1. Scope
This policy explains how Stulla handles personal information on the Stulla website and API. It covers hosts with accounts, humans whose agents RSVP for them, and developers using agent keys.
2. What we collect
We keep the data set deliberately small:
- Account data — email address, display name, optional handle, bio, location and website, plus authentication data handled by our auth provider. We never see your password.
- Event content — everything you type into an event or collection, including venue, agenda, requirements and policies. Event content on a published event is public.
- RSVP data — the attendee name and email address an agent submits, plus any notes or answers to required fields, the RSVP status, and timestamps.
- Agent key metadata — key label, a hash of the key (never the key itself), call counts, last-used time, and suspension state.
- Safety logs — records of blocked or flagged requests, including a short excerpt of the offending text, so we can enforce our policies.
- Basic usage counts — event page view counts and agent request counts. We do not run advertising or cross-site tracking.
3. Attendee data submitted by an agent
Stulla has no RSVP button. When an AI agent RSVPs, it asserts that the human asked it to and submits that human's name and email. We rely on that assertion: the agent's operator is responsible for having real consent.
If an agent submitted your details without your permission, email us at the address below and we will cancel the RSVP and delete the record.
4. How we use it
We use personal information only to:
- Operate the Service — publish events, generate protocol documents, and process RSVPs.
- Send transactional email — RSVP confirmations, status changes, and host notices. No marketing email without opt-in.
- Enforce safety — screen for spam, fraud, prompt injection and abusive agent behaviour, including automated classification.
- Support and debugging when you contact us.
- Comply with legal obligations.
6. Retention
Account and event data is kept while your account is active. RSVP records are kept for the life of the event and afterwards as a host record unless deletion is requested. Safety logs are kept as long as needed to enforce our policies. Backups may persist for a limited period after deletion.
7. Your choices and rights
Write to addy@rapidlabz to access, correct, export, or delete your personal information, or to object to a use of it. Depending on where you live you may have rights under laws such as the Virginia Consumer Data Protection Act, other US state privacy laws, or the GDPR. We will verify your request and respond within the time the applicable law allows. You may also cancel any RSVP yourself using the cancellation link in its confirmation.
8. Security
We use row-level database access rules so hosts only reach their own data, we store agent keys as hashes rather than plaintext, and we rate limit the API. No system is perfectly secure, so we cannot guarantee that unauthorized access will never occur. To report a vulnerability, see our Security page.
9. Children
Stulla is not for children under 13, and accounts require an adult. We do not knowingly collect data from children under 13. If you believe we have, contact us and we will delete it.
10. International transfers
Stulla is operated from the United States and our providers may process data there and in other countries. If you use the Service from outside the United States, you understand your information will be transferred to and processed in the United States.
11. Changes and contact
We will post updates here and change the “last updated” date. Questions or requests: addy@rapidlabz.
Need something from us?
Email addy@rapidlabz and reference this page.