What we keep, what we don't.

• When you reserve a spot — your name, email, the number of seats, and any optional note you write for the host.
• When you join the waitlist — your name, email, and the city you're in.
• When you sign up to host — the basic info you provide on your profile (name, city, neighbourhood, a short bio, what you host, optional Instagram, optional payout details), plus the email address tied to your Google sign-in.
• Standard server logs — your IP address and browser type appear briefly in our hosting provider's logs, the way they do on every website. We don't mine these.
• Auth cookies — if you sign in as a host, a short-lived session cookie keeps you signed in. We don't set tracking or advertising cookies.

• No analytics or tracking pixels.
• No advertising profiles.
• No data from third-party services about you.
• No payment information. You pay the host directly by bank transfer using the details in their event listing, so no card or account details ever touch Pax.

We use a small number of service providers ("processors") to run Pax. Each sees your data only to do its job and is bound by its own data-processing terms. Where a provider stores data outside the EU, that transfer relies on the EU's Standard Contractual Clauses (SCCs) in the provider's data-processing agreement.

• Supabase — our database and sign-in. Stores your reservation, waitlist, and host-profile data. Hosted in the EU (Frankfurt).
• Vercel — hosts and serves the website. Processes your IP address and request metadata in standard server logs to deliver pages. US-based; transfers covered by SCCs.
• Resend — sends our emails (verification, confirmations, reminders, host messages). Processes your email address, the subject line, and delivery logs. US-based; transfers covered by SCCs.
• Google — only if you sign in as a host with Google. Google authenticates you and shares your name and email with us; your use of Google is governed by Google's own privacy policy.

Pax Social (Private) Limited is based in Pakistan; our team may access your data there to operate the service, under the same safeguards.

We use only strictly necessary cookies, and only for signed-in hosts: a short-lived session cookie (set by Supabase) keeps you logged in, plus a brief technical cookie during the sign-in handshake. That's it.

We set no analytics, advertising, or tracking cookies, and we use no third-party analytics or pixels. Because the only cookies are essential to a service you asked for (signing in), no cookie-consent banner is required. If you only browse events without signing in, we set no cookies at all.

The host of an event you reserve. They receive your name, email, party size, and any note you wrote, so they can prepare the room and reach you about the address.

Nobody else. We don't sell or trade your data, and we don't share it with advertisers.

You can ask us to:

• Show you what we have on you.
• Correct anything that's wrong.
• Delete your data — including all your reservations, waitlist entry, or host account. Reservations linked to past events stay with the host's records for their own bookkeeping.
• Cancel a reservation any time via the link in your email.

Reach us at hello@pax-social.com and we'll handle it within a week. Account and data deletion is currently handled by us on request at this address; a self-service delete option is on the way.

If you're in the EU, you have rights under the GDPR — access, correction, erasure, portability, and objection — and the same email reaches us. You also have the right to lodge a complaint with your local data-protection supervisory authority.

We'll update the date at the top whenever we change anything material. If we make a change that affects you directly — like new categories of data, or new services we hand data to — we'll also email you.

Anything else, please write to hello@pax-social.com. A human reads every message.