Privacy policy

Cambleu is provided by Cambleu Technology Limited, a company registered in Nigeria, whose registered address is Enspire Hub, 1st Floor, Merit House, Maitama, Abuja, Nigeria. Cambleu is a product of Foxy Labs Technology. In this notice, “Cambleu”, “we” and “us” mean Cambleu Technology Limited.

This notice describes what Cambleu does with information today and what we plan once more features open. We will update it as features go live. It has been prepared with the Nigeria Data Protection Act 2023 and, where applicable, UK GDPR in mind. It is not legal advice and will be reviewed by a qualified privacy professional.

Today you can browse the website, look at sample event pages that contain made-up content, create an account, sign in, and manage your profile and notification choices. Creating real events, payments, RSVPs, guest uploads, Concierge and the planner programme are not open yet, so we are not collecting information through them.

While Cambleu is not open, creating an account or signing in records your account, asks you to confirm your email address and sends you a thank-you email. We will email you when the service opens.

The information we handle depends on how you use Cambleu. At the moment it includes:

• Account details: your name, your email address, and, if you add them, your phone number, country and preferred currency. If you sign up with an email, we also store your password. We keep it only as a one-way scrambled value that we cannot read back.
• Google sign-in: if you use Google, we receive your name, your verified email address, your Google account identifier and the link to your profile picture. At sign-up we copy that picture onto our own storage. Signing in again later does not fetch or change it. You can connect or disconnect Google in Account, and we keep the email of the Google account you connected for as long as it is connected.
• Your event cover picture: when you create an event you can upload a cover picture. We resize it, remove hidden data such as location details, and store it. If you do not pay for the event, we delete it within about two days. If you do, it is used on your event site and kept with the event.
• Your time zone: when you sign in for the first time, we work out your time zone from your IP address, using the location our network provider (Cloudflare) gives us, so times show correctly for you. We keep only the time zone, not your IP address, and you can change it on your profile.
• Guest replies and memories: when a guest replies to an event we store their name, the phone number or email address they give, whether they are coming, and any note they leave for the hosts. Hosts can also add guests themselves, one by one or from a file they upload. Only the event’s hosts see the phone number, email and note. Before a guest leaves a memory we email them a short code to confirm their email address; the code is kept for 15 minutes. Hosts may choose that only certain guests can leave memories by giving us up to 20 email addresses; we keep these with the event, use them only to check who may share, and delete them with the event or when the host removes them. With the memory we store their name, the email they confirmed (only the event’s hosts see it), how they know the hosts if they say, when they shared it, and what they share: a message, a photo, a voice note or a video, as the hosts allow. A memory is shown to other guests of that event once the host approves it, or at once if the host has chosen that. We resize photos and remove hidden data such as location details. Voice notes and videos are kept as they were sent. A photo in Apple’s HEIC format, or one too large for us to resize straight away, is kept as sent, and not shown to anyone, until we convert it, which removes its hidden data.
• Co-hosts: a host can invite up to three people to help run an event. We store the email address the invitation is sent to, the role chosen and, once accepted, which account accepted it. We send that person one invitation email.
• Faces in photos: when you or a guest choose a photo, your own browser looks for faces in it, so the part of the photo with the faces stays in view on every screen. This happens on your device. We receive and keep only that position, such as 46% across and 28% down, and nothing about the faces themselves. Nobody is recognised or identified.
• A password for your event site: you can ask guests for a password before they see your site. We store the password you choose in encrypted form, so you can see and change it, and keep it with the event. A guest who enters it is remembered for that browser session only.
• Photos you add to your event site: in the site editor you can add your own photos to your event site, such as your main photo, the pictures in your story and your gallery. We resize each one, remove hidden data such as location details, and store it with the event. A photo you replace or remove is deleted once no published version of your site still shows it.
• Your profile picture: if you upload one, we turn it into a square image, remove hidden data such as location details, and store it. A picture can be removed in your account at any time.
• Your choices: which notification emails you want.
• Messages to our team, and the emails we send you (such as your welcome, a link to confirm your email, a password reset link, and a message when the service opens).
• Technical information needed to operate and protect the site: your IP address and browser details when you sign up or log in, the information our human check collects, and security logs. We use these for security checks and to limit repeated attempts.

