Privacy policy
Version of 31 October 2026
This policy explains what personal data Vivat processes when an organiser sets up an event and when guests and crew take part in it, why, who helps us with it and when it is deleted.
1.Who we are
Vivat (the “Service”: the website getvivat.com, the organiser cabinet, the apps for iOS and Android and their web version) is operated by [OPERATOR: legal name], [ADDRESS], registration number [NUMBER] (“we”).
For organiser accounts we decide how the data is used. For data about an event’s participants, the organiser decides whom to invite and what to enter, and we process that data to provide the Service to the organiser. [TO BE CONFIRMED BY COUNSEL: controller and processor roles.]
Contact for privacy questions: [CONTACT EMAIL].
2.What we collect
About organisers:
- email address and sign-in data, handled by Supabase Auth; if the organiser signs in with Google or Apple, the name and email the provider shares;
- the events, programmes, guest lists, texts and photos the organiser enters in the cabinet.
About participants (guests and crew):
- the name, and the role, position and group, as entered by the organiser;
- whether and when the personal code was activated;
- device tokens for push notifications and the chosen app language;
- bingo facts, card answers and results;
- photos the participant uploads, with the time of upload.
We do not ask participants for an email address, a phone number or a password. The personal code is an access key to the event, not an identity.
Technical data: IP address and request logs, used to protect the Service and to limit attempts to enter a code. We do not use advertising cookies.
3.Why we use it
- to provide the Service: show the event, the programme, the games and the gallery to its participants;
- to send the reminders the organiser schedules — participants can turn notifications off in the device settings;
- to protect the Service: rate limits, code reissue, logs;
- to record purchases made in the App Store or Google Play and attach them to the event;
- to understand how the Service is used and to find app crashes (Google Analytics for Firebase and Firebase Crashlytics, see below).
[TO BE CONFIRMED BY COUNSEL: the legal basis for each purpose.]
We do not sell personal data and do not use it for advertising.
4.Who processes data for us
- Hosting: [HOSTING PROVIDER, COUNTRY] — servers, the database and file storage.
- Supabase Auth — organiser sign-in. [TO BE CONFIRMED: run on our own servers or by Supabase Inc.]
- Google Firebase Cloud Messaging — delivery of push notifications. The device token and the text of the notification pass through Google; on iPhones also through Apple Push Notification service.
- Google and Apple — sign-in, if the organiser chooses it.
- Apple (App Store) and Google (Google Play) — payment for events. They process the payment under their own terms; we receive a confirmation of the purchase (transaction number, product, date), never card details.
- Google Analytics for Firebase — basic app usage statistics: automatic events (app open, screens by name, device, version, country), without names, codes, texts or photos; no advertising identifier and no ad personalisation. Turned off in debug builds.
- Firebase Crashlytics — crash reports from the iPhone and Android apps: error stack, device model, OS and app version. Codes and tokens are stripped from error text before sending.
Some of these providers process data outside the participant’s country. [TO BE CONFIRMED BY COUNSEL: transfer safeguards.]
5.How long we keep it
- Participant names, device tokens, bingo facts and photos are deleted 90 days after the event ends. The organiser is reminded by email 14 and 3 days before.
- Organiser account: until the organiser deletes it. [TO BE DEFINED: deletion after a period of inactivity.]
- Purchase records: for as long as accounting and tax law requires. [PERIOD]
- Server logs: [PERIOD].
6.Your rights
Participants can, in the app and at any time, delete the photos they uploaded and the bingo facts they wrote, and turn off notifications. To correct or remove a name, write to the organiser or to us.
Depending on where you live (for example, under the GDPR), you may also have the right to access, correct, delete or export your data, to restrict or object to its processing, and to complain to a supervisory authority [AUTHORITY]. Write to [CONTACT EMAIL]; we answer within [PERIOD].
7.Security
Codes have eight characters and a limited number of attempts; the organiser can reissue a code, and the old one stops working at once. Links to photos are signed and expire. Each event is isolated: a participant of one event sees nothing from another. Connections are encrypted.
8.Children
The Service is not aimed at children. Children may attend an event; the organiser decides whether to add them as participants and is responsible for the consent this requires. [TO BE CONFIRMED BY COUNSEL: age threshold.]
9.Changes
We publish changes on this page with a new date. Organisers are told about significant changes by email.
10.Contact
[OPERATOR], [ADDRESS], [CONTACT EMAIL].