Operator: DIGITALFRAMEWORK I.T. SOLUTIONS, a sole proprietorship registered in the Philippines, owned and operated by Mark Baldus, with business address at 14 Gregorio St., Barangay Mariano Espeleta II, Imus City, Cavite 4103, Philippines.
Contacts: support@celebratesync.app | privacy@celebratesync.app | legal@celebratesync.app | reportabuse@celebratesync.app
Version: v3 Publication
Plain Summary
This Policy explains how CelebrateSync handles account deletion, data-subject rights, Event Data, retention periods, backups, security logs, legal holds, and preservation obligations.
Users may request account deletion through the in-app deletion route, where available, or by contacting the Privacy channel. However, deleting an account does not always mean that every related record is immediately deleted. Some information may need to be retained because it belongs to an Event controlled by an Organizer, is needed for security, is required for billing or legal records, is subject to a legal hold, or must be preserved for child-safety, cybercrime, privacy, IP, abuse, or dispute purposes.
This summary is provided for convenience only. The full Policy governs.
1. Purpose and Scope
This Account Deletion, Data Rights, Retention, and Legal Hold Policy explains how CelebrateSync handles requests involving account deletion, personal-data rights, Event Data, retention, backup data, legal holds, security logs, evidence preservation, and confidentiality limits.
This Policy applies to the CelebrateSync mobile application, HostHaven organizer platform, websites and web applications, Event workspaces, invitations, RSVP tools, QR passes and Event Credentials, guest-management tools, supplier profiles, Public Trust features, reviews and ratings where enabled, media galleries, Event memories, communications, support channels, security systems, billing records, and other Services operated by or through CelebrateSync.
This Policy should be read together with the CelebrateSync Terms of Service, Privacy Notice and Data Rights Policy, Privacy Notice Acknowledgment and Consent Form, Community, Content, Child Safety, IP, and Enforcement Policy, Media Terms, Supplier Network and Public Trust rules, Review Guidelines, Spark Points Program Terms, Cookie and Marketing Policy, Subprocessor Register, Retention Schedule, and any applicable Event-specific or feature-specific rules.
2. Account Deletion Route
Where a User has created an Account, CelebrateSync may provide an in-application account-deletion route, a web-based deletion route, a support-assisted deletion route, or another reasonable mechanism required by applicable law, app-store rules, or platform policy.
A User may request account deletion through the in-app account deletion feature where available, or by contacting privacy@celebratesync.app. Requests involving account compromise, abuse, child-safety concerns, non-consensual intimate media, security misuse, or urgent harm may also be routed to reportabuse@celebratesync.app.
CelebrateSync may require reasonable verification before processing an account-deletion request. Verification may include confirming control over the Account, confirming access to the registered email address or phone number, requesting additional identifying information, or requiring proof of authority where the request is submitted by a parent, guardian, representative, estate representative, company administrator, Organizer, or other authorized person.
3. Effect of Account Deletion
Account deletion generally means that the User’s Account is disabled, closed, deleted, anonymized, or otherwise removed from ordinary active use, subject to applicable law, technical limitations, legal obligations, and retention rules.
Account deletion does not necessarily result in immediate deletion of all information associated with the User. Certain information may need to remain available where required or permitted by law, including Event Data controlled by an Organizer, legal holds, security logs, abuse reports, child-safety records, cybercrime preservation records, billing records, transaction records, privacy-request records, moderation records, IP complaint records, supplier-profile records, review integrity records, support records, backup data, and information needed to protect rights, safety, security, or legal compliance.
Where deletion is appropriate, CelebrateSync may delete, anonymize, de-identify, restrict, block, or otherwise remove information from active systems according to its technical architecture and retention procedures.
4. Event Data and Organizer-Controlled Informationbold
Event Data may include guest lists, invitation records, RSVP status, check-in records, QR pass activity, seating assignments, table assignments, Event roles, program participation, supplier assignments, staff permissions, client approvals, Event communications, Event media, incident notes, accessibility notes, dietary notes, security notes, and other information related to an Event.
In many cases, the Event Organizer determines what Event Data is collected, why it is collected, who may access it, and how long it is needed for the Event. In those circumstances, the Organizer may act as the Personal Information Controller, and CelebrateSync may act as the Personal Information Processor.
