Privacy Policy

Who we are

OurStudentParty (“OurStudentParty,” “we,” “us”) is event software for the parent committees, PTOs, booster clubs and school groups that organize student events such as post‑prom and all‑night graduation parties. OurStudentParty is operated by Tall Timbers Group LLC, 21784 Tall Timbers Rd, Nisswa, MN 56468.

This policy covers ourstudentparty.com, every event site hosted on it (for example ourstudentparty.com/yourschool), our admin tools, and the emails we send.

Organizers and us

Each event is run by an Organizer — the group that created the event on OurStudentParty. When you register for, volunteer at, sponsor or donate to an event, the Organizer decides what to ask you and how to use your answers for their event. We store and process that information on the Organizer's behalf and under their instructions, as their service provider.

For information about Organizer accounts themselves (the people who log in to run an event), and for our own website, we are responsible for it directly.

If you have a question about how a particular event uses your information, contact that event's Organizer. You can always contact us too, and we will help.

What we collect

From Organizers and their committee members

• Name, email address, phone number and the role you hold on an event
• Sign‑in details: password (stored only as a secure hash) or one‑time sign‑in codes and links
• A record of your agreement to our Terms: which version you accepted, when, and the IP address and browser you used
• Your group's name, event details, site content and images you upload
• Bank details for receiving payouts. These are passed to Mercury, our bank, to set up transfers to your group. We keep only the bank name, account holder name, account type and last four digits of the account number.

From people who register, volunteer, sponsor or donate

• Parent or guardian name, email address and phone number
• Student name, grade and school, when the Organizer asks for them
• Details the Organizer asks for on the registration form, such as dietary needs and allergies, shirt size or mailing address
• Volunteer shifts and supplies you sign up for; sponsor business name and logo
• Payment records: amount, date, ticket type and the last four digits and brand of the card. Card details are typed directly into our payment processor's secure fields (or provided by Apple Pay or Google Pay) and never reach our servers. We do not store full card numbers or security codes.

Automatically

• Basic technical information needed to run and secure the service: IP address, browser type, pages requested, and error and performance logs
• Strictly necessary cookies (see Section 8)
• Anonymous page‑view counts through Plausible Analytics, which uses no cookies and does not identify you or follow you to other sites

When you ask us to resend a receipt

• If you use the receipt lookup on our help page, Help recognizing STDT_PARTY* card charges,, we use the email address you enter only to find recent purchases made with that address and to email their receipts to it. Receipts are only ever sent to the address used at checkout, never shown on the page.
• The page gives the same response whether or not we find a match, so it cannot be used to learn whether someone has bought anything.
• To prevent abuse, requests are rate‑limited by email address and by network address. We delete the entered email address once the request is finished, and keep a one‑way scrambled (hashed) form of it, used only for those limits, for no more than 30 days.

We do not collect precise location, contacts, photos from your device, or any information from social media accounts.

How we use it

We use personal information only to:

• Run events: take registrations, process payments, send receipts and confirmations, manage volunteers and sponsors, and show Organizers their event records
• Send service emails, such as receipts, sign‑in codes and the Organizer's daily activity digest
• Keep the service secure, prevent fraud and spam, and meet legal, tax and payment‑network obligations
• Provide support when you contact us
• Understand and fix problems with the service, using aggregated or de‑identified technical data

We send marketing emails about OurStudentParty only to Organizers who have opted in, and every one of those emails has an unsubscribe link. We never send marketing to registrants, parents or students.

What we never do

• We never sell or rent personal information, and we never “share” it for cross‑context behavioral advertising as that term is defined in California law.
• We never show advertising on OurStudentParty or on event sites, and we do not use third‑party advertising or tracking pixels.
• We never use student information to build profiles, target anyone with ads, or for any purpose other than the event it was collected for.
• We never give personal information to colleges, recruiters, data brokers or marketers.
• We never use registrant or student information to train AI models.

Students and children

OurStudentParty is designed to be used by adults: parents, guardians, school staff and adult volunteers. It is not directed to children under 13, and we do not knowingly allow children under 13 to create accounts or submit their own information.

Information about a student is normally provided by the student's parent or guardian, or by the Organizer. Where an Organizer allows students 13 or older to register themselves, the Organizer is responsible for obtaining any parental consent their school or local law requires.

