Plan an Event

Privacy Policy

Draft — to be reviewed by counsel before launch.

Effective date: [effective date] · Last updated: October 8, 2026

This Privacy Policy explains how Clevers LLC ("we", "us") collects, uses and shares personal information when you use Cafy: our website (https://cafy.ai), the Cafy Go app for event planners (iOS, Android and web at [Cafy Go web app URL]), and the Cafy partner app and partner portal (https://app.cafy.ai) for transportation companies (together, the "Service").

Cafy helps people plan events (weddings, corporate events, trips and private occasions) day by day, and connects them with independent transportation companies that quote for and run the rides. In this policy:

  • Planners are people and companies who plan events in Cafy Go.
  • Partners are the independent, vetted transportation companies (for example limousine and charter operators) that receive ride requests, send quotes and carry out rides.
  • Drivers are the people a Partner assigns to drive a ride.
  • Responsible parties and guests are people whose details a Planner adds to a plan, such as an on-site coordinator or passengers.

We are the controller of the personal information described here. When we pass a Planner's ride details to a Partner so it can quote for and carry out a ride, that Partner uses them as an independent business, under its own obligations and privacy practices.

1. Information we collect

Everyone with an account

  • Account and profile: your name, email address, phone number (if you add one), profile photo (if you add one), language and time zone.
  • Sign-in: if you sign in with email, a password hash (never the password itself) or one-time codes we send you; if you sign in with Google or Apple, a unique identifier for that account and the email address it shares (with Apple, this may be a private relay address).
  • Sessions and devices: when and how you signed in, IP address, browser or app version, device model and operating system, and a push notification token if you allow notifications.
  • Agreements: which version of our Terms of Use and this Privacy Policy you accepted, and when.
  • Messages: what you send and receive in the Service's messaging between Planners, Partners and Drivers, including attachments.
  • Support: what you send us when you contact support, and our replies.

Planners

  • Events: the event's name, type, dates and any notes you add.
  • Your contact details for the event (name, phone and email).
  • Responsible party: the name, phone number and email address of someone else to coordinate with, if you add one.
  • Day-by-day plan: for each day, the rides (pickup and drop-off addresses, date and time, number of passengers, vehicle type, hourly service and any notes) and the places you add (restaurants, hotels, venues and activities).
  • Plan with AI: the free-text description you type to have an itinerary drafted, and the draft that comes back (see section 5).
  • Quotes and bookings: the quotes you receive, which you accept, and the ride's status and history.
  • Payments: payments are handled by Stripe (see section 6). We receive limited details from Stripe, such as the card brand, last four digits and expiry, the amount, and whether a payment or refund succeeded. We never receive or store your full card number.

Responsible parties and guests

If a Planner adds you to a plan, we receive what they enter, usually your name, phone number and email address, and sometimes passenger names or notes. Planners must have your permission, or another lawful reason, to give us these details. If you have questions, contact the Planner or write to privacy@cafy.ai.

Partners

  • Business details: your company's legal and trading name, address, contact people, phone and email, service area, and fleet and vehicle details.
  • Vetting information: the licences, permits, insurance documents and other information we ask for to check that you can lawfully carry passengers.
  • Quotes and rides: the quotes you send, the rides you accept, the Drivers and vehicles you assign, and ride status updates.
  • Payouts: to receive payouts you onboard with Stripe Connect. Stripe collects your identity, business and bank account details directly, under its own terms and privacy policy. We receive your Stripe account's status (for example whether payouts are enabled and anything Stripe still needs), payout amounts and dates, and limited account details such as the last four digits of the bank account.

