Version 3.0 · Effective [DATE] · Replaces Version 2.0 (August 21, 2026)
This Privacy Policy explains what personal information NContro ("NContro," "we," "us") collects when you use our website, app and related services (the "Platform"), how we use and share it, and the choices and rights you have. It is written to meet the Virginia Consumer Data Protection Act and applies to everyone who uses NContro.
Summary
We collect what we need to run bookings: your account details, event details, messages and payment records.
We do not sell your personal information, and we do not use it for targeted advertising.
Card numbers go straight to Stripe, our payment processor. We never see or store them.
You can access, correct, download or delete your information, and appeal if we say no.
To delete your account, email us from your account email (see Section 8).
1. Who We Are
1.1 NContro is an online marketplace that connects people planning events ("Customers") with event vendors ("Vendors").
1.2 NContro is the controller of the personal information described in this Policy. Contact details are in Section 18.
2. Information We Collect
Information you give us
Account details: name, email address, phone number, password (stored only in scrambled, hashed form), and your role (Customer or Vendor).
Event details: event date, location, guest count, budget, preferences and notes.
Messages you send through NContro, and reviews and ratings you post.
Vendor business details: business name, address, service area, descriptions, menus, prices, photos and other listing content.
Vendor verification documents: business licenses, insurance certificates, permits and certifications, and, for transportation Vendors, driver's licenses and vehicle registrations (see Section 12).
Vendor payout and tax details, which Vendors give directly to Stripe.
Anything you send us when you contact support.
Information from payments
Payments are handled by Stripe. Card numbers are entered on Stripe's pages and never reach NContro. Stripe sends us limited details: payment status, amount, transaction IDs, the card brand and last four digits, and billing ZIP or country.
Information collected automatically
Device and log data: IP address, browser, device type, operating system, pages visited, referring site, and error reports.
Usage data: searches, pages and vendors viewed, and booking steps.
Cookies and similar technologies (see Section 6).
Information from others
Other users, for example a review a Customer writes about a Vendor.
Services you choose to connect, such as a Vendor's Tripleseat calendar (see Section 13).
What we don't collect
We do not collect precise location from your device. We use the city or ZIP code you enter to show nearby Vendors. We do not knowingly collect sensitive data as defined by Virginia law, such as health, religious, biometric or precise geolocation data.
3. How We Use Information
We use personal information to:
create and run your account and keep you signed in;
show Vendor listings and help Customers find, message and book Vendors;
process payments, refunds, payouts and chargebacks;
send booking confirmations, reminders, receipts and account notices;
verify Vendors and keep the Platform safe from fraud and abuse, including reviewing messages and booking records when we investigate a report or a suspected booking or payment outside the app;
provide customer support and resolve disputes;
understand how the Platform is used, fix problems and improve it;
send marketing emails, only if you have not opted out (see Section 11);
meet legal, tax and accounting obligations and enforce our terms.
We use your information only for these purposes or for purposes we tell you about when we collect it.
4. How We Share Information
We do not sell personal information. We do not share it for targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects.
With other users
Vendor listings, including business name, photos, prices, ratings and reviews, are public.
When a Customer requests or books a Vendor, the Vendor sees the Customer's name, event details and messages, and contact details needed to deliver the service.
Reviews are public and show the name on the reviewer's account.
With service providers
These companies process information for us under contracts that limit how they can use it:
Stripe: payments, refunds and Vendor payouts.
Resend: sending email.
Sentry: error monitoring.
Emergent: app hosting, database and storage.
PostHog (operated through Emergent): usage analytics and session replays (see Section 6).
Google (Gemini AI models): reading menus and documents Vendors upload, and similar features (see Section 14).
With connected services
If you connect a third-party service, we exchange only the information needed for it to work (see Section 13).
For legal reasons and safety
We may share information to comply with law, a subpoena or court order; to respond to payment disputes and chargebacks; to protect the rights, safety or property of NContro, our users or others; or to investigate fraud.
In a business transfer
If NContro is involved in a merger, acquisition, financing or sale of assets, personal information may transfer as part of that deal. The new owner must honor this Policy for information collected under it.
5. Categories at a Glance
Identifiers and contact details (name, email, phone, address): used for accounts, bookings and support. Shared with the other party to a booking, Stripe, Resend and Emergent.
Commercial information (bookings, payments, refunds): used for bookings, payments and records. Shared with the other party to a booking, Stripe and Emergent.
Communications (messages, reviews, support requests): used for bookings, safety and support. Shared with the other party to a booking; reviews are public.
Vendor business and verification information: used for listings, verification and safety. Listings are public; verification documents are not.
Device, usage and analytics data: used to run, secure and improve the Platform. Shared with Emergent, PostHog and Sentry.
6. Cookies and Analytics
6.1 We use cookies and similar technologies that are needed to keep you signed in, remember your settings and keep the Platform secure.
