Privacy Policy

1. A Quick Summary

• We collect only the information needed to run the Service.
• We never sell your data and we never use it to train AI models.
• We never contact the people on your guest list.
• We use a small number of trusted providers (Supabase, Stripe, Google, Resend, Vercel) to run the Service.
• We use Google Analytics to understand how visitors use the site, and Google Ads to measure whether our advertising works. Both tools use cookies. We do not use other ad trackers or third-party analytics.
• You can access, export, or delete your data at any time.

The sections below explain each of these points in detail.

2. Information We Collect

We collect information in three ways: information you provide directly, information you create inside the app, and a small amount of technical information that is automatically collected when you visit the Service.

Information you give us

• Account information. When you sign in with Google, we receive your name and email address from Google.
• Payment information. When you purchase Arranged, our payment processor (Stripe) collects and processes your payment details. We receive a confirmation and the last four digits of your card, but we never see or store your full card details.
• Support messages. If you email us, we keep a copy of your message and our reply.

Information you create inside Arranged

• Event data. The floor plans, tables, seating arrangements, and notes you build in Arranged.
• Guest list data you upload. Guest names and, optionally, email addresses, phone numbers, dietary notes, or any other fields you choose to include when importing a guest list.

You decide what goes into your guest list. The minimum we need from you is a name per guest. Everything else is optional.

Information collected automatically

• Device and browser information. Browser type, operating system, screen size, language, and similar technical details that help us serve the app correctly.
• Log information. IP address, approximate location based on that IP address (usually just a city or region), timestamps, pages visited inside the app, and error reports.
• Cookies. Essential cookies that keep you signed in, plus analytics and advertising cookies from Google Analytics and Google Ads. See Section 8 for the full list and opt-out options.

We do not collect precise geolocation (your GPS coordinates). We do use Google Analytics and Google Ads for site measurement and advertising attribution. See Section 5 and Section 8 for details.

Categories of personal information (for California CCPA/CPRA)

In the past 12 months, Arranged has collected the following categories of personal information as defined by the California Consumer Privacy Act:

• Identifiers. Name, email address, IP address, account identifier.
• Customer records. Payment confirmation details and last four digits of your card (through Stripe; we do not see full card numbers).
• Commercial information. Records of your purchase of Arranged.
• Internet and network activity. Browsing history on our site, pages visited, referring site, device and browser information, interactions with the Service.
• Geolocation (approximate only). City or region derived from your IP address. We do not collect precise GPS location.
• Inferences. Limited inferences about ad performance and site usage, drawn from Google Analytics and Google Ads data.
• User-generated content. Event data, floor plans, seating arrangements, and guest lists you create or upload.

We do not collect sensitive personal information as defined by California law (such as Social Security numbers, precise geolocation, racial or ethnic origin, religious beliefs, health data, biometric data, or contents of your mail, email, or text messages).

3. How We Use Your Information

We use the information above for the following purposes:

• To provide the Service. Sign you in, save your work, display your events and guest lists back to you.
• To process your purchase. Send your payment to Stripe for processing and confirm your access once payment succeeds.
• To communicate with you. Send account emails (receipts, password resets, service updates), respond to support requests, and notify you about material changes to the Service or this policy.
• To keep the Service safe and working. Detect bugs, prevent fraud and abuse, enforce our Terms of Service, and improve reliability and performance.
• To comply with the law. Respond to lawful requests, keep required tax and payment records, and protect our legal rights.

We run advertising on Google Ads and use Google Analytics to measure the effectiveness of our site and ads. Google may use the cookies set through these tools to show you relevant ads on other sites (remarketing). We do not use your account, event data, or guest data for advertising targeting, and we do not use any of your information, event data, or guest data to train AI or machine learning models.

Legal bases (for users in the EU, UK, and Switzerland)

If you are in the European Union, United Kingdom, or Switzerland, we process your personal information under the following legal bases of the GDPR and UK GDPR:

• Contract. To deliver the Service you purchased.
• Legitimate interests. To keep the Service secure, prevent abuse, and make the product better, in ways that are balanced against your privacy rights.
• Legal obligation. To comply with tax, accounting, and other legal requirements.
• Consent. Where required by law. You can withdraw consent at any time.