Drivers

  • Driver details a Partner enters or you add yourself: your name, phone number and photo (if added), and the vehicle you're driving (make, model, colour and licence plate).
  • Ride status: the updates you make during a ride (en route, arrived, passengers on board, completed) and when you made them.
  • Location: [TO CONFIRM: whether the partner app uses a driver's device location during an active ride (for example to set "en route" or "arrived", or to show the vehicle's position to the planner), whether it runs in the background, and that it stops when the ride is completed]

Collected automatically

  • Logs: IP address, browser or app, the requests made to our servers and error reports, used to run and secure the Service.
  • Cookies and browser storage: only what's strictly necessary to sign you in to our web apps. See our Cookie Policy.

We don't collect Planners' precise device location, we don't use advertising identifiers, and we don't ask for sensitive information such as health data. Please don't put sensitive information (for example health or accessibility details) in notes unless it's needed for the ride; if you do, it will be shared with the Partner and Driver who carry out that ride.

2. Where information comes from

  • You: when you sign up, plan an event, quote for or carry out a ride, send a message, pay or contact us.
  • Planners: details of responsible parties, guests and passengers.
  • Partners: details of the Drivers and vehicles they assign.
  • Stripe: payment and payout status, as described above.
  • Google and Apple: if you choose to sign in with one of them, your name (Apple only the first time), email address and a unique account identifier. We never receive your password for those services.
  • Public and third-party sources: when vetting Partners, we may check public registers of licensed carriers and insurers.

3. How we use information and our legal bases

Where the GDPR or UK GDPR applies, we rely on the legal bases below.

What we do Legal basis
Create your account, sign you in and keep you signed in Contract with you
Let Planners build and edit event plans, and draft plans with AI when asked Contract with you
Send a plan's ride details to suitable Partners, collect quotes and confirm bookings Contract with you
Let Partners assign Drivers, and keep Planners, Partners and Drivers updated on ride status Contract; legitimate interests (making sure rides happen as planned)
Process payments, refunds and Partner payouts through Stripe Contract; legal obligation (tax and accounting records)
Vet Partners and keep the marketplace safe: checking licences and insurance, preventing fraud, investigating complaints and abuse Legitimate interests (a safe, trustworthy marketplace); legal obligation where it applies
Use responsible-party and guest details to coordinate the rides they're part of Legitimate interests of the Planner and of us (running the event they're part of)
Deliver messages, push notifications and emails about your events, quotes and rides Contract; legitimate interests
Send security and service messages Contract; legitimate interests
Provide support and resolve disputes between Planners and Partners Contract; legitimate interests
Record which version of our Terms and Privacy Policy you accepted Legal obligation; legitimate interests (proving what was agreed)
Understand and improve the Service, using aggregated or de-identified information where we can Legitimate interests
Send product news, where we do Consent where the law requires it; you can unsubscribe at any time
Meet legal obligations and respond to lawful requests Legal obligation

We don't use your information for advertising and we don't sell it. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. What Partners and Drivers see, and what Planners see

When you send a request as a Planner, the Partners we send it to see what they need to quote: the event's dates, the rides (pickup and drop-off, times, passengers, vehicle type, hourly service, notes) and your name. When you accept a Partner's quote, that Partner (and the Driver it assigns) also sees your contact details and, if you added one, the responsible party's, so they can coordinate the ride. Partners don't see the rest of your plan (such as the restaurants or hotels you've added) unless it's part of a ride.

When a Partner is booked, the Planner sees the Partner's business name and contact details, and the assigned Driver's name, phone number, vehicle and licence plate, and the ride's status.

Partners are independent businesses. Once they receive your details, they're responsible for how they use them, under the law and their agreement with us, which limits them to using the details to quote for and carry out your rides.

5. Plan with AI

"Plan with AI" drafts an itinerary from a description you type. When you use it, we send that description (and the event details the feature needs, such as dates and destinations) to our AI provider ([TO CONFIRM: AI provider(s) used for Plan with AI, e.g. Anthropic or OpenAI]) to produce the draft.