6.2 We use PostHog, through our hosting provider Emergent, to understand how people use the Platform. This includes session replays, which record pages viewed, clicks and scrolling so we can find and fix problems. Payment card details are entered on Stripe's pages and are never recorded.
6.3 We do not use advertising cookies or share data with ad networks.
6.4 You can block or delete cookies in your browser settings. Some features, such as staying signed in, won't work without them.
7. Your Privacy Rights
7.1 Under the Virginia Consumer Data Protection Act, Virginia residents have the right to:
confirm whether we process your personal information and access it;
correct inaccurate personal information;
delete personal information you provided or that we hold about you;
get a copy of your information in a portable, usable format;
opt out of the sale of personal information, targeted advertising and certain profiling. We do none of these.
7.2 We honor these requests for every NContro user, wherever you live.
7.3 How to make a request. Email [email protected] with the subject "Privacy request" from the email address on your account, and tell us what you want. We may ask for more information to confirm your identity. We will not charge you for up to two requests in a 12-month period.
7.4 Timing. We respond within 45 days. If we need more time, we may extend this once by another 45 days and will tell you why within the first 45 days.
7.5 Appeals. If we deny your request, you can appeal by replying with the subject "Privacy appeal." We will answer in writing within 60 days and explain our decision. If we deny your appeal, you can file a complaint with the Virginia Attorney General at https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint.
7.6 We will not deny you service, charge you a different price or give you a lower level of service for exercising these rights.
8. Deleting Your Account
8.1 To delete your NContro account and the personal information linked to it, email [email protected] with the subject "Delete my account" from the email address on your account. You can do this from any device, without the app.
8.2 We confirm your request and delete your account within 45 days. Your profile, listing and messages are removed from the Platform.
8.3 We keep some records after deletion where the law or our legitimate business needs require it: booking, payment, refund, payout and tax records; records needed for an open dispute, chargeback or investigation; and information needed to prevent fraud or enforce a ban. These are kept only as long as needed, generally no more than 7 years, and are not used for anything else.
8.4 Reviews you wrote are removed with your account.
9. How Long We Keep Information
9.1 We keep account information while your account is active.
9.2 After you delete your account, we keep only the records described in Section 8.3.
9.3 Analytics data and session replays are kept for no more than 12 months.
9.4 When we no longer need information, we delete it or remove the details that identify you.
10. Security
10.1 We protect personal information with reasonable administrative, technical and physical safeguards, including encryption in transit, hashed passwords and access limited to people who need it.
10.2 No system is completely secure. If a breach affects your personal information, we will notify you and the authorities as required by Virginia law.
11. Emails and Messages
11.1 We send service messages about your account, bookings and payments. You can't opt out of these while you have an active account.
11.2 You can stop marketing emails at any time with the unsubscribe link in any marketing email.
11.3 We do not currently send text messages. If we add them, we will ask for your consent first, and we will not share your phone number with anyone for their marketing.
12. Vendor Verification Data
12.1 Vendors in our verification program may give us licenses, insurance certificates, permits, certifications, portfolio samples, expiration dates and, for transportation Vendors, driver's licenses and vehicle registrations.
12.2 We use these only to verify Vendors, prevent fraud, meet legal requirements and keep the Platform safe. Only authorized NContro staff and service providers can see them, and they are never public.
12.3 Vendors must keep this information accurate and update it when anything changes or expires.
13. Connected Services
13.1 If you connect a supported service to your account, we exchange only the information needed for it to work.
13.2 For calendar-availability integrations such as Tripleseat, we import only what we need to check a Vendor's availability: event dates, times, status and internal event IDs. We do not import Tripleseat customer emails, phone numbers, private notes, payment details or guest information.
13.3 You can disconnect a service at any time, and we stop exchanging data with it. Records already imported may remain in your account history and follow Section 9.
14. Automated and AI Features
14.1 Some features use automated tools and AI, provided by Google's Gemini models, for example reading a menu a Vendor uploads or pulling images from a Vendor's website.
14.2 Files sent to these features are processed only to provide the feature.
14.3 We do not use automated systems to make decisions that have legal or similarly significant effects on you. Decisions on verification, moderation, refunds and account suspension are made by NContro staff.
15. Children
NContro is for adults. You must be 18 or older to create an account. We do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it.
16. Other Websites
The Platform may link to other websites and services. Their privacy practices are their own, so review their policies before you share information with them.
17. Changes to This Policy
17.1 We may update this Policy. We will post the new version with its effective date.
17.2 For material changes, we will notify you by email or in the app before they take effect.
18. Contact Us
Questions or requests about your privacy:
NContro 2000 N Beauregard St #345, Alexandria, VA 22311 [email protected] · (901) 573-7661 https://www.ncontro.com