Because of this controller/processor split, a User’s request to delete a CelebrateSync Account does not automatically require deletion of all Event Data associated with that User. CelebrateSync may need to coordinate with the applicable Organizer before deleting, correcting, exporting, restricting, or disclosing Organizer-controlled Event Data.
CelebrateSync may assist the Organizer in responding to data-subject requests, subject to applicable law, contractual obligations, platform capability, and reasonable verification.
5. Data Rights Requests
A data subject may exercise rights available under applicable Philippine data-protection law, including the right to be informed, right of access, right to correction or rectification, right to object, right to withdraw consent where processing is based on consent, right to erasure or blocking in appropriate circumstances, right to data portability where applicable, right to file a complaint with the National Privacy Commission, and right to seek damages where legally available.
Requests may be submitted to privacy@celebratesync.app or through an in-app or web-based privacy request mechanism where available.
A request should include enough information to identify the requester, locate the relevant Account, Event, supplier profile, review, media, message, QR credential, or other record, and understand the right being exercised. Requesters should avoid submitting unnecessary sensitive personal information unless specifically requested for verification or legal purposes.
6. Verification and Authority
CelebrateSync may verify the identity, Account control, legal authority, or representative authority of a requester before acting on a deletion or data-rights request.
Verification is intended to prevent unauthorized persons from accessing, deleting, changing, exporting, or restricting another person’s personal data.
Where a request is made by a parent, guardian, legal representative, heir, company administrator, Organizer, supplier representative, or other representative, CelebrateSync may request reasonable evidence of authority before processing the request.
Where a request involves sensitive personal information, minors, private Event media, security logs, legal records, supplier disputes, IP complaints, or other higher-risk information, additional verification may be required.
7. Request Handling and Response
Upon receiving a request, CelebrateSync may determine the nature and scope of the request, verify the requester’s identity or authority, determine whether CelebrateSync is acting as PIC or PIP for the relevant information, identify any applicable legal or contractual limits, coordinate with an Organizer or other controller where necessary, and determine the appropriate response.
A response may include confirmation of action taken, request for additional information, explanation of limitations, referral to the applicable Organizer or controller, partial compliance, denial where legally justified, or another appropriate response.
CelebrateSync will endeavor to respond within the period required by applicable law. Where no specific statutory period applies, CelebrateSync will endeavor to respond within a reasonable period based on the nature, complexity, sensitivity, and volume of the request.
8. Limits on Deletion, Access, and Portability
Data rights are subject to legal, technical, contractual, privacy, safety, and evidentiary limits.
CelebrateSync may decline, delay, limit, redact, anonymize, or partially fulfill a request where necessary to protect another person’s privacy, avoid disclosing confidential information, maintain security, comply with law, preserve evidence, investigate fraud or abuse, respond to legal requests, satisfy accounting or tax requirements, comply with a legal hold, protect minors or vulnerable persons, or establish, exercise, or defend legal claims.
A requester is not automatically entitled to receive information about other Users, guests, suppliers, staff members, Organizers, reviewers, minors, complainants, witnesses, rights holders, or third parties.
9. Retention Principles
CelebrateSync does not intend to retain personal data indefinitely. Personal data should generally be retained only for as long as reasonably necessary for the purpose for which it was collected or processed, unless a longer period is required or permitted by law.
Retention may depend on the type of data, the purpose of processing, the role of CelebrateSync, the instructions of an Organizer, the existence of an Account, the lifecycle of an Event, billing or tax requirements, security needs, support needs, moderation needs, legal requirements, child-safety obligations, cybercrime preservation, dispute handling, and legal holds.
When information is no longer reasonably required, CelebrateSync may delete, destroy, anonymize, de-identify, block, restrict, or otherwise dispose of the information in accordance with applicable law, technical capability, and the applicable Retention Schedule.
10. Retention Schedule
CelebrateSync may maintain a Retention Schedule identifying default retention periods or retention triggers for material categories of information.
The Retention Schedule may address Account records, authentication records, Event Data, guest lists, RSVP records, QR and check-in logs, Event role records, seating records, Event communications, media records, support records, privacy-request records, moderation records, child-safety reports, abuse reports, IP complaints, supplier profiles, review records, Spark Points records, billing records, payment entitlement records, app-store records, analytics records, security logs, backups, legal holds, and other categories.
