Terms of Service

These terms are provided by Kivorise OÜ, a private limited company (OÜ) registered in Estonia, trading as Pulln.

Legal entity identification:
Legal entity name: Kivorise OÜ
Registry code (registrikood): 17317014
EUID: EEARIREG.17317014
Registered office: Harju maakond, Tallinn, Kesklinna linnaosa, Pärnu mnt 135-17, 11314, Estonia
Management board: Jishnu Sygal
VAT liability: Not VAT-liable
Contact email: hello@pulln.io

Company registration details are publicly available in the Estonian Business Register (e-Äriregister) at ariregister.rik.ee.

Pulln is an event management platform that helps organisers create invite-only events, manage guest lists, and run check-ins. These terms govern your use of the Pulln platform at pulln.io.

You must be at least 18 years old to create an organiser account. Guest RSVPs for attendees under 18 require guardian consent in accordance with our platform flow and applicable law.

As an event organiser using Pulln, you are responsible for:

• Ensuring you have a lawful basis for collecting guest personal data.
• Communicating clearly with your guests about how their data will be used.
• Complying with applicable data protection laws in your jurisdiction.
• The accuracy and appropriateness of all event content you publish.

You agree not to use Pulln to organise events that are unlawful, discriminatory, or harmful. Pulln reserves the right to suspend access to accounts that violate these terms without notice.

5.1 Fair use — Free event creates

The Free plan is subject to an anti-abuse / fair-use limit. It is not a marketed Free feature. On Free you may have one concurrent active event and may create at most 40 events per rolling 30 days (UTC). Soft-deleted events count toward the create ceiling. If you exceed these limits, we may refuse further event creates and require an upgrade to Host Pro.

Pulln is provided on an "as-is" basis during early access. We aim for high availability but do not guarantee uninterrupted service. We will notify organisers of planned maintenance in advance wherever possible.

All platform code, design, and branding are owned by Pulln. Event content (names, descriptions, images) remains the property of the respective organisers and guests.

To the maximum extent permitted by law, Pulln is not liable for indirect, incidental, or consequential damages arising from your use of the platform.

When you use Pulln to manage an event, you act as the data controller for your guests' personal data, and Pulln acts as your data processor. The terms below supplement our Privacy Policy and constitute a Data Processing Addendum (DPA) in accordance with GDPR Article 28(3).

9.1 Subject matter and duration

We process guest personal data on your behalf for the duration necessary to deliver the event management services you request, from event creation until automated data retention policies apply (as described in our Privacy Policy).

9.2 Nature and purpose

Processing activities include: storing and retrieving guest data (names, email addresses, RSVP preferences, dietary restrictions), sending transactional emails (invitations, confirmations), generating QR code tickets, and producing guest lists and reports.

9.3 Categories of data and data subjects

Data subjects: Your event guests (adults and minors with guardian consent).
Data categories: Identity and contact information (name, email, phone), RSVP preferences, dietary restrictions and allergies (special category health data per GDPR Art. 9), guardian details for minors, and consent records.

9.4 Your instructions

We process personal data only on your documented instructions, implemented through your use of the platform: creating events, generating invitations, exporting guest lists, and configuring event settings. If we believe an instruction violates applicable data protection law, we will inform you immediately.

9.5 Personnel confidentiality

All persons authorised to process personal data on our behalf have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

9.6 Sub-processors

We engage third-party sub-processors to provide infrastructure services (database hosting, email delivery, media storage). The current list is published in our Privacy Policy §5 and the complete registry at docs/compliance/sub-processors.md. Sub-processors with confirmed Data Processing Agreements are documented in the registry; those marked TBC must be completed before public launch. We will notify you at least 30 days before adding a new sub-processor; you may object via email to privacy@pulln.io.

9.7 Security measures

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS 1.3) and at rest (AES-256), row-level security policies in the database, PII scrubbing in error logs, and regular security reviews. For details see our threat model.

9.8 Assistance with controller obligations

Taking into account the nature of processing and the information available to us, we will assist you in fulfilling your obligations under GDPR Articles 32 to 36, including:

• Article 32 (Security): Implementing appropriate security measures as described in section 9.7 above.
• Article 33 (Breach notification to authority): Notifying you without undue delay if we become aware of a personal data breach.
• Article 34 (Breach communication to data subjects): Providing available information to assist you in determining whether breach notification to guests is required.
• Article 35 (Data Protection Impact Assessment): Providing relevant information about our processing activities, security measures, and sub-processors to support your DPIA where required.
• Article 36 (Prior consultation): Assisting you in consulting with the supervisory authority where a DPIA indicates high risk.

We also provide tools for you to respond to data subject access, rectification, erasure, and portability requests. Guests may exercise these rights directly via privacy@pulln.io; we will notify you when such requests relate to your event and require your input.

9.9 Deletion or return of data

At your choice, we will either delete or return all personal data to you after the end of the provision of services relating to processing. You may export guest data at any time via the admin dashboard (CSV format).

Our automated retention policy (30 days post-event for guest PII, 5 years for consent logs) continues to apply unless you request earlier deletion or export. Where EU or Member State law requires us to retain certain data (for example, consent records for accountability under GDPR Article 7), those legal storage obligations override deletion requests.

9.10 Audit rights

We make available all information necessary to demonstrate compliance with GDPR Article 28, including this DPA, our Privacy Policy, security documentation, and sub-processor registry. Upon reasonable written notice and subject to confidentiality obligations, we will allow for and contribute to audits or inspections by you or an auditor you mandate. Contact privacy@pulln.io to arrange an audit.

EU Consumer Directive (2011/83/EU): If you are a consumer in the European Union, you have the right to withdraw from a contract for digital services within 14 days of entering into the agreement, without giving any reason.

For the current early-access phase, Pulln is provided free of charge. No refunds or cancellation fees apply. When paid subscription plans are introduced, the 14-day withdrawal right will apply to those plans. You may request withdrawal by emailing hello@pulln.io with the subject line "Withdrawal Request". If you begin using the paid services during the 14-day period and then exercise your withdrawal right, you may be charged a pro-rated amount for the services provided up to the point of withdrawal.

Account deletion: You may delete your organiser account at any time via the account settings page. Deletion triggers our data retention policy as described in the Privacy Policy.

These terms are governed by the laws of the Republic of Estonia. Any disputes arising out of or relating to these terms or your use of Pulln shall be subject to the exclusive jurisdiction of the courts of Estonia.

EU consumer protection: If you are a consumer habitually resident in a Member State of the European Union, nothing in these terms affects your rights under mandatory consumer protection laws in your country of residence, including the right to bring proceedings in the courts of that country.

Alternative dispute resolution: Information about consumer dispute resolution is available from the European Commission at ec.europa.eu/info/live-work-travel-eu/consumer-rights-and-complaints. We are not obliged to participate in alternative dispute resolution procedures, but we are open to resolving disputes amicably.

We may update these terms as the platform evolves. We will notify registered organisers by email at least 14 days before material changes take effect.

Questions about these terms? hello@pulln.io