Privacy Policy

1. Who we are and what this policy covers

1.1 点点DianDian ("DianDian", "we", "us") is operated by DianDian, a sole proprietorship registered in BC (registration no. FM1118813) and based in Vancouver.

1.2 This policy covers personal information we collect, use and disclose through:

• our website, diandianevent.com;
• the 点点DianDian app;
• email; and
• the events we organize.

1.3 We handle personal information under BC's Personal Information Protection Act ("PIPA"). If you are outside BC (for example, if you attend events in Ontario), and where personal information moves across provincial or national borders, the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") applies. In this policy, PIPA and PIPEDA together are "applicable privacy law".

1.4 This policy explains how we handle your personal information. It isn't part of our Terms of Service; when you sign up, you consent to our handling your personal information as this policy describes. Venues, Stripe and other third parties handle information under their own privacy policies (see sections 8 and 17).

1.5 "Personal information" means information about an identifiable individual. Aggregated or anonymized data that can no longer identify anyone is not personal information.

2. Privacy Officer

2.1 The operator of DianDian is our Privacy Officer and is responsible for our compliance with applicable privacy law and this policy.

2.2 Contact:

• Email: diandian.event@gmail.com (please put "Privacy" in the subject line)
• Mail: 422 Richards Street, Unit 170, Vancouver, BC V6B 2Z4
• Phone: +1 416-829-6597

2.3 Contact the Privacy Officer with any question about this policy or how we handle your information, any request to access or correct it, or any complaint. Sections 14 and 19 explain how we handle these.

3. What we collect

3.1 Account details (required to sign up):

• your first and last name;
• your email address;
• your password (stored by Supabase as an encrypted hash; we can't see it);
• your birth year and month.

3.2 "About you" details (nationality is optional; everything else is required at sign-up, and you can change it later but not leave it blank):

• gender, nationality (optional), languages you can chat in, preferred language (Mandarin by default);
• MBTI type, industry, interests;
• relationship status;
• favourite cuisines and budget;
• allergies and dietary needs.

Gender and relationship status each include a "Prefer not to say" option. MBTI includes "Not sure", and industry, nationality and languages include "Other".

Allergies and dietary needs may reveal health information, and relationship status is personal. We treat both as sensitive. We use them only for the purposes in section 4, and only DianDian admins can see them.

3.3 Optional information:

• a profile photo in the app, if you upload one;
• event feedback (rating and comments);
• emails and attachments you send us.

3.4 Information created as you use the service:

• bookings, reschedules and cancellations;
• the reason you select when you cancel a booking (required) and any note you add (optional);
• subscription status, and the customer, subscription and payment status identifiers Stripe returns (never your card number);
• the text and quick messages you send in event chats (see section 7);
• reports you file (including the people you select, your reason and details) and people you block, as well as reports and blocks others make about you;
• invitations: who invited you and whom you invited. Your invite link carries your account ID, not your name or email;
• notification settings, and a record of when you turned promotional email on or off;
• the interface language you choose, which is saved to your account. The city you choose is kept only in a browser cookie, not in your account (see section 11);
• account status, including when and why an account was suspended or closed;
• logs of admin actions on your bookings, reports or account.

3.5 Consent records:

• when you accept our Terms of Service and Community Guidelines, and consent to our handling your personal information under this policy: the version of each document, the exact wording shown to you (recorded as a wording ID and checksum), the language, the time, where you accepted (website or app), your email address at the time, and the result of the age check;
• when you book an outdoor or physical event: the version of the risk acknowledgment, the wording shown to you, and when you confirmed it;
• a record of each optional consent you give or withdraw, such as promotional email.

When we record a consent, we also record your IP address and device information (browser or app type and version), to show that you were the one who gave it.

3.6 Technical information collected automatically. When you use the website or app, we and our hosting providers log the following, which we use for security, troubleshooting and preventing abuse:

• your IP address;
• your browser or device type;
• the time of each visit and the pages you request;
• sign-in and error logs.

