Privacy Policy

1. Who we are

PartyOps is operated by SquareTwo, based in Dublin, Ireland ("we", "us", "our"). This policy explains how we handle personal data when you use PartyOps. You can contact us about privacy at hello@squaretwo.ie.

2. Our two roles

For your account and how you use PartyOps, we are the data controller.

For the data you enter into PartyOps about your own customers and bookings, you are the controller and we act as your processor, handling that data on your instructions in order to provide the service. The data processing agreement that governs this is in our Terms of Service.

If you are a customer of a business that uses PartyOps, for example you booked a bouncy castle or a sauna session through a booking form on their website, that business is the controller of your details. PartyOps stores and processes them on behalf of that business. Please contact the business first about your data; if you cannot reach them, contact us and we will help.

3. What we collect

Account data: your name, business name, email address, and password (which is stored in hashed form by our authentication provider, not in plain text).

Business content: the products, prices, bookings, customer records and invoices you create in the service.

Payment data: we use Stripe to process payments. Card details are handled by Stripe and are not stored on our systems. We store limited payment information such as amounts, status, and Stripe identifiers.

Technical data: log, usage, and device or browser information, used to operate and secure the service. Our booking widget records anonymous usage events (for example that a booking form was opened or an error was shown) under a random per-visit identifier. These events do not include IP addresses, names or contact details.

Rate limiting: to protect the service from abuse, IP addresses of requests to our public booking endpoints are held in short-lived counters and deleted automatically within 24 hours.

4. How and why we use data

We use personal data to provide and maintain the service and your account, to take payments, to send you service related emails, to keep the service secure and prevent abuse, and to meet our legal obligations.

Our legal bases under the GDPR are performance of our contract with you, our legitimate interests in running and securing the service, compliance with legal obligations, and, where required, your consent.

5. Sharing and sub-processors

We use a small number of trusted providers who process data on our behalf. Our current sub-processors are: Supabase Inc. (database, authentication and file storage, hosted in Ireland), Vercel Inc. (application hosting, Dublin region), Stripe Payments Europe Ltd (payments), Resend (transactional email), and Google Ireland Ltd (Maps geocoding: only the Eircode a customer enters is sent, and only for businesses that price delivery by distance).

We will update this list at least 14 days before a new sub-processor starts handling personal data.

We do not sell your personal data, and we only share it where needed to provide the service or where required by law.

6. International transfers

Some of our providers may process data outside the European Economic Area. Where they do, we rely on appropriate safeguards such as the European Commission Standard Contractual Clauses.

7. How long we keep data

Account and business data, including bookings and customer records: for as long as your account is open, then available for export for 30 days after closure, then deleted from our live systems. Backups roll off within a further 30 days. Invoice and payment records may be kept for up to 6 years where Irish tax law requires it.

Email log (who was sent which booking email and when): 24 months. Booking widget usage events: 13 months. Rate-limiting counters: 24 hours. Eircode geocoding cache: 30 days. These are enforced automatically by a nightly job.

8. Security

We use access controls, row level isolation between businesses, encryption in transit and at rest, and regular backups. All personal data is hosted in the European Union. No method of storage or transmission is completely secure, but we take reasonable steps to protect your data, and we will notify affected businesses without undue delay if a breach affects their data.

9. Your rights

Under the GDPR you have the right to access, correct, delete, restrict, or port your personal data, to object to certain processing, and to withdraw consent where we rely on it. To exercise these rights, contact hello@squaretwo.ie. We respond within one month. Businesses can close their account and have their data deleted by emailing the same address.

If your personal data was entered into PartyOps by an operator using the service, that operator is the controller of that data, so please contact them first.

You also have the right to complain to the Irish Data Protection Commission at dataprotection.ie.

10. Cookies

We use only essential cookies needed to sign you in and keep your session active. Our booking widget sets no cookies of its own. We do not use advertising or analytics cookies.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a revised date.

12. Contact

Questions about this policy or your data can be sent to hello@squaretwo.ie.