Privacy Policy
Last updated: 11 October 2026 · Version 1.2
Regional compliance context
Based on your detected country (US), this page currently applies United States (state privacy laws) as the baseline policy profile.
- Cookie model: opt-out
- Guardian-consent age threshold (GDPR Art. 8 for information society services): 13
- Transfer rule: Comply with applicable state privacy and consumer protection laws.
Note: Our RSVP product enforces a stricter under-18 guardian-consent rule for all event registrations. See section 8 below for details.
1. Controller
The data controller for personal data processed through the Pulln platform is Kivorise OÜ, trading as Pulln ("we", "us", "our"), operating the event management platform at pulln.io.
Controller identification:
Legal entity name: Kivorise OÜ
Legal form: Private limited company (OÜ)
Trading as: Pulln
Registry code (registrikood): 17317014
EUID: EEARIREG.17317014
Date of registration: 1 September 2025
Registered office: Harju maakond, Tallinn, Kesklinna linnaosa, Pärnu mnt 135-17, 11314, Estonia
Management board: Jishnu Sygal (Management board member; every board member may represent the company)
For questions or requests, contact us at privacy@pulln.io.
Company registration details are publicly available in the Estonian Business Register (e-Äriregister) at ariregister.rik.ee.
2. Data we collect and why
We collect only the minimum personal data needed to manage event invitations and RSVPs.
| Data category | Examples | Legal basis |
|---|---|---|
| Identity & contact | First name, last name, email address, phone number | Performance of contract (GDPR Art. 6(1)(b)) |
| RSVP preferences | Attendance status, sub-event selections | Performance of contract (Art. 6(1)(b)) |
| Health data - dietary | Dietary restrictions, allergies | Explicit consent (Art. 6(1)(a) + Art. 9(2)(a)). Required for catering safety. |
| Guardian details (minors) | Guardian name and email, consent timestamp | Legal obligation (Art. 6(1)(c)). Product requires guardian involvement for guests under 18; GDPR Art. 8 ISS consent thresholds (13-16 by member state) apply separately to account/sign-up contexts where applicable. |
| Consent records | Hashed IP, UTC timestamp, consent text version | Legal obligation - GDPR Art. 7 accountability |
| Technical / session | Hashed IP address, Supabase session cookie | Legitimate interests (Art. 6(1)(f)) - security and fraud prevention |
| First-party analytics | Page path, referrer and campaign (UTM) tags, and a daily-rotating keyed hash that cannot identify you across days. No cookies, no IP address or browser string stored, no third-party analytics. | Legitimate interests (Art. 6(1)(f)) - understanding which pages and campaigns work |
| AI writing help | Usage counts only (no text stored) | Performance of contract (Art. 6(1)(b)). Optional feature you ask for. |
| Error diagnostics | Browser/OS version, stack traces (PII-scrubbed before transmission) | Legitimate interests (Art. 6(1)(f)) - service stability and bug resolution |
3. Data retention
We retain personal data for as long as necessary to manage the event. Automatically:
- All identifying fields (name, email, phone, dietary information) are permanently nulled 30 days after the event ends by an automated nightly job.
- Non-PII structural data (UUIDs, RSVP status, attendance counts) is kept indefinitely for referential integrity and aggregate reporting.
- Consent log rows are kept for 5 years (GDPR Art. 7 accountability - proof of consent).
- Data subject request records (access, erasure, portability requests) are kept for 5 years (legal obligation - compliance audit trail).
4. Your rights
Under state privacy laws (including California CCPA/CPRA, Virginia VCDPA, Colorado CPA), you have the right to:
- Access - receive a copy of the personal information we have collected about you.
- Deletion - request deletion of your personal information.
- Correction - request correction of inaccurate personal information.
- Opt-out of sale or sharing - direct us not to sell or share your personal information with third parties. See our Do Not Sell or Share My Personal Information page.
Important: Pulln does not currently sell personal information as defined by the CCPA/CPRA. We do not exchange personal information for monetary or other valuable consideration. If our practices change, we will update this policy and provide an opt-out mechanism before any sale occurs.
To exercise any right, use the privacy request form or email privacy@pulln.io with the subject line "Data Subject Request". We will respond within 30 days. You may also have the right to appeal our decision regarding your request by contacting us at the email above with "Appeal" in the subject line.
