Privacy Policy

1. Who we are

Event Host is a digital invitation and RSVP platform operated by Kinpin Arts Media, registered in Zambia, with its registered office at Unit C11, Chamba Valley Shopping Plaza, Maposa Road, Lusaka, Zambia.

In this policy, "we" and "us" mean that company. "You" means whoever is reading it: a host with an account, or a guest who received an invitation from one.

2. What we collect

Account information

When you create a host account we store your name, email address, and optionally your phone number, company name and a profile photo.

Event content

Everything you enter when building an event: its title, description, date, venue and location, cover image, chosen invitation template and design settings, table layouts, and any photos uploaded to the event gallery.

For an invitation event we also ask for a contact number. It is shown to your guests on the RSVP pages, with your name, so they can call you with questions. Give a number you are happy for your guests to see.

For a ticketed event we ask for an organizer name, contact number and email. If you choose to show them, they appear on the event's public ticket page in its Contact & Help card, so buyers can ask about the event. If you choose not to, buyers only see our own support details, and we keep your organizer details to reach you.

Payment information

Payments are processed securely through our trusted payment providers. Your sensitive payment details are handled by the payment provider, not stored by EventHost. We retain transaction records for payment verification and reconciliation.

To pay out ticket sales we also ask a host of a ticketed event for a bank payout account: the account holder name, account number, bank and branch. These are stored encrypted, are used only to pay you, are visible to authorised members of our team who handle payouts, and are never shown to buyers or on any public page.

Help from our team

If you ask our team to set up or fix an event for you, we store your request: what you asked for, the event it is about, how you would like to be contacted, which member of our team handles it, and a record of what they did on your account while helping.

Technical information

We record the time and IP address of your most recent sign-in, and our servers keep standard access logs. API tokens issued to your account expire after seven days.

3. Guest data you upload

When you add or import a guest list, you give us other people's information, typically names, email addresses and phone numbers. When those guests respond, we also store their RSVP status, party size, dietary notes or other answers you asked for, their check-in time if you scan them at the door, and any photos they upload to your event gallery.

You are responsible for that data. You must have a legitimate reason to hold your guests' contact details and to pass them to us for the purpose of inviting them. We process that data on your instructions (to deliver invitations, collect RSVPs, remind guests about your event and run check-in) and for nothing else. We do not use your guest list to market to those guests, and we do not sell it.

When you remove a guest, their RSVP and its history are deleted and their personal link and entry pass stop working. We keep a short record that they were removed: their name, email address, a simplified form of their phone number, whether they had answered, and when and by whom they were removed. It lets us show you who you removed, tell a person who opens an old link that it was removed, and hold for your approval a new sign-up from someone you removed. If you ask us to email them that they were removed, that email is the only use of their address. The record is deleted when the event is permanently deleted.

When you delete a group or turn off its shared RSVP link, we keep a fingerprint of the old link address (not the address itself, and no names) so that anyone who opens it is told it was closed. It is deleted with the event.

When an email to a guest bounces because the address does not exist or cannot take mail, we add that address to a list of addresses we no longer email, with the reason the receiving server gave and when it happened. It applies to every event on the platform, so one bad address is not tried again by each host who has it, and it protects our ability to deliver everyone else's email. We tell you on your guest list, and you can ask us to try the address again once you have checked it.

4. How we use it

• To create, host and display your event invitation pages
• To deliver invitations and RSVP confirmations, and to collect responses
• To remind your guests about your event: an email before the RSVP deadline to guests who have not replied, an email a week before, the day before and on the day to guests who have accepted and a WhatsApp message on that same schedule to guests who have accepted. Every reminder email has a link that stops further reminder emails to that guest for that event. Reminders are only sent for events on plans that include them
• To send WhatsApp messages about your event: an invitation when you send one from your guest list, and a confirmation when a guest replies to it
• To set up or fix an event for you when you ask us to. Our team only opens your account after you send a request and a member of our team picks it up, only for as long as that request is open, and you can cancel it at any time, which ends their access straight away. While helping, they never change your password or email address, never delete your account and never pay on your behalf. Everything they do is recorded and you can see it under Get help in your account
• To run guest check-in, QR badges and table photo uploads
• To process event credit purchases and keep a billing history
• To send service email you cannot opt out of: email verification, password resets, and notices when your account email is changed
• To send optional notification email, controlled by the toggles in your account settings
• To publish a review on our homepage, but only one you wrote and submitted yourself, and only after we approve it
• To keep the service secure, prevent abuse, and meet our legal obligations

