Back to Confetti
Legal

Privacy Policy

Last updated: 27th August 2026

This Privacy Policy explains how Confetti collects, uses, shares and protects personal data when you use our website, mobile application and related services (together, the "Service"). It also explains your rights under UK data protection law.

1. Who we are

The Service is operated by Channelle Chin trading as Confetti ("Confetti", "we", "us" or "our"), a sole trader based in England and Wales, with a business address at 124 City Road, London, EC1V 2NX.

For the purposes of UK data protection law, we are the "controller" of the personal data we process about you. If you have any questions about this policy or your data, contact us at privacy@heyconfetti.co.uk.

Data protection point of contact: Channelle Chin.

2. The law we follow

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR). Because our Service is used in connection with children’s parties, we also design our data practices with reference to the Information Commissioner’s Office (ICO) Age Appropriate Design Code (the "Children’s Code").

3. A note about children’s data

Confetti is designed to be used by adults (parents and guardians) aged 18 or over. We do not knowingly allow children to create accounts or use the Service directly. Account holders are responsible for the information they enter about their own children and, where relevant, other people’s children (for example, when logging a party their child has been invited to).

The information about children that we process is limited to what is needed to provide the Service — for example, a child’s first name, age or year group, and details of a party (date, time, and a general or precise location as chosen by the host). We do not ask for or require sensitive information about children. Account holders should only enter information about a child that is necessary and appropriate, and should not enter another person’s child’s details without a proper basis for doing so.

4. The personal data we collect

Depending on how you use the Service, we may collect and process the following categories of personal data:

Information you give us when you create and use an account:

  • Your name and email address, and any password or authentication details.
  • Details of your household, including any co-parent or partner you invite to share an account.
  • Information about your children that you choose to add (such as first name, age or year group, interests, and gifts already received).
  • Details of parties you are hosting or attending, including dates, times, locations, tasks, and guest responses (RSVPs).
  • Messages or notes you choose to send through the Service (for example, a message to a party host, or a thank-you note).
  • Any invitation content or images you upload.

Information about guests who respond to an invitation:

When someone hosts a party using Confetti and shares an invitation link, guests can respond (RSVP) without creating an account. In that case we process the information the guest chooses to provide — for example, their name, the name of the child attending, the number of people attending, and any message to the host. This information is collected on behalf of, and shared with, the host.

Information we collect automatically:

  • Technical information such as device type, browser, and general usage information needed to operate and secure the Service.
  • Cookies and similar technologies (see our Cookie Policy below).

Information from third parties:

  • If you sign in using a third-party login (if offered), we receive limited information from that provider.

If you click an affiliate link to a retailer, that retailer and our affiliate partners may process information about that visit.

Affiliate partners and retailers:

The Service contains affiliate links to third-party retailers, provided through affiliate networks and programmes including Amazon Associates and Awin (together, our "Affiliate Partners"). When you click an affiliate link, our Affiliate Partners and the relevant retailer may place cookies or use similar tracking technologies on your device and process personal data about you — such as your device and browser information, the fact that you arrived from Confetti, the pages you view, and any resulting purchase — in order to attribute that purchase to us and calculate any commission payable. This processing is carried out by our Affiliate Partners and the retailers as independent data controllers under their own privacy policies, not ours. We do not receive your payment details or the specific items you purchase; we generally receive only aggregated or anonymised commission and performance information. We are not responsible for the data practices of our Affiliate Partners or retailers, and we encourage you to review their privacy policies before making a purchase.

5. How and why we use your data (and our legal basis)

We use personal data for the following purposes, relying on the following legal bases under UK GDPR:

  • To provide and operate the Service — such as creating your account, managing your parties, tasks and RSVPs, and enabling co-parents to share an account. Legal basis: performance of a contract with you.
  • To make gift recommendations and show relevant suggestions. Legal basis: performance of a contract and/or our legitimate interests in providing a useful service.
  • To send you service-related communications (for example, an email when someone RSVPs to your party, or important notices about your account). Legal basis: performance of a contract and/or legitimate interests.
  • To send you marketing communications, where you have agreed to receive them. Legal basis: consent.
  • To keep the Service secure, prevent misuse, and troubleshoot problems. Legal basis: legitimate interests and legal obligation.
  • To comply with our legal obligations. Legal basis: legal obligation.

