ElleQ Privacy Policy

ElleQ for Hosts and ElleQ for Venues

Last updated: 11 October 2026

1. Who we are and what this policy covers

ElleQ is supplied by Sabrage Limited, trading as ElleQ ("ElleQ", "we", "us"), with its registered office at 81 Leinster Road, Rathmines, Dublin, D06 XR79, Ireland. Contact hello@elleq.ai or +353 83 4868244 for privacy questions or requests.

This policy explains how we handle personal data through our websites, ElleQ for Hosts, separately purchased planning tools, ElleQ for Venues, support and communications. Personal data means information relating to an identified or identifiable person. We follow the EU General Data Protection Regulation (GDPR), Ireland’s Data Protection Act 2018 and other applicable privacy laws. This policy does not limit your mandatory rights.

Sabrage Limited is the controller of information used for our own purposes, including account administration, billing, website operation, marketing and authorised supplier-directory contributions. A controller decides why and how personal data is used.

For event information managed on behalf of a venue or other business customer, that customer is normally the controller and ElleQ acts as its processor under the data processing schedule in our Terms. A processor handles data on the controller’s instructions. The venue’s own privacy notice also applies. Private hosts may be subject to the personal or household exemption for their own activities; that does not exempt ElleQ’s own processing from GDPR. Our role depends on the particular processing, rather than simply the name of the product.

2. Personal data we collect

Account and contact information: names, business names, email addresses, telephone numbers, account identifiers, login and account activity, approximate location and information provided in enquiries or support messages.

Purchase information: orders, subscriptions, invoices, billing details, payment status, transaction references and refund records. Stripe processes payments. The payment flow determines which payment details we receive; payment credentials are handled through the payment provider.

Event information: event dates and locations, guest names and contact details, invitations, RSVPs, guest numbers, seating and floor plans, suppliers, budgets, arrangements, dietary preferences, allergies, accessibility needs and other information entered by hosts, venues, staff or guests. Free-text fields and uploaded files may also contain personal data.

AI information: questions, prompts, relevant context supplied to an AI feature, generated responses and associated service information. Where an AI feature sends event context to OpenAI, that context may contain personal data. Only supply information needed for the question; avoid guest identifiers and sensitive details unless the feature expressly requires them and the necessary safeguards are in place.

Website and advertising information: IP address, device and browser information, pages visited, interactions, referral information, cookie identifiers and advertising events, such as a page visit or purchase, depending on the tracking enabled and your consent choices.

Voluntary contributions: supplier names, business contact details, reported prices, dates, inclusions and information you authorise us to use in supplier listings or cost guides. We may also collect survey answers, promotion entries and communication preferences where those activities are offered.

Some information is necessary to fulfil a purchase, create an account or provide a requested feature. If it is not provided, we may be unable to deliver that service. Marketing consent and directory contributions are optional.

3. Where information comes from

We collect information directly from you through registrations, purchases, questionnaires, guest forms, AI interactions and communications. Hosts, venues, staff or suppliers may provide information about other people involved in an event. Wix, Stripe and other connected providers may supply service, transaction or technical information. We may obtain relevant public business information from supplier websites, public directories or other lawful public sources.

Anyone providing information about other people must have the necessary authority or lawful basis and give them appropriate privacy information. Where we are controller of indirectly collected data, we provide the information required by GDPR within the applicable timeframe, unless a lawful exception applies. Where we are a processor, we assist the customer with its obligations.

4. Why we use personal data and our legal bases

Where we act as controller, the following purposes and legal bases apply. Where we act as processor, the business customer determines its legal bases and we process on its documented lawful instructions.

Purpose

Use

Legal basis

Accounts, purchases and requested services

Create and administer accounts, deliver paid planning features and requested AI assistance, handle orders and refunds.

Performance of our contract with you, or steps requested before entering it. For authorised users who are not contracting parties, our legitimate interests in delivering and administering the requested service.

Enquiries and support

Answer questions, resolve complaints and provide service messages.

Contract where related to your purchase; otherwise legitimate interests in responding and supporting users.

Billing and compliance

Maintain required records and meet tax, accounting and other legal duties.

Legal obligation; contract for payment administration.

Security and service improvement

Prevent misuse, investigate incidents, maintain functionality and improve the service without repurposing private event data for unrelated uses.

Legitimate interests in a secure, reliable service, balanced against individuals’ rights. Non-essential tracking still requires consent.

Analytics and advertising

Measure site use and advertising effectiveness and support relevant advertising through Wix and advertising tags.

Consent for non-essential analytics and advertising tracking and associated personal-data processing.

Marketing communications

Send newsletters and product offers.

Consent where required. A limited existing-customer exception may apply only where all applicable electronic-marketing conditions are met; the associated GDPR basis is legitimate interests in promoting similar services.

Supplier listings and cost guides

Publish authorised contributions and relevant public business information; handle corrections.