3.7 Information from others:

• Stripe tells us the status of payments, refunds and subscriptions;
• other people in your group may mention you in a report or in feedback;
• venues may tell us what happened at an event, such as damage, an unpaid bill or a safety incident.

3.8 What we don't collect:

• card numbers, CVCs or bank account details (Stripe handles these);
• copies of identity documents (see section 16);
• your precise location, your contacts, or any photos other than the one you choose to upload;
• health information beyond allergies and dietary needs. For outdoor events, you confirm your own fitness to take part; we don't ask about medical conditions.

We no longer collect drinking preferences, and any we held have been deleted.

4. Why we collect it and how we use it

4.1 We use personal information for these purposes:

4.2 Grouping.

• (a) After booking closes, our system creates draft groups from participants' profiles. The system uses: age (calculated from birth year and month), gender, the price level that matches your budget, the languages you can chat in, your preferred language, industry, interests, blocks, and companion links (two people booked on the same event where one invited the other through an invite link, and companions recorded by an admin). Nationality is not used for grouping.
• (b) A DianDian admin reviews the draft and may adjust it. Groups, and any booking cancellations that result from them, take effect only once an admin confirms them; the system does not confirm drafts automatically. When adjusting a draft, an admin may also consider your other "About you" details (except nationality).
• (c) A booking that can't be placed in any group, given the event's group size requirements, price levels and blocks, is cancelled when an admin confirms the groups, with a full refund (see section 5.4 of the Terms of Service).
• (d) You may ask for a person to review a grouping or cancellation that affects you. Email diandian.event@gmail.com with "Group review" in the subject line and tell us your concerns.

We don't make decisions with a significant effect on you, such as grouping, cancelling a booking, or suspending or closing your account, solely by automated means.

4.3 We use your information only as reasonably needed, and never for purposes unrelated to DianDian. Before using it for a new purpose not described here, we will tell you, and we will ask for your consent where it is required, unless the law allows us to proceed without it.

5. Consent

5.1 To sign up, you tick to accept our Terms of Service and Community Guidelines and to consent to our handling your personal information under this Privacy Policy. That consent covers only the purposes needed to provide the service, which are all the purposes in section 4 except promotional messages.

The "About you" step of sign-up explains what those details are for, with a short note under "Allergies and dietary needs" and under "Relationship status". By completing and submitting it, you consent to our using them as this policy describes, including your allergies and dietary needs and your relationship status.

5.2 Some uses aren't needed to provide the service, such as promotional email or using a photo in which you can be identified to promote DianDian. For these, we ask separately. The option is never pre-ticked, and saying no doesn't affect your use of the service.

5.3 You may withdraw consent at any time, and we will tell you what that means for you:

• if you withdraw consent we need to provide the service (for example, to use your "About you" details to arrange groups), we may no longer be able to arrange events for you;
• withdrawing doesn't affect anything we did before you withdrew;
• withdrawing doesn't affect records the law requires or allows us to keep (see section 12).

5.4 Where applicable privacy law permits, we may collect, use or disclose personal information without consent, for example:

• to investigate a breach of an agreement or of the law;
• for a legal proceeding;
• in an emergency that threatens someone's life, health or safety;
• to collect a debt.

6. Who can see your information

6.1 The people in your group. From the release time shown on the event page, the people with a confirmed booking in the same group as you ("the people in your group") can see:

• your first name, but not your last name;
• a summary of the group's industries and shared interests. It shows the industries the other people in your group work in, and interests that at least two people in the group share. It shows only which industries and interests are present, not whose they are or how many people have each, so none of it can be linked to any one person: if everyone else works in the same industry, no industry is listed; if only two other people are in your group, only shared interests you also have are listed; and "Other" industries are left out. If only one other person is in your group, no summary is shown;
• the messages you send in the event chat, with the first name you had when you sent them (see section 7).

The people in your group never see your last name, email, birth year or month, gender, nationality, languages, preferred language, MBTI type, favourite cuisines, budget, relationship status, allergies or dietary needs, or profile photo. Your industry and interests appear only in the summary described above.

6.2 Please keep in mind that we can't control what you choose to tell people at an event or in a chat, or the contact details you exchange. Other participants are responsible for how they use that information. Our Community Guidelines require everyone to respect each other's privacy.

6.3 DianDian admins. Admins can see your account details, booking and payment records, and reports and blocks in our admin tools, for the purposes in section 4. They look only at what a specific task needs. We don't read chats routinely (see section 7).

6.4 Venues, event partners and service providers: see section 8.

6.5 No one else can see your personal information, except as this section and section 8 describe.

7. Event chat

7.1 Once groups are set, you and the people in your group share an event chat. By default it opens 6 hours before the event starts and closes 24 hours after it ends. Some events may use different times; the chat page on the website or in the app shows when.

7.2 We store:

• the text and quick messages you send, such as "On my way" or "I'm here";
• when you sent them;
• your first name at the time, but not your last name.

7.3 Only people with a confirmed booking in your group can see these messages, and only while the chat is open. You won't see messages from people you have blocked.

7.4 We don't read chats routinely. We look at a chat only when we need to handle a report, a safety incident or a technical problem. When someone submits a report about an event, we keep a copy of all the messages in the reporter's group chat at that time; if the report is still open when the chat closes, we also keep the messages sent after the report. The copy is stored with the report, and only our admins can see it (see section 12 for how long).

7.5 When the chat closes, its messages are deleted and can't be recovered. There are two exceptions: the copy kept with a report under section 7.4; and if a report about the group is still open when the chat closes, we keep the group's messages until the report has been handled, and then delete them. If you'd like to stay in touch with someone, swap contact details before the chat closes. If you delete your account, your messages are deleted too, except any copy kept with a report.

8. Who we share information with

8.1 We don't sell or rent your personal information, use it for third-party advertising, or trade it with data brokers.

8.2 Service providers. The providers below help us run DianDian. They process information only on our instructions and to provide their services to us, under contractual confidentiality and security obligations.

8.3 Venues. We book under the name Dian and tell the venue only the number of guests and the time. If someone has listed allergies or dietary needs, we may pass these on without naming anyone, so the venue can prepare. This doesn't replace telling the venue yourself (see section 8.2 of the Terms of Service).

8.4 Event partners. For special events, such as craft workshops, the studio or partner may need to know how many people are coming. We share your first or full name only if the event genuinely requires it, for example when the partner needs a booking list or a safety register, and we will say so on the event page in advance.

8.5 Insurers, lawyers and professional advisers. If there is an incident, complaint, dispute or claim, we may share relevant information, limited to what is needed, with any insurer we may have, claims adjusters, lawyers, accountants and other professional advisers.

8.6 Legal requirements and safety. We may disclose information to authorities or other appropriate people:

• when the law requires it, such as under a court order, warrant or subpoena;
• to assist a lawful investigation by a law enforcement agency;
• in an emergency, to protect someone's life, health or safety;
• in other circumstances applicable privacy law allows.

Where the law allows, we will tell you.

8.7 Business transfers. If another entity takes over DianDian's business (for example, a company set up by the operator), or the business is sold or merged, your information moves with it. The new operator must keep using it in line with this policy, and will ask you to accept its agreement with you (see section 18.4 of the Terms of Service).

8.8 With your consent. Otherwise, we share your information only with your consent.

9. Storage and processing outside Canada

9.1 Our main database is stored in Canada. Some of the providers in section 8, however, process and store information in the United States or other countries, so your information may be transferred outside Canada.

9.2 Information stored in another country is subject to that country's laws and may be accessed by its courts, law enforcement and national security authorities under those laws.

9.3 We choose providers that maintain reasonable security safeguards, and we require them by contract to protect your information. To find out more about how our providers handle information outside Canada, contact our Privacy Officer.

10. Service messages and promotional messages

10.1 Service messages. These are needed to provide the service, and we send them while your account is open:

• sign-up confirmation and password reset;
• booking confirmations, event reminders and venue details;
• reschedule and cancellation notices;
• subscription and payment notices;
• notices of changes to our terms or policies;
• safety notices, including notices that an account has been suspended or closed.

