What we hold, and why

When you introduce yourself, create an account, request or accept seats, or update your party, we may collect your name, email address, phone number, introduction answers, location context, party size, and marketing choice. For everyone attending, we keep the names and food preferences you provide, including allergies or medical food risks.

If payment is requested, we keep the booking price, reference, payment state and any payment-proof image you upload. We do not collect bank login or card details. We also keep essential sign-in, security, rate-limit and email-delivery records. Basic site analytics may record page and device information, but invitation and private-address links are excluded from analytics.

We use booking and contact details to consider your request, manage an offer, verify payment, communicate practical changes, plan the table and run the supper. This is needed to take steps at your request and provide a seat if confirmed. We use limited technical records to keep the service secure and reliable, and to protect the legitimate interests of Atithi and its guests.

Food-risk information may reveal health or belief information. When you choose to provide it, you ask us to use it only to decide whether and how we can host your party safely. You can withdraw that permission, but we may then be unable to host you safely. Marketing is separate and optional; you can switch it off in your account or email us at any time.

The host reads introductions to curate the table. There is no solely automated decision that accepts or rejects a guest.

The host and authorised helpers can see the information needed to manage the supper. Other guests do not receive your contact, introduction, food or payment details. We use Supabase for the database, account sign-in and private file storage; Vercel to host and protect the website and provide basic analytics; and Resend to deliver service and opted-in marketing email. Those providers process information for us under their own security and data-processing terms. We may also disclose information where the law requires it or to protect someone’s safety.

Our main database is configured in the EU. Some suppliers may process information outside the UK; where required, the relevant contractual or other lawful transfer safeguards apply. We do not sell guest information.

We keep information only while it is reasonably needed to run the club, protect guests, answer disputes and meet legal, tax or accounting duties. The operational schedule is: completed delivery-queue items are removed after 90 days; email-delivery logs are removed after 12 months; and an unfinished email that is still waiting after 30 days is permanently retired and stripped of its recipient and message data, so it cannot be sent later.

A reviewed payment-proof image is removed 12 months after the supper. We keep it longer when a cancelled booking still has money awaiting refund. Removing the image does not remove the amount, date, booking reference or review result needed for the accounting record; those essential transaction records may be kept for up to six years where required. A proof still awaiting host review is never removed by the scheduled cleanup.

Food-safety and guest-profile information is reviewed when it is no longer needed for hosting or a related issue. Marketing contact continues until you opt out. We delete or anonymise other information when its purpose and any required retention period end.

Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability, or object to how we use your information. You can withdraw consent at any time without affecting earlier use. Email hello@atithisupperclub.com; we may need to confirm your identity and will respond without undue delay, normally within one month.

If something feels wrong, please contact us first so we can put it right. You can also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. Your account page lets you keep your current contact and food details accurate. See also our seat terms.