Who we are
Goodness Guestbook provides software for retreat operators, venues, and participants to manage events, rosters, payments, and guest experiences. This policy describes how we process personal data when you use our websites and applications.
Data we process
- Account & identity: email (login id), password hash (via Supabase Auth), name, and profile fields you provide.
- Event & roster data: retreat and event participation, forms you submit as a guest, staff notes where permitted, and community content you post.
- Payments: when you pay through our flows, Stripe processes card data; we store payment status, amounts, and references — not full card numbers.
- Communications: transactional email (sign-in, invites, receipts) via Resend; marketing email only with appropriate consent.
- Technical: server logs, security events, and — if you opt in — aggregated analytics from Vercel Web Analytics and Speed Insights.
How we use data
We use data to authenticate users, operate multi-experience workspaces (operator, venue, participant, platform admin), enforce row-level security in PostgreSQL (Supabase), deliver email, process payments, and improve reliability. We do not sell personal data.
Legal bases (GDPR)
Requires legal review: map each processing activity to contract performance, legitimate interests, consent (marketing/analytics), and legal obligation as applicable in your markets.
Sharing & subprocessors
- Supabase (database, authentication, file storage)
- Vercel (hosting; analytics only after cookie consent)
- Stripe (payments)
- Resend (email delivery)
Operators and venues may access participant data according to membership, grants, and event roster rules — not as independent controllers of the platform account system unless your agreement says otherwise (legal review).
Retention & security
We retain data while accounts and events are active and as needed for legal, audit, and backup requirements. Access is protected by authentication, HTTPS, and Postgres RLS policies.
Your rights
Depending on location, you may have rights to access, correct, delete, or restrict processing, and to withdraw consent for optional analytics or marketing. Contact privacy@goodnessguestbook.app (confirm address with legal).
International transfers
Requires legal review: document transfer mechanisms for US-hosted subprocessors if you serve EU/UK users.
Children
The service is not directed at children under 16 (age threshold — legal review).
Changes
We will post updates here and adjust the “last updated” date. Material changes may require additional notice (legal review).