Privacy Policy

1. Overview

Lime-n.io, operated by Harvest Technology Systems, Inc. ("we", "us", or "our"), is committed to protecting the privacy of the people who use our platform. This Privacy Policy explains what personal information we collect, how we use it, and the choices you have. It applies to all users of the Service, including Organizers, Promoters, Sub-Promoters, Door Staff, and Guests.

By using the Service, you agree to the collection and use of information as described in this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your name, email address, and (optionally) a phone number. We use this to identify you, authenticate your account, and communicate with you about the Service.

2.2 Guest Information

When a guest self-registers through an invite link, the information they submit (typically name and contact details) is collected and associated with the relevant event. This data is collected by Lime-n.io on behalf of the Organizer.

2.3 Usage and Technical Data

We automatically collect certain technical information when you use the Service, including:

• Browser type and version
• Device type and operating system
• Pages visited and features used
• IP address and approximate location (country/region)
• Time and date of access

This data is used to maintain and improve the Service and is not used to identify individual users in our analytics.

2.4 Lawful basis

Account holders. We handle your account information to perform our contract with you — the Terms of Service — and in our legitimate interest in running the Service and keeping it secure.

Guests. The Organizer decides the basis on which guest details are collected, because the Organizer is responsible for them. We handle those details only on the Organizer's instructions, under our Data Processing Agreement.

Analytics. Your consent, which you can withdraw at any time in Section 6.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Authenticate users and manage access controls.
• Enable event management, guestlist operations, and real-time check-ins.
• Send transactional emails (e.g., email verification, invite links).
• Respond to support requests and inquiries.
• Detect and prevent fraud, abuse, or security incidents.
• Improve and develop new features of the Service.

We do not sell your personal information to third parties. We do not use guest data for advertising purposes.

4. Who we share it with

Four providers handle data on our behalf. Each one is bound by a written agreement and handles it only for the purpose named here.

• Google Cloud / Firebase — Hosting, stored data, processing, sign-in, and (after consent) product analytics. United States (nam5 multi-region storage; us-east4 processing). Google Cloud Data Processing Addendum with EU Standard Contractual Clauses; Google LLC is certified under the EU-US Data Privacy Framework and its UK and Swiss extensions.
• Resend — Delivery of transactional email (confirmations, invitations, reminders, recaps, billing notices). United States. Resend Data Processing Agreement with EU Standard Contractual Clauses.
• Stripe — Subscription billing for organizer accounts; card details are collected and held by Stripe only. United States. Stripe Data Processing Agreement with EU Standard Contractual Clauses; Stripe is certified under the EU-US Data Privacy Framework.
• Sentry — Error reports from the app and its services, so faults can be fixed. United States. Sentry Data Processing Addendum with EU Standard Contractual Clauses; Sentry is certified under the EU-US Data Privacy Framework.
• Other users within your organization — owners and admins can see the details of guests on all of your organization's events; door staff see the guests of the events they are assigned to; promoters see only the guests who signed up through their own link or their sub-promoters' links. Guests are told on the sign-up form that the promoter who invited them and their team can see their details.
• Law enforcement or regulators — If required by applicable law, court order, or governmental authority.

We do not sell personal information and we do not share it for advertising.

4.1 Where your data is kept, and international transfers

All data is kept on Google Cloud in the United States: stored in the nam5 (US multi-region) and handled in us-east4. Lime-n.io itself is a Canadian company in Ontario, Canada.

Canada holds an adequacy decision from the European Commission, and equivalent recognition from Switzerland and the United Kingdom, for data handled by commercial organisations, so the transfer to us needs no extra paperwork. From us to Google, Google's Cloud Data Processing Addendum applies, which includes the EU Standard Contractual Clauses; Google is also certified under the EU-US Data Privacy Framework. The same kinds of terms cover our other providers, listed above.

The full chain is set out on our trust page and in our Data Processing Agreement. A Quebec organizer assessing this transfer under Law 25 can use the Quebec transfer fact sheet.

5. Data Retention

We retain account data for as long as your account is active. Upon account termination, all remaining account and event data is deleted within 180 days, subject to any overriding legal obligations.

Guest event data is deleted 90 days after the event date, subject to any overriding legal obligations. Guest details are deleted by an automatic daily process.

You may request earlier deletion of your data at any time by writing to privacy@lime-n.io. We will respond to such requests within 14 days of receipt, subject to any overriding legal obligations.

Deleted data leaves our backups within 7 days.

6. Cookies and Tracking

The Service uses session cookies and local storage to maintain your authenticated session and preferences. You can configure your browser to block cookies, but some features of the Service may not function correctly without them.

6.1 Analytics (Google Analytics 4)

We use Google Analytics 4 (GA4) to understand how the Service is used and to improve your experience. GA4 may collect:

• Pages visited and navigation paths
• Feature engagement events (e.g., event creation, check-ins)
• Device type, browser, and operating system
• Approximate location (country/region — not precise GPS)

We do not share names, email addresses, or other directly identifying information with Google Analytics. Only opaque internal identifiers are used in analytics events.

Advertising tracking is not currently enabled — advertising storage and personalisation are denied in this implementation.

Analytics data collection requires your consent. Before you accept, GA4 uses statistical modelling on anonymised data only. After you accept, full event data is collected.

6.2 Error reports

We use Sentry to collect error reports when something breaks. Reports contain technical context and never names, email addresses or guest details. This is not a tracking tool and does not require consent.

7. Security

The measures we have in place:

• Encrypted in transit and at rest.
• Access is by role: every read and write is checked against who you are and what your organization allows.
• An activity trail that only our own trusted code can write to.
• Daily backups, kept 7 days.
• Anyone opening a promoter's link without signing in sees the list without email addresses or phone numbers.
• Error reports never include names, email addresses or guest details.
• Access to your data is limited to the people on our side who need it to run the Service.

However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

If your data is affected by a security incident, we notify affected organizers within 48 hours of becoming aware.

If you discover a security vulnerability, please contact us responsibly.

8. Your Rights

Depending on your location, you may have rights regarding your personal information, including the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data.
• Export your data — Organizers, from the event page at any time; anyone else, by request.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a relevant supervisory authority.

To exercise any of these rights, write to privacy@lime-n.io. Deletion requests are governed by the 14-day timeframe stated in Section 5. Other rights requests will be responded to within a reasonable timeframe.

You can also complain to a regulator:

• European Union / EEA: Your national data protection authority (see the EDPB members list)
• Switzerland: Federal Data Protection and Information Commissioner (FDPIC)
• United Kingdom: Information Commissioner's Office (ICO)
• Quebec: Commission d'accès à l'information du Québec (CAI)
• Canada: Office of the Privacy Commissioner of Canada (OPC)

9. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the Effective Date at the top of this page. For material changes, we will notify you by email or through the Service. Continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

11. Governing law and which rules apply

This Privacy Policy is governed by the laws of Canada. We are committed to complying with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

For people in the European Union, Switzerland, the United Kingdom and Quebec, the GDPR, the Swiss Federal Act on Data Protection, the UK GDPR and Quebec's private-sector privacy law respectively also apply to how we handle your data, and our Data Processing Agreement sets out our obligations to organizers under them.

12. Contact

For anything about personal data — this policy, your rights, a deletion request — write to privacy@lime-n.io. For everything else, hello@lime-n.io or the Contact page.

Person responsible for personal information: Stu Doherty, Harvest Technology Systems, Inc., Ontario, Canada.