Privacy Policy

BanquetAssist, operated by Crosby Co LLC ("we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services (the "Service").

Please read this Privacy Policy carefully. By using the Service, you consent to the practices described in this policy. If you do not agree with this policy, please do not use the Service.

1. Information We Collect

1.1 Information You Provide

We collect information you provide directly to us, including:

• Account Information: Name, email address, password, phone number, and organization name when you create an account
• Organization Data: Venue information, addresses, contact details, and business settings
• Event Data: BEO documents, event details, schedules, guest counts, room bookings, and service requirements
• Client Information: Names, contact information, and event preferences of your clients
• Event Guest Contact Details: Names and email addresses of event on-site contacts and clients, provided by venue organizers, used to send post-event survey invitations on the venue's behalf
• Survey Responses: Ratings, free-text feedback, and optional name and email submitted by event guests through post-event satisfaction surveys
• Communications: Messages, support requests, and feedback you send to us
• Payment Information: Billing details when you subscribe to paid features (processed by third-party payment processors)

1.2 Information Collected Automatically

When you use the Service, we automatically collect:

• Usage Data: Pages visited, features used, actions taken, time spent, and interaction patterns
• Device Information: Browser type, operating system, device type, and screen resolution
• Log Data: IP address, access times, referring URLs, and error logs
• Cookies and Similar Technologies: Session cookies, authentication tokens, and analytics identifiers
• Mobile App and Push Notification Tokens: When you use our mobile app, we collect a device push-notification token (used solely to deliver the notifications you enable) and basic device information (platform and device model). You can disable push notifications at any time in your device settings; signing out of the app removes the device token from our systems. The mobile app also reports crash and error diagnostics to our error-monitoring sub-processor (Sentry) so we can fix problems.

1.3 Information from Third Parties

We may receive information from third parties, including:

• Authentication providers if you sign in using third-party services
• Payment processors regarding transaction status
• Analytics providers that help us understand Service usage

2. How We Use Your Information

We use the information we collect to:

2.1 Provide and Improve the Service

• Create and manage your account
• Process and display your events, tasks, and data
• Enable collaboration with your team members
• Process BEO documents using AI-powered extraction
• Generate QR codes for guest service requests
• Provide customer support and respond to inquiries
• Improve and optimize the Service based on usage patterns

2.2 Communications

• Send transactional emails (account verification, password resets, event notifications)
• Send post-event survey invitations on behalf of venues to event guests, when the venue enables this feature, with an unsubscribe option in every email
• Provide product updates and announcements
• Send marketing communications (with your consent)
• Notify you of changes to our terms or policies

2.3 AI and Analytics

We do not train AI models on your Content. BEO documents, event data, notes, client information, and survey responses are never used to train general-purpose AI models, and they are not shared with model providers for training purposes. We use third-party AI providers (such as OpenAI and Anthropic) under zero-retention API terms, meaning your content is processed in memory and not retained or used for training by those providers.

We do use the Service to:

• Improve extraction within your organization: Our system learns from your venue's corrections and patterns to improve future extractions for your Organization. This organizational learning stays within your Organization and is never used to benefit other customers.
• Anonymized usage signals: We collect aggregate, de-identified signals (extraction success and failure rates, error categories, feature adoption) to improve our prompts, validation logic, and overall user experience. These signals cannot be linked back to you or your clients.
• Generate platform-level insights and analytics to improve features
• Analyze usage trends to enhance the user experience

2.4 Legal and Safety

• Comply with legal obligations
• Enforce our Terms of Service
• Protect against fraud, abuse, and security threats
• Respond to legal requests and prevent harm

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

3.1 With Your Consent

We share information when you explicitly authorize us to do so.

3.2 With Service Providers (Sub-processors)

We share information with third-party vendors who help us operate the Service. Our current sub-processors are:

• Supabase — database, authentication, and file storage (United States)
• OpenAI — AI document extraction and reasoning, under zero-retention API terms (United States)
• Anthropic — AI reasoning and content generation, under zero-retention API terms (United States)
• Resend — transactional, survey, and notification email delivery (United States)
• Vercel — application hosting and global edge delivery (United States and global edge network)
• Sentry — error monitoring and operational observability (United States)

These sub-processors are contractually obligated to protect your information and use it only as directed by us. We will update this list when our sub-processors change. Material changes are communicated at least 30 days in advance to customers under a Data Processing Agreement.

3.3 Within Your Organization

Information you enter into the Service may be visible to other members of your organization based on their roles and permissions. You control who has access to your organization's data through our permission settings.