4. A Special Promise About Your Guest List

When you upload a guest list to Arranged, you are trusting us with other people’s personal information. We take that seriously. Our promises:

• We will never email, message, call, market to, or otherwise contact anyone on your guest list.
• We will never sell, rent, or share guest data with third parties for their own use.
• We will never use guest data for advertising, marketing, or AI training.
• Guest data is used only to let you build and manage your seating plan inside Arranged.
• When you delete an event or your account, the associated guest data is removed from our active systems promptly and from backups within the timeframe described in Section 6.

You are responsible for having the appropriate authority to upload guest information to the Service, and for telling your guests, where required, that their details are stored with a planning tool you use.

5. Third Parties We Work With

Arranged is a small operation. We rely on a short list of trusted providers to run the Service. Each one is contractually required to protect your information and to use it only to provide services to us.

• Supabase stores your account, event data, and guest data. See Supabase’s privacy policy.
• Stripe processes your one-time payment when you purchase Arranged. See Stripe’s privacy policy.
• Google provides three services we rely on. (1) Sign-in via Google OAuth: we receive your name and email address when you sign in. (2) Google Analytics 4: we use GA4 to measure how visitors use the site, including pages visited, scroll depth, and outbound clicks. Google collects this data on our behalf and may use it subject to Google’s privacy policy. (3) Google Ads: we run advertising on Google and use the Google Ads conversion tag on every page of the site to measure whether ads lead to purchases. You can opt out of Google’s use of advertising cookies at adssettings.google.com.
• Resend sends our transactional emails (receipts, account emails, support replies). See Resend’s privacy policy.
• Vercel hosts the application and serves it to your browser. See Vercel’s privacy policy.

We may also disclose information if required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of Arranged, our users, or the public.

We do notsell your personal information. Our use of Google Ads and Google Analytics may qualify as “sharing” personal information for cross-context behavioral advertising under some US state privacy laws (such as the California CCPA/CPRA). You can opt out of Google’s advertising cookies at adssettings.google.com, or email us at support@arrangedapp.co to request that we not share your information in this way.

6. How Long We Keep Your Data

We keep your account and event data for as long as your account is active. When you delete an event, the event data and its guest list are removed from our active systems promptly and from backups within 30 days.

When you delete your account, we remove your data within 30 days, except where we are legally required to keep records. For example, payment and tax records are retained for the period required by applicable financial and tax law (typically up to 7 years).

If you stop using Arranged without deleting your account, we may delete inactive accounts after an extended period of inactivity. We will email you before doing so.

7. Data Storage and Security

Your data is stored on servers operated by Supabase and Vercel, primarily in the United States. We use encryption in transit (HTTPS) and at rest, access controls, and reasonable administrative and technical safeguards to protect your information.

No system is perfectly secure. If we become aware of a security incident that affects your personal information, we will notify you and any regulators required by applicable law.

If you are located outside the United States, please be aware that your information will be transferred to, stored in, and processed in the United States. Where required by law (for example, for users in the EU, UK, or Switzerland), we rely on appropriate safeguards such as Standard Contractual Clauses for these transfers.

8. Cookies and Similar Technologies

Arranged uses two categories of cookies:

Essential cookies

• Authentication cookies that keep you signed in between page loads.
• Session cookies used by Supabase to manage your login session securely.

Analytics and advertising cookies

• Google Analytics cookies (_ga, _gid, and related). These help us understand how visitors use the site, such as which pages are visited and how long users spend on them. We use this data primarily in aggregate.
• Google Ads cookies. These allow Google to attribute purchases to the ads that drove them, and may be used by Google to show you relevant ads on other sites. You can opt out at adssettings.google.com.
• Google Ads Enhanced Conversions. When you complete a purchase, Google Ads may hash (one-way encrypt) limited user-identifying data from the page (such as your email address) and send it to Google to match the conversion to the ad click that drove it. Google does not receive your email in readable form and uses it only to measure ad performance.

