Your celebration data stays connected to its purpose.

Who is responsible

Monkey Magic Cloud Ltd, company number 12859688, is the operator of MKMela and the data controller for organiser accounts, service operation, security and our direct relationship with users. Our registered office is 71–75 Shelton Street, London WC2H 9JQ. Contact hello@mkmela.co.uk.

When an organiser uploads a guest list and decides why guests are invited and what replies are needed, that organiser is normally responsible for that use of guest data. MKMela provides the RSVP service and also has limited controller responsibilities for protecting the service, answering rights requests and meeting legal obligations. Professional planners should also read our planner data terms.

Information we use

• Organiser account information supplied through Sign in with ChatGPT: stable Site user ID, email and, when available, display name.
• Celebration information: title, type, town, dates, venues, functions, host wording, planning selections and RSVP deadline.
• Guest information supplied by the organiser: name, email, household grouping, invitation allocation and optional plus-one setting.
• Guest replies supplied directly by the guest: attendance choice and answers to organiser-created, non-sensitive questions.
• Operational information: private invitation-token hash, invitation status and timestamps needed to show whether a link was opened or a reply was submitted.
• A temporary celebration draft stored on the organiser’s own device for up to 30 days.

Where guest information came from

If you received an invitation without previously using MKMela, your host or their event planner supplied your contact details so they could invite you and collect your reply. You do not need an MKMela account to respond. Contact the host for questions about the guest list, or contact us if you want help locating, correcting or removing information held in MKMela.

Why we use it and our lawful bases

• Provide organiser accounts and the RSVP service: performance of our contract with the organiser.
• Operate invitations and record guest replies: the organiser’s and guests’ legitimate interests in managing a requested celebration efficiently, balanced against the limited information used.
• Protect links, prevent misuse and keep service records: our legitimate interests in security and reliability, and legal obligations where applicable.
• Direct MKMela marketing: consent. Guests are not added to marketing simply because they reply.
• Public event listings: legitimate interests in helping visitors discover published UK events; listings link back to the independent organiser.

Sensitive information

MKMela is not designed to collect medical information, allergies, disability details, religious beliefs or other special-category data in RSVP answers. Organisers are told not to ask for it through MKMela. Guests should share any genuinely necessary sensitive information directly with their host using a separate private channel.

Who receives information

Authorised organisers can see their own celebration and guest replies. Guests see only the people and functions attached to their private household link. OpenAI provides Sites hosting, Sign in with ChatGPT and managed D1 storage under its data-processing terms. Brevo is prepared as a future transactional email provider but is not connected and receives no MKMela data in this V3 review. We do not sell guest lists.

International processing

OpenAI Sites does not currently offer data residency for Sites, so information may be processed outside the UK. Where required, appropriate contractual safeguards such as the UK Addendum or other lawful transfer mechanisms apply through our provider contracts. We will review Brevo’s processing locations and safeguards before enabling email delivery.

How long we keep information

Organisers can permanently delete a celebration at any time. MKMela automatically removes a celebration, its guest list, invitations and replies 90 days after the latest recorded function date. When no date has been entered, it remains until the organiser deletes it or asks us to do so. New private invitation links expire at the RSVP deadline, shortly after the celebration, or after 90 days when no date exists. Device drafts expire after 30 days. Account details remain while the account is active and are removed when the organiser deletes their MKMela account, subject to any short retention required by law, security or backup rotation.

Your rights

You may ask for access, correction, deletion, restriction, portability or object to certain processing. You may withdraw consent at any time without affecting earlier lawful processing. See Your data rights for the request process. You may also complain to the UK Information Commissioner’s Office at ico.org.uk.

Children

MKMela is for adult organisers and is not directed to children under 13. Organisers should add a parent or responsible adult as the household contact and avoid entering a child’s email address. We will delete child data submitted contrary to this rule when identified.

Changes

We will update this notice when the service, providers or legal position changes and show the new date here. Material changes affecting how existing information is used will be communicated appropriately.