How Monte Peony collects, uses, shares and protects personal information across its website, your Monte Peony account and every Monte Peony product, including Planner, and the rights you have over it wherever you live.
This Privacy Policy explains how Monte Peony ("Monte Peony", "we", "us" or "our") collects, uses, discloses and protects personal information when you use any of our services (together, the "Services"):
the montepeony.com website, including its product pages and the contact form; your Monte Peony account at account.montepeony.com, which signs you in to every Monte Peony product; Planner, our event planning service at planner.montepeony.com, including the reply pages guests open from their own link; and the emails these Services send.
It is the one privacy policy for all of them. Where a Service works differently, this Policy says so in a section of its own. Any product we add later is covered too, and we'll add a section for anything particular to it before it launches.
"Personal information" means any information that identifies, relates to or could reasonably be linked to a particular person. It has the same meaning as "personal data" under the EU and UK General Data Protection Regulations ("GDPR").
This Policy applies wherever you live. Sections near the end add information required by the laws of particular places. Where local law gives you more protection than this Policy describes, local law applies.
For most of the personal information described here, Monte Peony decides why and how it is processed. Under the GDPR and similar laws we are the "controller" of it; under US state privacy laws we are the "business".
There is one exception. In Planner, the information hosts record about their guests is processed by us on the host's behalf and on the host's instructions. For that information the host is the controller (or "business") and we are the host's "processor" (or "service provider"). See "Planner: Hosts and Guests" below.
Your first and last name and your email address, and whether you've confirmed that address.
Your password, which we store only in a form that can't be turned back into the password.
For each signed-in session: the type of browser and device you used, the IP address, and when the session started and was last used, so we can keep your account secure and show you where you're signed in.
If you arrived by one of our tagged links, such as from a post or from a guest's reply page: the link's campaign details (where it was shared and which campaign it belongs to), saved with your account when you sign up, so we can tell which of our posts and pages bring people to us. They are never shared, and are deleted with your account.
If you buy credits: a record of each purchase and of your credits, described under "Payments".
When you use our contact form or email us, we collect your name, your email address, the subject you choose and what you write, and anything else you decide to tell us.
Everything you enter about an event you plan: its name, date, venue and type, the timeline, seating plans and seating rules, meal options, checklist, budget and suppliers, the people you've invited to plan with you and their roles, and the email addresses you've sent planning invitations to. We also keep a history of who changed what in each event, so the people planning it can see it, and previous versions of each seating plan, so they can be restored.
Information about guests, which hosts record and guests may add to through their reply page. It's described under "Planner: Hosts and Guests".
The IP address each request comes from, which we use to protect the Services from abuse, for example by limiting how many requests can come from one place in a given time. We don't use it to work out where you are beyond what that protection needs.
Technical records of requests to our servers, such as the time, the address requested and whether it succeeded, which we use to run and fix the Services. We keep names, email addresses and guests' contact details out of these records.
Cookies and similar technologies, as explained in our Cookie Policy, including, with your consent, Google Analytics on montepeony.com, in your account and in Planner.
We use personal information only for the purposes below. Where the GDPR or a similar law applies, the legal basis we rely on for each is shown in brackets.
To provide the Services: creating and securing your account and signing you in to our products, storing your events and showing them to the people you plan with, showing guests the reply page for their party, and making the files you export (performance of our contract with you; for guests' information, the host's instructions).
To send the emails the Services depend on: confirming your address, resetting your password, invitations to plan an event together, notice to an event's owners before its guests' information is anonymised, and telling hosts when a guest asks for their information to be deleted (performance of our contract; the host's instructions).
To answer you when you contact us (our legitimate interest in helping you; performance of our contract, where your message is about the Services).
To keep the Services secure, prevent abuse and fraud, and fix problems (our legitimate interest in running safe and reliable services).
To understand how the Services are used, so we can improve them (your consent, where the law requires it; otherwise our legitimate interest in improving the Services).
To comply with the law, enforce our terms, and establish, exercise or defend legal claims (legal obligation; our legitimate interests).
We don't sell personal information, and we don't share it for cross-context behavioural advertising or targeted advertising.
We don't send marketing emails. If we ever want to, we'll ask first where the law requires it, and every such email will let you unsubscribe.
We never use guests' information for our own purposes, never contact guests to market anything, and never combine guests' information across different hosts' events.
We don't make decisions about anyone based solely on automated processing that produce legal or similarly significant effects. Features such as suggested seating are suggestions a host can accept or change.
Planner is used by two kinds of people. Hosts are the people with an account who plan an event, alone or with others they invite. Guests are the people a host invites to an event; guests don't need an account.
For hosts' account and planning information, we are the controller, as for everyone else. The host decides what to record about their guests and why, and we process guests' information only on the host's behalf and on their instructions, to provide Planner to them. Our Terms of Service set out the terms on which we do so ("Planner Data Processing Terms").
Hosts can record, for each guest: first and last name, email address, phone number, dietary needs, notes, tags, the party (household) they belong to and its postal address, their plus-one, the parts of the event they're invited to, their meal choice, their seat and whether they've arrived on the day. All of these except the name are optional, and the host decides which to fill in.
