Privacy Policy

Gather is operated by Liquid Mash. For staff accounts we act as the responsible party. For guest content inside an event, the event's organiser is the responsible party and we act as their operator (processor). South African users are additionally protected under POPIA — see our POPIA statement.

• Staff: name, email address, organisation membership and role, sign-in and audit activity.
• Guests: display name you provide, email address where an invitation is sent to you, RSVP response, photos you upload, and session identifiers.
• Content: photos and event media, with technical metadata needed to process them.
• Technical: IP addresses and device/browser metadata in server logs, and short-lived session tokens kept in your browser's session storage.

We do not use advertising trackers or sell personal information.

• Provide the service: event galleries, uploads, RSVP, moderation and notifications.
• Send transactional email (invitations, staff onboarding) via our email provider.
• Security: access control, audit logging, abuse prevention.
• Legal obligations and defending legal claims.

Originals and derived images live in private, encrypted storage with public access blocked. They are served only through short-lived signed URLs to authorised viewers of that event. Object versioning protects against accidental loss, and deletion is performed under controlled processes.

• Amazon Web Services (hosting, storage, email dispatch) — data is hosted in the af-south-1 (Cape Town) region.
• Resend — transactional email delivery.
• The organiser and guests of your event see the content and RSVP information you contribute to that event.

We do not sell personal information or share it for third-party marketing.

Event content follows the event's lifecycle and release windows configured by the organiser. Soft-deleted records, audit logs and backups are retained for limited periods needed for security, recovery and legal purposes, then destroyed.

You may request access to, correction of, or deletion of your personal information; object to or restrict processing; and withdraw consent where processing relies on it. Guests can also use the in-event controls (withdraw photo, leave event) and report content. Contact privacy@liquidmash.io. We may need to verify your identity and event membership before acting.

Measures include encryption in transit and at rest, tenant isolation enforced at the database layer, least-privilege roles, multi-factor authentication for staff, signed URLs for private media, audit logging and session revocation.

Updates appear on this page with a new date. Privacy questions and requests: privacy@liquidmash.io.