Privacy Notice

Last updated September 10, 2026

The House of Tatum LLC, trading as UnfoldIT, is the data controller for personal data collected through unfoldit.app. Contact us at support@unfoldit.app.

For guest data that a planner collects through their invitation, the planner decides why and how that data is used; we process it on their behalf to run the invitation and RSVP features.

What we collect and why

• Account data (name, email, login credentials, plan) — to create and secure your account and provide the Service. Legal basis: performance of a contract.
• Invitation content (event details, photos, text, uploaded and AI-generated images, prompts) — to build, host, and display your invitation. Legal basis: performance of a contract.
• Guest data (name, email, phone number, RSVP response, plus-ones, dietary notes) — to collect RSVPs and send event communications on the planner’s behalf. Legal basis: performance of a contract with the planner and our legitimate interest in providing the Service.
• Support messages — to answer your questions. Legal basis: legitimate interests.
• Usage and device data (page views, invitation view counts, IP address, browser and device identifiers, log data) — for security, fraud prevention, and improving the product. Legal basis: legitimate interests.
• Marketing preferences — if a planner or guest separately opts in, we use their email address to send UnfoldIT product updates, new invitation designs, and offers. Legal basis: consent, which can be withdrawn at any time.

We do not sell personal data. We do not use RSVP details to market to guests unless a guest separately and explicitly joins the UnfoldIT mailing list after responding. Joining the list is optional and is not required to RSVP.

Who we share data with

• Payment processor — Stripe, for checkout, subscription management, payments, and invoicing. Stripe collects payment data directly; we never see full card details.
• Service providers / subprocessors — cloud hosting and database, email and SMS delivery, AI image and voice generation, and analytics providers, all acting on our instructions.
• Professional advisers — legal and accounting, where necessary.
• Authorities — where we are required to by law.

How long we keep data

• Guest RSVP data on one-time ($39) event purchases — automatically deleted approximately 14 days after the event date by a scheduled job. This includes guest names, contact details, RSVP responses, plus-ones, and dietary notes.
• Guest RSVP data on Pro Planner subscriptions — retained while the account is active so planners can reuse and report on guest lists. From 30 days after the event date, the planner can permanently delete an event’s guest data at any time from their event dashboard.
• Account and invitation content — kept while your account is active, then deleted or anonymised when no longer needed.
• Transaction records — retained as long as required for tax and accounting law.
• Mailing-list details — retained until you unsubscribe or ask us to delete them. Removing RSVP data does not remove a separate mailing-list signup, and unsubscribing does not affect an RSVP.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to certain processing, and to withdraw consent. To exercise any of these, email support@unfoldit.app. We respond within one month. If you are in the UK or EEA you can also complain to your local supervisory authority.

Guests: if you responded to an invitation and want your details removed, contact the planner who invited you, or email us and we will pass the request on and assist.

International transfers

We are based in the United States and our providers may process data in the US and other countries. Where data is transferred out of the UK or EEA we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

Security

We use appropriate technical and organisational measures, including encryption in transit, encrypted storage, row-level access controls in our database, and least-privilege access for staff and services.

Cookies

We use essential cookies and local storage to keep you signed in and to keep the Service working. We use limited analytics to understand product usage. We do not run third-party advertising cookies. You can clear or block cookies in your browser, though the Service may not work correctly without the essential ones.

Changes

If we make material changes to this notice we will update the date above and notify you by email or in the app.