Privacy Policy

Last Updated: July 10, 2026

At Eventist, your privacy matters. This Privacy Policy explains how Eventist ("we," "us," or "our") collects, uses, discloses, and protects your personal information when you use our website www.eventist.ca, our mobile applications, and all related services (collectively, the "Services").

By using the Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Services.

1. Information We Collect

We collect information in the following categories:

a) Information You Provide

  • Account Information: Name, email address, phone number, and password when you create an account.
  • Profile Information: Profile photo, organization name, and other details you choose to add.
  • Event Information (Organizers): Event descriptions, venue details, pricing, schedules, and media you upload.
  • Payment Information: Billing address and payment method details. Payment card information is collected and processed directly by our third-party payment processors (Stripe and Square) and is not stored on Eventist servers.
  • Registration and Ticket Data (Attendees): Information provided when registering for or purchasing tickets to events, including custom form fields set by Organizers.
  • Communications: Messages you send to us through support channels, contact forms, or email.
  • Waiver and Consent Data: If an Organizer requires you to sign a waiver or provide consent as part of event registration, that information is collected through the platform.

b) Information Collected Automatically

  • Usage Data: Pages visited, features used, actions taken, time and date of visits, and referring URLs.
  • Device Information: Browser type and version, operating system, device type, screen resolution, and unique device identifiers.
  • IP Address and Location: Your IP address, which may be used to determine your approximate geographic location (city/region level).
  • Precise Location (Mobile App): When you use the in-person payment features of our mobile app (Tap to Pay or a connected card reader), your device's precise geographic location is collected by our payment processor, Stripe, to authorize the transaction, as required by Stripe and payment card network rules and to help detect and prevent fraud. It is accessed only while you are actively using these features, never in the background, and Eventist does not store your location — it is used only to complete the payment through Stripe. See Section 13.
  • Camera (Mobile App): Our mobile app uses your device's camera to scan tickets and QR codes. The camera reads codes on your device only; we do not capture, store, or transmit photographs or video. See Section 13.
  • Cookies: We use a small number of functional cookies to operate the Services. See Section 10 for details.

c) Information from Third Parties

  • Payment Processors: Transaction status, payment confirmations, and fraud screening results from Stripe and Square.
  • Social Login Providers: If you sign in using a third-party service (e.g., Google), we receive your name, email address, and profile picture as authorized by that service.
  • Social Media Platforms (Organizers): When an Organizer connects their Facebook Page or Instagram Business Account to Eventist, we receive page access tokens, page names, and linked Instagram account information via the Meta (Facebook) API. This data is used solely to publish event announcements on the Organizer's behalf.
  • Organizers: Organizers may import attendee lists or other information to the platform.

2. How We Use Your Information

We use your information for the following purposes:

  • Providing the Services: Processing transactions, managing accounts, delivering tickets, sending order confirmations and event updates.
  • Communication: Responding to your inquiries, sending service-related announcements, and providing customer support.
  • Improving the Services: Analyzing usage patterns, diagnosing technical issues, and developing new features.
  • Personalization: Recommending events and content based on your interests and activity.
  • Marketing: Sending promotional emails, newsletters, and event recommendations (with your consent or where permitted by law). You can opt out at any time.
  • Safety and Security: Detecting and preventing fraud, abuse, and security threats. Enforcing our Terms of Service.
  • Legal Compliance: Complying with applicable laws, regulations, legal processes, or government requests.

3. No Sale of Your Data

We will never sell your personal information to third parties. We do not share your data with third parties for their own direct marketing or advertising purposes.

4. How We Share Your Information

We may share your information in the following circumstances:

a) With Organizers

When you register for or purchase a ticket to an event, the Organizer of that event receives your registration information (such as your name, email address, and any data you provided in the registration form). Once your data is shared with an Organizer, their use of your data is governed by their own privacy practices, not this Privacy Policy. Deleting your Eventist account does not delete data that Organizers have already received or exported.

b) With Service Providers

We share information with trusted third-party service providers who perform services on our behalf, including:

  • Payment Processing: Stripe and Square for transaction processing.
  • Email and SMS: Communication service providers for sending transactional and marketing messages.
  • Hosting and Infrastructure: Cloud hosting providers for storing and serving our platform.
  • Analytics: Analytics services to help us understand usage patterns.

