Privacy Policy

1. Data controller

NITELY is the data controller for personal data processed through the Service. If you are a Group admin or promoter, you are also responsible for making the people whose data you enter into the Service (team members, guest-list and table-reservation contacts, and venue contacts) aware of this Privacy Policy.

2. Information we collect

From customers (Group admins, promoters and staff):

• Account data: name, email address and authentication details when you register or sign in.
• Profile data: display name, role, phone number and Instagram handle, as entered by you or your Group admin.
• Billing data: billing email and subscription details. Card payments are processed by Stripe; we receive confirmation of payment status, the last four digits and card type, but never full card numbers.
• Usage data: analytics events, device and browser information, and log data generated when you use the Service.

From guests and bookings (information promoters collect and store in NITELY):

• Guest-list contacts: name, phone number, Instagram handle and gender, entered by a promoter or provided by the guest through a client portal.
• Table-reservation contacts: the same contact details for the lead guest and party members, plus booking details such as venue, arrival time, party size, minimum spend, dress code and music or drink preferences.
• Attendance and operational data: arrival status, door and bounce records, non-attendance requests, notes, and financial figures derived from bookings.
• Reference images: where a client-portal flow requests it, a selfie (see section 7).

From venues subscribed for venue access: venue name, address, contact details, per-head pay rates and the booking and attendance data shared with that venue.

3. How we use data

• Providing and maintaining the Service, including authentication and Group isolation.
• Processing contacts, bookings, table reservations, door management, financial summaries and reporting.
• Matching a guest to an existing contact and checking blacklist records when a guest adds themselves through a client portal.
• Sending in-app and email notifications about accounts, bookings, billing and team activity.
• Managing subscriptions, per-seat billing and plan limits.
• Providing support and responding to requests.
• Improving the Service, and providing insight to NITELY-approved research partners as described in section 14.
• Complying with legal obligations.

4. Legal basis for processing

• Performance of a contract: providing the Service to Group admins, promoters and staff.
• Legitimate interests: operating and securing the Service, per-seat billing, fraud prevention, and industry research that does not override the rights of the people concerned.
• Legal obligation: complying with applicable laws and tax requirements.
• Consent: for optional analytics and marketing communications, and, for guest-list and table-reservation contacts, the consent given when adding themselves through a client portal.

5. How data is shared

Operational data is isolated within your Group and is not shared with other Groups. We use the following categories of processors and partners:

• Cloud hosting and application platform: the infrastructure that runs and stores the Service.
• Payment processing: Stripe, for subscription billing.
• Communications: email delivery providers for notifications and support.
• Analytics: usage-analytics providers.
• Research partners: NITELY-approved third parties who receive a read-only research dataset as described in section 14.

We do not sell personal data. We may disclose data to authorities where required by law.

6. Data retention

We retain data for as long as the relevant Group is active. Deleted records within an active Group are soft-deleted and recoverable by a Group admin within the retention window configured for the plan (default 90 days). If a paid subscription lapses without payment, the Group moves to a read-only state and its data is retained for 60 days before being permanently deleted; resubscribing before then restores access. A Group on the Free plan is retained while it remains in use.

7. Selfie and reference images

When you join a guest list through a NITELY client portal, you may be asked to take a selfie using your device camera. The selfie is used for reference so that the promoter or host knows who they are hosting. It is not sold, posted publicly, transferred to unrelated third parties, or shown to venues or other guests. It is not intended to be stored long-term and is handled in accordance with our retention and deletion procedures.

Where necessary and subject to applicable law and access controls, the image may also be retained as a reference for NITELY's safety and blacklist records if a person is bounced, evicted or banned from a venue due to misbehaviour, including suspected drug use, excessive alcohol consumption or anti-social behaviour. It is not used for automated facial recognition or biometric matching. Access is limited to authorised NITELY users and the image is displayed only on the relevant contact profile, authorised blacklist page or relevant client-portal booking. You may decline to provide a selfie where the flow permits this. For questions or requests concerning your image, contact us using the details in section 13.

8. Your rights

• Right of access - request a copy of your personal data.
• Right to rectification - correct inaccurate or incomplete data.
• Right to erasure - request deletion of your data, subject to legal exceptions.
• Right to restrict processing - limit how we use your data.
• Right to data portability - receive your data in a structured, machine-readable format.
• Right to object - object to processing based on legitimate interests, including the research use in section 14.
• Right to withdraw consent - at any time where processing is based on consent.

To exercise these rights, contact us using the details in section 13. You may also lodge a complaint with the Information Commissioner's Office (ICO) or your local data protection authority.

9. Security

We use appropriate technical and organisational measures to protect data, including role-based access controls, tenant isolation, audit trails, and encryption in transit and at rest. No method of transmission or storage is completely secure, but we use commercially reasonable means to protect data.

10. International transfers

Data may be processed in countries outside the UK or EEA. Where this occurs we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.

11. Children's privacy

The Service is not directed to individuals under 18, and guest lists and table reservations managed through NITELY are intended for adults only. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will take steps to delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page and updating the "Last updated" date.

13. Contact us

If you have questions about this Privacy Policy or your personal data, contact us at hello@nitely.online.