  • We use the provider's business API, under terms that don't let it train its models on what we send.
  • The provider may keep inputs and outputs for a limited time to detect abuse, as set out in its API terms.
  • We don't use your descriptions or plans to train AI models.
  • Don't include information about other people that they wouldn't expect to be shared, or sensitive information, in your description.
  • An AI draft is a suggestion. Check it before you rely on it or send any ride for quotes.

6. How we share information

We don't sell personal information, and we don't share it for cross-context behavioral advertising. We share it only:

  • With Partners and Drivers, as described in section 4, so they can quote for and carry out rides.
  • Between Planners and Partners through messaging and booking details, as described in section 4.
  • With Stripe, which processes payments for Planners and onboards and pays out Partners through Stripe Connect. Stripe acts under its own privacy policy for the information it collects directly.
  • With service providers that process information for us under contract and only on our instructions:
    • cloud hosting, databases and file storage ([TO CONFIRM: hosting provider and region, e.g. Google Cloud us-central1, Iowa]);
    • AI processing for Plan with AI ([TO CONFIRM: AI provider(s) used for Plan with AI, e.g. Anthropic or OpenAI]);
    • email delivery ([TO CONFIRM: email delivery provider]);
    • text messages ([TO CONFIRM: whether we send text messages and, if so, the SMS provider]);
    • push notifications ([TO CONFIRM: push provider, e.g. Google Firebase Cloud Messaging and Apple Push Notification service]);
    • maps and address search ([TO CONFIRM: maps / address search provider, e.g. Google Maps Platform]);
    • error monitoring and customer support tools.
  • With sign-in providers you choose: Google or Apple, when you sign in with them, and Apple when you delete your account, so it can disconnect Cafy from your Apple account.
  • When the law requires it, or to protect the rights, safety and security of our users, passengers, the public or us (for example, in connection with an incident during a ride).
  • In a business transfer, such as a merger or acquisition, where this policy keeps applying to your information.

7. Push notifications, email and text messages

  • Push notifications tell you about new quotes, bookings, messages and ride status (for Partners and Drivers, new requests and assigned rides). You can turn them off in the app or in your device settings.
  • Email is used for sign-in, booking confirmations, receipts and important updates about your events or rides. Security and transaction messages can't be turned off while you have an account.
  • Text messages, where we send them, carry sign-in codes or time-sensitive ride updates. Reply STOP to opt out.

8. Where information is stored and international transfers

The Service is hosted in the United States ([TO CONFIRM: hosting provider and region, e.g. Google Cloud us-central1, Iowa]). Our service providers, and the Partners who carry out your rides, may process information in other countries, including the country where your event takes place.

If you're in the European Economic Area, the United Kingdom or Switzerland, your information is transferred to the United States and, where your event is elsewhere, to the Partners there. We protect transfers to our service providers with the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and equivalent safeguards, together with the security measures in section 10. Transfers to a Partner are necessary to carry out the rides you've asked for. [TO CONFIRM: whether Clevers LLC self-certifies under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions); if so, say so here, otherwise remove] You can ask us for a copy of the safeguards at privacy@cafy.ai.

9. How long we keep information

We keep personal information only as long as we need it. In particular:

Information How long
Your account and profile While your account exists
Sessions and devices Until you sign out, the session expires ([30 days]) or you delete your account
Events, plans, responsible-party and guest details, quotes and rides [TO CONFIRM: how long events, plans and ride details are kept after the event, e.g. while the account exists]
Messages [TO CONFIRM: how long in-app messages are kept]
Booking, payment, refund and payout records [TO CONFIRM: how long booking, payment and payout records are kept, e.g. 7 years for tax and accounting]
Driver location (if collected) [TO CONFIRM: how long driver location data is kept, if collected]
Partner vetting information While the Partner is active on Cafy, then as long as needed to handle claims about rides it carried out
Records of the Terms and Privacy Policy you accepted As long as we need to show what was agreed
Support messages [TO CONFIRM: support message retention period]
Server logs [TO CONFIRM: server and load balancer log retention period]
Backups Deleted information may remain in a backup until it's overwritten. We don't restore deleted personal information from backups except to recover from an incident

When you delete your account

You can delete your account in the app's settings, or by writing to privacy@cafy.ai from the email address on your account. Deletion is final. We sign you out everywhere and delete or anonymize your personal information, except what we must keep for the reasons below. Copies already given to a Partner for a booked ride are held by that Partner under its own obligations.

