Privacy Policy

1. Who is responsible for your data

The data controller is Faustin Boiselle, publisher of Gathr, an individual based in Barcelone (Spain). For any question about your data: contact@gathr.group.

2. The data we use

• Your account: first name, last name, email address or phone number, password (stored encrypted, never readable), date of birth, city, school (optional), profile photo (optional), chosen language.
• If you sign in with Google or Apple: your name and email address provided by that service.
• Your network: your contacts on Gathr, friend requests and recommendations.
• Your parties: the ones you create, your place requests, your confirmed places, your ticket and the time you entered the party.
• Your reliability: the number of finished parties where you had a place and actually came.
• Group chats: your messages and reactions.
• Gift pots: the ones you create and the amount of your contributions.
• Payments: amount, date and status. Your card is entered directly with Stripe: Gathr never sees your card number.
• Identity verification: it is carried out by Didit. Gathr only receives the result (verified or not), your first name, last name and date of birth. Gathr receives neither the photo of your ID document nor your selfie.
• Technical data: cookies needed for the app to work (see section 8) and technical logs (IP address, date, type of device) used for security.

3. Why we use it

• To run Gathr: your account, your network, parties, tickets, groups and gift pots. Legal basis: performance of the contract (the Terms of Use).
• To check that you are at least 18 and that your identity is real, for everyone's safety. Legal basis: your consent, which you give when you start the verification. You can withdraw it at any time, but some parties will then no longer be available to you.
• To collect and pay out payments, and keep accounts. Legal basis: performance of the contract and our legal obligations (accounting, tax).
• To send you useful notifications (for example a refund or a cancelled party). Legal basis: performance of the contract.
• To send you news about Gathr, only if you agreed to it. Legal basis: your consent, which you can withdraw at any time.
• To prevent abuse, protect members and enforce the rules (for example by suspending an account). Legal basis: our legitimate interest in keeping the community safe.

We never sell your data and we do not do targeted advertising.

4. What other members see

• Members of your network see your first name, last name, photo, school, city, "verified" badge and the friends you have in common.
• The host of a party where you request a place also sees your reliability.
• The exact address of a party is only visible to the host and to people with a confirmed place.
• A group's messages are only visible to the members of that group.
• A surprise gift pot is never visible to the person it celebrates.
• Your email, phone number and date of birth are never visible to other members.
• Gathr's two administrators can view accounts and parties, only for moderation and support.

5. Our service providers

To run Gathr, we use service providers that process some data on our behalf, following our instructions:

• Supabase: database, sign-in and photo storage.
• Vercel: website hosting.
• Stripe: card payments and payouts to hosts.
• Didit: identity verification.
• Resend: sending emails.
• Google and Apple: only if you choose to sign in with them.

Some of these providers may process data outside the European Union, in particular in the United States. These transfers are covered by the safeguards provided by the GDPR (the European Commission's standard contractual clauses or certification under the Data Privacy Framework).

6. How long we keep it

• Your account and everything linked to it: as long as your account exists. After it is deleted, your data is erased within 30 days.
• Payments: 6 years, as required by Spanish accounting law.
• The result of the identity verification: as long as your account exists. Didit keeps its own data according to its privacy policy.
• Technical logs: a few weeks at most.

7. Your rights

You can ask to access your data, correct it, delete it, restrict its use, object to certain uses, receive it in a reusable format, and withdraw your consent at any time.

To do so, write to contact@gathr.group from the address linked to your account. We reply within one month.

If you believe your rights are not respected, you can file a complaint with the Agencia Española de Protección de Datos (aepd.es) or with the data protection authority of your country.

8. Cookies

Gathr only uses cookies that are needed for it to work. They are not used for advertising or to measure your activity, which is why no consent banner is shown:

• sign-in cookies, so that you stay signed in;
• "gathr_locale", to remember your language;
• "gathr_theme", to remember light or dark mode;
• a cookie that remembers whether you chose to stay signed in on this device.

When you pay (Stripe) or verify your identity (Didit), these services may use their own cookies on their pages.

9. Adults only

Gathr is reserved for people aged 18 and over. If we learn that an account belongs to a minor, we delete it.

10. Security

Connections are encrypted (HTTPS), passwords are stored encrypted, and each member only has access to the data they need. No protection is perfect: if a data breach puts you at risk, we will let you know.

11. Changes

We may update this policy. If there is an important change, we will let you know in the app or by email. The date of the last update is shown at the top of the page.