5. Sub-processors
We share personal data only with the following processors, each bound by a Data Processing Agreement (GDPR Art. 28):
| Processor | Purpose | Region |
|---|---|---|
| Supabase | Database and authentication | EU (Frankfurt) |
| Vercel | Application hosting and CDN | EU-West (Dublin) |
| Cloudinary | Image and media optimisation | EU |
| Cloudflare | DNS, domain management, and CAPTCHA | Global edge |
| Resend | Transactional email delivery | EU |
| Kit | Marketing newsletter (DPA approved; opt-in on account signup / settings) | US |
| Sentry | Error monitoring (PII-scrubbed) | EU (Frankfurt) |
| Doppler | Secret management (no personal data) | US |
| GitHub | Internal feedback tracking (metadata only, no PII) | US |
| Slack | Internal notifications (metadata only, no PII) | US/EU |
| Pexels | Admin photo search (no guest data) | US |
| Google (OAuth) | Optional 'Continue with Google' sign-in | US/Global |
| Apple | Optional 'Sign in with Apple' | US/Global |
| Google Maps Platform | Admin venue search and transit directions (server-side only) | US/Global |
| Google (Gemini API) | Optional AI writing help when you create an event. It suggests a title, description and invitation text from what you type. | US/Global (may be outside the EU) |
Note on Sentry: Error monitoring is initialised automatically to maintain service stability (legitimate interest, Art. 6(1)(f)). All events are scrubbed of names, email addresses, phone numbers, and IP addresses before leaving your device. Session replay is permanently disabled. Sentry processes data exclusively in its EU (Frankfurt) region under a Data Processing Agreement.
Google Maps (embed): When you opt in to the venue map on an event page, Google acts as an independent controller (not a processor) for that embed traffic. See our full sub-processor registry at GitHub.
Kit (newsletter): The optional Pulln newsletter is processed by Kit.com (US) after you tick the consent box on account signup (or later under Account settings) and confirm via Kit's double-opt-in email. Kit processes this under a Data Processing Agreement. Unsubscribe from Account settings or the link in Kit emails. Erasure of the Kit copy is documented in our DSAR runbook.
Google (Gemini API), optional AI writing help: We send Google only the text you type into the AI helper and the basic event details you have entered (event type, date, tone). We do not send guest information, your email address or your account ID. Google may process this outside the EU, including in the US, under the EU-US Data Privacy Framework and Standard Contractual Clauses. Google does not use these prompts to train its models. It keeps prompts and responses for up to 55 days only to detect abuse. Pulln does not store the text you send to the AI helper. AI suggestions can be wrong: check them before you share.
Stripe (billing): Subscription billing infrastructure is present in the codebase but not yet active in production. When billing launches, Stripe will be added here with appropriate regional processing and DPA disclosure.
6. Cookies
We use strictly necessary cookies and, with your consent, optional functional cookies. See our Cookie Policy for the full list.
7. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be notified to confirmed guests by email.
8. Region-specific compliance overlays
Pulln is designed for region-aware compliance. Depending on event geography and user location, we apply jurisdiction overlays in addition to this base policy.
| Region | Cookie model | Guardian age |
|---|---|---|
| EU/EEA | Opt-in | 13-16 (varies by member state) |
| US | Opt-out | 13 |
| India | Opt-in | 18 |
EU/EEA Art. 8 thresholds (information society services): GDPR Article 8(1) allows member states to set their own digital consent threshold between 13-16 years for information society services offered directly to children (e.g., account creation, sign-ups). Examples: Germany, Netherlands, Ireland (16); France, Czech Republic, Greece (15); Italy, Spain, Austria (14); Sweden, Denmark, Finland, Belgium, Portugal, Malta (13). Default is 16 when the specific country threshold is unknown.
Product rule (RSVP guardian consent): Our platform enforces a stricter threshold: guests under 18 require guardian involvement for RSVP submission, regardless of the Art. 8 threshold in their jurisdiction. This ensures consistent protection for minors across all event RSVPs.
Local statutory requirements may still impose stricter obligations. For enterprise and event-specific legal reviews, contact privacy@pulln.io.