We may keep information longer where the law requires it (for example tax and accounting records of payments), or to resolve a dispute, handle an insurance or safety claim, or investigate abuse.

10. Security

We protect information with measures that include encryption in transit (HTTPS) and at rest, hashed passwords and one-time codes, rate limits on sign-in, access to production data limited to staff who need it, and logs of sensitive actions. Card and bank details are handled by Stripe and never stored on our servers.

No system is perfectly secure. If we learn of a breach that affects your information, we'll notify you and the authorities as the law requires.

11. Your rights and choices

In the Service you can see and correct your profile, edit or delete your events and the people you've added to them, choose notifications, and delete your account.

By email: for anything else, including a copy of your information in a portable format, write to privacy@cafy.ai from the email address on your account. Responsible parties, guests and Drivers who don't have an account can write to the same address.

Depending on where you live, you may have the right to access, correct, delete or export your personal information; to object to or restrict how we use it; to withdraw consent at any time (this doesn't affect what we did before); and to complain to your data protection authority. In the EEA and UK you can find yours on the EDPB or ICO website.

We'll answer within the time the law sets (usually one month, or 45 days in California) and may need to confirm your identity first. We won't discriminate against you for using your rights. Where a Partner holds your details for a ride, we'll tell you how to contact that Partner, or pass your request on.

12. California and other US states

This section applies to residents of California and other US states with similar privacy laws.

  • What we collect: identifiers (name, email, phone, IP address, account and device IDs); customer records (account details and limited payment details); commercial information (events, quotes, bookings and payments); internet activity (sessions and use of the Service); geolocation (addresses in ride plans and, if collected, Drivers' location during rides); audio, electronic or visual information (a profile photo you upload, messages); professional information (for Partners, business and licensing details). Sensitive information is limited to sign-in credentials and, for Drivers, location during rides if collected, used only to provide the Service.
  • Sources, purposes and retention: as described in sections 2, 3 and 9.
  • Disclosures: we disclose these categories for business purposes to the service providers in section 6, and to Partners and Planners as needed to arrange and carry out rides.
  • No selling or sharing: we don't sell personal information or share it for cross-context behavioral advertising, and haven't in the past 12 months. We don't knowingly sell or share the information of anyone under 16.
  • Your rights: to know and access, correct and delete your information, and not to be discriminated against for using these rights. Because we don't sell or share personal information, or use sensitive information beyond what's needed to provide the Service, there is nothing to opt out of or limit. To use your rights, email privacy@cafy.ai. An authorized agent can act for you if you confirm you've authorized them.

13. Children

You must be [18] or over to create an account. Children can be passengers on rides booked by an adult, and a Planner may enter a child's name as a passenger; the Planner is responsible for doing so only where needed and with the parent's or guardian's permission. We don't knowingly collect other personal information from children. If you believe a child has given us information, contact privacy@cafy.ai and we'll delete it.

14. Changes to this policy

We'll post changes on this page and update the date at the top. If a change is material, we'll tell you in the Service or by email before it takes effect, and, where the law requires, ask you to accept the new version.

15. Contact

Clevers LLC, [company postal address]

  • Privacy questions and requests: privacy@cafy.ai
  • Data protection officer: [name or role of the data protection officer, or "not appointed"; reachable at privacy@cafy.ai]
  • EU representative: [EU representative under GDPR Article 27, if required]
  • UK representative: [UK representative under UK GDPR Article 27, if required]
  • Everything else: support@cafy.ai