We collect information you provide directly:

• Account information: name, email, and password when you create an account
• Purchase information: name and email for ticket purchases (no account required)
• Host information: identity, tax, and bank details collected by our payment processor for verification and payouts
• Event information: details about events you create as a host
• Usage and diagnostic data: how you interact with the platform, plus error and performance data used to keep it working

We use the information we collect to:

• Process purchases and deliver digital tickets
• Facilitate event check-in via QR scanning
• Send transactional email (confirmations, event updates, account notices)
• Calculate, collect, and remit sales tax as a marketplace facilitator
• Review and moderate event listings
• Diagnose errors, prevent abuse, and improve the platform

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share data only with the service providers (“sub-processors”) that run the platform, and only as needed for them to do their job:

• Stripe: payments, host identity/bank verification, and sales-tax calculation
• Supabase: database, authentication, and file storage (hosting infrastructure)
• Resend: delivery of transactional email
• Sentry: error and performance monitoring (diagnostic data, which may include IP address and device info)
• Mapbox: map display on event pages (receives approximate location to serve map tiles)
• Upstash: rate limiting to protect the platform from abuse

We also share attendee names and check-in status with the event host for events you attend, and we may disclose information when required by law.

We use essential cookies to keep you signed in and remember your display preferences (like light or dark mode). We do not use advertising cookies, cross-site trackers, or third-party product-analytics tools. The only behavioral data we collect is diagnostic error and performance monitoring (via Sentry), used to keep the platform reliable, never to profile you for advertising.

We protect your information with industry-standard measures, including:

• Encrypted data transmission (HTTPS)
• Row-level security on every database table
• HMAC-signed ticket and access links with timing-safe verification
• Rate limiting on sensitive endpoints
• Payment and identity data handled by Stripe, not stored on our servers

You have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your account and data
• Export your data in a portable format
• Opt out of non-essential communications

California residents (CCPA/CPRA): because we do not sell or share personal information for cross-context behavioral advertising, there is nothing to opt out of on that front, but you retain all the rights above. To exercise any of them, email privacy@occasio.events from your account address.

We retain your information for as long as your account is active or as needed to provide the Service. Transaction and tax records are retained for the period required by financial and tax law, even after account deletion. You can request deletion at any time by contacting privacy@occasio.events.

The Service is not directed to individuals under 13, and we do not knowingly collect personal information from them. If we learn we have, we will delete it promptly.

We may update this Privacy Policy from time to time and will post material changes on the platform. Continued use after changes constitutes acceptance of the updated policy.

Questions or requests about your privacy? Reach us at privacy@occasio.events.