Privacy Policy
Cova (covaco.io) — Last updated May 2026
1. Who we are
Cova is a UK-based event vendor marketplace operated by Cova (covaco.io). We connect event planners with vendors across the UK.
If you have any questions about this policy, contact us at hello@covaco.io.
2. What data we collect and why
Vendors
When you join the vendor waitlist or create a vendor profile, we collect:
- Your name and email address
- Your vendor type and primary city
- Any portfolio content, pricing, or profile information you provide
We use this to manage your waitlist spot, notify you at launch, and (once live) operate your vendor profile on the platform.
Event planners
When you use Cova to search or enquire with vendors, we collect:
- Your name and email address
- Event details you provide (date, type, budget, location)
- Messages sent through the platform
We use this to facilitate enquiries and bookings between you and vendors.
All users
When you visit covaco.io we may also collect:
- Basic analytics data (pages visited, browser type, device type) via privacy-respecting analytics tools
- Cookies necessary for the site to function
3. How we store your data
Your data is stored securely using Supabase, a third-party database provider with servers in the EU. We take reasonable technical measures to protect your data from unauthorised access.
We do not sell your data to third parties. Ever.
4. Third-party services we use
Running Cova requires us to share limited data with the following trusted third parties:
- Supabase — database and authentication (EU-based servers)
- Stripe — payment processing. Stripe handles all payment data directly; we never store card details. Stripe's privacy policy is at stripe.com/gb/privacy
- Brevo — transactional email (confirmation emails, notifications)
- Clerk — user authentication and sign-up. Clerk's privacy policy is at clerk.com/privacy
- Vercel — website hosting
Each of these providers has their own privacy policy and data processing terms. We only share the minimum data necessary for each service to function.
5. How long we keep your data
- Waitlist data is kept until you ask us to remove it or until 12 months after our launch date, whichever comes first
- Account data is kept for as long as your account is active
- If you delete your account, we will remove your personal data within 30 days, except where we are required to retain it for legal or financial purposes (e.g. records of completed transactions)
6. Your rights under UK GDPR
You have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your data (the “right to be forgotten”)
- Restrict how we process your data
- Object to processing based on legitimate interests
- Portability — receive your data in a portable format
To exercise any of these rights, email us at hello@covaco.io. We will respond within 30 days.
If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
8. Children
Cova is not directed at anyone under the age of 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us at hello@covaco.io and we will delete it promptly.
9. Changes to this policy
We may update this policy from time to time. When we do, we will update the “last updated” date at the top of this page. If changes are significant, we will notify you by email.
10. Contact
For any privacy-related questions: hello@covaco.io