Consent for optional personal-data contributions where requested; legitimate interests in providing accurate business listings from lawful public sources, subject to rights and objections.

Claims and business transactions

Establish or defend legal claims and assess or complete a business transfer.

Legal obligation where applicable; otherwise legitimate interests in protecting rights and managing the business, with confidentiality and data minimisation.

Surveys and promotions

Run an optional survey or administer a promotion you enter.

Consent for optional survey participation; contract for administering a promotion under its rules. Marketing permission is separate.

We assess whether our legitimate interests are overridden by individuals’ interests or rights. You may object as explained below. Accepting our Terms or this policy is not, by itself, consent to optional marketing, tracking or unrelated processing.

5. Allergies, accessibility information and children

Allergies and some dietary or accessibility details can reveal health information or other special-category data. This information needs an Article 6 legal basis and an additional condition under Article 9 GDPR. Where ElleQ is controller and no other appropriate condition applies, we rely on the individual’s explicit consent obtained through a separate, specific process. A host entering someone else’s allergy or accepting general Terms does not by itself establish that consent. If the necessary condition is absent, the sensitive information should not be submitted or processed.

For business event records, the venue or other controller is responsible for identifying and documenting the relevant conditions, informing individuals and giving lawful processing instructions. We assist within our processor role. We limit sensitive information to what is necessary and do not use it for advertising or supplier-price research.

Purchasers and account administrators must be at least 18. Event records may include children as guests, including contact, seating or dietary information supplied by an authorised adult. Such information must be minimised and handled with appropriate permissions and safeguards. Contact us if you believe children’s information has been used improperly.

6. Who receives information

Wix provides our website and platform hosting, storage and website analytics. Stripe provides payment processing and related transaction services. OpenAI supports AI features. Meta, Google and Pinterest receive advertising-related information through their tags where enabled with the required consent. The information shared depends on the feature, integration and settings in use.

Providers receive information needed for their function under appropriate contractual arrangements. Some also act as independent controllers for their own specified purposes, such as payment fraud prevention or advertising-platform services; their privacy notices explain those activities. Details are available at wix.com/about/privacy, stripe.com/privacy, openai.com/policies/privacy-policy, facebook.com/privacy/policy, policies.google.com/privacy and policy.pinterest.com/privacy-policy.

We may also disclose necessary information to professional advisers, authorised support providers, regulators or authorities where legally required, and parties involved in a genuine business transfer under appropriate safeguards. We do not sell identifiable guest lists or use them for unrelated advertising.

Hosts and venues can share event information and Outputs with guests, staff and suppliers. The recipient is responsible for its own handling where it is an independent controller. Take care with shareable links: depending on the permissions, anyone who receives a forwarded link may be able to view information. Only share with intended recipients and include only necessary details.

7. AI features and OpenAI

When you use an AI-assisted feature, information submitted to that feature and context passed by the integration may be sent to OpenAI to generate a response. We use this information to deliver and support the requested feature, not to authorise unrelated use of private event or guest information. AI responses may be inaccurate and should be reviewed before use.

We do not authorise use of identifiable Client Data for AI model training. Provider processing and retention depend on the OpenAI service, endpoint and account settings used. We do not promise zero retention or that every AI request is deleted immediately. OpenAI may retain information for service operation, safety, abuse monitoring or legal purposes under the applicable agreement. Contact us for details of the integration and safeguards relevant to your use.

For venue information, any processing through OpenAI must be covered by the venue’s lawful instructions and applicable subprocessor arrangements. Do not submit sensitive guest information to a general AI chat simply because it is already recorded in the event plan.

8. Cookies, analytics and advertising tags

We use strictly necessary technologies to provide requested functions such as security, sign-in, account access and checkout. Where required, we seek consent before activating non-essential Wix analytics and Meta, Google or Pinterest advertising tags. Optional tracking is not a condition of buying or using the planner.

With consent, advertising tags may collect device identifiers, IP addresses, pages visited and interaction or conversion events to measure advertising and support relevant advertising. The platforms may link these events to information they already hold and use them under their own notices. We do not send private guest lists, allergy information or event-plan contents to advertising tags.

You can accept or reject optional tracking through the website’s consent controls and withdraw or change consent through its cookie-settings control. Rejecting optional tracking does not prevent access to core services. Browser settings offer an additional control but do not replace our consent process. Withdrawal does not affect earlier lawful processing.

The cookie information available through our website’s consent controls must identify the technologies actually used, their purposes, providers and durations. Platform advertising preferences provide additional controls over information held by those platforms.

9. Marketing communications

You can unsubscribe from marketing emails using the link in each message or contact hello@elleq.ai. You may object at any time to direct marketing and associated profiling. We retain the minimum suppression information needed to honour your choice. Essential order, billing, security and service messages continue where necessary. We do not use event guests’ details for ElleQ marketing merely because they appear in an event record.