When those features open, we expect to handle event details supplied by a host (such as names, dates, venues, schedules and privacy settings), Guest RSVP details (a name, a phone number or email address, and a yes or no response), photos, videos, voice recordings and messages that hosts or guests choose to add, and order and payment records such as the item bought, amount, currency and payment status. Payment-card details are intended to be handled by the payment provider and not stored by Cambleu. If you give from an event's Registry, we keep your name, any email, phone number and message you add, and what you said you gave, with that event, so the hosts can thank you; you pay the hosts directly, not through Cambleu. If you use a gift link to pay for an add-on for someone else's event, we keep your name, your email, any note you write and the order record. We use your email to send your receipt, and we show the host your name and note so they know who the gift came from.

We will update this notice, and tell you, before those features start collecting this information.

We use your information to create and run your account, sign you in, send you the emails described above, keep the service secure, prevent misuse, answer questions and meet legal obligations. Once features open, we expect to use information to operate event websites, show event details to invited guests, record RSVPs, display memories, process purchases and provide Concierge services.

Depending on the purpose and the law that applies, we rely on a contract with the account holder, consent, our legitimate interests in running and securing the service, or a legal obligation. Where we rely on consent, you can withdraw it.

Your notification settings include optional emails such as tips and product news. Tips and product news is switched off until you turn it on in your account under Notifications, and you can switch it off again at any time. Other optional emails, such as RSVP and receipt emails once events open, are switched on to start with and you can switch each one off. We send marketing only with your consent. Emails about your account, security, purchases or events are service notices and are not marketing. Every email we send has an Unsubscribe link: you tell us who you are and why, confirm your email with a short code, and our team stops the emails that are not needed for an account or event you are using.

When events open, a host will choose the event details to add, the privacy settings and who receives the event link. If you are a guest, the host is the best person to contact about why your information was added to an event, who can see it and whether it can be removed.

A host may be responsible for deciding why guest information is collected and how it is used. Cambleu expects to process guest information to provide the event service on the host’s instructions. The exact legal roles and agreements between Cambleu and hosts will be reviewed before that feature opens.

Hosts will be able to view and export RSVP replies. A host who exports information is responsible for keeping their copy secure and using it lawfully.

Today the pictures we store are profile pictures, event cover pictures, the photos a host adds to their own event site, and the photos, voice notes and videos guests add to an event’s wall. Event content may later include identifiable people and can reveal sensitive details. Only upload content you are entitled to share. If a person does not want an image or recording displayed, contact the event host or Cambleu to request review.

Hosts must take particular care when sharing information about children and obtain any permission required from a parent or guardian. Children should not create their own account unless the live service’s age rules and applicable law permit it.

Guest photos and messages are looked at by the event’s hosts, who can hide or delete any of them. To ask for something to be removed, contact the host or write to us. We keep the photo itself and a short description of it, and no other file details.

We share only what is needed with service providers that help operate Cambleu. At the moment they are:

• Hostinger, which hosts the website and our server.
• Cloudflare, which provides our domain and network protection, the human check on the sign-up and log-in forms (Turnstile), and the human check on the forms guests use to reply and leave memories, and the storage where profile pictures, cover pictures and the photos on event sites and walls are kept (R2).
• Google, if you choose to sign in with Google. Google’s own privacy notice applies to your Google account.
• Zoho ZeptoMail, which delivers the emails we send you.
• Google Analytics, which tells us how people use Cambleu’s own pages, only if you accept its cookies.

Bachs is the planned payment provider. When payments open, it may process information, including your name, email address and payment details, under its own privacy notice when you use its payment service. We receive a record of each payment (the amount, the currency, the time and a reference) but not your full card details.

