Privacy Policy

1. Scope and who is responsible

This notice describes how RH Seating ("RH Seating," "we," or "us") processes personal data through rhseating.com, its dashboard, QR seat finder, contact forms, and support services.

Event organizers control their guest lists. For guest names, table or seat assignments, and related event data uploaded by an organizer, the organizer is normally the controller or Data Fiduciary and RH Seating acts as its processor or Data Processor. The organizer decides what to upload, why it is used, when it is published, and when it is deleted.

RH Seating controls its own business data. We are the controller or Data Fiduciary for account registration, security, support communications, service administration, and our consent-based analytics.

2. Data we process and why

• Account data: name, email, Magic authentication identifier, acceptance records, plan status, and the website or link you first arrived from (kept in your browser tab until you sign up, then stored with the account), to create and secure your account, provide the service, and understand which channels bring people to us.
• Event data: event name, date, venue, public link, page settings, layouts, tables, seats, and assignments—to operate event planning and seat-finding features.
• Guest data provided by organizers: primarily guest names and table/seat assignments. Optional contact, note, or dietary fields may exist in stored records; organizers should not upload unnecessary or sensitive data.
• Seat-search input: a guest's typed name is sent to our server only to return matching seat results. The full guest roster is not downloaded to the browser. A typed name is never sent to analytics. Optional analytics may run on seat-search pages, but only after you allow it. Request infrastructure may still process IP address, URL, timing, and security metadata.
• Guest photos: where an organizer turns on photo sharing, guests can upload photos to the event page. Photos can show identifiable people. They are stored for the organizer, visible to people with the event link, and removable by the organizer at any time. The organizer is the controller for them, as for the guest list.
• Payment and billing records: what was bought, when, the amount, and the Stripe payment reference, to deliver what was paid for, handle refunds, and keep the accounting records the law requires.
• Support data: name, email, optional mobile number, subject, message, requested service, and optional event details—to answer questions and prepare requested quotes.
• Technical and security data: IP address, device/browser information, request identifiers, authentication and audit signals, and operational logs—to prevent abuse, investigate faults, and protect the service.
• Optional marketing analytics: pseudonymous identifiers and interaction data from Google Analytics and Contentsquare, only after consent, and with Google advertising features disabled. Available on any page, including seat-search pages, and never including a guest's typed name.

Legal bases (EU and UK GDPR). Where the GDPR applies, we rely on:

• Performance of a contract (Art. 6(1)(b)) for account, event, payment, AI features an organizer starts, and support data needed to provide what you asked for;
• Legal obligation (Art. 6(1)(c)) for payment, tax, and accounting records;
• Legitimate interests (Art. 6(1)(f)) for technical and security data (keeping the service safe and working), the channel you arrived from (understanding what brings people to us), and answering questions from people who are not yet customers. You can object to these at any time;
• Consent (Art. 6(1)(a) and the ePrivacy rules on device storage) for Google Analytics and Contentsquare. You may withdraw it at any time through Privacy choices, without affecting processing before withdrawal.

For guest data and guest photos, we act on the organizer's instructions as a processor, and the organizer is responsible for the legal basis.

3. When data is disclosed

We do not sell personal data, and we do not use it for cross-context behavioral advertising. We disclose only what is reasonably necessary to:

• Cloudflare for website delivery, D1 database and KV storage, rate limiting, security, email routing, and service logs;
• Magic for passwordless authentication;
• Zoho for our business email, including replies to support requests and messages we send to account holders;
• Stripe for payment processing when an organizer pays to publish an event. Card details are entered on Stripe and are never held by RH Seating;
• Groq, our text-reading provider, in three places and only when an organizer asks for one of them. The paste importer sends only the lines our own parser could not read, so most pasted lists never leave our servers at all. Seating suggestions and the event assistant send guest names and table names for that event, because working out where people sit is what the organizer asked for. Nothing about an event is sent unless the organizer starts one of these, imported lists and suggested seating are shown for approval before anything is saved, and the assistant can change only the event it is opened on and can never delete a guest;
• Google Analytics and Contentsquare for optional analytics after consent;
• comply with valid legal process, protect rights and safety, investigate abuse, or complete a business transfer subject to appropriate safeguards; and
• follow an organizer's instructions or your direction.

RH Seating is operated from India, and these providers may process data in India, the United States, or other countries where they operate. For personal data from the European Economic Area, the United Kingdom, or Switzerland, transfers rely on the providers' data processing terms, which incorporate the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) or, for United States providers certified to it, the EU-U.S. Data Privacy Framework. You can ask for a copy of the relevant safeguards at privacy@rhseating.com.

4. Retention

Account, event, and guest data remains available until the organizer deletes an event or the account is deleted; RH Seating does not currently promise automatic deletion a fixed number of days after an event. Support records, consent evidence, security logs, and backups are kept only as long as reasonably necessary for the stated purpose, dispute prevention, security, legal compliance, and recovery, then deleted or de-identified under applicable retention controls.

Deleting an RH Seating account removes the app's account and event data. Authentication provider records may remain with Magic for its independent legal, security, and retention obligations.

5. Your choices and rights

Depending on where you live and which law applies, you may request access, a copy, correction, completion, deletion, portability, restriction or objection, withdrawal of consent, information about disclosures, or review of a privacy grievance. You may also nominate another person where India's DPDP Act provides that right.

• Account holders can download app data or permanently delete their account under Privacy & account.
• Event guests should first contact the event organizer, who controls the guest list. You may also contact us and we will assist the organizer as appropriate.
• To withdraw analytics consent, use the Privacy choices link in the site footer. We honor supported Global Privacy Control signals by keeping optional analytics off.
• For other requests, email privacy@rhseating.com. We may verify identity and authority before acting.

We aim to respond within the period required by applicable law. For an India grievance, we aim to resolve it without unreasonable delay and no later than 90 days under the applicable DPDP Rules. You may complain to the Data Protection Board of India or the relevant U.S. state authority after using available grievance channels.

If you are in the EU, EEA, UK, or Switzerland, we answer requests within one month, extendable only where the GDPR allows. You have the right to object to processing based on legitimate interests, and the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live, work, or where you believe an infringement took place. In the UK that is the Information Commissioner's Office. You do not have to contact us first, though we would welcome the chance to put things right.

6. U.S. privacy signals and notices

Some U.S. state privacy rights apply only when a business meets statutory thresholds. Regardless, RH Seating provides the controls described here. We do not sell personal information or share it for cross-context behavioral advertising. Global Privacy Control is treated as a request to keep optional analytics off. Because there is no universal technical standard for other "Do Not Track" signals, we do not respond differently to unsupported DNT signals; you can always reject analytics through our controls.

7. Children and guest minors

RH Seating accounts are for adults aged 18 or older. We do not knowingly allow children to create accounts. Optional analytics on seat-search pages runs only after the visitor allows it, and is never used to profile a guest. An event guest may be a minor; the organizer must have a lawful basis and obtain verifiable parental consent where required—including for a child under 18 under India's DPDP framework. Organizers should upload only the minimum information necessary. Contact us to report improperly uploaded child data.

8. Security and incidents

We use measures appropriate to the service, including authenticated access, ownership checks, encrypted network transport, restricted provider access, request-size and rate limits, data minimization, monitoring, and backup/recovery controls. No system is completely secure. If a qualifying personal-data breach occurs, we will investigate and notify affected people and authorities as required by applicable law.

9. Updates and contact

We may update this notice as the service or law changes. We will post the revised date and provide additional notice when legally required. Privacy and grievance contact: privacy@rhseating.com. General support: support@rhseating.com.