Privacy policy

1. Who is responsible for your data

Mirthday.co.uk is operated by MirthDay, 66 Paul Street, London, EC2A 4NA, who is the data controller for the personal data described here.

For anything about your data — a question, a correction, a deletion — write to hello@mirthday.co.uk.

2. What we collect

If you have an account

• your name and email address;
• your password, which we never store as text and cannot read;
• the date you signed up.

What you put into a party page

• the first name of each child the party is for, their age, and their gender if you choose to give it;
• the details of the party itself: when and where it is, how to get there, what you are laying on and what you ask of your guests.

If you reply to an invitation as a guest

• your name and email address;
• whether you are coming;
• how many grown-ups and children are coming, and the name and age of each child you bring.

Technical data

• one cookie that keeps you logged in (see section 8);
• ordinary web server logs, which include your IP address. We keep them to run the site and to spot abuse.

We do not ask for, and would rather you did not enter, anything sensitive: health details, allergies, dietary or medical information, religion, or anything similar. If you put such information into a free text box anyway, it is stored like any other text you type.

3. Children’s details

Children’s first names and ages appear on this site because a grown-up — a parent making an invitation, or a parent replying to one — typed them in. We never collect them from a child, and children do not hold accounts here.

If you are a parent or guardian and you believe a child’s details are on MirthDay when they should not be, write to us and we will remove them.

4. What we use it for, and our legal basis

• Running the service — making your account work, showing your invitation to the people you send it to, collecting replies and showing them to you. Legal basis: performance of a contract with you.
• Emails about your own party — confirming a reply, telling a host about a new reply, reminding a guest who has replied about the party they said yes to, or telling people when a party changes or is called off. Legal basis: performance of a contract, and our legitimate interest in the service doing the job it exists to do.
• Occasional news about MirthDay — a note when something new appears, at most a few times a year, and only to account holders who have agreed to it when signing up. Every such email has an unsubscribe link, and you can also opt out by writing to us. We do not send this kind of email to guests who have only replied to an invitation. Legal basis: your consent.
• Keeping the service safe — spotting abuse, preventing fraud, keeping backups, fixing faults. Legal basis: our legitimate interest in a service that works and is not misused.
• Meeting legal obligations — where the law requires us to keep or hand over information. Legal basis: legal obligation.

5. Who else sees it

We do not share your personal data with anyone else, with these unavoidable exceptions:

• The people you send your invitation to. A party page lives at a long, random web address, and anyone who has that address can read what is on it, including the children’s names and the replies left by other guests. You choose who gets the link.
• Our hosting provider, which stores the server the site runs on and acts on our instructions as a data processor under a contract that requires it to keep your data confidential and secure.
• Google Fonts. Our pages load typefaces from Google’s servers, so your browser tells Google your IP address and which page it is loading.
• Anyone we are legally required to tell — for example in response to a court order, or a lawful request from the police.

We plan to add an analytics service — see section 8. When we do, it will be named in this section, together with what it collects and where it sends it, before it is switched on, and it will only run for visitors who have agreed to it.

6. Where your data is kept

Your data is stored on servers in the United Kingdom or the European Economic Area. The EEA is covered by UK adequacy regulations, which means data may move there under the same protection it has here. If we ever need to move data outside the UK or the EEA, we will put appropriate safeguards in place first — such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

An analytics provider, once we have one, is likely to process data outside the UK — Google Analytics, for instance, sends data to Google in the United States. We will only use a provider covered by UK adequacy regulations or by such safeguards, we will say so here before switching it on, and nothing will be sent for a visitor who has not agreed.

7. How long we keep it

• Your account — for as long as you have one. Tell us to close it and we delete your account, your parties and the replies to them.
• Parties and the replies to them — up to 24 months after the date of the party, then deleted. A party you delete yourself disappears from the site at once and is removed from our database within 30 days.
• Server logs and backups — only as long as they are useful for running the service and recovering from a failure, and then discarded.
• Anything the law requires us to keep for longer, we keep for exactly that long and for nothing else.

8. Cookies

We set one cookie. It holds a random token that tells us you are logged in and contains nothing about you. Without it you could not stay logged in, so it is a strictly necessary cookie and does not need your consent.

A guest who only opens an invitation and replies to it is given no cookie at all.

We do intend to add analytics — something like Google Analytics, to count visits and show us which pages people actually use, so we know what is worth improving. Analytics cookies are not necessary for the site to work, which means we may not set them without your permission. So when analytics arrives:

• a banner will ask you before anything is set;
• if you say no, or close the banner without choosing, nothing is set and the site works exactly as before;
• you will be able to change your mind at any time, in the same banner or by writing to us;
• this policy will be updated first, so you can read what the service collects and how long it keeps it before you decide.

You can delete our cookie in your browser at any time; you will simply be logged out.

9. How we protect it

We take appropriate measures to keep your data safe, and access to it is limited to the people who run the service. No system is completely secure, and we cannot guarantee that nothing will ever go wrong — but if a breach puts your rights at risk, we will report it as the law requires and tell you where that applies.

10. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• object to, or ask us to restrict, how we use it;
• receive the data you gave us in a portable form;
• withdraw consent at any time, where we rely on consent — which stops future emails but does not undo anything sent before.

Write to hello@mirthday.co.uk and we will answer within one month. Exercising any of these rights is free.

If you replied to an invitation and want your reply removed, write to us — you do not need to go through the host, although asking them to delete it works too.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, or 0303 123 1113. We would rather you came to us first, so that we can put it right.

11. Changes to this policy

When this policy changes, the new version appears on this page. Worth a look now and then, and always before you rely on what it says.