10. Supplier information and local pricing guides

You may optionally contribute supplier information and costs through a clearly identified contribution process or direct permission. We explain what will be used and whether supplier names will be displayed. Entering a price in a private plan or discussing it in a Facebook group is not by itself permission for ElleQ to republish it.

Listings may use lawfully sourced public business information and authorised contributions. Reported costs are labelled according to their source, date or year, currency and known inclusions. They are indicative information, not current binding quotes. Confidential quotes, private personal contact details and guest information must not be contributed.

We may retain genuinely anonymised aggregated statistics and local price ranges that cannot reasonably identify an individual, private event or confidential transaction. Removing names alone is insufficient. Anonymising venue source data must be within the venue’s documented lawful instructions. Contact us to request correction or removal of a listing or contribution, or to withdraw consent where it is the basis for processing.

11. How long we keep information

We keep personal data only as long as necessary for the stated purpose. Retention depends on the service or account duration, unresolved support or complaints, documented customer instructions, legal record-keeping obligations and particular claims. We do not keep identifiable event information indefinitely just because it might be useful for future research.

ElleQ for Hosts: we review retained event records at least quarterly and delete complete records no longer needed for delivering the purchased service, outstanding support or complaints, or a specific legal obligation or claim. Retention does not extend your access period. We handle lawful deletion requests separately within applicable time limits.

ElleQ for Venues: during the subscription, the venue determines and documents its lawful retention requirements. We review retained event records at least quarterly against those instructions and follow up where continued retention needs clarification. On termination, the customer may request return within 30 days. Complete live event records are deleted within a further 30 days, or sooner on lawful instruction after return, unless law requires retention, in accordance with our Terms and processing schedule.

Event information is reviewed and deleted as complete event records, not through different schedules for each field. ElleQ-controlled CMS backups containing deleted records are deleted or replaced within 30 days of live deletion. Residual Wix infrastructure backups remain protected under Wix’s applicable processing and retention arrangements and are not used for ordinary business purposes. Data restored from backups is deleted again where already due for deletion.

Account, contact, support and AI interaction records are reviewed for continuing necessity once their service or support purpose ends. Separate billing and contract records are retained for applicable accounting, legal and claims requirements. Consent evidence and marketing-suppression records are kept as needed to demonstrate and honour your choices. Optional tracking data follows the actual cookie durations and provider settings described through our website. You may ask for information about the retention applicable to your records.

12. International transfers

Although ElleQ is supplied from Ireland, Wix, Stripe, OpenAI and advertising providers may process information in the United States and other countries outside the EEA. Wix storage does not mean all information is stored in Ireland or exclusively within the EEA.

Where required, transfers are covered by an applicable European Commission adequacy decision or appropriate safeguards, such as Standard Contractual Clauses, with supplementary measures where necessary. The mechanism depends on the destination, recipient and service. We assess the applicable provider arrangements rather than treating this policy as a transfer mechanism. Contact us for relevant transfer details or a copy of applicable safeguards, subject to lawful redactions.

13. Security

We apply technical and organisational safeguards appropriate to the information and risks, including account and permission controls, limiting administrative access to those who need it, secure authentication and transmission, confidentiality obligations and backup and recovery arrangements. Wix supplies infrastructure protections; ElleQ remains responsible for its own settings and handling. No online system is completely secure, but this does not reduce our legal responsibilities or your rights. Contact us promptly about suspected unauthorised access or disclosure.

14. Your rights and complaints

Subject to applicable conditions and exceptions, you may request access, correction, deletion, restriction of processing or portability, and object to processing based on legitimate interests. You have an unconditional right to object to direct marketing. Where processing relies on consent, you can withdraw it at any time without affecting earlier lawful processing. You may also have rights concerning solely automated decisions with legal or similarly significant effects. Our planning suggestions and advertising personalisation are not intended to make such decisions about you.

Send requests to hello@elleq.ai. We may request proportionate information to verify identity. Requests are normally free and we respond without undue delay and within one month. Where permitted, a complex request or number of requests may require up to two additional months; we will explain the extension within the first month. If we cannot fulfil a request, we explain the reason and your complaint rights.

For event information controlled by a venue, contact that venue first where possible. You may still contact ElleQ; we will pass the request to the relevant controller or assist as appropriate. We will not require you to wait for a quarterly review to exercise your rights.

You can complain to Ireland’s Data Protection Commission at dataprotection.ie, or to the supervisory authority in the EEA country where you live, work or believe an infringement occurred. You do not have to contact us before lodging a complaint. Other applicable local privacy rights remain available.

15. Changes and contact

We may update this policy to reflect changes to our services, providers or legal requirements. The revision date appears above. We will draw material changes to your attention where appropriate and obtain fresh consent where required. A policy update does not retrospectively authorise an incompatible new use of personal data.

Privacy contact: Sabrage Limited trading as ElleQ, 81 Leinster Road, Rathmines, Dublin, D06 XR79, Ireland. Email hello@elleq.ai. Telephone +353 83 4868244.