Privacy Policy

1What we collect

Things you give us:

• Account — your email address (one address is one account), your name, an avatar if you add one, and a phone number if you verify one.
• Purchases, including checkout without an account — the name on the order, an email address, an optional phone number, what you bought and what it cost. Card numbers go directly to Stripe; we never see or store them.
• Pass holder names — the name a pass is issued to, which is often not the buyer.
• If you promote — a permanent public handle, optionally a city, and payout onboarding through Stripe Express. Stripe collects identity and tax details under its own policy; we receive whether you cleared it, not the documents.
• If you run an organizer — business and contact details and who holds which role. Payout and tax details are collected by Stripe.
• If you represent a sponsor — business name, category, city, logo, and a business address, which is required, never shown to guests, and the one fact we can check.
• City calls — raising a hand for a town stores an anonymous identifier on your own device. Only a signed-in hand is attached to an account.
• Anything you write to us — support messages and their replies.

Things collected automatically: device and log data (IP address, browser, pages viewed, where you came from), and approximate city-level location worked out from your IP address. We do not collect precise or GPS location.

Things the Services produce: your order and refund history; door scan records for passes, which are financial evidence in a chargeback; offer redemptions recorded against the pass, never against you; who you follow and a summary of what you have attended; email delivery, bounce and complaint events; and attribution records — which promoter link, typed code or email a purchase followed, frozen at the moment of purchase.

Things others tell us: payment and fraud signals from Stripe, and delivery signals from our email provider.

We collect no sensitive-category data as state privacy laws define it — no precise location, no health data, no biometrics, and no government ID held by us. We collect what the purposes below actually need and nothing else.

2Why we use it

Each purpose gets the least data that serves it:

• Running the Services — accounts, checkout, passes, the door scanner, payouts, refunds.
• Transactional messages — receipts, your passes, event changes and cancellations.
• Marketing, strictly according to your choices in §5.
• Reporting to organizers, promoters and sponsors — aggregate numbers, never identities beyond what §3 describes.
• Fraud prevention, security and enforcing our terms. This includes detecting self-dealing, which is why a buyer and a promoter who are the same person are visible to us as the same account.
• Legal compliance — tax, financial records, information reporting.
• Improving Groovity, using aggregate or de-identified data wherever it will do the job.

We do not use your information to make automated decisions that produce legal or similarly significant effects about you.

3Who sees it

Organizers whose events you buy into or follow. They see the name on the order, the names on the passes, what was bought, and whether it checked in. They do not receive your email address or your phone number, and there is no export. When an organizer sends an email to their guests, Groovity sends it on their behalf — they compose it, we resolve who it goes to, and the list never leaves the platform.

Anything you hand an organizer directly — at their door, on a form of their own, on their own website — is between you and them. They are an independent business with their own responsibilities, and Groovity is not responsible for what they do with it.

Sponsors: never. A sponsor sees counts — views, taps, redemptions — and no names, no contact details and no per-person rows. A sponsor who tries to obtain guest identities loses their account.

Promoters see how many passes they sold and what they earned. They do not see who bought.

Service providers, under contracts that limit them to our instructions and require safeguards consistent with Massachusetts 201 CMR 17.00: payment processing (Stripe), email delivery, hosting and databases, and error monitoring.

Legal and corporate — to comply with the law or valid legal process, to protect the rights, safety or property of Groovity or of other people, and in a merger or acquisition, in which case this policy’s protections travel with the data and we will tell you who the new custodian is.

WE DO NOT SELL PERSONAL INFORMATION AND HAVE NOT DONE SO. WE DO NOT SHARE PERSONAL INFORMATION FOR CROSS-CONTEXT BEHAVIOURAL ADVERTISING. THERE ARE NO THIRD-PARTY ADVERTISING TRACKERS ON GROOVITY.

If that ever changes we will update this policy before it changes, provide the opt-outs the law requires, and honour Global Privacy Control signals. We would not sell or share the data of anyone under 18 in any case.

4How long we keep it

• Orders, passes, scan logs and payout records are financial records. They are kept as long as tax and accounting law requires, then deleted or stripped of identity.
• Your account is kept while it exists. When you delete it we remove the person and keep the ledger — the financial rows survive without you in them.
• Abandoned checkouts — contact details are deleted after 30 days.
• Unsubscribes, bounces and complaints are kept indefinitely, because deleting them is how somebody who said stop gets emailed again.
• Banned accounts — we keep the minimum needed to stop the same person signing up again.

5Your marketing choices

Two independent switches, changeable any time from the link at the bottom of every marketing email or from your account:

1. Email from organizers you know — ones you have bought from or follow. On by default; one opt-out silences all of them at once, everywhere on the platform.
2. Groovity recommendations — events near you from organizers you have never dealt with. Off by default; you only get them if you say yes.

Every marketing email names who it is from, says why you are getting it, carries our postal address and a one-click unsubscribe, and is subject to platform frequency caps that no organizer can raise. Organizers cannot upload outside mailing lists into Groovity — there is no import.

Passes and receipts are a different stream and unsubscribing never touches them.

Text messages: we do not send marketing texts. If we ever offer them it will be on separate express written consent, and SMS opt-in and consent data will never be shared with anyone for their own marketing.

6Your rights

Wherever you live, you can access a copy of what we hold, correct it, delete it (subject to the financial records in §4), take it with you in a portable format, and opt out of marketing at any moment.

State privacy laws — California, Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Maryland and others — additionally give rights to opt out of sale, of sharing for targeted advertising, and of profiling. We do none of those things, so there is nothing to opt out of; if we ever start, those opt-outs and Global Privacy Control will be honoured and described here first.

To exercise anything, write to hello (at) groovity (dot) co or use your account settings. We verify requests against the account email, answer within 45 days (extendable once by another 45 with notice), and never treat you worse for asking. Authorised agents may act for you with proof. If we say no, you can appeal by replying, and we will answer the appeal within 60 days; you can also contact your state Attorney General.

Notice at collection (California): the categories in §1 — identifiers, commercial information, internet activity, coarse location and inferences limited to what kind of events you like — collected for the purposes in §2, kept as described in §4, and neither sold nor shared.

7Cookies

We use first-party cookies and similar storage for: keeping you signed in; security; remembering your city and your theme; a 7-day attribution cookie recording which promoter link or email you arrived from — a code typed at checkout always beats it; and your own raised hands on the city board, which live on your device.

We use no third-party advertising cookies. Your browser controls work normally, though blocking cookies will break signing in.

8Security

We keep a written information security programme with administrative, technical and physical safeguards proportionate to what we hold, consistent with Massachusetts 201 CMR 17.00: encryption in transit, access controls, audited administrative access, and vendor contracts that require the same of them.

No system is perfectly secure and we will not pretend otherwise. If a breach affects you, we will tell you and the regulators as the law requires.

9Children

Groovity is for adults. Nobody under 18 may hold an account or buy a pass, and we do not knowingly collect anything from a child under 13. If we find we hold a child’s data, we delete it. Parents and guardians: hello (at) groovity (dot) co.

10Visitors from outside the United States

Groovity is operated and hosted in the United States and your information is processed here. Where European, UK or Swiss law applies to you, Groovity is the controller; we process on the basis of contract (giving you the Services you asked for), consent (marketing) and legitimate interests (security and fraud prevention). You additionally have the right to object, to restrict processing, to withdraw consent, and to complain to your supervisory authority. Transfers rely on standard contractual clauses.

11Changes, and how to reach us

Material changes are announced by email to your account address and on the Services before they take effect, and the date at the top of this page always reflects the current version.

Questions, requests and complaints: hello (at) groovity (dot) co