3.4 For Legal Reasons

We may disclose information if required to:

• Comply with applicable law, regulation, or legal process
• Respond to lawful requests from public authorities
• Protect the rights, property, or safety of BanquetAssist, our users, or others
• Detect, prevent, or address fraud or security issues

3.5 Business Transfers

If BanquetAssist is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your information.

4. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure authentication and access controls
• Regular security assessments and monitoring
• Employee training on data protection
• Incident response procedures

However, no method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. We may retain certain information after account closure for:

• Legal compliance and record-keeping requirements
• Dispute resolution
• Fraud prevention
• Enforcing our agreements

Anonymized and aggregated data that cannot identify you may be retained indefinitely for analytics and product improvement.

6. Your Rights and Choices

You have the following rights regarding your information:

6.1 Access and Portability

You can access most of your information through your account settings. You may request a copy of your data in a portable format.

6.2 Correction

You can update or correct your account information through the Service. Contact us if you need assistance correcting other information.

6.3 Deletion

You can request deletion of your account and Organization data by emailing privacy@banquetassist.com from the email address associated with your account. We will fulfill verified deletion requests within 30 days. Upon deletion:

• Your account, Organization, events, notes, recaps, photos, and service requests will be soft-deleted and signed out, then queued for permanent purge after a 30-day recovery window (during which deletion can be reversed by contacting support)
• After the recovery window, data is permanently purged from production systems; backups roll off on a 30-day cycle
• Anonymized usage signals that cannot be linked to you may be retained
• Information we are legally required to retain (transaction records, fraud-prevention logs) is kept only for the duration required by law

6.4 Marketing and Survey Email Opt-Out

You can opt out of marketing communications and post-event survey invitations by clicking the "unsubscribe" link in any such email, or by using the one-click unsubscribe option supported by Gmail, Outlook, and other email clients. Opting out of survey invitations does not affect transactional emails related to your account or events.

6.5 Cookie Preferences

You can manage cookie preferences through your browser settings. Note that disabling cookies may affect Service functionality.

7. Cookies and Tracking Technologies

We use the following types of cookies:

• Essential Cookies: Required for authentication and core functionality
• Analytics Cookies: Help us understand how users interact with the Service
• Preference Cookies: Remember your settings and preferences

We do not use advertising cookies or sell data to advertisers.

8. Children's Privacy

The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately, and we will take steps to delete such information.

Account holders must be at least 18 years old. Team members under 18 may use the Service when invited by an account holder, in compliance with applicable labor laws.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have different data protection laws. By using the Service, you consent to the transfer of your information to the United States and other countries.

We take appropriate safeguards to protect your information during international transfers, including using standard contractual clauses where applicable.

10. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to Know: Request information about the categories and specific pieces of personal information we collect
• Right to Delete: Request deletion of your personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights
• Right to Opt-Out of Sale: We do not sell personal information

To exercise these rights, contact us at privacy@banquetassist.com.

11. European Privacy Rights (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and equivalent laws provide you with additional rights regarding your personal information.

11.1 Legal Bases for Processing

We process your personal information under the following GDPR Article 6 legal bases:

• Contract: Processing necessary to provide the Service you signed up for (account management, event data processing, transactional communications)
• Legitimate Interests: Improving the Service, fraud prevention, security monitoring, and product analytics — balanced against your rights and freedoms
• Consent: Marketing communications and post-event survey emails to guests, both of which you can withdraw at any time
• Legal Obligation: Compliance with applicable laws (record-keeping, fraud prevention, lawful requests from authorities)

11.2 Your Rights

You have the right to:

• Access: Request a copy of the personal information we hold about you
• Rectification: Correct inaccurate or incomplete information
• Erasure ("Right to be Forgotten"): Request deletion of your personal information, subject to legal retention requirements
• Restriction: Ask us to limit how we use your information
• Portability: Receive your information in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests or direct marketing
• Automated Decision-Making: Request human review of any decision made solely by automated means that significantly affects you
• Complaint: Lodge a complaint with your local data protection supervisory authority

11.3 How to Exercise These Rights

Email privacy@banquetassist.com with the subject "GDPR Request" and identify which right you wish to exercise. We will respond within 30 days. We may need to verify your identity before processing your request.

11.4 Data Processing Agreement

If your Organization processes personal information of event guests or clients through the Service, you may be acting as a data controller with BanquetAssist as your data processor under GDPR Article 28. A Data Processing Agreement (DPA) is available on request — email legal@banquetassist.com.

11.5 International Transfers

Personal information of EU, UK, and Swiss data subjects may be transferred to the United States for processing. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission with our sub-processors to ensure adequate protection of your information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service and updating the "Effective Date." Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

For significant changes, we will provide at least 30 days' notice before they take effect.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: