01
Who we are and how to reach us
PartiStack, Inc. operates the PartiStack online marketplace, which connects customers planning events with independent local vendors who rent party and event equipment such as tents, tables, chairs, inflatables, audiovisual gear, and décor, and who provide event services such as DJs, catering, and photography. PartiStack is a neutral technology platform and payment facilitator; the vendors are independent businesses and are not employees or agents of PartiStack. This policy applies to our website, apps, and related services. You can reach our privacy team at PartiStack, Inc., 928 North Scott Avenue, Montebello, CA 90640, USA, by email at hello@partistack.com, by phone at +1 562 291 8287, or through the contact page on our site.
02
Categories of personal information we collect
Depending on how you use PartiStack, we collect the following categories of personal information: identifiers such as your name, email address, phone number, account role, and username; account and profile details, and for vendors, business name, business details, listings, and photos; commercial information such as bookings, items rented or services requested, event date, delivery and event location, order history, and reviews; financial and payment metadata such as billing details, payout details, and transaction records (full payment card numbers are handled by our payment processor and are not intentionally stored by us); communications such as messages between customers and vendors, support tickets, and correspondence with us; internet and network activity such as IP address, device and browser information, log data, pages viewed, referral information, and cookie and usage data; approximate location inferred from your IP address and the delivery or event address you provide; and inferences we may draw to operate and improve the marketplace. We do not intentionally collect sensitive personal information, and we do not knowingly collect personal information from children.
03
Sources of the information we collect
We collect personal information directly from you when you create an account, build a listing, request or place a booking, send messages, submit reviews, or contact support. We collect information automatically from your device and browser through cookies and similar technologies when you use our site. We also receive information from third parties, including our payment processor Stripe when you pay or receive a payout, and from Google when you choose to sign in using Google OAuth. When a booking or inquiry involves another user, a customer and a vendor will exchange information with each other through the platform, so a vendor may receive booking information originating from a customer and vice versa.
04
How and why we use your information
We use personal information to create and manage accounts and vendor profiles; to power search, listings, and the booking flow; to connect customers with the independent vendors who fulfill orders; to process payments, platform service fees, and vendor payouts through Stripe; to coordinate event dates, delivery, and setup; to send transactional and service messages such as booking confirmations and receipts; to provide customer and vendor support; to display and moderate reviews; to detect, prevent, and investigate fraud, abuse, and security incidents; to enforce our Terms of Service and Vendor Agreement; to improve, secure, and develop the marketplace; and to comply with legal, tax, accounting, and dispute-resolution obligations. Where our processing is subject to GDPR or UK GDPR, our legal bases are performance of a contract with you, our legitimate interests in operating and protecting a safe marketplace, compliance with legal obligations, and your consent where required, such as for certain cookies.
05
Service providers and subprocessors
We share personal information with vetted service providers who process it on our behalf under contract and only for the purposes we specify. These include Stripe, which processes payments and operates vendor payouts through Stripe Connect and receives payment and identity information necessary for those functions; Supabase, which hosts our Postgres database, authentication, and file storage and therefore stores account, listing, booking, and message data; Vercel, which provides hosting and content delivery and processes request and log data; Resend, which sends our transactional emails and receives recipient email addresses and message content; Upstash Redis, which supports rate limiting and receives limited request metadata such as IP address; and Google, which provides OAuth sign-in when you choose it. We may add Cloudflare Turnstile for bot protection in the future, in which case it would receive limited device and interaction signals to distinguish humans from bots. We do not authorize these providers to use your information for their own independent marketing.
06
Sharing between customers and vendors
PartiStack is a marketplace, so completing a booking or inquiry requires sharing certain information between the customer and the relevant independent vendor. When a booking, inquiry, or message involves a vendor, we share the relevant customer, event, delivery, booking, and contact details that the vendor needs to prepare, deliver, and fulfill the order, and we share vendor and listing details with the customer. Because vendors are independent businesses, once they receive this information each vendor acts as an independent controller of the personal information it receives and is responsible for handling that information in accordance with applicable law and its own privacy practices. Vendors are contractually required to use the information only to fulfill marketplace transactions and to meet their legal obligations, but PartiStack does not control a vendor's independent use of information after it is shared. If you have concerns about a specific vendor's data practices, you may contact us and we can help direct your request.
07
Cookies, analytics, and tracking technologies
We use cookies and similar technologies to keep you signed in, remember preferences, secure the platform, prevent fraud, measure how the site is used, and improve performance. Some cookies are strictly necessary for the site to function, while others are used for analytics and product measurement. You can control cookies through your browser settings, though disabling some cookies may affect how the site works. Where required by law, we obtain consent before setting non-essential cookies, and we honor recognized browser-based opt-out preference signals as described below.
