metadata or event data. Removing a connection does not erase results already received by the assistant.

You can remove a connection in your assistant and revoke Personal Access Tokens in Access tokens. For connection setup and access details, see AI connections. Contact us through our Contact page to request deletion or help with access.

6. Retention

We retain information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary based on the type of data and our obligations.

7. Security

We implement technical and organizational measures designed to protect information. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

8. International transfers

If we transfer personal data internationally, we implement appropriate safeguards (e.g., Standard Contractual Clauses) as required by law.

9. Your rights

EEA/UK: access, rectification, erasure, restriction, portability, and objection. You may also withdraw consent at any time.
California (CCPA/CPRA): right to know, delete, correct, and opt out of certain sharing. We do not sell personal information.

To exercise rights, including opting out of product analytics or requesting deletion of your analytics data, please visit our Contact page. We may verify your request and respond within the timeframes required by law.

10. Children's privacy

The Service is not directed to children under 13 (or the age of digital consent in your jurisdiction). If you believe a child provided personal information, contact us and we will take appropriate steps.

11. Cookies and tracking

We use cookies and similar technologies as described in our Cookie Policy. You can block or delete cookies in your browser settings. We do not currently show a cookie banner, so to opt out of product analytics, contact us as described in "Analytics and diagnostics".

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated by reasonable means (e.g., posting on this page). Continued use of the Service after updates constitutes acceptance.

13. Contact

Questions about this Policy? Visit our Contact page. For terms governing use of the Service, see our Terms of Use.