They don't include promotional content. Service messages also say who we are and how to contact us, and include a link to manage your email settings.

10.2 Promotional messages. Emails about new events, offers and other promotions are sent by DianDian only if you turn them on. You can tick the option when you sign up, or turn it on later under Account → Notifications. It is off by default and never pre-ticked.

Every promotional email identifies the sender, gives our mailing address and contact details, and includes an unsubscribe link. You can also opt out in your notification settings or by emailing us. We act on unsubscribe requests within 10 business days.

10.3 Push notifications. Once the app launches, it will send push notifications only if you allow them on your phone. You can turn them off at any time in your phone's settings.

10.4 We don't currently send text messages.

11. Cookies and local storage

11.1 Our website uses only cookies it needs to work, and cookies that remember your preferences:

11.2 When you're signed in, your language is also saved to your account, and the emails we send you use it.

11.3 To pay, you are taken to Stripe's checkout page. Stripe may set its own cookies there to process payments and prevent fraud, under Stripe's privacy policy.

11.4 Our website fonts come from Google Fonts. When you open a page, your browser requests the font files from Google's servers, so Google receives your IP address and browser details.

11.5 We don't use advertising trackers, third-party analytics or social media pixels. The website doesn't use localStorage or other browser storage. Because we use only essential and preference cookies, there is no cookie banner.

You can clear or block cookies in your browser, but if you block the sign-in cookie, you won't be able to sign in.

11.6 The app keeps you signed in using storage on your phone, which works the same way as the sign-in cookie. It is cleared when you sign out or uninstall the app.

12. How long we keep information

12.1 We keep personal information only as long as needed for the purposes in section 4, and to meet legal requirements. If we use your personal information to make a decision that directly affects you, such as closing your account, we keep the information behind that decision for at least one year. When we no longer need information, we delete it or make it anonymous.

12.2 How long we keep each type of information:

12.3 Deleted information may remain in our providers' system backups for a limited time, until the backups are overwritten in the normal cycle.

13. Deleting your account

13.1 You can delete your account yourself under Account → Login and security → Delete account, without contacting us. Deletion is permanent and can't be undone. For what happens to a subscription and upcoming bookings, see section 15.1 of the Terms of Service.

13.2 What we delete:

• your name and birth year and month;
• all your "About you" details and your profile photo;
• your blocks, invitations and notification settings;
• the messages you sent in event chats;
• your sign-in account.

Upcoming bookings are cancelled, with refunds as set out in section 15.1 of the Terms of Service.

13.3 What we keep (never shown to anyone):

• Unlinked from your account: booking and transaction records, for tax and accounting; and your feedback ratings, with any comments erased.
• To deal with possible disputes and claims: your consent records, and the minimum needed to show they are yours (your email address, name and IP address). Section 12.2 sets out how long.
• For safety: reports, including reports others made about you, and information that lets us recognize the same person again, such as a one-way hash of the email address. This stops anyone from wiping reports about them by deleting their account, and lets us recognize them if they sign up again.

13.4 Accounts closed for breaking our rules:

• We keep the email address, the date and the reason for closure, and the related reports and records, so the same person can't sign up again. We keep them for as long as the closure is in effect; if it's lifted, the account is treated like any other.
• A closed account can't be deleted in the app. Email us to ask for deletion, and we will delete everything else while keeping these items.

14. Your rights

14.1 Access. You may ask to see the personal information we hold about you, how it has been used, and to whom it has been disclosed. You can see most of it yourself under Account → Your profile.

14.2 Correction. You can edit your profile at any time. For anything you can't change yourself, such as an error in a booking record, email us. If needed, we will tell any organization that received the incorrect information about the correction.

14.3 Withdrawing consent: see section 5.3.

14.4 Deleting your account: see section 13.

14.5 How to make a request. Write to our Privacy Officer (section 2):

• to protect your information, we will first confirm your identity, usually by asking you to write from the email address on your account;
• we will respond within 30 days of receiving your request. If we need more time, we will extend as applicable privacy law allows and tell you why;
• access requests are usually free. If a minimal, reasonable fee applies, we will tell you the amount first.

