Privacy Policy

Party Genius AI ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services (collectively, the "Service"). By using the Service, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use our Service. This policy applies to all users worldwide and complies with: • General Data Protection Regulation (GDPR) for EU/EEA users • California Consumer Privacy Act (CCPA) for California residents • UK General Data Protection Regulation (UK GDPR) • Other applicable data protection laws

We collect information in the following ways: Information You Provide: • Account information (name, email address) when you register • Profile information you choose to add • Party and event planning data you create • Payment information (processed securely by Stripe) • Communications you send to us Information You Provide About Other People: When you plan a party you can enter details about your guests. This is the most sensitive information we hold, and it is about people who have not read this policy: • Guest names, and their email addresses or phone numbers where you add them • Children's first names, where you add them to a guest entry • A parent or guardian's email address or phone number for a child guest • The name of the person the party is for • Photographs you upload, which may include children You are responsible for having a proper basis to share other people's details with us. We use them only to help you plan and run your party — never to market to them. Any guest may ask us to remove their details by contacting privacy@partygeniusai.com, whether or not they have an account. Automatically Collected Information: • Device information (browser type, operating system) • Usage data (pages visited, features used, time spent) • Cookies and similar tracking technologies About IP addresses: we process your IP address transiently to rate-limit requests, to protect forms from bots, and to determine your country so we can apply the right cookie-consent rules. We do not store your IP address against your activity, and we do not keep a log of which pages a given IP address visited. Location is resolved to a country only — never to a city, address or coordinates. Information from Third Parties: • Social login data (if you sign in with Google, etc.) • Payment confirmation from Stripe (no full card numbers)

We use your information for the following purposes: Service Provision: • To create and manage your account • To provide our party planning features • To process payments and subscriptions • To save and sync your data across devices Service Improvement: • To analyze usage patterns and improve features • To develop new features based on user needs • To fix bugs and technical issues Communication: • To send important account notifications • To respond to your inquiries and support requests • To send marketing communications (with your consent) Legal Compliance: • To comply with legal obligations • To enforce our Terms of Service • To protect our rights and prevent fraud

For users in the EU/EEA, we process your data based on: Contractual Necessity: • Processing required to provide the Service you requested • Account creation and management • Payment processing Legitimate Interests: • Service improvement and analytics • Fraud prevention and security • Customer support Consent: • Marketing communications • Non-essential cookies and tracking • Sharing data with third parties for advertising Legal Obligation: • Tax and accounting requirements • Responding to lawful requests from authorities • Compliance with applicable laws

We do not sell your personal information. We may share your data with: Service Providers: • Supabase (database, authentication and file storage) • Stripe (payment processing) • Vercel (hosting, and BotID bot-protection on our contact and RSVP forms) • PostHog (product analytics) • Sentry (error monitoring; session recording only with Analytics consent, with all text and images masked) • Resend (sending transactional email — receives the recipient's address and the message) • Upstash (Redis rate-limiting — receives your IP address for the duration of the rate-limit window) • Cloudinary (image hosting — receives photographs you upload, which may include children) • Cloudflare (Turnstile anti-bot checks on forms — receives your IP address and browser signals) • Google (Analytics, only if you consent to analytics cookies; and Google Sign-In if you use it) • MailerLite (email address only, if you request a downloadable guide) • ImprovMX (inbound email forwarding — receives any message you send to an @partygeniusai.com address, including privacy requests) These providers are contractually obligated to protect your data. Party Genius does not send your data to any AI provider. Our party plans, menus, timelines and activity suggestions are generated from our own curated content, not from a live AI model, and no personal information you give us is sent to an AI service. Other Disclosures: • With your consent • To comply with legal obligations • To protect our rights, privacy, safety, or property • In connection with a merger, acquisition, or sale of assets We never share your: • Full payment card details • Passwords or authentication tokens • Private party data without your permission

We use cookies and similar technologies: Essential Cookies (Required): • Authentication and security • Session management • Load balancing Functional Cookies (Optional): • Preferences and settings • Theme selection (light/dark mode) • Language preferences Analytics Cookies (Optional): • Usage statistics (PostHog) • Performance monitoring • Error tracking Marketing Cookies (Optional): • Advertising effectiveness • Social media integration You can manage cookie preferences through our cookie consent banner or your browser settings. Note that disabling essential cookies may impact Service functionality.

