Privacy Policy

Eleventy is operated by Lulo Consulting Inc., doing business as Eleventy Software (“Eleventy”, “we”, “us”), a company in British Columbia, Canada. This policy covers our websites and apps: eleventyapp.com, the Eleventy dashboard and staff app, and the booking sites we host for businesses (for example, yourbusiness.eleventyapp.com).

We handle personal information in two roles:

• For businesses and their teams, we decide how we use the information, and this policy applies in full. A “business” is a company that has an Eleventy account; its “team” is the owner, managers and staff who sign in.
• For the customers of those businesses, the business decides what to collect and how to use it, under its own privacy practices. We keep and process that information for the business, as our Terms of Service and this policy describe. See Information about customers of a business.

When you book with a business that uses Eleventy, or ask it for a quote, you give your information to that business. The business is in charge of it: it decides what it asks for and how it uses it, under its own privacy practices. Eleventy keeps and processes that information for the business, to run its booking site and its dashboard. For questions about your booking, or to see, correct or delete your information, contact the business first. We help businesses answer these requests.

On a booking site, the business collects through Eleventy:

• your name, email address and phone number;
• the event: dates, address, the letters and extras you choose, the price, and any notes and event details you send;
• your payments: you pay the business directly, through its own Stripe account. Stripe collects your card details; Eleventy never sees your full card number. We store the payment status and amounts;
• your rental agreement, if the business asks you to sign one (Pro plan): BorealSign, our e-signature provider, keeps the signed agreement with the time you opened and signed it, your IP address and your browser details.

Addresses you type are sent to Google to suggest matching addresses, and the event address is sent to Google to work out the road distance for the delivery price. We send booking emails (confirmations, reminders, signing requests) for the business, through Resend.

Booking sites also use PostHog, the same as our other sites (see Cookies). On a booking site you are not identified by name: PostHog uses a random id. Session replays hide what you type into forms, and card details are entered in Stripe's own secure frame, which is never recorded. Eleventy uses this information to improve booking sites.

We use cookies and browser storage for these purposes. We don't use them for advertising.

• Sign-in (dashboard and staff app): cookies that keep you signed in. Eleventy can't work without them.
• Analytics (all our sites, booking sites included): PostHog stores a random visitor id in a cookie and in your browser's local storage, so it can count visits and connect the pages of one visit.
• Payments and security: on payment pages, Stripe sets its own cookies to prevent fraud. A business owner who previews their booking site before it opens gets a preview cookie.
• Maps: on pages with address search or a map, Google provides the search and the map under its own privacy policy.

You can block or delete cookies in your browser settings. If you block sign-in cookies, you can't sign in. You can also block analytics with most ad and tracking blockers.

• To provide Eleventy: booking sites, bookings, payments, emails, contracts and the dashboard.
• To bill businesses for their subscriptions.
• To give support and to answer messages.
• To keep Eleventy secure: to stop bots, fraud and abuse, and to investigate problems.
• To understand how Eleventy is used, to fix errors and to improve it.
• To tell businesses about changes to Eleventy, their account and these policies. We send marketing email only to businesses and people who asked for it, and every marketing email lets you stop them.
• To meet our legal obligations, such as tax and accounting records.

We use the information of a business's customers only to provide Eleventy to that business, to keep it secure and to improve it. We don't contact a business's customers for our own purposes.

We never sell personal information. We share it only in these cases:

• With the business you book with. What you send on a booking site goes to that business, and its team sees it in its dashboard.
• With our service providers (sub-processors, listed below), which process it for us under contracts that protect it.
• When the law requires it. We answer a request from the police, a court or a government only when the law requires us to, and we tell the people concerned unless the law does not let us.
• To protect people. To investigate fraud, abuse or a threat to someone's safety, or to defend our legal rights.
• If our business changes hands. If Eleventy is sold or merged, the information goes to the new owner, under this policy. We tell businesses before that happens.
• With your permission, in any other case.

Our own team sees the information of a business, including its signed rental agreements, only to give support, to keep Eleventy working and secure, or when the law requires it. We log every time our support tools open a business's dashboard.

These services process personal information for us. We update this list before a new service receives the information of businesses or their customers.

• Supabase

  Database, sign-in and file storage

  Information: Everything Eleventy stores: accounts, bookings, customers, settings, logos and photos

  Location: United States

• Vercel

  Hosting, request logs and the bot check on signup

  Information: Requests to our sites, including IP address and browser details

  Location: United States

• Stripe

  Payments on each business's own Stripe account, and Eleventy's subscription billing

  Information: Payment and billing details, and the name and email given at checkout

  Location: United States

• Resend

  Sending email

  Information: Recipient names and addresses, and the content of the emails we send

  Location: United States

• PostHog

  Product analytics, session replay and error reports

  Information: Pages viewed, clicks, session recordings, browser details, and the email of signed-in dashboard users

  Location: United States

• Google Maps Platform

  Address search, maps and road distances for delivery prices

  Information: Addresses typed into address fields, and event addresses

  Location: United States

• BorealSign (on Railway)

  Electronic signature of rental agreements (Pro plan)

  Information: The signer's name and email, the booking details in the agreement, the signed document and its audit trail (times, IP address, browser)

  Location: United States

• HubSpot

  Scheduling calls with Eleventy's team

  Information: The name, email and answers given when booking a call

  Location: United States

Eleventy and its sub-processors store and process information in the United States. Information stored there is protected by our contracts with these providers, but the courts, police and national security authorities of the United States may be able to get it under the laws of that country.

• Account and booking information, including a business's customers and signed rental agreements: for as long as the business has its account. We delete it 60 days after the account ends, unless the business asks for it earlier (see our Terms of Service, Change 9). Copies in our backups are removed as the backups expire, within 30 days after that.
• Billing records: for as long as tax and accounting laws require, usually six years.
• Analytics: PostHog keeps events for up to seven years and deletes session replays after 90 days at the latest. We delete a person's analytics data when they ask.
• Messages to us (the website form and email): for as long as we need them to answer and follow up, or until you ask us to delete them.
• Email sending records and server logs: for a short time, under our providers' retention settings.

• Every connection to our sites is encrypted (HTTPS).
• Our database and files are encrypted at rest by our provider, and backed up every day.
• Secret keys, such as private calendar links and e-signature access keys, are encrypted again in our database.
• Card numbers go to Stripe directly and never reach our servers.
• Only the people who run Eleventy can reach its production systems.

No system is perfectly secure. If a breach of security creates a real risk of significant harm, we tell the people affected and the regulators, as the law requires, and we tell the business when its customers' information is affected.

You can ask us to tell you what personal information we have about you, to give you a copy, to correct it, or to delete it. You can also withdraw your consent to a use of your information, though some of Eleventy may then stop working for you. Businesses can change most of their own information in the dashboard.

To make a request, email support@eleventyapp.com. We may ask you to confirm who you are. We answer within 30 days. If you are a customer of a business, we may send your request to that business, because it is in charge of your information.

These rights apply wherever you live. If you live in a US state with a privacy law, you have the rights that law gives you, and we don't treat you differently for using them. We don't sell or share personal information for targeted advertising.

If you aren't happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia, the Commission d'accès à l'information du Québec, or the privacy regulator where you live.

Eleventy is for businesses and the adults who book with them. We don't knowingly collect information from children under 13. If you think a child gave us information, email support@eleventyapp.com and we will delete it.

We may update this policy. We post the new version on this page with a new date. If a change is significant, we also email the businesses that use Eleventy before it takes effect.

Our Privacy Officer, Daniel Garcia, is responsible for how Eleventy handles personal information. Send questions and requests to: