Privacy Policy

Last updated 1 November 2026

Who we are

Eventsheart (eventsheart.com) is operated by Eventsheart, based in Copenhagen, Denmark(“we”). We are the controller of your personal data. Contact us at hello@eventsheart.com.

What we collect

• Account data: your email address, your sign-in method (password, email link or Google) and an optional display name.
• Workspace content you enter: events, tasks, suppliers and their contact details, bookings, budgets, expenses, run-of-show items, analytics results, and files you upload (contracts, invoices, library documents). Teammates you invite can see the content of the workspaces they belong to.
• Speakers you add: names, job titles, companies, contact details, bios, links, photos and internal notes about the speakers of your events, and which sessions they speak at. You add this data as part of your workspace and should only add it where you have a reason to.
• Early access requests: Eventsheart is currently open to approved people only. When you request access we keep your email address, the name and company you optionally give, the date, and whether we have approved you.
• Invitations: when a workspace member invites you, we keep your email address, who invited you and to which workspace. If you don't have access yet, the invitation is also recorded as an access request for us to review.
• AI planner waiting list: if you join it, your email address, the date and the page you joined from, and whether your access has been approved.
• Bug reports: if you report a problem from Settings, we receive your message, where it happened, your email address, your workspace name, the time and your browser type, by email.
• AI usage and diagnostics: counts of AI requests per workspace, used to apply monthly limits, and technical records of each AI request (time, provider and model used, duration, and any error), used to fix problems. These records do not contain the text of your questions or answers.
• Your own AI provider key, if you choose to add one in Settings. It is stored encrypted and used only to make your own AI requests.
• Technical data: standard server logs such as IP address and request details, kept by our hosting providers for security and reliability.

How we use it, and why

• To provide the service you asked for: running your account, workspaces, events and invitations (performance of a contract).
• To generate event plans and answer questions about your events with AI when you use the AI features (performance of a contract).
• To review early access requests and decide who can use Eventsheart during early access, and to answer your messages and bug reports (our legitimate interest in running a controlled early access and supporting our users).
• To keep the service secure, prevent abuse and fix errors (our legitimate interest).
• To send emails needed to use the service, such as confirmations of your access request, sign-in links, password resets and invitations. We do not send marketing email without your consent.

AI features

When you use the AI planner, the text you type and the event details needed to build a plan (for example dates, budget, team and supplier names) are sent to an AI provider to generate the answer. When you ask Heart, the event assistant, a question about an event, your question, the recent conversation and that event’s data (details, tasks, budget and expenses, bookings, suppliers, speakers, run of show, results, and the names of workspace members) are sent the same way. By default the provider is Groq or Google Gemini. If you add your own key in Settings, requests are sent to the provider you choose (Groq, Google, OpenAI or Anthropic) under your own account with them. Do not enter information you do not want processed by these providers. We do not use your content to train our own models; check each provider’s terms for how they handle API data.

Talking to Heart by voice is optional and uses your browser’s built-in speech features. Your browser turns your speech into text, and in some browsers (for example Google Chrome) it does so by sending the audio to its maker’s speech service. We do not receive or store your audio, only the text, which is then handled like a typed question. Heart’s answers are read aloud by your browser.

Who we share data with

We use these service providers (processors) to run Eventsheart:

• Supabase: database, authentication and file storage. Our project is hosted in the EU (Frankfurt).
• Vercel: application hosting and our domain.
• Resend: sending emails, such as access request confirmations, invitations, waiting-list confirmations, and the access requests and bug reports sent to us.
• AI providers: Groq and Google, and OpenAI or Anthropic if you add your own key, as described above.
• Google: if you choose “Continue with Google” to sign in.
• Our email provider: messages you send to hello@eventsheart.com and the requests and bug reports emailed to us are kept in our mailbox.

Your browser’s speech service (for example Google, in Chrome) is chosen by your browser, not by us, and handles your audio under its own terms when you use voice.

We do not sell your personal data.

International transfers

Some providers process data outside the European Economic Area, notably in the United States. Where this happens we rely on safeguards such as the EU–US Data Privacy Framework or Standard Contractual Clauses, as offered by the provider.

Cookies and local storage

We use only what is needed to keep you signed in (authentication cookies) and to remember your light or dark theme (local storage). We do not currently use advertising or analytics cookies. If that changes we will update this page and ask for consent where required.

How long we keep data

We keep your data while your account is active. When you ask us to delete your account, we delete your account and the workspaces you own, and remove other data tied to you, except what we must keep by law. Backups are overwritten on their normal schedule.

Early access requests are kept until we have decided on them and, if approved, while you use Eventsheart. If we decline a request, or you ask us to, we delete it. Bug reports and messages you send us are kept only as long as we need them to answer you and fix the problem.

Your rights

Under the GDPR you can ask to access, correct, export or delete your personal data, to restrict or object to its processing, and to withdraw consent where we rely on it. Self-service export and deletion are not yet available in the app, so please email hello@eventsheart.com and we will respond within one month. You can also complain to a data protection authority: ours is Datatilsynet (the Danish Data Protection Agency), or you can contact the authority in the country where you live.

Security

Data is encrypted in transit. Each workspace’s data is isolated by database-level access rules so that other workspaces cannot read it, and uploaded files are stored in private storage. No online service is perfectly secure, so please use a strong, unique password.

Changes

We will update this page when our practices change and show the date above.