These providers are contractually obligated to use your data only for the purposes of providing services to us and to maintain appropriate security measures.

c) For Legal Reasons

We may disclose your information if required to do so by law or if we believe in good faith that disclosure is necessary to:

  • Comply with a legal obligation, court order, or government request.
  • Protect and defend the rights, property, or safety of Eventist, our users, or the public.
  • Detect, prevent, or address fraud, security, or technical issues.

d) Business Transfers

If Eventist is involved in a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

5. Data Controller and Processor Roles

  • Eventist as Controller: Eventist is the data controller for personal information collected to operate the platform, including account data, usage data, and payment data.
  • Eventist as Processor: When Organizers collect Attendee data through custom registration forms, Eventist processes that data on behalf of the Organizer (who acts as the data controller). Organizers are responsible for ensuring they have a lawful basis for collecting this data and for their own compliance with privacy laws.

6. Data Security

We implement industry-standard technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS/SSL), secure authentication, access controls, and regular security assessments.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee its absolute security.

7. Data Retention

We retain your personal information only as long as necessary to fulfill the purposes described in this Privacy Policy, including:

  • Active Accounts: Data is retained for the duration of your account.
  • After Account Deletion: Upon account deletion, we will delete or anonymize your personal information within 90 days, except where retention is required for legal, tax, accounting, or fraud prevention purposes.
  • Inactive Accounts: Accounts that have been inactive for more than five (5) years may be deleted after notice.
  • Transaction Records: Financial and transaction records may be retained for up to seven (7) years as required by tax and accounting laws.

8. Data Breach Notification

In the event of a data breach that poses a real risk of significant harm to individuals, we will:

  • Notify affected users without unreasonable delay.
  • Report the breach to the relevant privacy authorities as required by law (including the Office of the Privacy Commissioner of Canada under PIPEDA).
  • Provide information about the nature of the breach, the data affected, and steps being taken to mitigate harm.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

a) All Users

  • Access: Request a copy of the personal information we hold about you.
  • Correction: Request that we correct inaccurate or incomplete information.
  • Deletion: Request that we delete your personal information, subject to legal retention requirements.
  • Withdrawal of Consent: Where processing is based on your consent, you may withdraw consent at any time.

To exercise these rights, email us at [email protected]. We will respond within 30 days.

b) Canadian Residents (PIPEDA)

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

  • Access and challenge the accuracy of your personal information held by us.
  • Withdraw consent for the collection, use, or disclosure of your personal information (subject to legal or contractual restrictions).
  • File a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

c) European Economic Area, UK, and Swiss Residents (GDPR)

If you are located in the EEA, UK, or Switzerland, our legal bases for processing your personal information include:

  • Contract: Processing necessary to perform our contract with you (e.g., providing the Services).
  • Consent: Processing based on your explicit consent (e.g., marketing emails).
  • Legitimate Interest: Processing necessary for our legitimate business interests (e.g., fraud prevention, service improvement), balanced against your rights.

In addition to the rights above, you also have the right to:

  • Data Portability: Receive your personal data in a structured, machine-readable format.
  • Restriction: Request restriction of processing in certain circumstances.
  • Object: Object to processing based on legitimate interests, including profiling.
  • Automated Decision-Making: Not be subject to a decision based solely on automated processing that produces legal or significant effects.

You may lodge a complaint with your local supervisory authority.

International Data Transfers: Your data may be transferred to and processed in Canada. Where required, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) to protect your data during international transfers.

d) California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

  • Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the categories of third parties with whom we share it.
  • Right to Delete: Request deletion of your personal information.
  • Right to Correct: Request correction of inaccurate personal information.
  • Right to Opt Out: Opt out of the "sale" or "sharing" of your personal information. Eventist does not sell your personal information.
  • Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

To exercise these rights, email [email protected] or use the privacy controls in your account settings.