Where a specific legal requirement, lawful request, preservation duty, Organizer instruction, dispute, or legal hold applies, the applicable retention period may be longer than the ordinary schedule.
11. Backups and Disaster Recovery
Deletion from active systems may not result in immediate deletion from backups, archives, logs, or disaster-recovery systems.
Backup systems are maintained for security, continuity, disaster recovery, integrity, and restoration purposes. Information retained in backups may not be readily searchable, editable, or removable on an individual-record basis without compromising the integrity or functionality of the backup system.
Information in backups will remain subject to appropriate safeguards and will generally be deleted, overwritten, or made inaccessible according to the applicable backup lifecycle, unless earlier restoration, preservation, or legal hold is required or permitted by law.
12. Security Logs and Abuse Records
CelebrateSync may retain security logs, authentication logs, access logs, IP or device records, QR scan logs, invitation activity, suspicious activity records, abuse reports, moderation records, account-compromise records, and related technical or security records where reasonably necessary.
Such records may be retained to protect Accounts, Events, Users, minors, suppliers, rights holders, and the Services; investigate unauthorized access; detect fraud or abuse; respond to security incidents; preserve evidence; enforce the Terms; comply with legal obligations; and establish, exercise, or defend legal claims.
Security logs and abuse records may be withheld, redacted, or limited in response to access requests where disclosure would compromise security, reveal investigative methods, expose another person’s information, enable abuse, or interfere with an investigation.
13. Legal Holds and Preservation
Where litigation, regulatory proceedings, investigations, legal claims, cybercrime preservation, child-safety reports, non-consensual intimate media reports, IP complaints, payment disputes, billing disputes, security incidents, fraud concerns, abuse reports, or lawful requests are pending, reasonably anticipated, or legally required, CelebrateSync may place relevant information under a legal hold or preservation status.
Information subject to a legal hold or preservation status may be retained beyond the ordinary retention period and may not be deleted, altered, anonymized, or released until the hold is lifted or the preservation requirement ends.
Legal holds may apply to Account data, Event Data, content, media, reports, communications, metadata, logs, timestamps, IP or device records, billing records, supplier-profile records, review records, QR or invitation activity, access records, moderation notes, and related evidence.
14. Child-safety, Non-consensual Media, and Urgent Harm Preservation
Reports involving minors, OSAEC/CSAEM, child sexual abuse or exploitation, grooming, trafficking, sexualized minor content, non-consensual intimate media, voyeuristic content, serious threats, stalking, extortion, security compromise, or other urgent harm may require immediate restriction, preservation, internal escalation, documentation, and reporting or cooperation with competent authorities where required or permitted by law.
CelebrateSync may preserve relevant information even where the reporting User, uploader, Account holder, Organizer, or affected person requests deletion, where preservation is required or permitted by law or reasonably necessary to protect a child, affected person, rights holder, User, Event, or the Services.
15. Confidentiality of Preservation and Legal Requests
Certain preservation, restriction, disclosure, reporting, or cooperation actions may be confidential.
CelebrateSync may be unable to notify an affected person, Account holder, Organizer, uploader, supplier, reviewer, or requester where notice is prohibited by law, restricted by a lawful request, unsafe, inappropriate, or likely to compromise an investigation, child-safety response, cybercrime preservation, legal obligation, or security response.
Nothing in this Policy requires CelebrateSync to disclose confidential legal requests, investigative details, internal risk assessments, security methods, moderation notes, or privileged communications where disclosure is not legally required.
16. Billing, Tax, and Transaction Records
Where CelebrateSync processes platform fees, event activation fees, subscriptions, app upgrades, storage upgrades, internal digital-tool fees, refunds, cancellations, payment confirmations, app-store purchase identifiers, invoices, receipts, tax records, entitlement records, or fraud-prevention records, those records may be retained for accounting, tax, audit, chargeback, dispute, fraud-prevention, legal, regulatory, and customer-support purposes.
At initial launch, supplier payments, supplier payouts, escrow, marketplace checkout, split settlement, supplier-service refunds, and supplier settlement funds are outside the Services unless separately reviewed, approved, and activated under applicable terms.
Organizer-entered supplier payment notes, due amounts, deposit notes, or invoice notes in HostHaven are Event Data for operational tracking and do not mean that CelebrateSync holds, verifies, settles, guarantees, or releases supplier funds.
