Privacy Policy

Effective Date: October 5, 2026 Version: 2.4.0

This Privacy Policy explains how JustGoing collects, uses, stores, and protects your information when you use our platform (the "Service").

1. Information We Collect

Account Information

When you create an account, we collect:

• Your name and email address
• A password (hashed and encrypted)
• Your profile photo (optional)
• Any details from social media accounts you link for verification

Guest Mode Information

When you participate as a guest through a shared event link, we collect:

• Your responses to voting and RSVP questions
• The date and time you submit your response
• Your device type and approximate location (derived from your IP address)
• Any comments or text you submit

Behaviour and Interaction Data

We collect information about how you use the Service. This includes:

• Events you create, view, or participate in
• Dates and times of your interactions
• Your voting patterns and RSVP decisions
• Information used to calculate your Event Karma score

User-Generated Content

We store:

• Event titles, descriptions, and photos you create
• Comments and venue suggestions you submit
• Any photos or attachments you share

2. How We Use Your Information

We use your details to:

• Create and manage your account
• Provide and improve the Service
• Facilitate event organising and coordination
• Calculate your Event Karma score
• Communicate with you about the Service, updates, and changes
• Enforce these Terms
• Protect the safety of the Service and other users
• Comply with legal duties

3. Event Karma Signals

Your Event Karma score is calculated using:

• Your RSVP history and event attendance
• Your response rate to invitations
• Whether your account is verified
• Reports of inappropriate behaviour by other users
• Other behaviour signals on the platform

The score itself is not shared publicly as a number. Other users may see your verification status. They may see general participation signals. The underlying numeric score is private.

4. Data Retention

Registered User Data

Your account details are retained as long as your account is active. We remove your personal data from our live systems when you delete your account. Backup copies are deleted within 30 days, except where required by law.

Guest Data

Guest data is automatically deleted 30 days after the event date. Guest data is also deleted when the event is marked confirmed. Whichever comes first applies. If you convert to a registered account, your guest data will be retained. This occurs only if you confirm the conversion. Your guest data is then retained according to the rules for registered users. When you delete your account, guest sessions you claimed stay with the event but without your name.

Event-Related Data

Event titles, descriptions, and related content are retained for 2 years. This is 2 years after an event ends or is cancelled. You can delete them sooner if you choose. If you delete your account, events you created remain on the Service. Other attendees can continue to see and interact with those events. However, you and anyone else can no longer delete those events. The events stay for others without your name, email or link to your account; others see "Deleted user" as the organizer.

5. Your Rights and Choices

Access Your Data

You can access, review, and download your personal details in your account settings. You can do this at any time.

Update Your Information

You can update your profile details, password, and privacy settings. Do this in your account settings.

Delete Your Account

You can delete your account at any time in your account settings or when reviewing updated terms on the Terms acceptance screen.

When you delete your account, we remove your personal data from our live systems immediately. Backup copies are deleted within 30 days, except where required by law. Events, votes, and suggestions you submitted stay on the Service for others to see. They are displayed without your name, email or link to your account; others see "Deleted user" as the source. We keep records of your consent to our Terms and Privacy Policy with the version you accepted, the date you accepted it, and how you accepted it (as evidence of your consent), but these records do not include your name, email or link to your account.

Marketing Communications

You can opt out of marketing emails. Click the unsubscribe link in any email. You can also update your communication preferences in your account settings. You will still receive emails about your account and the Service.

6. Children's Privacy

The Service is intended for users 13 and older. We do not knowingly collect personal data from children under 13. If we become aware that a child under 13 has provided us with personal data, we will delete that data. We will also end the child's account. If you believe a child under 13 has created an account, please contact us immediately.

Users 13 to 18 years old may use the Service. They need parental permission and supervision.

7. Data Security

We use industry-standard security measures, including encryption, to protect your personal data. However, no security measure is completely secure. We cannot guarantee the security of your details.

8. Third-Party Processors

We share your details with these kinds of providers to run the Service:

• Hosting providers run our servers and websites. They handle everything you send to the Service, including your IP address.
• Database providers store your account, your events and your votes.
• Network and security providers route and protect traffic to our servers. They also check that our sign-up form is used by a person and not a bot. They see your IP address and browser details.
• Email delivery providers send our emails, such as invitations and account notices. They see your email address, your name and the message.
• Sign-in providers are used only if you choose to sign in with another account. They confirm who you are and send us your name and email address.
• Map and place providers supply venue photos, place details and maps. They receive the place we look up. When your browser loads a photo or map image from them, they also see your IP address and browser details. Section 8A explains how venue photos work.
• Website analytics providers count visits to our public website. They see the pages viewed, your browser and device type, and your approximate location.
• Browser push services are used only if you turn on push notifications. The maker of your browser or device runs this service and delivers the notification to you. The content is encrypted, so the service cannot read it.

This list names kinds of providers, not individual companies. Section 8A names the company behind venue photos, because your browser contacts it directly and its own privacy policy applies. We update this list when we add or remove a kind of provider. Providers that work for us handle your details only as needed for their service and are bound by confidentiality terms. Sign-in, map and push providers also apply their own privacy policies.

8A. Google Places Photos API — Data Processing & Privacy

What Data Is Shared with Google

When you view a venue card on the guest voting interface, JustGoing may fetch a photograph from Google Places. To retrieve this photograph, we share the venue's Google Place ID with Google's servers. The Place ID is a unique identifier for the venue's location in Google's database.

