Privacy Policy

Effective 1 June 2026

bdayvillage (“we”, “us”) is a calm planning companion that helps parents organise birthday parties for young children. We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what we collect, why, how we protect it, and the choices you have.

Who this policy is for

bdayvillage is designed for parents and guardians (adults) who create and manage parties, and for guests who respond to invitations. Children do not create accounts and are not the intended users of the service. See Children’s information below.

What we collect

• Account information — your name and email, handled by our authentication provider (Clerk).
• Event information — party details you enter (date, location, theme, notes).
• Guest & RSVP information — guest names and responses, and where you choose to add it, a child’s first name and allergy notes.
• Payment information — if you buy Premium, payment is processed by Stripe. We receive confirmation and limited transaction metadata; we never see or store full card numbers.
• Messaging information — phone numbers or email addresses used to send reminders or invitations you initiate.
• Technical information — basic logs, device/browser information, and error diagnostics needed to run and secure the service.

Sensitive information

Allergy and dietary notes are sensitive information (health information) under the Privacy Act. We only collect it when you choose to enter it, we use it solely to help hosts cater safely, and by entering it you consent to us handling it for that purpose. You can edit or remove it at any time.

Why we use your information

• To provide the service — create events, manage RSVPs, coordinate gifts and help.
• To process Premium purchases.
• To send messages you initiate (invitations, reminders).
• To keep the service secure and working (logging, fraud and abuse prevention).
• To meet our legal obligations (for example, payment records).

We do not sell your personal information, and we do not use it for third-party advertising.

Children’s information

bdayvillage is directed at parents and guardians, not at children. Children cannot register, log in, or interact with the service directly. The only information about a child is what a parent or guardian chooses to enter — typically a first name and, optionally, allergy notes so a host can cater safely.

• We do not knowingly collect personal information directly from children.
• We do not ask children for information, show them advertising, or profile them.
• Allergy notes are treated as sensitive health information, encrypted at rest (see Security).
• When a parent deletes their account or an event, the associated child information is deleted (see Retention).

If you believe a child has provided us personal information directly, contact us at hello@bdayvillage.com and we will delete it.

Service providers

We share information only with providers that help us run the service, under contract and only as needed:

Overseas disclosure

Several of these providers store or process information overseas, including in the United States. By using bdayvillage you acknowledge that your information may be handled outside Australia, and we take reasonable steps to ensure providers protect it appropriately.

Retention & deletion

We keep your information while your account is active. You can delete your account at any time from settings. Deletion runs on a 30-day grace period (so accidental deletions can be recovered), after which your events, guests, RSVPs, and child/allergy information are permanently removed. Some records (for example, payment records) may be retained where the law requires.

We also minimise data we no longer need: around 90 days after a partyhas passed, we automatically reduce what we keep — guest names are masked, allergy notes and invitation contact details are purged, and the organiser’s saved location is coarsened.

Security

Information is encrypted in transit. Sensitive allergy notes are additionally encrypted at rest using AES-256-GCM. We limit access to personal information to what is necessary to operate the service.

Data breaches

We take steps to protect your information, but if an eligible data breach occurs that is likely to cause serious harm, we will notify affected individuals and the OAIC as required by the Notifiable Data Breaches scheme under the Privacy Act.

Your communication choices

We only send messages you ask for (such as invitations and party reminders) and essential account or payment notices. You can stop reminders at any time using the unsubscribe link in a message or your notification settings. We do not send marketing emails.

Accessing and correcting your information

You may request access to the personal information we hold about you, and ask us to correct it, by emailing hello@bdayvillage.com. If you’re in the EU or UK, you also have rights under the GDPR (including erasure and portability) — the same contact applies.

Complaints

If you have a privacy concern, contact us first at hello@bdayvillage.comand we’ll work to resolve it. You can also complain to the Office of the Australian Information Commissioner (OAIC).

Cookies

We use a small number of essential cookies. See our Cookie Policy for details.

Changes

We may update this policy. If we make material changes, we will update the effective date above and, where appropriate, let you know.

Contact

Questions about your privacy? Email hello@bdayvillage.com.