Privacy Policy

Last updated: 10 October 2026

This policy explains what personal data SeatIn collects, why, on what legal basis, and your rights.

Who is responsible (data controller): Antonios Chatziparaskevas, who operates SeatIn (the SeatIn app and panstratan.com). Contact: [email protected].

1. Data We Collect

We collect only the data necessary to provide the check-in and table management service:

SeatIn is currently free, so we collect no payment data. If we introduce charges, we will update this policy first.

2. Why We Use Your Data and Legal Basis

We do not sell, rent, or share your data with third parties for marketing purposes.

3. Guest Data

Guest lists are uploaded by event organizers. Guests themselves do not create accounts. For guest data the organizer is the data controller and decides the legal basis for using it; SeatIn processes it on the organizer's behalf (as a processor, GDPR Art. 28), only to run their event. It is accessible only to the organizer and to the people they give event access to (organiser and tablet passwords). Guests who want to exercise their rights should contact the organizer; we will help the organizer respond.

Guest data is kept until the organizer deletes the guest list, the event or their account — so organizers can look back at past events. When an event is deleted, its guests and its uploaded files (guest-list spreadsheets, logo, background image, automatic reports) are deleted too. Only a summary stays in the organizer's Event history: event name, date, venue and totals such as the number of guests and check-ins — never guest names. That summary is deleted with the account.

For each event the server keeps the last 3 uploaded guest-list files and the last 3 automatic check-in reports.

4. Data Retention

Organizer accounts and associated event data are retained while the account is active. You can delete your account and all associated data at any time from Admin → Account Security → Delete account, or by contacting us — see how to delete your account.

Sign-in records are kept for 12 months. Encrypted backups are kept for 14 days on our server and for 90 days in an encrypted off-site copy in Greece; deleted data disappears from backups once they expire.

5. Third-Party Services

Gmail and guest-list emails. Organizers can send a guest list to SeatIn by email. SeatIn connects through the Gmail API to its own Gmail account only. It never accesses organizers' or guests' personal Gmail accounts. SeatIn reads messages sent to that mailbox to import the attached guest list into the sender's event, sends a confirmation reply, and marks the processed message as read. Email content is used only for this import and is not shared, sold, or used for advertising.

SeatIn's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. International Transfers

SeatIn's servers, database and backups are in the EU (Frankfurt, Germany, and an off-site copy in Greece). Some of the providers above — Google and Cloudflare — may process personal data outside the European Economic Area, including in the United States. Where they do, the transfer is covered by the EU–US Data Privacy Framework for providers certified under it, or by the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards.

7. Data Security

All data is transmitted over HTTPS. Passwords are hashed using bcrypt and never stored in plain text. We use session-based authentication with secure, server-side sessions. Organizers can turn on two-factor authentication (2FA); once it is on, the 2FA code is asked for at every sign-in, including when signing in with Google.

8. Your Rights

Under the GDPR you have the right to:

  • access your personal data and get a copy of it;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict how we use your data;
  • receive the data you gave us in a portable format (data portability);
  • object to processing based on our legitimate interests;
  • withdraw consent at any time, where we rely on consent.

To exercise these rights, email [email protected]. We reply within one month. You can also delete your account yourself at any time (section 4).

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 115 23 Athens, Greece — www.dpa.gr — or with the data protection authority of the EU country where you live or work.

9. Age

You must be at least 18 years old to create a SeatIn account. We do not knowingly collect data from children through accounts; if you think a child has created one, contact us and we will delete it. Guest lists may include minors (for example at family events): the organizer is responsible for that data.

10. Changes to This Policy

We may update this policy. We will notify you of significant changes via email or in-app notice.

11. Contact

For privacy questions, to exercise your rights or to request data deletion, contact the data controller, Antonios Chatziparaskevas, at:
[email protected]

© 2026 SeatIn · Terms