We do not use any other advertising cookies, cross-site trackers, or marketing-automation tools beyond Google Analytics and Google Ads.

You can disable cookies in your browser settings. Disabling essential cookies will prevent you from staying signed in. Disabling analytics and advertising cookies will limit our ability to measure site performance but will not affect your use of the Service.

9. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights over your personal information. We honor these rights regardless of where you live, up to what is reasonably possible given the nature of the Service.

Rights that apply to everyone

• Access. Ask us what personal information we hold about you.
• Correction. Ask us to fix information that is wrong. You can also correct most information directly inside the app.
• Deletion. Ask us to delete your account and associated data.
• Export. Get a copy of your event and guest data in a portable format.
• Opt out of non-essential emails. Unsubscribe from any non-transactional emails at any time.

EU, UK, and Switzerland (GDPR and UK GDPR)

In addition to the rights above, you have the right to:

• Restrict or object to how we process your personal information.
• Withdraw any consent you previously gave.
• Lodge a complaint with your local data protection authority if you believe we have not handled your information properly. A list of EU authorities is available at edpb.europa.eu. For the UK, contact the Information Commissioner’s Office.

California

Under the California Consumer Privacy Act (CCPA/CPRA), California residents have the right to:

• Know what categories of personal information we collect and how we use them.
• Request access to, or deletion of, their personal information.
• Correct inaccurate information.
• Opt out of the sale or sharing of personal information. We do not sell personal information. Our use of Google Ads and Google Analytics may qualify as “sharing” for cross-context behavioral advertising. To opt out, enable Global Privacy Control in your browser, use Google’s controls at adssettings.google.com, or email support@arrangedapp.co.
• Not be discriminated against for exercising these rights.

Other US states

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other US states with comprehensive privacy laws have rights similar to those above, including access, deletion, correction, and opt-out of targeted advertising or the sale of personal information. We do not sell personal information. If you would like to opt out of our use of Google Ads and Google Analytics, enable Global Privacy Control in your browser, use Google’s controls at adssettings.google.com, or email us at support@arrangedapp.co.

Canada

If you are in Canada, you have rights under PIPEDA and provincial privacy laws, including the right to access your personal information and to challenge its accuracy. You may also file a complaint with the Office of the Privacy Commissioner of Canada.

10. How to Exercise Your Rights

The easiest way to exercise most of your rights is inside the app. You can edit your events, update your guest lists, and delete data at any time.

For anything you cannot do inside the app, email support@arrangedapp.co from the email address on your account. We will respond within 30 days. We may ask for information to confirm your identity before acting on certain requests, to protect you and other users.

You can also designate an authorized agent to act on your behalf, where permitted by law. We may require written authorization and identity verification.

11. Do Not Track and Global Privacy Control

Some browsers offer a “Do Not Track” (DNT) signal or a Global Privacy Control (GPC) signal.

Global Privacy Control. When we detect a valid GPC signal from your browser, we treat it as a request to opt out of the sharing of your personal information for cross-context behavioral advertising. For visitors with GPC enabled, we do not enable Google Ads remarketing audience features or share data with Google Ads for the purpose of targeting ads back to you.

Do Not Track.There is no agreed industry standard for how to interpret DNT. We do not currently alter our data collection practices in response to DNT signals. You can opt out of Google’s advertising cookies directly at adssettings.google.com.

12. Children

Arranged is not directed to children. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, please email hello@arrangedapp.co and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or an in-app notice before the changes take effect. The date at the top of this page shows when it was last updated.

14. Contact

For any privacy question, complaint, or request, email us at:

• General questions: hello@arrangedapp.co
• Privacy and data requests: support@arrangedapp.co

Arranged is operated by Arlen Bitsky (d/b/a Arranged). Our mailing address is:

Arranged
426 Hudson St.
New York, NY 10014
United States