This Privacy Policy explains how I Will Be There ("IWBT", "the service", "we", "our", "us") collects, uses, and protects your personal data when you use iwillbethere.app. We comply with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), the UK Data Protection Act 2018, and the UK Privacy and Electronic Communications Regulations (PECR).
For the purposes of UK GDPR and EU GDPR, the data controller is:
We collect only the data needed to operate the matchmaking and event-networking service.
For each event you join, we collect what you choose to enter into your event profile:
If you create or manage corporate events, we additionally collect:
We do not collect: bank or payment card details directly (Stripe handles those if/when you make a purchase), government identifiers, or marketing-tracking pixels.
Under UK GDPR Article 6, every processing activity needs a lawful basis. Ours are:
| Purpose | Lawful basis |
|---|---|
| Running your account (sign-in, profile, password reset) | Contract (Art. 6(1)(b)) |
| Showing your profile to other attendees at events you've joined | Contract |
| Sending you transactional emails (meeting requests, confirmations, cancellations) | Contract |
| Logging IP addresses for security/abuse purposes | Legitimate interest (Art. 6(1)(f)) |
| Retaining cancelled-meeting records for dispute resolution | Legitimate interest |
| Responding to subject access / deletion requests | Legal obligation (Art. 6(1)(c)) |
We do not currently process any data based on consent — meaning we don't run analytics, marketing tracking, or send marketing emails. If we ever introduce such processing, we will ask for your consent first.
We use Cloudflare D1 (a serverless SQL database) for storing account, event, and meeting data. Our D1 database is configured with the eu jurisdiction setting at Cloudflare, which contractually guarantees that data is stored and processed within the European Union.
Cloudflare:
We use Resend (Resend Inc., USA) to deliver transactional emails (meeting requests, confirmations, cancellations). When we send you an email, your email address and the message content are processed by Resend.
Resend:
We have signed Resend's standard Data Processing Agreement.
| Processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, D1 database, Pages | EU jurisdiction | EU residency + DPF for any incidental transfers |
| Resend, Inc. | Transactional email delivery | United States | DPF + SCCs |
We will update this list within 14 days of any change. Material changes will be reflected in a published version of this Privacy Policy with the "Last updated" date refreshed.
We retain data only as long as needed.
| Data | Retention period |
|---|---|
| Active accounts | Until you delete the account |
| Inactive accounts (no sign-in for 36 months) | Automatically deleted |
| Cancelled meeting records | 12 months from cancellation date, then deleted |
| Event records (organiser data) | 24 months after the event end date, then deleted |
| Audit and security logs | 24 months, then deleted |
| Database backups | 30 days rolling — older backups overwritten |
| Email delivery logs (held by Resend) | Per Resend's retention — typically 30 days |
When you delete your account, we erase your data from our primary database immediately. Backups continue to exist for up to 30 days before they roll off; we will not restore your data from backup once you've deleted it.
You have the following rights regarding your personal data. To exercise any of them, email [email protected]. We respond within one calendar month.
Request a copy of all personal data we hold about you. We provide this through the "Download my data" button on your account profile — instant download as a JSON file. No need to wait or pay.
Correct any inaccurate data about you. Most data is editable directly in the app (your profile, your availability). For anything that isn't user-editable, email us.
Delete your account through the "Delete my account" button on your account profile. The deletion is immediate from our primary database. Backups roll off within 30 days.
How erasure works in practice. When you delete your account, we hard-delete: your account row, sessions, authentication tokens, password reset tokens, notification view records, personal events you own with no other attendees, and personal event admin grants.
To preserve other users' record of meetings you participated in, your per-event attendee profile rows are anonymised in place (your name becomes "Deleted user", email and pitch are tombstoned) rather than deleted entirely. This is necessary because their booking records depend on yours; deleting them would silently corrupt the other party's history. Once anonymised, those rows no longer identify you and are no longer personal data under UK GDPR (Article 4 and Recital 26).
Bookings you participated in are marked as cancelled with reason "Account deleted by user" — the other party sees the cancellation rather than the meeting vanishing.
Ask us to pause processing your data while we resolve a dispute about its accuracy or use. Email [email protected].
The "Download my data" export is provided in JSON, a structured machine-readable format suitable for transferring to another service.
Object to processing based on legitimate interest. Email [email protected]. We don't currently process any data for direct marketing.
We don't make any automated decisions that have a legal or similarly significant effect on you. The "Find your synergies" feature ranks fellow attendees by compatibility for your information; it does not exclude anyone, restrict anyone's access, or make any decision about anyone.
If you believe we have not handled your data correctly, complain to the supervisory authority in your country.
UK residents:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
EU residents: Complain to your local DPA. List at edpb.europa.eu.
If we ever experience a data breach that is likely to affect your rights and freedoms, we will:
IWBT is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has signed up, email [email protected] and we will delete their data.
If you are located outside the United Kingdom or the European Economic Area, you understand that your data will be transferred to and processed in the EU (Cloudflare D1 with eu jurisdiction) and to the United States (Resend sub-processing under DPF). By using the service, you consent to that transfer.
When we change this Privacy Policy:
Minor non-material changes (typos, clarifying language) may be made without notice.
If anything in this policy is unclear, or you want to exercise a right, please email:
We aim to respond to all data subject requests within one calendar month, often sooner.