Privacy policy

HipHip is operated by 21 Holdings Limited, company number 10815109. For UK data protection purposes, 21 Holdings Limited is the controller of the personal information described in this policy unless we explain otherwise.

You can contact us about privacy at hello@hiphip.co. Our formal company details are set out in our Terms and conditions.

HipHip is designed for adults organising children's celebrations. Children should not create accounts or use payment features themselves. A parent, guardian or other responsible adult should decide what information about a child is appropriate to add.

Guests may provide an RSVP on behalf of themselves or their child. Please provide only the information needed to organise the celebration.

• Account information: email address, name, profile image, authentication details and account preferences. Passwords and Google sign-in are handled through our authentication provider; we do not see your Google password.
• Party and child information: a child's first name, celebration date, time, venue, invitation text, RSVP settings, wishlist content and any images or designs a host uploads or generates.
• Guest and RSVP information: guest or child name, email address, attendance response, numbers attending, messages and any dietary, allergy or health information a guest chooses to provide.
• Wishlist and purchase information: product links, gift status, purchaser name, email and message, and information about group-gift contributions.
• Payment and payout information: contributor name, email, amount, currency, payment status and provider identifiers. Fynex processes new card payments and registered UK bank payout details; Stripe remains involved in earlier payments and refunds. For earlier manually arranged payouts, we may retain account-holder name, UK sort code and account number.
• Reminder information: email address, optional child name, birthday and reminder timing.
• Technical information: IP-derived location or country, device/browser information, server logs, security events, cookie identifiers, local-storage data and page interaction information.
• Information sent to optional tools: venue searches entered into Google Places, image-generation prompts and reference images sent when a host asks to generate an invitation background, and images uploaded for an invitation.

Optional RSVP messages may contain health, allergy, religious or other special-category information. We process this only so it can be provided to the party host, and rely on the guest's explicit consent at the point they choose to submit it. A guest can avoid providing this information or ask us to remove it.

A host may add guest contact details so HipHip can send an invitation. The host is responsible for having an appropriate reason to use those details and for sharing only what is necessary. We use those details to provide the invitation service and related confirmations, not to add guests to unrelated marketing lists.

RSVP details are shown to the party host. Information placed on an invitation or wishlist is visible to anyone who has the relevant link and, where enabled, the password. Hosts should treat links as private and avoid including information they would not want link recipients to see.

We share information only where needed to run the service, complete a requested action, meet legal duties or protect users. Recipients may include:

• the party host, co-hosts and invited guests, according to the page and sharing settings;
• Supabase for authentication, database and storage infrastructure;
• Vercel for website hosting, delivery and operational logs;
• Resend for invitation, confirmation, reminder and service emails;
• Fynex and Stripe for card payments, refunds and payment security, with Fynex also processing new group-gift bank payouts;
• PostHog for optional product analytics where you have consented;
• UploadThing for user-uploaded and generated images;
• Google Maps Platform when a host uses venue autocomplete or directions;
• OpenAI when a host asks to generate or edit an invitation background;
• retailers and affiliate-network providers when someone follows a product link;
• professional advisers, insurers, authorities or courts where reasonably necessary; and
• a purchaser or successor if the business or service is reorganised or sold, subject to appropriate safeguards.

We do not sell personal information.

Some service providers may process information outside the UK. Where UK data protection law requires it, we use an adequacy decision, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard. You can ask us for more information about the safeguard relevant to your data.

We keep personal information only for as long as reasonably needed for the purpose collected, including operating an account or party, handling support, resolving disputes, preventing abuse and meeting legal, accounting or tax obligations. Relevant factors include whether a party is active or archived, whether an account remains open, the sensitivity of the information and any statutory limitation period.

• Account and party information is normally kept while the account is active and for a limited period afterwards so requests, disputes and recovery can be handled.
• Reminder details are kept until the reminder is completed, cancelled or no longer operationally required.
• Payment, refund and payout records may need to be retained for up to seven years for legal, tax and accounting purposes.
• Security logs and backups follow shorter operational retention cycles unless an incident requires longer preservation.

When information is no longer needed, we delete it, anonymise it or securely isolate it until deletion from backups.

HipHip uses storage that is necessary to sign users in, protect shared pages, remember draft party work and let a guest return to or amend an RSVP. This includes secure authentication/session cookies and browser local storage.

With your consent, we use PostHog, hosted in its EU region, to understand visits, traffic sources, approximate country, region and city, and creation steps. PostHog stores a browser identifier in local storage. When you sign in, we link consented activity to your account ID and email address, including earlier activity associated with the same browser identifier. We use masked playback of page interactions on public browsing and creation pages to understand navigation and difficulties: personal text, input values, personal-data attributes and images are masked or blocked, while reviewed fixed public page copy remains readable, and console logs and network request contents are not recorded. Shared invitation pages, account dashboards, sign-in and password-reset pages are excluded from interaction playback. We exclude private invitation codes, URL query strings and fragments, and form contents from event data, while retaining safe campaign tags and referring domains. You can decline or withdraw consent at any time using Analytics preferences. Optional external features and retailers may use their own cookies when opened.

We use access controls, authentication, encrypted connections, provider security controls and restricted administrative access designed to protect personal information. No online service can promise absolute security, so hosts should also use strong account credentials and share party links carefully.

Depending on the circumstances, UK data protection law may give you rights to:

• ask for a copy of your personal information;
• correct inaccurate or incomplete information;
• ask us to delete or restrict use of information;
• object to processing based on legitimate interests;
• receive certain information in a portable format; and
• withdraw consent at any time, without affecting earlier lawful processing.

To exercise a right, email hello@hiphip.co. We may need to verify your identity and clarify the information concerned. If information belongs to a party organised by another person, we may need to coordinate with that host while still meeting our own legal obligations.

Please contact us first so we can try to resolve a concern. You also have the right to complain to the UK Information Commissioner's Office through ico.org.uk or by calling 0303 123 1113.

We may update this policy as HipHip changes. Material changes will be highlighted through the service or another appropriate channel, and the date at the top will be updated.