Early access. CuratedLove is new and these policies are still being finalised. They're written plainly and honestly; if a question isn't answered here, email support and we'll answer it directly.

This Privacy Policy explains how CuratedLove (“CuratedLove,” “we,” “us”) collects, uses, and shares personal information when you visit curatedlove.party, join our waitlist, book a demo, or use our supper-club management tools (the “Service”).

Our data promise, in plain language

Before the legal detail, here is exactly what we do and don't do, on every plan including Free:

• Your guest list is yours. We store and process guest information only to run your dinners. We never sell it, never share it with other hosts, and never use one host's guest list to benefit anyone else.
• Our staff don't browse your guests' personal information. The dashboards we use to run CuratedLove — platform metrics, the founder's command center — are built to show only aggregate, non-identifying counts: how many bookings happened, coarse price bands, plan mix, which features get used, rating distributions, and similar totals. An automated filter runs on every one of those records before it's stored and strips out anything shaped like a name, email, phone number, or note, even if a bug tried to send one — that filter is how we keep names and contact details out of the systems we use day to day (see “How we use information” for the one narrow exception: a host's own use of the AI concierge, which does see whatever guest data it needs to answer that host's question). Engineers would only ever query a specific guest record directly to investigate a technical problem you've reported, keep the Service secure, or comply with the law.
• We learn from patterns, not people. To improve CuratedLove and build new features for hosts, we analyze how the platform is used in aggregate — for example, how quickly dinners fill at different price points, or which features hosts open most. One host's guest list is never sold and never shared with another host.
• You can leave with everything. Ask and we'll export your data; ask and we'll delete it. Deleted means deleted.

Information we collect

Information you give us. When you join the waitlist we collect your name, email, role, budget range, club or company, city, website or social handle, and the workflows you want help with. When you sign in we process your email and a securely hashed credential. When you use the Service you may add organization details and event information.

Information collected automatically. We collect limited technical data such as IP address, browser type and user agent, referring page, and general usage, primarily to keep the Service secure and working.

Information from third parties. If you book a demo, cal.com collects your name, email, and chosen time and shares the booking with us. If you or your guests pay through the Service — your subscription or a guest's dinner payment — Stripe processes that payment and shares limited details (such as amount and payment status, never your full card number) with us.

Guest information you add

Hosts may store information about their guests (such as names, contact details, and dietary preferences). For that data, you are the controller and CuratedLove is a processor acting on your instructions. You are responsible for having a lawful basis and any required consent before adding guest information — especially dietary or allergy notes, which may be treated as sensitive data in some regions.

Marketing consent, specifically. Booking a dinner is a transaction: we (and the host) process a guest's name, email, and booking details to actually deliver the seat they're reserving, and their confirmation email always goes out — that never depends on any marketing choice. Separately, our public booking form gives the guest an explicit, unticked-by-default checkbox asking whether the host may email them about future dinners. We record exactly what they choose — yes or no — as an explicit answer, never a blank. If they opt in, that's permission for the host to follow up, not for CuratedLove to contact them on our own behalf; the email would come from the host. Some booking surfaces (for example, joining a sold-out event's waitlist) don't currently show this checkbox at all, and in that case no marketing consent is recorded — it defaults to no, the same as a guest who saw the checkbox and left it unchecked.

How we use information

• To operate, maintain, and improve the Service.
• To process your subscription and any guest payments you collect, through Stripe.
• To respond to waitlist requests, schedule and run demos, and contact you about the Service.
• To power AI features you (the host) trigger — for example, drafting a menu or event, generating a seating plan, or asking the AI concierge for your guest list, a pre-service kitchen/allergy sheet, or a specific guest's dietary profile. Your prompt, and whatever account, event, or booking data the feature needs to answer accurately — which can include guest names, emails, and dietary/allergy notes you've stored — is sent to our AI provider, Anthropic, solely to generate that response. It is not used to train Anthropic's models. If Anthropic is unavailable, the same request falls back to another provider we have chosen on the same terms (today: NVIDIA, Groq, or Cloudflare Workers AI). We never send host or guest content to a provider that uses it to train its models, and we do not enrol your data in any programme that would.
• To answer a guest's question on your public booking page (for example, “is there parking?”). That box is answered by a second AI provider, Groq, using only the event's own public listing details (title, date, price, description, FAQs) and the words the guest just typed — never your stored guest list, dietary data, or knowledge base.
• If you use the AI concierge's voice mode in your dashboard, your spoken audio is transcribed by Deepgram and spoken replies are synthesized by ElevenLabs. Because a spoken reply can include whatever the concierge is reading back to you — including guest details, per the AI-concierge use above — that information can pass through those providers too, as audio or text.
• To secure the Service, prevent abuse, and meet legal obligations.

Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (creating your account, running a dinner a guest booked, and sending that guest their transactional confirmation — none of this needs or waits on marketing consent); your consent (e.g. joining our waitlist, visiting the /demo booking page, or a guest checking the “email me about future dinners” box) — a guest can withdraw that consent at any time by telling the host directly, or by emailing us at the address in “Your rights” below and we'll pass the request on; and our legitimate interests (securing the Service, and — limited to the aggregate, non-identifying platform patterns described above — improving it), balanced against your rights.

How we share information

We do not sell your personal information. We share it only with service providers that help us run the Service, under appropriate terms:

• Stripe — payment processing for subscriptions and guest dinner payments. Stripe receives payment details directly; we never see or store your full card number.
• Anthropic — AI generation for the features you (the host) trigger: event/menu drafting, seating, and the AI concierge, including when you ask it about your own bookings or guests. See “How we use information” above.
• Groq — answers your guests' questions on your public booking page, using only that event's public listing details and the guest's typed question; also used for voice routing in the dashboard concierge.
• Cloudflare and NVIDIA — hosting, and the AI models that stand in when our primary provider is unavailable, so a feature degrades rather than fails. Neither trains on what we send.
• Deepgram and ElevenLabs — speech-to-text and text-to-speech for the dashboard concierge's voice mode, used only when a host turns it on.
• Resend — transactional and waitlist email.
• Kroger — real-time grocery product names and store pricing used to build shopping-list suggestions. We send a product search, not personal or guest information, and Kroger does not receive any of your guest data.
• cal.com — demo scheduling, embedded on our /demo page.
• Cloudflare — hosting, security, and database storage.
• YouTube — embedded video, loaded in privacy-enhanced mode only when you press play.

We do not currently have a live integration for point-of-sale providers (such as Square) that shares data with them — if and when a POS connection goes live for customers, we will update this list first.

We may also disclose information to comply with law or to protect our rights, users, and the public.

Cookies

We use a small number of essential cookies, and third-party cookies are set by cal.com only on our /demo page, where its booking calendar is embedded. See our Cookie Policy for details.

Data retention

We keep personal information for as long as needed to provide the Service and for legitimate business or legal purposes, then delete or anonymize it. You can ask us to delete your data at any time.

Security

Data is transmitted over HTTPS and stored with our infrastructure providers using access controls. No method of transmission or storage is perfectly secure, but we work to protect your information and limit access to it. We do not currently hold formal security certifications (such as SOC 2 or ISO 27001); if that changes, we will state it here accurately.

Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict use of your personal information, and to withdraw consent or object to certain processing. California residents may exercise rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them. To make a request, email reach@curatedlove.party.

International transfers

We and our providers may process information in countries other than yours. Where required, we use appropriate safeguards for international transfers.

Children

The Service is intended for adults and is not directed to children. We do not knowingly collect personal information from anyone under 18.

Health information and HIPAA

CuratedLove is a hospitality and events platform. It is not a healthcare provider, health plan, or healthcare clearinghouse, and is not a “covered entity” or “business associate” under HIPAA. The Service is not intended to collect or process protected health information (PHI). Please do not submit medical or health records through the Service.

Changes to this policy

We may update this policy from time to time. We will revise the “Last updated” date above and, for material changes, take additional steps where required.

Contact

Questions or requests? Email reach@curatedlove.party.

About this policy

This policy is written to describe accurately, in plain language, what CuratedLove actually does with data today. It is not a substitute for legal advice, and having this policy does not by itself guarantee compliance with every law that may apply to you. CuratedLove recommends having this policy reviewed by a licensed attorney, particularly if you operate in a jurisdiction with specific requirements (such as the GDPR or CCPA/CPRA), before relying on it.