Privacy policy

hip hip is operated by 21 Holdings Limited, company number 10815109. For UK data protection purposes, 21 Holdings Limited is the controller of the personal information described in this policy unless we explain otherwise.

You can contact us about privacy at hello@hiphip.co. Our formal company details are set out in our Terms and conditions.

hip hip is designed for adults organising children's celebrations. Children should not create accounts or use payment features themselves. A parent, guardian or other responsible adult should decide what information about a child is appropriate to add.

Guests may provide an RSVP on behalf of themselves or their child. Please provide only the information needed to organise the celebration.

• Account information: email address, name, profile image, authentication details and account preferences. Passwords and Google sign-in are handled through our authentication provider; we do not see your Google password.
• Party and child information: a child's first name, celebration date, time, venue, invitation text, RSVP settings, wishlist content and any images or designs a host uploads or generates.
• Guest and RSVP information: guest or child name, email address, attendance response, numbers attending, messages and any dietary, allergy or health information a guest chooses to provide.
• Wishlist and purchase information: product links, gift status, purchaser name, email and message, and information about group-gift contributions.
• Payment and payout information: contributor name, email, amount, currency, payment status and Stripe identifiers. Stripe processes card details. Where a host uses group-gift payouts, we may also hold their account-holder name, UK sort code and account number.
• Reminder information: email address, optional child name, birthday and reminder timing.
• Technical information: IP-derived location or country, device/browser information, server logs, security events, cookie identifiers, local-storage data and page interaction information.
• Information sent to optional tools: venue searches entered into Google Places, image-generation prompts and reference images sent when a host asks to generate an invitation background, and images uploaded for an invitation.

Optional RSVP messages may contain health, allergy, religious or other special-category information. We process this only so it can be provided to the party host, and rely on the guest's explicit consent at the point they choose to submit it. A guest can avoid providing this information or ask us to remove it.

A host may add guest contact details so hip hip can send an invitation. The host is responsible for having an appropriate reason to use those details and for sharing only what is necessary. We use those details to provide the invitation service and related confirmations, not to add guests to unrelated marketing lists.

RSVP details are shown to the party host. Information placed on an invitation or wishlist is visible to anyone who has the relevant link and, where enabled, the password. Hosts should treat links as private and avoid including information they would not want link recipients to see.

We share information only where needed to run the service, complete a requested action, meet legal duties or protect users. Recipients may include:

• the party host, co-hosts and invited guests, according to the page and sharing settings;
• Supabase for authentication, database and storage infrastructure;
• Vercel for website hosting, delivery and operational logs;
• Resend for invitation, confirmation, reminder and service emails;
• Stripe for card payments, refunds and payment security;
• UploadThing for user-uploaded and generated images;
• Google Maps Platform when a host uses venue autocomplete or directions;
• OpenAI when a host asks to generate or edit an invitation background;
• retailers and affiliate-network providers when someone follows a product link;
• professional advisers, insurers, authorities or courts where reasonably necessary; and
• a purchaser or successor if the business or service is reorganised or sold, subject to appropriate safeguards.

We do not sell personal information.

Some service providers may process information outside the UK. Where UK data protection law requires it, we use an adequacy decision, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard. You can ask us for more information about the safeguard relevant to your data.

We keep personal information only for as long as reasonably needed for the purpose collected, including operating an account or party, handling support, resolving disputes, preventing abuse and meeting legal, accounting or tax obligations. Relevant factors include whether a party is active or archived, whether an account remains open, the sensitivity of the information and any statutory limitation period.

• Account and party information is normally kept while the account is active and for a limited period afterwards so requests, disputes and recovery can be handled.
• Reminder details are kept until the reminder is completed, cancelled or no longer operationally required.
• Payment, refund and payout records may need to be retained for up to seven years for legal, tax and accounting purposes.
• Security logs and backups follow shorter operational retention cycles unless an incident requires longer preservation.

When information is no longer needed, we delete it, anonymise it or securely isolate it until deletion from backups.

hip hip uses storage that is necessary to sign users in, protect shared pages, remember draft party work and let a guest return to or amend an RSVP. This includes secure authentication/session cookies and browser local storage.

At the date of this policy, we do not place advertising or third-party analytics cookies on the public homepage or blog. Optional external features and retailers may use their own cookies when opened. If we introduce non-essential cookies on hip hip, we will explain them and request consent where UK law requires it.

We use access controls, authentication, encrypted connections, provider security controls and restricted administrative access designed to protect personal information. No online service can promise absolute security, so hosts should also use strong account credentials and share party links carefully.

Depending on the circumstances, UK data protection law may give you rights to:

• ask for a copy of your personal information;
• correct inaccurate or incomplete information;
• ask us to delete or restrict use of information;
• object to processing based on legitimate interests;
• receive certain information in a portable format; and
• withdraw consent at any time, without affecting earlier lawful processing.

To exercise a right, email hello@hiphip.co. We may need to verify your identity and clarify the information concerned. If information belongs to a party organised by another person, we may need to coordinate with that host while still meeting our own legal obligations.

Please contact us first so we can try to resolve a concern. You also have the right to complain to the UK Information Commissioner's Office through ico.org.uk or by calling 0303 123 1113.

We may update this policy as hip hip changes. Material changes will be highlighted through the service or another appropriate channel, and the date at the top will be updated.