5. Who we share it with

We do not sell personal information. We share it only with the service providers we need to run the platform:

• Lenco: payment processing (mobile money)
• Astragate: card payment processing
• Our email delivery provider: delivery of invitation, reminder and account email
• Twilio: delivery of WhatsApp invitations, confirmations and reminders. It receives the guest's phone number and the message, and their replies come back through it
• Our hosting provider: servers and database storage

We may also disclose information where we are legally required to, or where it is necessary to protect our rights or someone's safety.

Note that a published event invitation page is public. Anything you put on it, including the venue, the date and any photos in the gallery, can be seen by anyone with the link, and events listed on our Discover page can be found by anyone.

6. Cookies

We use a small number of strictly necessary cookies, and load some assets from third parties. This is set out in full in our Cookie Policy.

7. How long we keep it

• Account data: until you delete your account
• Closed group links: a fingerprint of the old address, until the event is permanently deleted
• Records of removed guests: until the event they belonged to is permanently deleted. A guest's RSVP and answer history are deleted at once when you remove them; only the short removal record described in section 3 is kept
• Addresses that bounced: 365 days after the last bounce, or until a host whose guest has that address asks us to try it again
• Event and guest data: until you delete the event. A deleted event stays in Recently deleted for 30 days so you can restore it, then it is permanently removed together with its guest list, RSVPs and uploaded photos and media. We email you about a week before that happens. Deleting your account removes your events straight away, without that waiting period.
• Events with ticket sales or contribution payments: not permanently removed when you delete them. We keep the event and its orders or payments, including the buyer or contributor details attached to them, for as long as needed for tax and accounting, in the same way as other payment records below. You can still restore such an event.
• Help requests: deleted when you delete your account. The record of what our team did while helping is kept for security and accountability, but it is no longer linked to your account once that is deleted. It may still show the name of an event and the address the change was made from
• Payment records: kept as long as required for tax and accounting purposes, even after account deletion. That includes your own subscription and credit purchases: when you delete your account we keep the payments that went through, with the name and email address you paid under, and delete the ones that never did.

Deleting your account from account settings removes your profile, your events and their guest lists. We cannot delete an account while one of its events has ticket sales, refunds or contribution payments on record, or while a payment is still being processed. Those records are kept, so contact support to wind the event down first. Reviews you have written are kept when you delete your account, under the name and business details you gave when you wrote them, including any published on our homepage. Your profile photo is not kept with them. Ask us and we will delete a review.

8. Your rights

You can ask us to:

• Give you a copy of the personal information we hold about you
• Correct anything inaccurate. Most of it you can edit yourself in account settings
• Delete your account and its data
• Stop sending you optional email, which you can also do from the notification toggles

If you are a guest rather than a host and want your details removed from an event, the fastest route is to ask the host who invited you, since it is their guest list. You can also email us and we will pass the request on.

To exercise any of these rights, email info@eventhostzm.com. We aim to respond within one business day.

9. Security

Passwords are stored hashed, never in plain text. Traffic to the site is encrypted in transit. Access to production data is limited to staff who need it. RSVP and check-in links use unguessable tokens, and sensitive actions are rate-limited.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the relevant authority as required by law.

10. Children

Event Host is not intended for children under 18, and we do not knowingly collect their information from them directly. A host may add a child to a guest list; where that happens, the host is responsible for having the permission of a parent or guardian.

11. Changes

We may update this policy as the service changes. The "last updated" date at the top of this page always reflects the current version. If a change materially affects your rights, we will tell you by email or with a notice in the app before it takes effect.