Privacy Policy

Who we are

ListPop is operated by Bunnies Inc. We provide guest-list and access-control tools for venues and events. Our goal is to keep things simple — we collect as little data as possible and never sell or share your information for advertising.

Who is responsible for personal data depends on whose it is. For the people who hold a ListPop account — venue owners, managers, promoters and door staff — we are the controller. For guests, the venue that entered the information is the controller and we are its processor: we hold it on that venue's instructions and never use it for our own purposes. A guest who wants to see, correct or delete what is held should ask the venue; if they come to us, we pass the request on and help the venue answer it.

What we collect

Registered users (venue operators & staff):

• Email address — required to create an account and maintain your session.
• Name and phone number — optional, used only for team communications within the app.

Event guests:

• Name — the only required field when added to a guest list.
• Email, phone, or any other identifier is never required. If a guest voluntarily provides additional details, they are stored solely for the event organiser's reference.
• Guests do not need to create an account to be on a list.

What we don't do

• We do not run analytics or tracking scripts.
• We do not use marketing pixels or cookies.
• We do not serve ads.
• We do not sell, rent, or share personal data with third parties for their own purposes.

Infrastructure & data storage

All data is stored on servers located in Frankfurt, Germany (EU), provided by Supabase, our backend and database provider. Supabase processes data on our behalf and does not use it for any other purpose. No other third-party services have access to your data.

How we use your data

• To authenticate you and keep your session active.
• To provide the core product features (guest lists, check-ins, event management).
• To facilitate team communication if you choose to provide a name or phone number.

That's it. There is no secondary use.

Data retention

Account data is kept for as long as the account is active, and for up to 12 months after it closes where we need it to meet a legal or accounting obligation.

Guest data is kept for the venue, and unless the venue instructs otherwise:

• A name that has not appeared on any of a venue's lists for 12 months is anonymised. The night it belonged to keeps its counts; the name does not.
• A blacklist entry is kept while the venue keeps it. Removing one deletes its photograph immediately.
• When a venue deletes a person, the deletion covers every event and every spelling of the name it holds, not just the night the guest asked about.

Your rights

You can request access to, correction of, or deletion of your personal data at any time by emailing us at ali@bunniesinc.com. If you are located in the EU, you have rights under the GDPR including the right to data portability and the right to lodge a complaint with a supervisory authority.

Notice for venues to display at the door

A guest whose name goes on a list has to be told, and it is the venue that has to tell them. This is wording a venue can put on a sign or behind a QR code at the entrance. Replace the bracketed parts; add anything a local regulator requires.

[Venue name] keeps a guest list for this event. If you are on it, we hold your name, the number of people you are bringing, who added you and the time you came in — and, if you are refused entry and we record why, that note and any photograph we take. We keep it to run the door and to keep our events safe. We use ListPop to store it for us. Ask any staff member to see, correct or delete what we hold, at [contact address].

The venue is responsible for this notice being accurate and for answering the requests it invites.

Changes to this policy

If we make meaningful changes, we'll update the date at the top of this page. We won't suddenly start collecting more data — that's not how we operate.

Contact

Questions? Reach us at ali@bunniesinc.com.