When a guest replies through their own link, we store their replies for each part of the event, their meal choice, the names of any plus-ones, any dietary needs and message they choose to give, and, if they ask, their request to have their information deleted.
Dietary needs can reveal a health condition or a religious belief. Under the GDPR they may be "special category data", and under some US state laws "sensitive personal information". They are always optional. A guest's dietary needs are shown only to the people planning that event, so the host can pass them on to their caterer, and we use them for nothing else. We don't use sensitive information to infer anything about anyone.
Hosts are responsible for having a lawful basis to record such information, which will usually be the guest's own choice to give it. Hosts should record only what they need to plan their event, and use notes and tags with the same care.
Everyone a host has added to an event (owners, editors and viewers) can see that event, including its guests' information. Owners decide who is added.
A guest's reply link shows the details of their own party only. Anyone who has the link can open it, so it should be shared only with the guests it was made for. Hosts can replace a link at any time, and the old one then stops working. Google Analytics never runs on reply pages.
A planning invitation is shown only to the person who opens the link sent to them.
If you are a guest, you can ask from your reply page for your information to be deleted. The host is told straight away, and if they haven't removed you within 30 days, we do.
To see what a host has stored about you, or to have it corrected, ask the host of your event: hosts can download everything stored about a guest. Because we process your information on the host's behalf, we'll normally pass a request we receive to them. If you can't reach the host, or they don't respond, contact us and we'll help.
We use a small number of service providers ("sub-processors") to run the Services. Each is bound by a written contract to process information only on our instructions, only to provide its service to us, and with appropriate security.
DigitalOcean hosts the Services, their database and the database's backups.
An email delivery provider sends the Services' emails.
Stripe takes payments for credits on its own secure page, where you give it your card details.
Google provides Google Analytics on montepeony.com, in your account and in Planner, as described in our Cookie Policy.
When the law requires it, such as in response to a valid court order, and only to the extent required.
To protect the rights, safety or property of Monte Peony, our users, guests or the public, for example to investigate fraud or abuse.
If Monte Peony is involved in a merger, acquisition, financing or sale of assets, to the parties involved, who will be bound to respect this Policy. We'll tell you before your information becomes subject to a different privacy policy.
With your consent or at your direction, for example when you export a file and share it yourself.
When you buy credits, Stripe takes the payment on its own secure page, and we never see or store your card details. We keep a record of each purchase (what you bought, its price and currency, when, and Stripe's reference for the payment), and of your credits and the events you spent them on. We keep these records for as long as your account exists, and afterwards for as long as tax and accounting law requires.
We keep personal information only for as long as we need it for the purposes above, then delete or anonymise it.
We keep your account for as long as you have it. A sign-in session ends when you sign out, or after 30 days without use. To have your account deleted, email us at the address below; your account, and the Planner events you alone own, are then deleted, subject to the backup period below.
We may keep limited information for longer where the law requires it, or where we need it to establish, exercise or defend legal claims.
Guests' personal information is anonymised 12 months after the last day of the event, or 12 months after the event was created if it has no date. Names are replaced with "Guest 1", "Guest 2" and so on; email addresses, phone numbers, dietary needs, notes, tags and postal addresses are deleted; and entries in the event's history that name a guest are deleted. Replies, meal choices and seats are kept without anyone's name, so the event's numbers still add up.
The event's owners are told 30 days beforehand, by email and in Planner. They can download their guests' information before it goes, and can choose once to keep it for a further 12 months, to 24 months in all.
A guest removed by a host, or a whole event deleted by its owner, is deleted straight away. A guest who asks to be deleted from their reply page is removed by the host, or automatically after 30 days if the host hasn't done it.
We keep what you send us through the contact form or by email for as long as we need it to answer you and keep a record of the conversation, then delete it.
Once one of our emails is sent, we delete what it said. We keep a record of who it was sent to, and whether it arrived, for 30 days. If an address bounces or its owner reports our email as spam, we keep that address on a list of addresses not to email again, for as long as we send email.
Deleted information remains in our database backups until they expire, at most 7 days later. Backups are used only to recover from a failure.
Google Analytics data is kept for the period we've set in Google Analytics, and then deleted on a rolling basis.
Depending on where you live, you may have some or all of these rights over your personal information. We honour them for everyone, wherever the law allows:
Access: to know whether we process your information, and to receive a copy of it with details of how we use it.
Correction: to have inaccurate or incomplete information corrected.
Deletion: to have your information deleted.
Portability: to receive information you gave us in a structured, commonly used, machine-readable format, or have it sent to another service.
Restriction and objection: to have us limit how we use your information, or object to our using it on the basis of our legitimate interests.
Withdrawing consent: where we rely on your consent, to withdraw it at any time, without affecting what we did before.
Opting out: of the sale or sharing of personal information and of targeted advertising. We don't do either.
Non-discrimination: we'll never treat you differently for using any of these rights.