We do not share with Google:

• Your name, email address, or account identifier
• Your voting choices or event participation data
• Your IP address directly (though Google receives your IP when your browser fetches the image, as explained below)
• Your location data
• Any personal information you submit as a guest or registered user

How the Image Reaches You

The image retrieval process happens in two stages:

1. Server-side (Portal backend): JustGoing's server calls the Google Places Photos API with the venue's Place ID, receives a signed image URL, and caches that URL in our database for 30 days.

2. Client-side (your browser): When you view the voting page, your browser loads the image directly from Google's servers using the cached URL. This direct request is a cross-origin request — your browser sends a request to Google's domain (not JustGoing's), and Google receives:

   • Your IP address
   • Your browser type and version
   • The Referer header (indicating the request came from JustGoing)
   • Standard HTTP request metadata

Google's privacy policy governs how they use this information. JustGoing does not receive or store your IP address or browser details associated with image requests.

Google as a Data Processor Under GDPR/LGPD

For users in the European Union, United Kingdom, Switzerland, or any jurisdiction with data protection regulations (GDPR, LGPD, etc.), Google Places acts as a third-party data processor:

• Lawful basis: JustGoing has a legitimate interest in displaying venue photographs to improve your voting experience. Your consent to our Terms of Service and Privacy Policy covers this processing.
• Data minimisation: We share only the venue's Place ID with Google—the minimum information necessary to retrieve a photograph. No personal data is sent to Google by JustGoing.
• Your rights: If Google receives your IP address and browser details via your browser's cross-origin image request, you may have the right to access or delete that data under GDPR/LGPD. Please refer to Google's Privacy Policy (https://policies.google.com/privacy) for information on how to exercise those rights with Google.

Data Retention in JustGoing

JustGoing retains image URLs in our cache for a maximum of 30 days per venue. After 30 days, the cache entry expires and is refreshed on the next page view. This data is retained separately from your personal account data and is not linked to your identity.

Opting Out

If you do not wish to have your browser load images directly from Google's servers, you may:

• Disable images in your browser settings (however, this will affect all images, not just venue photographs)
• Contact us at privacy@justgoing.app to request a venue card display mode that uses a JustGoing-hosted fallback instead of Google-signed URLs (availability of this option is subject to implementation)

Changes to This Processing

If JustGoing changes how we use Google Places Photos (e.g., switching to a proxied image service, changing the cache duration, or discontinuing the feature), we will update this section and notify you in accordance with Section 13 (Changes to This Privacy Policy).

9. Data Sharing

We do not sell your personal data. We only share your details:

• With third-party processors listed above
• When required by law or court order
• To protect the safety and rights of JustGoing, its users, and the public
• With your explicit consent

10. European Union and GDPR

If you are located in the European Union, United Kingdom, or Switzerland, you have additional rights. These rights come under the General Data Protection Regulation (GDPR).

Your Rights

• Access: You can request a copy of your personal data
• Correction: You can request correction of inaccurate data
• Deletion: You can request deletion of your data. This right is called the right to be forgotten.
• Restriction: You can request that we restrict processing of your data
• Portability: You can request a copy of your data. It will be in machine-readable format.
• Objection: You can object to certain processing of your data

Legal Basis

We process your personal data based on:

• Your consent (for marketing communications)
• Contract (to provide the Service)
• Legal obligation (to comply with laws)
• Legitimate interests (to operate and improve the Service)

Right to Lodge a Complaint

If you have concerns about how we handle your personal data, you have the right to complain to a data protection authority. In Portugal, that authority is the Comissão Nacional de Proteção de Dados (CNPD). You can find it at www.cnpd.pt. If you live outside Portugal, you can also complain to your local data protection authority.

11. California Consumer Privacy Rights (CCPA)

If you are a California resident, you have rights. These rights come under the California Consumer Privacy Act (CCPA).

Your Rights

• Know: You can request what personal data we collect, use, and share
• Delete: You can request deletion of your personal data
• Opt-out: You can opt out of the sale or sharing of your personal data

How to Exercise Your Rights

To exercise these rights, email us at privacy@justgoing.app. You can also use the "Privacy" section of your account settings.

We do not discriminate against you for exercising your rights. We will not deny you services. We will not charge different prices. We will not provide different quality of service.

Children's CCPA Rights

If you are under 18, you have the right to request deletion of your personal data. There are some exceptions to this right.

12. Cookies and Tracking Technologies

We use cookies and similar tools to:

• Remember your preferences
• Understand how you use the Service
• Prevent fraud and secure accounts
• Personalise your experience

You can control cookies through your browser settings. Note that disabling cookies may affect your ability to use the Service.

When a "Page not found" error page does not show the cookie consent banner, it is because that page uses only strictly necessary cookies and similar tools, such as the one that remembers your language, and loads no analytics. There is nothing on it that needs your consent.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make a material change to how we collect or use your details, we will notify you by email. This notification will be at least 30 days before the change takes effect. Your continued use of the Service after the notice period means you accept the updated Privacy Policy.

We will post the updated Privacy Policy on this page. An updated "Effective Date" will be shown.

14. International Data Transfers

Your data may be transferred to, stored in, and processed in countries other than your country of residence. These countries may have different data protection laws compared to your home country.

By using the Service, you consent to these transfers. Your data may go to countries. These countries may not offer the same level of protection as your home country.

15. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Email: privacy@justgoing.app

We will respond to privacy inquiries within 30 days.

For the rules governing use of the Service, see our Terms of Service.

Last Updated: October 5, 2026