6. Affiliate links and gift recommendations

Confetti may include "affiliate links" to third-party retailers. If you click one of these links and make a purchase, we may earn a small commission, at no extra cost to you. We use affiliate programmes such as Amazon Associates and Awin. When you follow an affiliate link, you leave the Confetti Service and the retailer’s own privacy policy and terms apply to your activity on their website. We do not control, and are not responsible for, how those retailers process your data.

7. Who we share your data with

We do not sell your personal data. We share it only as needed to run the Service, including with:

  • Service providers who host and support the Service on our behalf (for example, our hosting, database and email providers such as Supabase, Vercel, Resend, and Anthropic (Claude)), who act as our processors under contract.
  • Party hosts and guests, to the extent needed for the party coordination features to work (for example, sharing a guest’s RSVP with the host of that party).
  • Affiliate partners and retailers, when you choose to click an affiliate link, as described above.
  • Professional advisers, regulators or law-enforcement bodies where we are legally required to do so.
  • A buyer or successor if we sell or reorganise our business.

8. International transfers

We are based in the United Kingdom, and we aim to keep your personal data within the UK or the European Economic Area (EEA) where possible. However, some of the service providers we rely on to operate the Service (for example, our hosting, database, email and other technology providers) may store or process personal data outside the UK.

Where personal data is transferred outside the UK, we take steps to ensure it receives a level of protection consistent with UK data protection law. Depending on the provider and the destination country, we rely on one or more of the following safeguards:

  • transfers to countries that the UK Government has determined provide an adequate level of protection ("adequacy regulations"); or
  • appropriate safeguards, such as the UK International Data Transfer Agreement (IDTA), or the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, together with any additional measures needed to protect your data.

You can ask us for more information about the safeguards we have in place for a particular transfer by contacting us at privacy@heyconfetti.co.uk.

9. How long we keep your data

We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide Confetti, comply with our legal obligations, resolve disputes and enforce our agreements.

If you close your Confetti account, we will delete or anonymise your account information, child profiles and associated party data within 30 days, unless we are required to retain particular information for longer. Copies contained in our routine backups may remain for up to 90 days before being automatically overwritten.

We generally retain:

  • account and profile information for as long as your account remains active and for up to 30 days afterwards;
  • guest and RSVP information for up to 12 months after the relevant party, unless the party or account is deleted earlier;
  • party tasks, lift arrangements and similar coordination information for up to 90 days after the relevant party;
  • customer support correspondence for up to 2 years after the enquiry is closed;
  • security and technical logs generally for up to 90 days, although we may retain relevant records for longer where necessary to investigate a security or fraud incident; and
  • transaction, invoice and accounting information for up to 6 years, or for any longer period required by applicable tax or accounting law.

Where information is no longer required but we need to retain a record for legal, regulatory, fraud-prevention or dispute-resolution purposes, we will limit its use to those purposes. We may retain information in anonymised form where it can no longer identify you.

10. How we protect your data

We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit, and restricting who can see information (for example, party details behind unique, unguessable invitation links, and household data accessible only to members of that household). No system is completely secure, but we work to protect your information and to respond appropriately if a problem occurs.

11. Your rights

Under UK data protection law you have rights over your personal data, including the right to:

  • Access the personal data we hold about you.
  • Ask us to correct inaccurate or incomplete data.
  • Ask us to delete your data (the "right to erasure").
  • Object to, or ask us to restrict, certain processing.
  • Ask us to transfer your data to another provider (data portability).
  • Withdraw consent at any time, where we rely on consent.

To exercise any of these rights, contact us at privacy@heyconfetti.co.uk. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk, though we’d appreciate the chance to address your concerns first.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make significant changes, we will take reasonable steps to let you know. The "Last updated" date at the top shows when it was last revised.

13. Contact us

If you have any questions about this policy or how we handle your data, contact us at privacy@heyconfetti.co.uk or by post at 124 City Road, London, EC1V 2NX.