If you believe a child under 13 has given us information directly, email [email protected] and we will delete it.

When a school or district uses OurStudentParty, we will act as a “school official” with a legitimate educational interest under FERPA, use education records only for the purposes the school authorizes, and sign a student data privacy agreement on request.

Who we share it with

We share personal information only with the event's Organizer, with the service providers below who help us run OurStudentParty, and where the law requires it. Each provider is bound by contract to use the information only to provide its service to us.

We may also disclose information if required by law, subpoena or court order; to protect someone's safety; or as part of a merger or sale of our business, in which case this policy will continue to apply to your information and we will notify Organizers in advance.

Cookies

We use only cookies that are strictly necessary for the service to work: keeping you signed in, protecting forms against forgery, and remembering choices you make during registration. We do not use advertising cookies or analytics cookies — the visit counts we keep come from Plausible, which sets no cookies — so there is no cookie banner to click through.

Our bot protection (Cloudflare Turnstile) and payment form (Stripe) may set their own strictly necessary cookies, used for security and fraud prevention, while you use them. Our Cookie Notice lists them.

The Site Assistant (AI)

Organizers can chat with the Site Assistant, powered by Claude from Anthropic, to get help using OurStudentParty and to edit their event site. To answer, the assistant receives the Organizer's messages, the content of their event site, their event's setup (such as ticket types, volunteer jobs, sponsor levels, questions and promo codes) and total counts of registrations. It can also read a web page when the Organizer pastes its link into the chat.

The assistant does not receive individual registrant, student, volunteer, donor or payment records. To suggest the short name that appears on card statements, we also send Claude the organization's name, and nothing else. Anthropic does not use this content to train its models. We keep assistant conversations while the Organizer's account is open so we can provide support and fix problems, and we delete them sooner if the Organizer asks.

Page edits are saved as a draft for the Organizer to review before they go live, and changes to event details or site style can be undone.

How long we keep it

• Event records (registrations, answers, volunteers) are kept while the Organizer's account is active so they can refer back and copy the event next year. Organizers can delete an event's records at any time.
• Dietary and allergy notes are deleted automatically 90 days after the event ends unless the Organizer chooses to delete them sooner.
• Payment and tax records are kept for seven years to meet accounting, tax and payment‑network rules.
• Closed accounts: we delete or de‑identify the remaining personal information within 90 days of an account closing, apart from records we must keep by law.
• Receipt lookup requests: the email address entered is deleted when the request is finished, and the hashed form used for rate limits within 30 days.
• Technical logs are kept for no more than 90 days.

Security

• All traffic is encrypted in transit with HTTPS, and data is encrypted at rest in Microsoft Azure.
• Access to event records is limited by role: full admin, regular admin, read‑only and volunteer coordinator.
• Only a small number of our staff can access production data, only when needed to provide support or keep the service running, and that access is logged.
• Payment card data is handled by PCI DSS‑compliant processors and never stored by us.

No system is perfectly secure. If a breach affects your personal information, we will notify the affected Organizers and, where required, affected individuals and authorities without undue delay.

Your rights and choices

Wherever you live, you can ask us to:

• Show you the personal information we hold about you
• Correct it
• Delete it
• Give you a copy in a portable format
• Stop sending you optional emails

Email [email protected] or use the Delete My Data link. We will confirm your request within 10 days and complete it within 45 days. If your information belongs to an Organizer's event, we may pass your request to them and help them fulfil it. We will not treat you differently for making a request.

A parent or guardian may make any of these requests on behalf of their child.

State privacy laws

Residents of California, Colorado, Connecticut, Virginia and other states with consumer privacy laws have the rights in Section 12, plus the right to opt out of the sale or sharing of personal information and of targeted advertising. Because we do none of those things, there is nothing to opt out of — but you can still use the Do Not Sell or Share My Info link to record your choice, and we honor Global Privacy Control browser signals.

You may use an authorized agent to make a request. If we deny your request, you can appeal by replying to our decision; we will respond within 45 days.

Changes to this policy

If we make a material change, we will email Organizers and post a notice on this page at least 30 days before it takes effect. We will never apply a change that weakens these protections to information we collected before the change without your consent. Earlier versions of this policy are available on request.

Contact us

Tall Timbers Group LLC
Attn: Privacy
21784 Tall Timbers Rd
Nisswa, MN 56468

[email protected]