Privacy Policy & Cookies
Last updated:
The Brihottor London Bihu organising committee operates this community event website and is responsible for the personal information used in its booking, CRM and event administration services. For privacy questions, contact brihottorlondonbihu@gmail.com.
Information we hold and why
We receive details you provide when contacting us or registering: names, email addresses, telephone numbers, enquiries, ticket choices and guest age bands. Records may also include payment amounts and references, cancellations, attendance, parking requirements, food and commute preferences, accessibility requests, addresses and family information supplied to the committee. We use these to organise events, fulfil bookings, reconcile payments, respond to enquiries and send relevant event messages.
Historical information may come from our previous booking system, committee spreadsheets and correspondence. We do not infer children's identities from ticket quantities. An adult should provide information needed for a child's attendance; please avoid unnecessary medical or sensitive details. Our booking forms do not ask for full payment-card details or banking passwords. Hosting services may process request logs to operate the website and investigate faults or abuse.
Google services: administrator sign-in and committee Gmail sending
The Gmail sending feature requires hosting configuration, explicit authorisation by the committee mailbox holder and a verification email before it is enabled. On Netlify, contact enquiries, booking emails and administrator-requested messages use Resend until Gmail is enabled. Enabling Gmail switches these sends to Gmail; disabling or disconnecting it selects Resend for subsequent sends. A failed or uncertain Gmail send is never automatically retried through Resend. Sites administration retains its existing ChatGPT sign-in; Netlify uses the separate Google administrator sign-in below. Guests do not need a Google account to browse, contact us or book. This policy does not indicate Google's approval.
Administrator sign-in on Netlify
A separate Google connection requests only openid email to receive and verify the administrator's permanent Google account identifier, email address and email-verification status. Access is restricted to approved committee administrators; a Google account alone does not grant access. A personal Google account using a non-Gmail address also requires the hosting owner to approve its permanent account identifier. No profile, contacts or Gmail permission is requested by this sign-in flow.
The application verifies Google's signed identity response on the server. It does not persist Google's sign-in access or refresh tokens. The account identifier and email are held in an encrypted, Secure, HttpOnly session cookie for up to 30 minutes. Temporary sign-in and owner-approval cookies expire after ten minutes. The approved personal account identifier is retained in private hosting configuration until access is removed. Sign-out removes this browser's session cookie; another copy of that session expires at its original expiry unless access or the encryption key is changed. Contact the committee to request removal of approved access.
Sending from the committee mailbox
When the committee authorises Gmail, Google returns an authorisation code, access and refresh tokens, and the granted permission scope. These allow our server to send mail without receiving the Google password. Google also returns sending results, including a message identifier when a send succeeds. We do not retrieve Google profile details or existing email content. Names, contact details and message text in outgoing mail come from the website's forms or event records, not from reading Gmail.
The holder of brihottorlondonbihu@gmail.com authorises the send-only Gmail permission, gmail.send, to send a connection-verification email, contact-form enquiries and booking confirmations and administrator-requested event communications from that mailbox. Contact enquiries are addressed to the committee, with the visitor's email as the reply-to address. Netlify continues to use Resend when Gmail is disabled or disconnected. The Sites contact form requires its own enabled Gmail connection. This connection does not grant administrator access or connect administrators' personal mailboxes. We do not request access to guests' Gmail accounts.
For each email, we will transmit the recipient addresses, subject, content and any necessary booking attachments to Google. We may retain returned message identifiers, sending status and error information to record the outcome and investigate delivery problems. Acceptance does not prove inbox delivery. Gmail may keep sent copies in the committee account.
We will not request permission to read or search inboxes, import registrations from Gmail, retrieve existing messages or attachments, manage drafts, modify or delete mailbox messages, or access Google Contacts, Drive, Sheets or Calendar.
Limited Use commitment
Brihottor London Bihu will handle Google API information in accordance with the Google API Services User Data Policy, including its Limited Use requirements, and the applicable Google Workspace API policy.
Google-derived information serves only the disclosed administrator sign-in and sending features. It will not be sold, supplied to data brokers or information resellers, used for advertising or credit and lending decisions, or used to develop, improve or train general-purpose or non-personalised AI or machine-learning models. This includes information obtained through Google Workspace APIs. Human access is limited to the user's affirmative agreement to view specific data, necessary security investigations or legal requirements. Sharing is limited to delivering the authorised feature with the user's consent, protecting security or complying with law.
Sharing and service providers
For the Gmail connection, Google processes outgoing messages and authorisation requests; the website's hosting and database providers process the connection data needed to operate the feature. Intended email recipients receive message content and sender details. We do not share Gmail tokens with recipients, Resend, advertisers or analytics services. Authorising Gmail does not permit us to import mailbox data into the CRM or build unrelated databases.