08
How we share information more broadly
Beyond service providers and the customer-vendor sharing described above, we may disclose personal information when required by law, subpoena, court order, or other legal process; to tax and payment authorities or to satisfy tax, payment-network, and accounting rules; to resolve disputes and enforce our agreements; to detect, prevent, or respond to fraud, security, or technical issues; and to protect the rights, property, and safety of PartiStack, our users, vendors, and the public. We may also share aggregated or de-identified information that cannot reasonably be used to identify you.
09
We do not sell your personal information for money
PartiStack does not sell your personal information for money. Under California law, certain routine data sharing, such as sharing with analytics or advertising-related partners, can be considered a sale or a sharing for cross-context behavioral advertising even when no money changes hands. To the extent any of our current or future analytics or cookie practices are treated as a sale or share under the CCPA as amended by the CPRA, you have the right to opt out, and we provide the controls described in the next two sections. We do not knowingly sell or share the personal information of consumers we know to be under 16 years of age.
10
Do Not Sell or Share and Global Privacy Control
You can direct us not to sell or share your personal information for cross-context behavioral advertising by emailing hello@partistack.com or using our contact page, or by using any Do Not Sell or Share My Personal Information link we make available on our site. We also recognize the Global Privacy Control (GPC) and similar browser-based opt-out preference signals; when we detect a GPC signal from your browser, we treat it as a valid request to opt out of any sale or sharing for that browser or device. Because an opt-out preference signal is tied to a specific browser or device rather than to your account, you may need to enable it on each browser and device you use.
11
Your California privacy rights
If you are a California resident, the CCPA as amended by the CPRA gives you the right to know and access the personal information we have collected about you, including its categories, sources, purposes, and the categories of parties with whom we share it; the right to request deletion of your personal information; the right to correct inaccurate personal information; the right to opt out of any sale or sharing of your personal information; and the right not to receive discriminatory treatment for exercising your rights, meaning we will not deny you service, charge different prices, or provide a different level of quality because you exercised a privacy right. We will not retaliate against you for exercising any of these rights.
12
How to exercise your privacy rights
To exercise your rights to know, access, delete, or correct, email us at hello@partistack.com or submit a request through our contact page, and account holders can also update much of their information directly from the account dashboard. We will verify your identity before fulfilling a request, typically by confirming information associated with your account, and we will respond within the timeframes required by law. You may use an authorized agent to submit a request on your behalf; we may require the agent to provide proof of authorization and may still ask you to verify your own identity or confirm that you authorized the request. There is no charge to submit a request unless it is excessive or repetitive as permitted by law. Some information may be retained where an exception applies, such as for security, fraud prevention, accounting, dispute handling, or legal compliance.
13
Data retention
We keep personal information for as long as needed for the purposes described in this policy, including operating your account, providing the marketplace, and completing bookings, and thereafter as needed to meet our legal, tax, accounting, and dispute-resolution obligations, to enforce our agreements, and to prevent fraud and abuse. Retention periods vary by the type of information and the reason we hold it; for example, transaction and payout records are generally kept longer to satisfy financial and tax requirements. When information is no longer needed, we delete, anonymize, or de-identify it using reasonable measures.
14
How we protect your information
We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit, access controls, and reliance on established infrastructure providers such as Supabase, Vercel, and Stripe. Payment card data is handled by our PCI-compliant payment processor rather than stored by us. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to respond appropriately if a security incident occurs.
15
International users and cross-border transfers
PartiStack is based in the United States and currently serves the Los Angeles and Orange County area, and our infrastructure and service providers are located primarily in the United States. If you access PartiStack from outside the United States, including from the EU or UK, your information will be transferred to and processed in the United States, which may have different data-protection laws than your home country. Where required, we rely on appropriate safeguards for such transfers. If you are in the EU or UK, you may have additional rights under the GDPR or UK GDPR, such as rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your local data-protection authority; you can exercise these rights by contacting us using the details in this policy.
16
Children's privacy
PartiStack is intended for adults and is not directed to children. We do not knowingly collect personal information from children under 13, and our services are not intended for anyone under the age of majority in their jurisdiction who cannot enter into a binding contract. If you believe a child has provided us with personal information, please contact us at hello@partistack.com and we will take appropriate steps to delete it.
17
Business transfers
If PartiStack is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, personal information may be transferred as part of that transaction, subject to the confidentiality protections customary for such deals. We will take reasonable steps to ensure that any successor honors this policy or provides notice and choices consistent with applicable law before your information becomes subject to a materially different privacy policy.
18
Changes to this policy
We may update this policy from time to time as our marketplace, technology, or legal obligations change. When we make changes, we will post the updated policy on this page and revise the date at the top. If the changes are material, we will provide additional notice as required by law, such as by email or an in-product notice. Your continued use of PartiStack after an update takes effect means you have reviewed the current policy, so we encourage you to review it periodically.