Legal information
Privacy policy
This policy explains how personal data is processed when PartyBookIt is used to manage bookings for indoor playgrounds.
This English version is provided for information only. If it differs from the Spanish version, the Spanish version prevails.
Data controller
The controller of each booking's data is the park where you make the booking; its name and contact email appear on the booking management page and in the emails you receive. ZANE ENTERTAINMENT SL, which operates PartyBookIt, processes that data as a processor on the park's behalf and under its instructions. For business account and administrator data, business signup and consented analytics on the landing page and the application, including the public booking portal, the controller is ZANE ENTERTAINMENT SL, with tax ID (NIF) B75811620 and registered address at Ctra. C-17, s/n, planta 1, local 12/4, 08480 L'Ametlla del Vallès (Barcelona); privacy contact: privacidad@partybookit.com.
Purpose and legal basis
Data is processed to create, confirm, manage, change or cancel bookings, send necessary communications about them and handle related enquiries. The legal basis is the performance of a contract or steps taken at the user's request before entering into a contract, under Article 6(1)(b) GDPR.
Service analytics
The application hosted on Vercel uses Vercel Analytics and Vercel Speed Insights to obtain aggregated usage and web-performance metrics. Vercel documents Speed Insights data points as anonymous and not associated with individual visitors or IP addresses. Before transmission, we discard routes containing private links or credentials, including /booking/*, /invitacion/*, password-recovery routes, and /payment/return; query strings and fragments are removed from all other URLs. In addition, only after the user accepts it, on the basis of consent under Article 6(1)(a) GDPR, we use PostHog Cloud EU to measure and improve how PartyBookIt is used. On the landing page, PostHog runs without cookies or profiles: it measures page views and explicit clicks on signup buttons, reduces each event to the surface, language, canonical path (/, /es/ or /en/) and, for a click, button placement, and computes a rotating daily hash on its EU servers from request-header metadata such as the IP address and user agent, without storing an identifier in the browser. In the application (business signup, admin panel and public booking portal), the SDK stores a random pseudonymous identifier in the browser and records screen views and specific actions: signup steps; the start, completed steps, attempts, errors and submission of bookings and availability inquiries; the payment result of a booking when returning from the payment gateway; opening the booking assistant and sending messages to it, without their content; changes saved in the panel and opening billing or Stripe onboarding. Each event is limited to a closed list: screen name, generic path without real data (for example, /[business]/[park]/book or /booking/[code]/payment-return), language, internal business and park identifiers, role, booking type, plan, process step, generic error code, action or payment outcome, the domain of the referring site (for example, instagram.com) and the utm_source, utm_medium and utm_campaign campaign parameters of the entry URL when they only contain letters, digits, dots, hyphens or underscores, browser, operating system, device type and technical session identifiers. When a panel or signup user is signed in, we link their events to their internal user identifier, never their email or name, and to their business, with its trading name, plan and subscription status, to understand usage per business. We never send the actual URL, query, fragment, full referrer address (only its domain), page title, booking codes or links, contact details, customer or child names, form contents or amounts, and we do not measure the private routes listed above, except the booking payment return page, for which we only record the generic path /booking/[code]/payment-return and the payment result, never the booking code or the private link. We do not use PostHog for advertising, cross-site tracking, session replay, autocapture, surveys or automated decisions. PostHog retains events for the period set by its plan, up to seven years; you can request their deletion at privacidad@partybookit.com. The choice is stored separately on the landing page and in the application for 180 days in localStorage under partybookit-analytics-consent, with the consent version, decision and expiry date. It can be rejected, reviewed or withdrawn at any time through “Analytics settings” in the landing footer, the footer of the application's public pages and the panel's side menu; withdrawal stops subsequent events and deletes PostHog storage from the browser.
Data processed and children
We may process contact and booking details for the responsible adult, including name, email, phone number, date, time, park, booked services and notes needed for the booking. The booking may expressly include the child's name and age. A responsible adult must provide children's data, confirms they are authorised to do so and is responsible for ensuring the data is accurate and necessary.
Recipients and processors
PartyBookIt processes booking data on behalf of the park providing the booked service and uses the following providers as sub-processors: Supabase (infrastructure and database), Vercel (hosting, Vercel Analytics and Vercel Speed Insights for aggregated application analytics), PostHog Cloud EU (landing-page and application analytics when the user consents), Resend (transactional email), Stripe (payments and billing where applicable), Sentry (security and error diagnostics) and Cloudflare (security and delivery of the landing page and application). These providers only process data under the applicable instructions and safeguards. If you use the automated booking assistant, the text you type is sent, together with the park's public information, to OpenAI or Anthropic, depending on the provider configured by PartyBookIt, to generate the answer; PartyBookIt does not store the content of those conversations.
Retention
Personal booking data is retained for three years after the booking is completed, in line with the limitation period for contractual claims. It is then deleted or anonymised unless a legal obligation requires longer retention.
Your rights
For booking data, you may exercise your rights of access, rectification, erasure, objection, restriction and portability with the park through its contact email. If you send the request to ZANE ENTERTAINMENT SL (PartyBookIt), privacidad@partybookit.com, we will forward it to the park. For other data, contact ZANE ENTERTAINMENT SL (PartyBookIt), privacidad@partybookit.com. If you believe the processing does not comply with the law, you may complain to the Spanish Data Protection Agency.