Authorised committee administrators access records for event management. Hosting and database services process website records: Sites uses OpenAI/Cloudflare infrastructure; the Netlify deployment uses Netlify and its database services. Resend receives recipient details and message content for emails it sends. Once Gmail sending is enabled, Google will process messages sent through that connection. Recipients receive the messages addressed to them; group updates are sent individually rather than exposing guest mailing lists.
Providers may process information outside the UK. Applicable provider arrangements and legally required transfer safeguards must cover those transfers; contact us for information about the providers handling your records. We do not sell customer records. Disclosure may also be necessary to comply with law or address fraud, abuse or legal claims.
Storage, protection and retention
For administrator-access security, we record sign-in and sign-out activity, including successful and unsuccessful attempts and sign-in starts. These records contain the time, action, result and reason, a verified Google account identifier and email address when available, and hosting-provided IP address, approximate city and country and request identifiers. We do not collect precise device location. Location may reflect a VPN or network provider. An attempt that ends before identity verification may have no account information. We do not store passwords, authorisation codes, OAuth state, cookies or tokens in this activity log. Access is restricted to approved administrators for security and accountability, not advertising.
Administrator activity records are retained for three years from the activity date. Expired records are excluded from the activity viewer and automatically removed from the active database by daily cleanup and on subsequent audit writes. Backup copies expire under the hosting provider’s separate backup lifecycle; deletion from the active database does not immediately remove existing backups. Administrators are shown a notice of this logging before sign-in. Contact the committee about access, correction or deletion requests relating to these records.
CRM and booking records are held in the website database, with related correspondence in the committee mailbox and authorised committee files or exports. The website uses HTTPS, server-side administrator checks and restricted admin responses. No internet service can guarantee absolute security.
Google client credentials and the encryption key belong in private server-side hosting settings. The Gmail refresh token is encrypted in the database using AES-GCM; access tokens are held in server memory during sending. They are not exposed in public pages, browser storage, source code or analytics. We do not receive your Google password. The connection records the authorising committee administrator and connection time for accountability. Stored mailbox credentials are removed when disconnected.
The encrypted refresh token and connection metadata remain in the active database while the connection is retained, including when sending is temporarily disabled. Disconnect removes that connection record and requests token revocation at Google. The application does not persist access tokens or authorisation codes in its database. Sending outcomes associated with bookings are retained with those booking records for the purposes below. Contact-form messages are processed for delivery rather than saved as separate contact records in the website database; delivered copies remain in the committee mailbox.
Event, payment and communication records are retained as needed for event administration, reconciliation, queries and applicable accounting or legal obligations. Retention depends on the record and those purposes; the system does not currently enforce a fixed automatic deletion period. Unneeded records should be deleted or anonymised following review. Recipient mailbox copies remain under recipients' control. A request to delete website information should also identify relevant committee emails or exports, since these are separate records.
Disconnecting Google and requesting deletion
Use Disconnect in the committee Gmail settings to remove stored credentials and request revocation at Google. You can also remove permission through Google Account connections. If remote revocation cannot be confirmed, the website will ask you to remove access there. An in-flight email may still complete. Revocation does not retract sent emails or automatically delete event records. On Netlify, disabling or disconnecting Gmail restores Resend for subsequent contact enquiries, booking confirmations and administrator-requested messages.
To request disconnection or deletion of stored Google account information, tokens or customer records, email brihottorlondonbihu@gmail.com, identifying the account or booking concerned. Do not send passwords or tokens. We may verify your identity and will explain any records that must be retained for legal obligations or claims.
Cookies, analytics and videos
We use Google Analytics to understand website visits, including pages visited, browser or device information and usage identifiers. Analytics is separate from the Gmail permission above. Theme and privacy choices are stored in your browser; privacy choices expire after 180 days. Hosting services may use necessary sign-in and security cookies. Cookie settings provides the site's optional-service preferences.
YouTube embeds connect when you enable videos or choose “Load video”; Google then handles connection information under its own privacy policy. Social links take you to the respective provider's service.
Photo like counts are public. A browser identifier and cookie lasting up to one year remember your likes and limit repeated likes from that browser. The identifier is not your name or email address. Tap the heart again to remove a like; clearing cookies resets recognition.
Your choices and rights
Booking information is used to provide requested event services; operational records support legitimate event-management and security needs or legal obligations. Where consent is required, including for optional services or sensitive information, it must be obtained separately. This policy is not itself consent. Essential booking messages are separate from optional promotional messages.
Depending on the circumstances, UK data protection law provides rights to access, correction, erasure, restriction, objection, portability and withdrawal of consent. Contact the committee to make a request or stop optional communications. Cancellation is not the same as erasure and does not automatically refund a payment. You may raise concerns with the UK Information Commissioner's Office.
Changes and further information
We will update this page's date when the policy changes. If we change how we access, use, store or share Google user data, we will notify the affected account holder through an in-app notice or email before the change takes effect. Before using Google information for a new purpose or requesting additional permissions, we will update disclosures and obtain fresh consent for that new use. Administrator identity and committee-mailbox sending use separate authorisations.