Privacy Policy

This Privacy Policy describes how Evlux collects, uses, shares, and protects information when you use our website and services (the "Service"). It also describes the choices you have about how we use your information. By using the Service, you agree to the practices described here.

We collect information in the following categories:

• Account information. When you create an account we collect your email address and, optionally, your name and other profile details you provide. If you sign in with Google, see Google Sign-In for the information Google provides.
• Event and guest information. Hosts may upload guest lists, RSVP responses, menu preferences, dietary notes, and event details. Guests provide RSVP responses and may optionally provide an email address or phone number.
• Payment information. Card data is collected, stored, and processed by Stripe, our payment processor. Evlux stores a payment reference (Stripe session and payment intent IDs) and the amount, currency, and status — not the card number itself.
• Communications. Email content you send through the Service (invitations, ticket confirmations, digests) is handled by Resend. Optional SMS/WhatsApp messages are handled by Twilio when you enable those channels.
• Usage and device data. Standard server logs and basic analytics about how you use the Service (pages visited, actions taken, approximate IP-based location). We may use a third-party error-monitoring service (Sentry) to capture unhandled errors so we can fix them.
• Cookies and local storage. See our Cookie Policy for the cookies and local-storage entries we use.

Evlux offers Google Sign-In as an optional way to access your account. You can also sign in with a one-time email sign-in link. When you choose "Continue with Google," Evlux requests the standard OpenID Connect scopes openid, email, and profile.

What Google may provide. Google and our authentication provider, Supabase, may provide information associated with your Google account, including your email address, name, profile image, and a Google account identifier.

How Evlux uses it. Evlux uses your email address to authenticate and identify your account, operate the Service, communicate with you about your account and transactions, and support features you choose to use.

How it is stored. Sign-in identity is handled by Supabase Auth. Evlux application code does not use your Google profile image or Google profile name to create Evlux application profile records; those values may remain in authentication-provider metadata. Supabase also maintains the provider identity information necessary to associate your Google sign-in with your Evlux account.

No Google access through sign-in. Evlux does not read or store Google OAuth access tokens or refresh tokens for the Google Sign-In flow, and Google Sign-In is not used by Evlux to access your Google services, such as Google Calendar.

Revoking Google access.You can revoke Evlux's access at any time from the third-party access (connected apps) settings in your Google Account. Revoking Google access does not by itself delete your Evlux account. You may still be able to sign in with another supported method, such as an email sign-in link, using the same account email. To request deletion of your account information, see section 7.

Google Calendar access is not requested as part of Google Sign-In. It is a separate, optional connection that is never required to create or use an Evlux account.

If you separately choose to connect Google Calendar from an Evlux feature that supports the integration, Evlux requests the Google Calendar authorization required for that connection. The current integration uses the calendar.events scope and may create or update calendar events associated with Evlux activity you select.

For this separate Calendar connection only, Evlux securely stores the authorization information required to maintain the connection, including a refresh token, in protected server-side storage.

You can disconnect the Calendar integration from Evlux at any time. The disconnect flow attempts to revoke the related Google authorization. You can also remove access from the third-party access settings in your Google Account.

We use the information we collect to:

• provide, operate, and improve the Service;
• authenticate account holders through Google Sign-In or email sign-in links, and verify guests and tickets through invitation links and QR codes;
• process ticket sales, send confirmations, and reconcile payments;
• deliver invitations, reminders, and other communications you initiate;
• prevent abuse, fraud, and unauthorized access; and
• comply with our legal obligations.

We do not sell your personal information. We share information only as needed to operate the Service:

• Service providers. These providers process data on our behalf, each for its own role and under its own privacy and security commitments. Not every provider receives every kind of information:
  • Google — authentication provider when you use Google Sign-In, and separately for Google integrations you choose to authorize, such as Google Calendar.
  • Supabase — authentication and backend infrastructure, including database hosting.
  • Vercel — application hosting and infrastructure.
  • Stripe — payments and checkout, when you make or receive a payment.
  • Resend — transactional and service email.
  • Twilio — optional SMS/WhatsApp messages, when you enable those channels.
  • Sentry — error monitoring, when enabled.
• Google-derived identity information. Information we receive through Google Sign-In, such as your email address, is disclosed or processed only as necessary to authenticate you, operate Evlux, perform transactions and features you request (for example, your email address on a checkout you start), and provide infrastructure, security, and communications.
• Hosts and recipients. Information you submit for an event (RSVP, menu selection, dietary note) is visible to the host or organizer of that event. Tickets you purchase are visible to the promoter or vendor running the public event.
• Legal and safety. We may disclose information when required by law or to protect the rights, property, or safety of Evlux, our users, or the public.

Evlux's use of information received from Google APIs adheres to the Google API Services User Data Policy. Where Google's Limited Use requirements apply, Evlux adheres to those requirements.

Evlux does not sell Google user data, and Evlux does not use Google user data for advertising.

We retain account information while your account remains active. We may retain information afterwards when reasonably necessary for legal, payment, security, fraud-prevention, dispute-resolution, or other legitimate recordkeeping obligations.

You may request deletion of your personal information by emailing privacy@evlux.app. When we receive a request, we will delete or de-identify your personal information where appropriate. Certain records may need to be retained for legal, contractual, payment, security, fraud-prevention, dispute-resolution, audit, or other legitimate obligations — for example, records of bookings, contracts, and payments.

Depending on where you live (for example, the EU/EEA under the GDPR or California under the CCPA), you may have the right to access, correct, port, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact privacy@evlux.app. We will respond within the timeframes required by applicable law.

The Service is operated from the United States. Data we collect may be transferred to, stored, and processed in the United States or other countries where our service providers operate. By using the Service you consent to such transfers.

We use industry-standard security measures to protect information, including encryption in transit (HTTPS) and at rest for data stored in our managed Supabase database. No security program is perfect; you use the Service at your own risk and should keep your credentials secure.

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact privacy@evlux.app and we will take appropriate action.

We may update this Policy from time to time. If we make material changes, we will provide notice through the Service or by email. The effective date at the top of this page indicates when this Policy was last revised.

Questions, requests, or complaints? Email privacy@evlux.app.