Last updated November 2026 · Effective [Effective date]
Privacy Policy
This is a draft pending legal review. It may change before it takes effect. Text in [square brackets] is still to be confirmed.
Your table, your privacy. This policy explains what personal information [Legal business name] (HER TABLE SOCIETY, we, us) collects through hertablesociety.com, why we collect it, who it is shared with and what choices you have.
We keep this simple on purpose. We collect what we need to run memberships and events. We do not sell your personal information. We do not use advertising or analytics trackers on the site.
1. What we collect
The information we collect depends on what you do on the site.
- Contact details: first and last name, email address and, if you give it, phone number. We ask for these when you buy tickets, join, or create an account.
- Date of birth, for members. We ask for it when you join, to check that you are 27 or older, and we store it with your member record. It is not shown in your account pages.
- Account details: your password, if you choose to sign in with one. We store only a one-way hash of it, never the password itself. Members who sign in by emailed link have no password.
- Order and membership history: which events you bought tickets for, how many, the amount, the date, your plan, when it started and renews, whether renewal is on, and whether a payment failed.
- Payment details: your card is handled by Stripe. We do not receive or store your card number. We store only the card brand, the last four digits and the expiry date, so we can show them in your account, and Stripe customer and payment reference numbers.
- Your 27+ confirmations, and the time you accepted the membership terms.
- Email preferences: whether you opted in to event announcements and member updates.
- Notify list sign-ups: your email address, and your name if given, for the membership waiting list and for events you asked to hear about.
- Messages you send us, such as emails to hello@hertablesociety.com.
- Technical data: a short-lived sign-in session record, and rate-limit counters used to stop abuse. Rate-limit counters use a scrambled (hashed) form of your IP address or email address, not the raw value. Our hosting provider also processes standard request data such as IP address and browser type to deliver and protect the site.
We do not collect health, financial account or government ID information through the site. If we check ID at an event, we look at it to confirm age and do not copy or keep it. [Confirm this practice with the client.]
2. How we use it
- To sell and deliver tickets and memberships, and to process payments and refunds.
- To manage your account, sign you in and keep it secure.
- To check eligibility, including the 27+ requirement.
- To send service emails: ticket confirmations, welcome emails, renewal reminders 14 and 3 days before renewal, payment problems, and notice that a membership has ended.
- To tell you when a membership spot or event tickets open, if you joined a notify list.
- To send event announcements and member updates, only if you opted in.
- To answer your questions and run our events, for example seating and allergy needs.
- To keep the site safe, prevent fraud and abuse, and meet legal and tax duties.
We do not use your personal information for automated decisions that have legal effects on you.
3. Marketing emails
We send marketing emails only if you opted in, for example by ticking the box when you join or by switching it on in your account. Every marketing email has an unsubscribe link, and you can switch it off at any time from your account.
Service emails, such as ticket confirmations and renewal reminders, are not marketing. We still send them while you have an order or membership.
6. How long we keep it
We keep information only as long as we need it for the purposes above.
- Member and order records: for as long as you are a member or have orders, then for [retention period, for example 7 years] to meet tax, accounting and legal duties and to handle disputes.
- Join-flow drafts, including a temporary password hash and date of birth entered before payment: these are cleared once the join is completed or the draft expires.
- Sign-in sessions: 30 days. Emailed sign-in links: 15 minutes, then removed.
- Rate-limit counters: about one day.
- Payment event records from Stripe: about 90 days.
- Notify list sign-ups: until you unsubscribe or the list is no longer needed.
- Email delivery log (recipient, type and status, not the message body): [retention period].
You can ask us to delete your information at any time. See your rights below.
7. Your California privacy rights
If you live in California, the California Consumer Privacy Act as amended (CCPA/CPRA) gives you these rights:
- Right to know: what personal information we collect, use, disclose and keep about you, and to receive a copy.
- Right to delete: ask us to delete the personal information we hold about you, with some exceptions, such as records we must keep for tax and legal reasons.
- Right to correct: ask us to fix information that is wrong.
- Right to opt out of sale or sharing: we do not sell or share your personal information, so there is nothing to opt out of.
- Right to limit use of sensitive personal information: we use sensitive information, such as account credentials, only to provide the service.
- Right not to be treated differently for using these rights.
To make a request, email hello@hertablesociety.com with the subject “Privacy request”. Tell us your name and the email address on your account, and what you would like us to do. We will verify that it is you, usually by replying to the email address on file. We will respond within 45 days, and tell you if we need more time. You can also use an authorized agent; we may ask for proof of her authority.
You can edit your name, email, phone number, password and email preferences yourself in your account at any time.
[Confirm whether the business meets the CCPA thresholds and whether any further notices are needed. Our legal advisor to decide.]
8. Children
The site is not directed to anyone under 18. Membership and events are for women who are 27 or older, and we do not knowingly collect information from anyone under 18. If you think a young person has given us information, email hello@hertablesociety.com and we will delete it.
9. How we protect it
We use reasonable measures to protect your information. Connections to the site are encrypted. Passwords are stored as one-way hashes. Sign-in tokens are stored only in hashed form. Card data stays with Stripe. Access to our systems is limited to people who need it.
No system is completely secure. If a breach affects your information, we will tell you as the law requires.
10. Where information is stored
Our providers may store and process information in the United States and other countries where they operate. We choose providers that protect it with appropriate safeguards.
11. Privacy at events
We share the world of HER TABLE SOCIETY: the styling, the tables, the flowers. Not our members’ private lives. Private conversations are never content.
[Photography and filming at events: the policy is not yet decided. Describe whether photos or video are taken, how guests can opt out, and how images are used.]
12. Changes to this policy
We may update this policy. We will post the new version here with a new “Last updated” date and, for significant changes, email our members. We will not use your information in a new way that you would not expect without telling you first.
13. Contact
Questions about this document? Email us at hello@hertablesociety.com.
[Legal business name] (Her Table Society), [Mailing address], Los Angeles, California.