14.6 Exceptions. Where applicable privacy law permits or requires, we may refuse all or part of an access request, for example where:

• the information would reveal someone else's personal information, such as who made a report;
• it relates to a legal proceeding or an investigation;
• it is protected by solicitor-client privilege.

If we refuse, we will tell you why.

14.7 Complaints. Please contact our Privacy Officer first (section 19). If you're not satisfied with the outcome, you can complain to:

• if you are in BC: the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca);
• if you are outside BC, or for processing across provincial or national borders: the Office of the Privacy Commissioner of Canada (priv.gc.ca).

15. Security and data breaches

15.1 We use reasonable security safeguards suited to how sensitive the information is, including:

• encrypted connections (HTTPS);
• passwords stored only as encrypted hashes;
• row-level database permissions, so guests can read only the data they are entitled to see;
• admin access limited to those who need it, with admin actions logged;
• payments handled by Stripe, so we never see card details;
• contractual confidentiality and security obligations for our service providers.

15.2 No system is completely secure. Please use a password you don't use anywhere else, and don't share your account. If you notice anything unusual on your account, change your password right away and contact us.

15.3 If a security incident involves your personal information, we will act promptly to contain it and assess its impact. If there is a real risk of significant harm to you, such as identity theft, financial loss or harm to your reputation, we will:

• notify you as soon as feasible, and tell you what steps you can take;
• report it to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia, as the law requires;
• where it may help reduce the harm, notify other organizations.

We keep a record of every security incident for 24 months.

16. Minors

16.1 DianDian is only for people aged 19 or older. We check your birth year and month when you sign up and each time you book. If you are under 19, you can't sign up or book. If you turn 19 this month, you can sign up and book from the first day of next month.

16.2 Where needed, we may ask to see photo ID to confirm your age. We only look at it and record the result; we don't keep a copy.

16.3 If we find that someone under 19 has signed up, we will close and delete the account, keeping only the minimum needed to prevent them signing up again, and refund any events that haven't taken place.

16.4 If you believe a minor is using DianDian, please let us know.

17. Third-party websites and services

Our website and app include some third-party links and features, such as:

• directions in Google Maps or Apple Maps;
• "Add to Google Calendar";
• Stripe's checkout and subscription management pages;
• venues' websites.

When you use one of these, the relevant details (such as the venue address or event time) go to that third party, and its own privacy policy applies. We are not responsible for third parties' practices.

18. Changes to this policy

18.1 We may update this policy when our service, the law or our service providers change. Each version has a version number (shared with our Terms of Service and Community Guidelines) and an effective date. We keep every version on file at its own fixed link, and you can ask us for a copy.

18.2 Material changes include collecting a new type of information, a new purpose, or sharing with a new type of recipient. For these:

• we will email you, and show a notice on the website and in the app, at least 30 days before the change takes effect, explaining what is changing;
• if a new purpose needs your consent, we will ask for it separately. We won't treat your continued use of the service as consent.

18.3 We may update the version number and date directly for corrections and clarifications that don't affect your rights.

18.4 Where the law requires otherwise, we will follow the law.

19. Contact and complaints

19.1 Privacy Officer: the operator of DianDian

• Email: diandian.event@gmail.com
• Mail: 422 Richards Street, Unit 170, Vancouver, BC V6B 2Z4
• Phone: +1 416-829-6597

19.2 How we handle complaints:

• tell us what your concern is, with any details or documents that help;
• we will acknowledge your complaint within 5 business days and give you a written response within 30 days;
• if we need more time, we will tell you why and when to expect our response.

If you're not satisfied with the outcome, you can contact the regulators listed in section 14.7.

20. Language

The official versions of this policy are in Simplified Chinese, Traditional Chinese and English, and the three versions have the same meaning. Korean and Japanese translations are also provided for reference only; if a translation differs from the English version, the English version prevails. The version in the language you used when you accepted it is the one that applies to you; if you accepted it in Korean or Japanese, the English version applies. We keep a record of that language (see section 3.5).