Legal

Privacy Policy

Last updated: 27 August 2026 · Effective from: 27 August 2026

The short version: We collect only what we need to run the platform. We don't sell your data. We don't advertise. Payment details go straight to Stripe — we never see your card number. For hosts, we store bank account numbers securely for payout purposes. You can request, correct, or delete your data at any time by writing to privacy@aseat-thetable.com.

1. Who we are and who is responsible for your data

A Seat at the Table ("ASATT", "we", "us") is the data controller for all personal data processed through this platform. That means we determine why and how your data is processed, and we are legally responsible for it under GDPR as applied in Norway through Personopplysningsloven.

Data controller:
A Seat at the Table · A-kurator AS · Org.nr. 932 744 147
Oslo, Norway
Privacy contact: privacy@aseat-thetable.com

2. What personal data we collect and why

We collect only the data we genuinely need. Here is exactly what, why, and on what legal basis under GDPR Article 6:

Data	Why we collect it	Legal basis
Name and email address	Create and manage your account; send booking confirmations and notifications	Contract (Art. 6(1)(b))
Profile photo and bio	Display your profile to other users; build trust between hosts and guests	Contract / Legitimate interest (Art. 6(1)(f))
Neighbourhood	Show broadly where you are for event discovery. We never collect GPS location.	Legitimate interest (Art. 6(1)(f))
Booking and payment history	Process bookings; manage cancellations and refunds; settle payouts to hosts	Contract (Art. 6(1)(b))
Payment transaction reference	Reconcile payments. We store only an amount and a Stripe transaction ID — we never see or store card numbers.	Contract / Legal obligation (Art. 6(1)(c)) — Bokføringsloven
Bank account number (hosts only)	Transfer earnings to hosts after events. Stored securely and only accessible by ASATT administrators.	Contract (Art. 6(1)(b))
Organisation number (business hosts only)	Required for invoicing and tax reporting for business accounts.	Legal obligation (Art. 6(1)(c)) — Bokføringsloven
Host event listings (title, description, photos, menu, location)	Display events to potential guests; facilitate bookings	Contract (Art. 6(1)(b))
Private address (hosts only, for private events)	Share only with confirmed guests after payment. Never in public listings.	Contract (Art. 6(1)(b)) — see Section 5
Messages (between users; support messages to ASATT)	In-app communication between hosts and guests; support responses	Contract / Legitimate interest (Art. 6(1)(f))
Reviews and ratings	Build trust and quality on the platform	Legitimate interest (Art. 6(1)(f))
Device push token	Send booking confirmations, event reminders, and messages. You can disable this in phone settings at any time.	Legitimate interest (Art. 6(1)(f))
Dietary information	Passed to host so they can accommodate your needs. Treated as sensitive data.	Explicit consent (Art. 9(2)(a)) — you provide it voluntarily

We do not collect: GPS/precise location, government ID numbers, or any data about children. We do not use automated decision-making or profiling that produces legal or similarly significant effects.

3. Dietary information — special category data

Information about food allergies or dietary requirements can reveal health conditions and is treated as special category data under GDPR Article 9. You provide this voluntarily when making a booking. We pass it to the host for the sole purpose of accommodating your needs. We do not use it for any other purpose and do not share it with anyone other than the host of the event you are attending.

4. Private address — sensitive personal data

A host's home address is particularly sensitive. Our handling of it is deliberately restrictive:

It is never displayed in public event listings
It is revealed only to guests with a confirmed, paid booking for that specific event, and only via the ASATT app
It is not used for any other purpose — not for marketing, not for research, not shared with any third party
Guests who share a host's address outside the confirmed guest list are in breach of our Terms of Service

Hosts provide their address voluntarily. By doing so, they acknowledge that it will be shared with confirmed guests as described above.

5. Who we share your data with

We share personal data only with the following parties, all of whom act as data processors under a Data Processing Agreement (DPA) with us:

Stripe (stripe.com) — payment processing and host payouts. Stripe is PCI DSS Level 1 certified. We have a DPA with Stripe. Stripe Privacy Policy →
Supabase (supabase.com) — database and authentication, hosted in the EU (Ireland). We have a DPA with Supabase. Supabase Privacy Policy →
Expo (expo.dev) — push notification delivery. Expo Privacy Policy →

We do not sell your data. We do not share it with advertisers, data brokers, or social media companies. We do not transfer personal data outside the EEA except where a third party (Stripe, Expo) has appropriate safeguards in place (Standard Contractual Clauses or equivalent).

We may disclose personal data to Norwegian law enforcement or courts if required by law, or to protect the safety of users or the public.

6. How long we keep your data

Account data — retained while your account is active. Deleted within 30 days of account deletion, except where Norwegian law requires longer retention.
Financial records (booking amounts, payment references) — retained for 5 years to comply with Bokføringsloven (Norwegian accounting law). After 5 years, permanently deleted.
Messages — retained for 2 years after the event date, then permanently deleted.
Event listings — retained for 3 years after the event date for dispute resolution purposes, then permanently deleted.
Bank account number (hosts) — deleted within 30 days of account deletion, or when the host removes it from their profile. Retained for up to 5 years for completed payouts to comply with Bokføringsloven.
Reviews — retained until you delete your account or request removal.
Private addresses — removed from active booking records 12 months after the event date.

7. Your rights under GDPR

You have the following rights regarding your personal data. To exercise any of them, contact privacy@aseat-thetable.com. We will respond within 30 days.

Right of access

Request a copy of all personal data we hold about you.

Right to rectification

Correct inaccurate data. Most of this you can do yourself in Profile → Edit profile.

Right to erasure

Request deletion of your account and personal data. Some data may be retained where required by law (see Section 6).

Right to portability

Request your data in a structured, machine-readable format (JSON).

Right to restrict processing

Ask us to pause processing of your data in certain circumstances.

Right to object

Object to processing based on legitimate interest, including direct communications from us.

Withdraw consent

Where processing is based on consent (e.g. push notifications), withdraw it at any time in your phone settings.

Lodge a complaint

You may complain to Datatilsynet at any time if you believe we are processing your data unlawfully.

8. Security

We take data security seriously. Our technical measures include:

Encrypted transmission — all data between the app and our servers is encrypted via HTTPS/TLS
Row-level security — our database is configured so users can only access their own data; ASATT staff have restricted access
No stored payment data — card numbers, bank account details, and CVVs are handled entirely by PCI DSS-certified providers (Stripe, Vipps) and never touch our servers
Access controls — staff access to personal data is limited to what is necessary for their role
Regular reviews — we review our security practices regularly

In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify Datatilsynet within 72 hours and inform affected users without undue delay as required by GDPR Article 33–34.

9. Cookies and tracking

The ASATT mobile app uses no third-party tracking cookies and no advertising or analytics trackers. Usage data is anonymised before any analysis.

The website at aseat-thetable.com uses no cookies beyond those strictly necessary to serve the site. We use no third-party analytics tools that process personal data. No consent banner is required.

10. Children

The platform is strictly for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we become aware that a user is under 18, we will delete their account and all associated data promptly. If you believe a minor has registered, please contact privacy@aseat-thetable.com.

11. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by in-app notification and email at least 30 days before they take effect. The current version is always available at aseat-thetable.com/privacy and in the app under Profile → Terms & Privacy.

The date at the top of this policy shows when it was last updated.

12. Contact and supervisory authority

For any privacy question, data request, or complaint:

A Seat at the Table
A-kurator AS · Org.nr. 932 744 147
Oslo, Norway
privacy@aseat-thetable.com

Supervisory authority:
Datatilsynet
datatilsynet.no
+47 22 39 69 00