When you ask for Concierge help, we save your name, email, phone number, the event, the jobs you choose and your notes, and send them to our support team so we can reply. Nothing is charged when you ask. We agree the work and the price with you first.

Some Concierge support or moderation tasks may use AI-assisted tools. If they are used, event details or content relevant to the task may be processed by the selected provider. Before Concierge opens, we will identify those providers, what information they receive, where they process it, how long they retain it and whether they use it to train models.

Cambleu does not send a host’s guest list to InVyt automatically. Links to InVyt on our website carry a Cambleu referral code so InVyt knows you came from us. If you choose to use InVyt, that is a separate service and its own privacy notice and terms apply.

We may disclose information if required by law, to protect a person’s safety or rights, to investigate misuse, or as part of a business transfer with appropriate safeguards.

Cambleu and its service providers may process information in countries other than the country where you live, because providers such as Cloudflare, Google and Zoho operate internationally. Where the law requires a transfer mechanism or additional protection, we will put it in place. We will publish more detail about hosting locations and safeguards as the service opens.

We keep personal information only for as long as we need it for the reasons in this notice. These are our retention periods:

Children’s images can be removed sooner on request, and we treat those requests as urgent.

We may keep information for longer if the law requires it, or to resolve a dispute or prevent fraud. We will review these periods as events and payments open and update this notice if they change.

Depending on where you live and the law that applies, you may have the right to ask for access to, correction of, deletion of or a copy of your personal information, to object to or restrict some uses, or to withdraw consent. You may also complain to the relevant data protection authority.

You can change most of your details yourself in your account. You can ask for a copy of your data or ask us to delete your account from Account, then Your data. To change your email address or make any other privacy request, email [email protected] from the address on your account. We may need to verify your identity before responding. If information is part of someone else’s event, we may direct you to the host or work with them to handle your request.

We use a small number of cookies and browser storage, all to make the website work:

• A session cookie that keeps you signed in and a security cookie that protects our forms from misuse.
• A small marker cookie that notes this browser was signed in, so we can tell you when your session has expired. It holds nothing personal.
• A “keep me logged in” cookie, only if you choose that option when you log in.
• Cloudflare Turnstile, our human check, runs in your browser on the sign-up and log-in pages and may use browser information to tell people from automated programs, under Cloudflare’s privacy notice.
• Browser storage that remembers your chosen currency, which sample notifications you have read, and your cookie choice.
• Google Analytics cookies (_ga and _ga_ followed by an ID), only if you accept them. See Analytics and advertising below.

We use Google Analytics, a service of Google, to understand how people find and use Cambleu’s own pages (the website, sign-up and your dashboard), so we can improve them. It only runs if you accept it in the cookie banner. Without your consent, nothing is sent to Google.

If you accept, Google Analytics sets cookies that recognise your browser, and Google receives information such as the pages you visit, how you arrived, your device and browser, and your approximate location. We also note a few steps, such as signing up, starting checkout and completing a payment (the order reference, amount and what was bought). We do not send your name, email address or payment details. Google may process this information outside your country under its own safeguards, and we keep it for 14 months.

Google Analytics never runs on the event sites guests visit, on guest pages or on the gift link pages.

You can change your mind at any time with Cookie settings at the bottom of our pages. Saying no stops Google Analytics and removes its cookies from your browser. We do not use advertising cookies.

We use technical and organisational safeguards to protect personal information, including encrypted connections, one-way storage of passwords and a human check on sign-up and log-in. No online service can promise perfect security. If a personal data breach occurs, we will take the steps required by applicable law.

We may update this notice as the service changes. We will publish the current version and update its date. If a change materially affects how existing users’ information is handled, we will provide notice where required.

For privacy questions or requests, email [email protected], which is our privacy contact. For any legal issue, including a complaint about how your information is handled, email [email protected]. You can also call Foxy Labs Technology on +234 708 640 7310, or write to Foxy Labs Technology at Enspire Hub, 1st Floor, Merit House, Maitama, Abuja, Nigeria.