Privacy

PRIVACY POLICY

Last updated: 25 September 2026.

This policy explains how ProstEvents processes personal data for ticket intermediation and venue listings, in line with Brazil’s LGPD and the EU GDPR where they apply.

Creating an account or using the Platform involves processing needed to perform the service. Optional features (guest-list visibility and event-invite notifications) can be turned off in settings.

1. Data we collect

Account: name, email, phone, hashed password, account type, operating country (organizers, landlords and musicians) and, if you use Google, Google ID, name and email; if you use Apple, Apple ID, name and the email you authorize (which may be an Apple private relay address).

Profile: display name, photo, city, bio, social links, musician Spotify/SoundCloud links, and organizer tax details if provided.

Tickets and payments: event, quantity, amounts, currency, payment status, Stripe session/payment IDs. We do not store full card numbers. Organizers have a Stripe Connect account ID and payout preference (automatic or manual).

Guest lists and invites: who bought a ticket, visibility preference (name/photo or anonymous) and whether you want notifications about events you attended.

Venues: listing data and contact phone/email published by the landlord.

Technical: IP, browser, pages, language, session and security cookies (including CSRF). Precise device geolocation is not required.

iOS app: if you allow notifications, we store the device push token, language and app version only to send alerts about your account. Camera and photos are used only when you choose to scan a QR code or upload an image.

2. Purposes and legal bases

Contract: registration, sales, QR codes, ticket transfer, organizer dashboard, Stripe payouts and support ([email protected]).

Legitimate interests: fraud prevention, grouped purchase notices to organizers, account security and service improvement, balanced against your rights.

Consent or settings controls: showing name/photo on guest lists (on by default; you may turn it off) and receiving invites from past events (on by default; you may turn it off). Google or Apple sign-in sends the data you authorize with those services. App push notifications are only sent if you allow them on your device.

Legal obligation: tax/accounting retention, authorities and chargeback defence.

3. Sharing

We do not sell personal data.

Organizers see buyers for check-in and, unless the guest is anonymous, name and photo on the list. Event invites send a notification to the invited user.

Stripe processes payments and Connect accounts (including payouts). Google and Apple authenticate social login. Apple (APNs) delivers app push notifications. Email providers send operational messages. Hosting stores the system.

Landlords publish their own phone and email on listings, visible to marketplace visitors.

Authorities receive data only when the law requires it.

4. Guest lists, notifications and public profiles

The guest list is public on the event page. If you uncheck the settings option, you appear as an anonymous user without a photo.

Organizer invites use attendance history. Turn off “notifications from events I attended” to stop these messages.

An organizer’s public profile (name, photo, bio, social links) is visible to anyone who opens that page. A musician’s public profile (including contact and music links) is visible on the marketplace and on the event page when the organizer attaches them.

5. International transfers

Stripe, Google, Apple and cloud/email infrastructure may process data outside your country (for example the EU or US), with appropriate safeguards where GDPR/LGPD require them.

6. Retention

We keep data while the account exists and for as long as needed for tax, chargebacks and legal defence (often 5–10 years under local law), then delete or anonymise what is no longer needed.

7. Your rights

Under LGPD/GDPR you may request access, correction, deletion, portability, objection, restriction and withdrawal of consent. You may also complain to your data protection authority.

You can delete your account at any time in Account settings > Delete account, on the website or in the app. Your personal data is erased or anonymised and Sign in with Apple access is revoked; purchase and payment records are kept for the legal period, no longer linked to your name or email.

To exercise rights: [email protected]. We may need to verify your identity.

8. Cookies

We use essential session, language and security cookies. Login and checkout may fail without them. When an organizer connects a Meta Pixel, that organizer’s event pages and purchase confirmation send a page view and a purchase to Meta for that organizer’s ads. This is not required to use the platform.

9. Security and minors

We use HTTPS, hashed passwords, CSRF tokens and access controls. No system is 100% secure.

The service is not intended for children below the legal age for independent registration in your country. Minors must follow local consent rules.

10. Changes and contact

Updates will be posted on this page with a new date. If the law requires fresh consent, we will ask clearly.

Privacy contact: [email protected].