You can see your account details and change your password in your account, and see, change or download your Planner events in Planner. For anything else, email us at the address below. We'll respond within one month, or sooner where local law requires; if a request is complex we may extend that by the period the law allows, and we'll tell you why.
To protect you, we'll verify your account before acting on a request, usually by asking you to confirm it from the email address on your account. You may use an authorised agent where the law allows; we'll ask for proof that you've authorised them.
If we decline your request, we'll explain why. Where your law gives you a right to appeal our decision, reply to our answer saying you appeal, and we'll review it and answer within the period your law sets. You can also complain to your data protection authority or attorney general.
If you are a Planner guest, see "Guests' Choices" above.
We use technical and organisational measures appropriate to the risk, including: encryption of information travelling to and from the Services; passwords and planning-invitation links stored only in a form that can't be turned back into the original; signed-in sessions that can be ended at any time; access to production systems limited to the people who need it; and names, email addresses and guests' contact details kept out of our service logs.
No method of transmission or storage is completely secure, and we can't guarantee absolute security. If a personal data breach affects you, we'll notify you, the Planner hosts concerned and the authorities as and when the law requires.
We and our service providers may process and store information in countries other than the one where you live, including the United States, whose data protection laws may differ from yours.
When we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision for the destination (including, for providers certified to it, the EU–US Data Privacy Framework and its UK and Swiss extensions) or on standard contractual clauses approved by the European Commission, with the UK and Swiss addenda where they apply, together with any additional safeguards needed. You can ask us for more information about these safeguards.
Our Services aren't directed at children. You must be at least 16 to create a Monte Peony account. We don't knowingly collect personal information from children under 13 (or the higher age set by your country's law); if we learn we have, we'll delete it. If you believe a child has given us personal information, contact us.
Planner hosts may record children among their guests, for example to plan a meal or a seat. We ask hosts to record only what they need, and hosts are responsible for having the authority to do so, such as a parent's agreement where the law requires it.
If you are in the European Economic Area, the United Kingdom or Switzerland, the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to our processing of your personal information.
The legal bases we rely on are shown under "How We Use Information". Where we rely on our legitimate interests, we've weighed them against your rights, and you may object at any time. Providing account information is necessary to have an account; everything else you give us is optional.
You have the rights listed under "Your Rights", and the right to lodge a complaint with the supervisory authority where you live or work, or where you believe an infringement happened. We'd appreciate the chance to address your concern first.
This section supplements this Policy for residents of California and of other US states with comprehensive privacy laws (including Colorado, Connecticut, Delaware, Oregon, Texas, Utah and Virginia). It serves as our notice at collection.
In the past 12 months we've collected these categories of personal information, from you, from the Planner hosts you plan with, from guests through their reply pages, and automatically from your device:
Identifiers, such as name, email address, postal address, phone number, account identifiers and IP address.
Customer records, such as the information in an event you plan or are a guest at, and messages you send us.
Internet or other electronic network activity, such as browser and device type, session times and, with analytics, how the Services are used.
Sensitive personal information: account log-in credentials, and dietary needs that may reveal health or religious information, used only to provide the Services as described above.
We use these categories for the business purposes under "How We Use Information", disclose them only to the service providers and others listed under "Service Providers and Other Disclosures", and keep them for the periods under "How Long We Keep Information".
We don't sell personal information or share it for cross-context behavioural advertising, and haven't done so in the past 12 months, including that of consumers under 16. We use sensitive personal information only for purposes that don't require a right to limit it. We don't disclose personal information to third parties for their own direct marketing.
Subject to your state's law, you have the right to know what personal information we've collected about you and how we use and disclose it, to access it and receive a portable copy, to correct it, to delete it, and to opt out of its sale, sharing, targeted advertising and profiling with significant effects (which we don't do), without discrimination. See "How to Use Your Rights" for how to make a request, use an authorised agent or appeal a decision.
Some browsers send a "Do Not Track" signal. As there is no common standard for it, the Services don't respond to it; your cookie choice is described in our Cookie Policy.
If you live elsewhere, including in Canada, Brazil, Australia, New Zealand, Japan, South Korea or another country with a data protection law, you have the rights that law gives you, which generally include access, correction and deletion, and you may complain to your national data protection authority. Use "How to Use Your Rights" to exercise them.
Under Brazil's LGPD we rely on the legal bases listed under "How We Use Information". Under Canada's PIPEDA, by using the Services you consent to the collection, use and disclosure described in this Policy, and you may withdraw that consent, subject to legal and contractual limits, by closing your account.
Our Services link to websites we don't run, such as our social media profiles. This Policy doesn't apply to them; check the privacy policy of whichever site you go to.
We may update this Policy from time to time. We'll change the date at the top of this page when we do, and if a change is significant, we'll tell account holders by email or in our products before it takes effect. Where the law requires your consent to a change, we'll ask for it.
If you have any questions about this Privacy Policy, or want to use any of your rights, please contact us at [email protected] or through our contact form.
We use cookies to remember your preferences and, with your consent, to understand how Monte Peony is used. See our Cookie Policy for details.