17. Media, Event Memories, and Deletion
Event media, photographs, videos, Event memories, albums, galleries, captions, media comments, and related metadata may involve multiple rights and interests, including the uploader’s rights, the Organizer’s Event purpose, the rights of persons appearing in the media, photographer or creator rights, privacy rights, child-safety concerns, IP rights, and legal or evidentiary obligations.
A request to delete media may require assessment of the requester’s relationship to the media, the uploader’s authority, the Organizer’s role, the visibility setting, the presence of other identifiable persons, IP or photographer rights, child-safety risks, non-consensual intimate media concerns, and legal-hold or preservation requirements.
CelebrateSync may remove, restrict, anonymize, hide, disable sharing, preserve, or decline to delete media depending on the applicable rights, risks, technical capabilities, and legal obligations.
18. Supplier Profiles, Reviews, and Public Trust Records
Supplier profiles, public ratings, reviews, supplier responses, report histories, moderation records, and Public Trust records may involve the rights and interests of suppliers, reviewers, Event Organizers, guests, complainants, and the public.
A request to delete or change supplier-profile or review information may be assessed in context. CelebrateSync may correct information, restrict visibility, remove identifying information, annotate disputed records, require verification, preserve evidence, freeze reviews, or take another proportionate action where appropriate.
Reviewer identity should be handled according to the published display setting and applicable Review Guidelines, subject to lawful requests, dispute processes, safety needs, and legal obligations.
19. De-identification and Anonymization
Where deletion is not required or is not technically or legally appropriate, CelebrateSync may de-identify, anonymize, aggregate, restrict, or separate information from direct identifiers where such action reasonably addresses the relevant privacy concern.
De-identified or aggregated information may be retained for analytics, security, product improvement, legal compliance, system integrity, reporting, or other legitimate purposes, provided that reasonable measures are taken to prevent re-identification where the information is intended to be anonymous.
20. Successor Entity or Business Transition
If CelebrateSync transitions from its present sole proprietorship structure to a corporation, one-person corporation, or other successor entity, relevant records may be transferred to the successor entity where reasonably necessary to continue operating the Services, fulfill contractual obligations, maintain business records, preserve security, comply with law, respond to requests, and protect legal rights.
Any successor entity should remain subject to applicable privacy, retention, security, and data-rights obligations. Where required, CelebrateSync will update the applicable legal documents to identify the successor operator or Personal Information Controller.
21. User Responsibility
Users, Organizers, suppliers, staff, and other role holders are responsible for using information accessed through the Services only for authorized purposes.
A User who uploads, imports, submits, copies, exports, shares, or uses another person’s information must have the necessary authority, consent, lawful basis, license, or permission to do so. This includes guest information, Event Data, photos, videos, supplier information, reviews, staff records, and sensitive Event notes.
Deleting an Account or withdrawing consent does not excuse prior misuse, unlawful disclosure, IP infringement, Event-privacy violation, review manipulation, or other conduct that occurred before the request.
22. No Absolute Right to Deletion or Access
Nothing in this Policy should be interpreted as creating an absolute right to immediate deletion, unrestricted access, full portability, or removal of all related records in every circumstance.
Rights are subject to the limitations, exceptions, and conditions provided by applicable law, the rights of other persons, Event Organizer responsibility, legal obligations, security needs, legal holds, preservation duties, technical limitations, and legitimate operational requirements.
Where CelebrateSync cannot fully comply with a request, it will endeavor to explain the limitation where required or appropriate.
23. Contact Information
For account deletion, data-rights requests, retention questions, legal-hold concerns, privacy complaints, or related matters, contact:
DIGITALFRAMEWORK I.T. SOLUTIONS CelebrateSync / HostHaven Data Protection Officer / Privacy Contact: Mark Baldus
Privacy: privacy@celebratesync.app Legal: legal@celebratesync.app Support: support@celebratesync.app Abuse / Safety Reports: reportabuse@celebratesync.app
Business Address: 14 Gregorio St., Barangay Mariano Espeleta II, Imus City, Cavite 4103, Philippines
24. Version Control
Policy: Account Deletion, Data Rights, Retention, and Legal Hold Policy Version: v3.0 Publication Version Date: September 16, 2026 Effective Date: September 16, 2026