Privacy Policy.
In plain English.

• Conversations: messages you exchange with a venue’s assistant on Facebook Messenger or Instagram, or through the chat widget on this site or a venue’s site.
• Booking details: name, email address, phone number, event date, guest count, menu selections, and similar details you provide while planning an event or filling an order form.
• Business inquiries: name, email, venue details, and your message when you submit our quote or contact forms.
• Survey responses: post-event ratings and feedback comments, if you choose to give them.

We do not collect payment card numbers. Payments are made directly to the venue through Stripe’s secure checkout, and card data never touches our systems.

• Answering your messages and questions about the venue, its menu, and its spaces.
• Preparing quotes, deposit invoices, and final invoices for events you book.
• Adding confirmed bookings to the venue’s calendar.
• Sending booking-related email (invoices, confirmations) and, after your event, a feedback survey.
• Alerting the venue’s human team when a conversation needs their attention.

Conversations are processed by large-language-model AI services to generate replies. Your messages are used to answer you. We do not sell personal data, and we do not use your conversations to train AI models.

We use a small set of service providers, each bound by their own data-processing terms:

• Meta: delivers Messenger/Instagram conversations.
• Stripe: invoicing and payments (the venue is the merchant of record).
• Google: venue calendar entries for confirmed bookings, and, only if you accept the notice on this site, Google Analytics to count visits to our own pages. Analytics never runs on a venue’s site or inside the chat widget.
• Mailchimp: post-event survey email.
• Resend: transactional email (alerts, confirmations).
• OpenRouter: routes conversation text to AI models to generate replies.
• Vercel, Supabase, Upstash: hosting, database, and queue infrastructure.
• Sentry: error monitoring; error reports are automatically scrubbed of emails, phone numbers, and credentials before they leave our servers.

Identifying data has an automatic expiry: if you have no upcoming event and have been inactive for 90 days, a daily job strips your name, email, phone, and messaging identity from our records and scrubs your conversation text. Anonymous business records (that an event happened, its date and amount, aggregate ratings) are retained for accounting and statistics.

Paid invoices are retained by the venue in Stripe as financial records, as required by tax and accounting law.

Wherever you are, we honor the core rights of the EU GDPR and the California CCPA/CPRA:

• Access / export: request a machine-readable copy of everything we hold about you.
• Deletion: request erasure; we remove your identity and conversations, keeping only what the law requires (e.g. invoices) or fully anonymized statistics.
• Correction: ask us to fix inaccurate details.

To exercise access or deletion, request it here. We email a link to confirm it’s really you (nothing happens until you open it), and then answer within 30 days. Every request is logged for accountability.

For corrections, or to reach a person about anything on this page, email info@vespar.ai from the address your booking used.

• All traffic is encrypted in transit (TLS).
• Venue credentials and integration secrets are encrypted at rest with AES-256-GCM.
• Access to operational data is restricted to the Vespar team and the venue’s own staff.
• Every inbound webhook is cryptographically verified before it is processed.

Our services are for booking event venues and are not directed at children under 16. We do not knowingly collect children’s data.

If this policy changes, we’ll update this page and its effective date. Questions about privacy (or anything else) reach us at info@vespar.ai or via the contact form.