We retain your data for as long as necessary: Active Accounts: • Account data: Until you delete your account • Party data: Until you delete it or your account • Usage logs: we keep the record that an event happened so we can count how our tools are used, and we remove the identifiers attached to it — the session identifier and the browser/device string — once the event is more than 90 days old. What remains cannot be linked back to you. After Account Deletion: • We delete your data at the moment you ask, not on a schedule. Deleting your account removes your profile, parties, guests, photographs and related records immediately, across our database, our file storage and our image host. • One deliberate exception: our email delivery log keeps a record that a message was sent, with the recipient address replaced by a placeholder. We keep this as a delivery audit trail; it can no longer identify you. • Legal hold data: As required by law Backups: • We take periodic encrypted database backups so we can recover from a failure, and we verify that they restore. A backup taken before you deleted your account may still contain your data until that backup is replaced. We do not use backups to restore data you have asked us to delete. Anonymized Data: • Aggregated analytics may be retained indefinitely • We may publish anonymized, aggregated statistics derived from how our free tools are used — for example, the median guest count or party length across all planning sessions. These figures are aggregates only. They never include your email address, your name, your party details, or anything that could identify you or your guests, and we never publish or sell individual records. • This data cannot identify you

We implement robust security measures: Technical Safeguards: • TLS/SSL encryption for data in transit • Our database and hosting providers encrypt data at rest • Secure password hashing, handled by our authentication provider • Row-level access rules so one account cannot read another's data • Automated security checks run against our code before every release Operational Safeguards: • Access controls and authentication • Incident response procedures • Periodic backup and restore testing Infrastructure Security: • Hosted on established cloud platforms (Vercel and Supabase), which provide network-level protections including DDoS mitigation • Automated dependency vulnerability scanning Party Genius is operated by a small team. Where a protection above is provided by one of our infrastructure providers rather than implemented by us, we have said so rather than claim it as our own. While we strive to protect your data, no system is 100% secure. Please use strong passwords and keep your credentials confidential.

You have the following rights regarding your data: All Users: • Access: Request a copy of your data • Correction: Update inaccurate information • Deletion: Request deletion of your data • Portability: Export your data in a standard format EU/EEA Users (GDPR): • Restriction: Limit how we process your data • Objection: Object to certain processing activities • Withdraw consent: Revoke previously given consent • Lodge complaint: Contact your supervisory authority California Residents (CCPA): • Know: Learn what data we collect about you • Delete: Request deletion of your data • Opt-out: Opt out of data sales (we don't sell data) • Non-discrimination: Equal service regardless of rights exercised To exercise these rights, contact us at privacy@partygeniusai.com

Your data may be transferred to and processed in countries outside your residence: Transfer Mechanisms: • Standard Contractual Clauses (SCCs) for EU transfers • Adequacy decisions where applicable • Contractual protections with all service providers Locations: • Primary servers: United States • CDN: Global distribution for performance • Backups: Secure locations in US and EU We ensure appropriate safeguards are in place for all international transfers in compliance with applicable data protection laws.

Party Genius helps adults plan parties, including children's birthday parties. That means we need to be precise about children's data rather than simply say we do not handle it. Children do not use this Service: Our Service is not directed to children under 13 (or 16 in the EU). Children cannot create accounts, and we do not knowingly collect information directly from a child. If a child has created an account or sent us their information, contact us and we will delete it promptly. But adults do give us information about children: Because you are planning a child's party, you may enter into Party Genius: • A child's first name, as the person the party is for, or as a guest • A parent or guardian's email address or phone number for a child guest • Photographs taken at a party, which may include children We do not ask for a child's surname, address, date of birth, school or any other identifier, and you should not enter one. How that information is handled: • It is visible only to you and to anyone you explicitly share the party with. It is not public, not sold, not used for advertising, and not used to build a profile of any child. • Photographs are stored in private storage and are served only through short-lived links. • It is deleted when you delete the guest, the party, or your account — immediately, not on a schedule. • We do not send marketing email to any address you enter for a guest or a parent. If you are a parent or guardian: If someone has entered your child's details into Party Genius and you want them removed, email privacy@partygeniusai.com. You do not need an account, and you do not need to know who created the party. Tell us the child's first name and the party or host if you know it, and we will locate and delete the information and confirm when it is done.

Our Service may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit. Third-party services we integrate with: • Google (if using Google Sign-In) • Stripe (payment processing) • Pinterest (content distribution to our own Pinterest Business account — see below) • Social media platforms (if sharing features used) Pinterest API Integration: We use the Pinterest API v5 to publish pins from our own Pinterest Business account (@partygeniusai) that link back to free planning tools on partygeniusai.com. This is a server-to-server integration: we do not authenticate individual users into Pinterest, we do not access or read user Pinterest data, and we do not post on behalf of any user. The data we send to Pinterest is limited to our own pin content (image, title, description, and target URL pointing to a free tool on partygeniusai.com). None of this data contains personal information about our users. Pinterest's use of any data we send to them is governed by Pinterest's privacy policy at https://policy.pinterest.com/en/privacy-policy. Each of these services has its own privacy policy that governs their use of your data.

We may update this Privacy Policy from time to time. We will notify you of any material changes by: • Posting the updated policy on this page • Updating the "Last Updated" date • Sending an email notification for significant changes • Displaying a notice in the Service Your continued use of the Service after changes constitutes acceptance of the updated policy. We recommend reviewing this policy periodically for any updates.

If you have questions about this Privacy Policy or our data practices: Email: privacy@partygeniusai.com Support: hello@partygeniusai.com Website: https://partygeniusai.com/contact Data Protection Officer (for EU inquiries): Email: dpo@partygeniusai.com For GDPR complaints, you may also contact your local supervisory authority. We aim to respond to all inquiries within 30 days.