Privacy Policy

DraVan Technologies SARL-S ("we", "us", "our") operates PulUp, an event creation and sharing platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

By using PulUp, you consent to the data practices described in this policy.

2.1 Account Information

You sign in with Google or with an email magic link. We do not use or store passwords. When you create an account, we collect:

• Email address (required for authentication and contact)
• Display name or nickname (if provided)
• Profile avatar image
• Optional profile details you choose to add (bio, language and timezone preferences)
• Account creation date and authentication tokens

When you sign in with Google, Google provides us with your Google account identifier, name and profile picture. We process this data to create and operate your account.

2.2 Event Information

When you create or interact with events, we collect:

• Event details (title, date, location, description, theme)
• Event settings (capacity, cost, dress code, public/private status)
• Optional links (playlist URLs, external links)
• Event participation data (RSVPs, attendance)

2.3 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent on the platform
• Device Information: Browser type, operating system, IP address
• Cookies: A single essential cookie for authentication and session management. Our analytics (Umami) is cookieless, so we do not use analytics or tracking cookies.

2.4 Content and Media

When you use PulUp, we store the content you create:

• Avatars and event gallery photos you upload (stored on Cloudflare R2)
• Comments you post on events
• Direct messages you send to other users

2.5 Payment and Order Information

When you purchase a subscription or an event pass:

• Payments are processed by Stripe. We store your Stripe customer ID, subscription ID, and payment status — your full card details never reach our servers.

We process your personal data based on the following legal grounds:

• Performance of Contract: To provide PulUp's event creation and sharing services
• Legitimate Interests: To improve our services, prevent fraud, and ensure platform security
• Consent: For analytics and marketing communications (where applicable)
• Legal Obligations: To comply with applicable laws and regulations

Specifically, we use your data to:

• Create and manage your account
• Enable you to create, share, and manage events
• Facilitate event RSVPs and participant communication
• Send service-related notifications (e.g., event reminders, account updates)
• Improve platform performance and user experience
• Prevent abuse, fraud, and security incidents
• Analyze usage patterns to enhance features (anonymized data)

We do not sell your personal data. We share data only in the following circumstances:

4.1 Service Providers

We use the following processors to operate PulUp. Each acts on our behalf under a data processing agreement:

• Google: Sign-in via Google OAuth (authentication).
• Cloudflare R2: Storage of avatars and event gallery photos.
• Stripe: Payment processing and fraud prevention for subscriptions and event passes.
• Resend: Delivery of transactional emails (magic links, payment and order confirmations).
• Google Gemini: Optional AI generation of event cover images, using the event details you provide.
• Klipy: GIF and sticker search.
• OMDb: Movie metadata lookup for movie-night events.
• Umami: Privacy-first, cookieless website analytics. It sets no cookies and collects no personal data or cross-site tracking identifiers.

4.2 Event Participants

• When you create or join an event, your display name and participation status may be visible to other event participants
• Public events are visible to anyone with the event link

4.3 Legal Requirements

We may disclose your information if required by law, court order, or government regulation, or to protect our rights and safety.

We retain your personal data only as long as necessary for the purposes outlined in this policy:

• Active Accounts: Data is retained while your account is active
• Deleted Accounts: When you delete your account, your profile and related data are removed promptly; residual copies in backups are purged within 30 days, except where we have a legal obligation to retain them
• Event Data: Events you create remain accessible until you delete them or delete your account
• Gallery Photos: Event gallery photos are automatically deleted after the event ends, based on the event tier — 7 days (free), 30 days (event pass), or retained while your account is active (Pro)
• Payment Records: Invoices and transaction records are retained for the period required by Luxembourg accounting and tax law (currently 10 years)

As a user in the European Union, you have the following rights:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data
• Right to Restriction: Limit how we process your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for data processing at any time (where processing is based on consent)
• Right to Lodge a Complaint: File a complaint with your local data protection authority

To exercise any of these rights, please contact us at privacy@pulup.lu. We will respond within 30 days. You can also delete your account at any time from your account settings.

We implement industry-standard security measures to protect your data:

• Encrypted data transmission (HTTPS/TLS)
• Passwordless authentication via Google OAuth or email magic links
• Card payments handled entirely by Stripe, a PCI-DSS compliant payment provider
• Regular security audits and updates
• Access controls and authentication mechanisms

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

We use a single essential cookie:

• Essential Cookie: Required for authentication and session management. This cannot be disabled.

We use privacy-first, cookieless analytics (Umami) that sets no cookies and collects no personal data. You can manage cookies through your browser settings, but disabling the essential cookie will prevent you from logging in.

For detailed information about cookies we use, including technical specifications and legal basis, please see our Cookie Policy.

Some of our processors (including Stripe, Resend, Google, Cloudflare, and Umami) may process your data outside the European Economic Area, including in the United States. Where this happens, the transfer is protected by appropriate safeguards — such as Standard Contractual Clauses, the EU-U.S. Data Privacy Framework, or an adequacy decision — in accordance with GDPR requirements.

PulUp is not intended for users under 16 years of age. We do not knowingly collect personal data from children. If we discover that we have collected data from a child without parental consent, we will delete it immediately.

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the updated policy on this page
• Updating the "Last updated" date
• Sending an email notification (for material changes)

Your continued use of PulUp after changes constitutes acceptance of the updated policy.

If you have questions, concerns, or wish to exercise your data protection rights, please contact us:

For GDPR-related complaints, you may also contact the Luxembourg National Commission for Data Protection (CNPD).