Privacy Policy

1. Who we are

PhateSar is owned and operated by TauriX Digital Solutions (“we”, “us”), based in Victoria, Australia. You can contact us about privacy at privacy@phatesar.app.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, whether or not the Act strictly applies to a business of our size. This policy applies to the PhateSar website, the host dashboard and guest invitation pages.

2. What we collect

Hosts (people who create invitations):

• your email address, which you use to sign in, and your name if you give it;
• the content of your invitations: title, date, address and directions, notes, potluck and wishlist items, and any photos you upload;
• email addresses of co-hosts you add;
• names, and optional email addresses or phone numbers, of guests you add to create personal links; and
• a record of how you shared an invitation (for example link, SMS or email).

Guests (people who open an invitation):

• the name you type when you reply;
• your reply: whether you are going, how many people, your chosen time, and the dishes or wishlist items you claim or add; and
• if you opened a personal link, the name the host invited you under.

Everyone who visits:

• technical information in our hosting logs, such as IP address, browser type, the pages and links requested (including personal-link codes) and the time; and
• a random identifier or personal-link code kept in your browser’s local storage so we can recognise your reply on later visits, and, for hosts, a sign-in cookie.

We do not use advertising or analytics cookies or trackers. We do not ask for sensitive information (such as health details). Please don’t type sensitive information, or other people’s personal information that they wouldn’t expect us to hold, into free-text fields.

3. How we collect it

Mostly directly from you, when you sign in, build an invitation or reply. Hosts also give us details of the guests they invite. Technical information is collected automatically when you use the site.

4. Why we use it

• to run PhateSar: show invitations to guests, record replies, and show hosts who is coming;
• to send sign-in links to hosts, and reminder emails to guests on a host’s behalf (see section 7);
• to keep the service secure, prevent abuse, fix problems and improve it; and
• to meet legal obligations.

We do not sell personal information and we do not use it for advertising.

5. Who can see it

• Hosts and co-hosts see the replies to their invitation: guest names, whether they are going, party size, time slot and dishes. Hosts do not see who claimed which wishlist item.
• Other guests can see the number of people coming at each time, the dish list including the name of the guest bringing each dish, and whether a wishlist item has been claimed.
• Our service providers (section 6), only so they can provide their services to us.
• Authorities or other parties where the law requires or permits it, for example a court order.

Anyone with an invitation link can open that invitation. Hosts should share links only with the people they invite.

6. Service providers and overseas disclosure

We use these providers. Some are outside Australia, so your information may be disclosed to or stored in other countries.

• Supabase: database and sign-in. Our database is hosted in Mumbai, India (AWS ap-south-1).
• Cloudflare: website hosting, network, DNS and storage for uploaded photos. Cloudflare operates a global network, so data can be processed in many countries, including the United States.
• Resend: delivery of the emails we send (sign-in links and reminders). Resend is based in the United States.
• Google Fonts: our pages load fonts from Google, which receives your IP address and browser details when you visit. Google operates in the United States and other countries.

Before disclosing information overseas we take reasonable steps to make sure the recipient handles it in a way that is consistent with the Australian Privacy Principles, for example by using established providers with their own security and privacy commitments. By using PhateSar you understand that those overseas providers may not be subject to Australian privacy law.

7. Emails and the Spam Act

We send two kinds of email: sign-in links to hosts, and reminders to guests whom a host has added with an email address. Reminders are sent at the host’s request, are about the host’s event, and are not marketing. We do not currently send marketing emails. If we ever do, we will only send them with your consent and with a way to unsubscribe, as the Spam Act 2003 (Cth) requires.

Hosts must only add an email address if the guest would reasonably expect to hear from them about the event. If you receive a reminder you don’t want, email privacy@phatesar.app and we will stop sending to your address.

8. Storage, security and how long we keep it

We use access controls, and information is encrypted in transit (HTTPS). No system is perfectly secure, so we cannot guarantee security. If a data breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

• Invitation data (including replies, guest lists and dishes) is kept until the host deletes the invitation, which removes it from our database.
• Host account details are kept while the account exists. Ask us if you want your account removed.
• Uploaded cover photos are not yet deleted automatically when replaced or when an invitation is deleted. They may remain in file storage until we remove them. Email us if you want a photo removed.
• Hosting logs are kept by our hosting provider for a short period.

When we no longer need information and the law doesn’t require us to keep it, we delete or de-identify it.

9. Access and correction

You can ask for access to the personal information we hold about you, or ask us to correct it, by emailing privacy@phatesar.app. We may need to confirm your identity first, and we will respond within a reasonable time (usually within 30 days). If we can’t give you access or make a correction, we will tell you why in writing. A guest can also ask a host, or us, to remove their reply.

10. Children

Host accounts are for people aged 18 or over. Hosts of children’s events may list children’s names; please include only what is needed. We do not knowingly collect personal information directly from children, and replies to children’s events are expected to come from a parent or guardian.

11. Complaints

If you think we have mishandled your personal information, email privacy@phatesar.app. We will investigate and reply in writing. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

12. Changes to this policy

We may update this policy. The date at the top shows when it last changed, and we will tell hosts by email or on the website if a change is significant. Our Terms of Use also apply to your use of PhateSar.