Privacy Policy

Eventasaurus operates the ticketing platform. Each event organizer (“Organizer”) runs their own events on it. For the attendee data collected through an event — names, email addresses, order and check-in records — the Organizer is the controller of that data and we act as their processor. For your Eventasaurus account itself, we are the controller.

In practice: if you want an event’s attendee list changed or your booking discussed, the Organizer is the right contact. If you want your Eventasaurus account deleted, come to us.

Account information. Your email address and a hashed password when you sign up. Organizers also provide an organization name. We never store passwords in readable form.

Order information. When you buy or claim a ticket or pass: the purchaser name and email, the attendee name and email if different, what was purchased, the amount paid, any promo code used, and a Stripe payment reference. Organizers may configure additional questions on their events; whatever they ask for is stored with the order and visible to that Organizer.

Payment information. Card numbers, expiry dates, and security codes are entered directly into Stripe’s hosted checkout and never reach Eventasaurus servers. We store only what Stripe returns to us: a payment identifier, the amount, the currency, and the status. We cannot see or charge your card.

Event activity. Reservations you make with a pass, sessions you star or add to your personal schedule, and check-in records (when and where a ticket or pass was scanned, and by which staff account).

Content you upload. For Organizers: festival logos, banners, presenter photos and biographies, venue details, and schedule content.

Help chat and contact. If you use the help chat, your messages are sent to our AI provider to write an answer. We don’t save chats on our servers. If you choose “Talk to a person”, the conversation and your email address are emailed to our support team. We also keep messages you send through our contact form, and the email address you give when you join an event’s waitlist.

Technical data. Standard server and security logs — IP address, browser type, pages requested, timestamps — kept to operate the service, debug problems, and detect abuse. We use cookies that are necessary to keep you signed in and to run checkout. We do not use advertising or cross-site tracking cookies. We count page visits with Vercel Web Analytics, which uses no cookies and does not identify you or follow you across sites.

• To create and secure your account, and to sign you in.
• To process orders, issue tickets and passes with their QR codes, and send confirmation emails.
• To let you view your tickets, passes, reservations, and personal schedule.
• To let Organizers and their check-in staff admit you to the events you paid for.
• To calculate and collect our platform fee, and to support Organizer payouts.
• To send transactional messages about your order or an event you are attending — for example a confirmation, a receipt, or an Organizer’s notice that an event has moved.
• To deliver messages an Organizer sends about their event, and a reminder the day before it starts. These include an unsubscribe link.
• To prevent fraud, duplicate scans, and abuse, and to meet legal and tax obligations.

We do not sell your personal data, rent it, or share it with advertisers. We do not use your data to train machine learning models.

The Organizer of the event you bought into. They receive your name, email address, what you purchased, and your check-in status, because they need it to run the event and support you. They are bound by our Terms of Service to use it only for that purpose. Organizers cannot see data from other organizations’ events.

Service providers who process data on our behalf, under contract:

• Stripe: payment processing, fraud screening, and Organizer payouts. Stripe is an independent controller of payment data under its own privacy policy.
• Supabase: database, authentication, and file storage (hosted in the United States, US West).
• Resend: delivery of transactional email such as order confirmations and password resets.
• Vercel: application hosting and content delivery.
• Anthropic: the AI model behind the help chat and the translation of Organizers’ event text. Chat messages and text sent for translation are processed to write answers and translations and, under Anthropic’s commercial terms, are not used to train its models.

Apps an Organizer connects. If an Organizer connects an app, script, or AI assistant to their account (with an API key or by signing in with Eventasaurus), that app can access the Organizer’s event data with the Organizer’s permissions. The Organizer chooses these apps and can revoke them at any time.

Legal and safety. We may disclose data when we are legally required to, or where it is necessary to investigate fraud or protect the rights and safety of attendees, Organizers, or the platform. If Eventasaurus is ever acquired or merged, account and order data may transfer as part of that transaction; we will give notice before your data becomes subject to a different privacy policy.

Data is stored on servers in the United States. If you are accessing the platform from outside the US, your information will be transferred there.

We keep account data while your account is open. Order, ticket, and check-in records are retained after an event because Organizers need them for reconciliation and we need them for financial and tax records — typically seven years — after which they are deleted or anonymized. Server logs are kept for a short operational window. Deleted content may persist in encrypted backups for a limited period before rotating out.

Data is encrypted in transit (TLS) and at rest. Access between organizations is enforced at the database level with row-level security, so one organizer cannot read another’s attendees. Check-in tokens are signed and single-use. Staff accounts are limited to check-in functions and cannot see financial data. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant authorities as required by law.

You can access and correct most of your information by signing in. Depending on where you live, you may also have the right to request a copy of your data, ask us to correct or delete it, object to or restrict certain processing, or withdraw consent.

To request deletion or a copy of your data, email privacy@eventasaurus.app from the address on your account. We will respond within 30 days. Note that we may need to keep order and payment records to meet legal and accounting obligations even after an account is closed, and we may not be able to delete data an Organizer holds as controller — for those requests, contact the Organizer directly.

Transactional email about an order you placed is not marketing and cannot be unsubscribed from while the order is active. We do not send marketing email without your consent.

Eventasaurus is not directed at children under 13, and we do not knowingly collect their personal information. Tickets for children are normally purchased by a parent or guardian under their own account. If you believe a child has given us personal data, contact us and we will delete it.

We will update this page when our practices change and revise the “last updated” date above. If a change materially affects how we use your data, we will notify account holders by email.

Privacy questions, data access requests, and deletion requests: privacy@eventasaurus.app

By mail: Eventasaurus LLC, PO Box 7, Sedona, AZ 86339