10. Cookies

Eventist uses a minimal number of cookies, all of which are functional. We do not use analytics, tracking, or marketing cookies.

The cookies we use are:

  • Session Cookie: Used to keep you logged in and authenticate your requests. This is essential for the Services to function.
  • Preference Cookie: Used to remember your selected city on the discover page so you don't have to choose it each time you visit.

These are first-party cookies only. We do not set any third-party cookies.

Managing Cookies: You can control and delete cookies through your browser settings. Disabling cookies may prevent you from logging in or may affect certain preferences.

Do Not Track: Some browsers send "Do Not Track" (DNT) signals. Since we do not use tracking or advertising cookies, this signal does not change our behavior. We do not track you across third-party websites.

Organizer Tracking Pixels: Organizers may configure their own tracking pixels (such as Meta Pixel or Google Analytics) on their event storefronts. These are set by the Organizer, not by Eventist, and are governed by the Organizer's own privacy practices.

11. Children's Privacy

The Services are not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected] and we will delete it promptly.

12. Social Media Integrations

Organizers may connect their Facebook Page and Instagram Business Account to Eventist to automatically post event announcements when events are published. When an Organizer connects via Meta (Facebook):

  • Data Collected: We receive and store a page access token, Facebook Page ID and name, and Instagram Business Account ID and username.
  • Data Use: This information is used only to publish posts to the Organizer's connected social media accounts on their behalf.
  • Data Storage: Access tokens and account information are stored securely on our servers for as long as the connection is active.
  • Disconnecting: Organizers can disconnect their Facebook and Instagram accounts at any time from their Account Settings. Disconnecting immediately removes all stored access tokens and account information from our servers.
  • Data Deletion: To request deletion of all Meta-related data stored by Eventist, Organizers can either disconnect their account in Account Settings, delete their Eventist account, or email [email protected].

Eventist does not access or store any content from the Organizer's Facebook Page or Instagram account beyond what is necessary to publish event posts.

13. Mobile Application

Our mobile app is used by Organizers and their staff to run events in person — for example, scanning tickets at the door and accepting payments. This section explains the device permissions the app uses and how account management works on mobile.

a) Device Permissions

  • Camera: Used to scan tickets and QR codes at the door. Codes are read on your device; no photos or video are captured, stored, or sent to us.
  • Precise Location: Used only when you accept in-person payments. Stripe and payment card networks require the device's location to authorize Tap to Pay and card-reader transactions and to help prevent fraud. Location is accessed only while the payment feature is in use, never in the background. It is sent to Stripe to process the payment; Eventist does not store your location.
  • NFC and Bluetooth: Used to accept contactless (Tap to Pay) payments and to connect to supported external card readers. These are used only to complete in-person transactions.

You can grant or revoke any of these permissions at any time in your device settings. Denying a permission disables the related feature — for example, revoking camera access prevents ticket scanning.

b) Account Creation and Deletion

You cannot create or delete an Eventist account from within the mobile app. New accounts are created on our website. There is no self-service option to delete an account in the app or on the website; instead, to request deletion of your account and associated personal information, email us at [email protected] from the email address associated with your account. We will verify and process deletion requests as described in Section 7 (Data Retention).

14. Third-Party Links and Services

Our Services may contain links to third-party websites, services, or applications. We are not responsible for the privacy practices or content of these third parties. We encourage you to review the privacy policies of any third-party service you access through our platform.

15. Electronic Communications

By using the Services, you consent to receiving electronic communications from us. See our Terms of Service for details on the types of communications you may receive and how to manage your preferences.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top and may notify you by email or through the Services. Your continued use of the Services after changes are posted constitutes your acceptance of the revised Privacy Policy.

17. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information:

If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.