Privacy Policy
1. Who is responsible for your data
Eventeru is operated by Almirall Events S.L., a company established in Spain, with registered address Carrer de Comte de Montornes 4, Pta 17, 46003 Valencia, Valencia, Spain, tax identification number B13729157, registered at Registro Mercantil de Valencia, Tomo 11368, Libro 8646, Folio 80, Sección 8ª, Hoja V-210816, Inscripción 1ª. In these documents “we”, “us” and “Eventeru” mean that company.
This policy explains what we do with personal data when you use https://eventeru.com, the Eventeru applications and the Eventeru API. It applies to visitors, people with accounts, attendees and organisers.
For questions about this policy or to exercise a right, write to connect@eventeru.com.
2. Us and the organiser: who controls what
Eventeru is a platform other people run their events on, so responsibility for personal data is split. Getting this right matters, because it decides who you ask when you want your data changed or erased.
| Data | Controller | Ask them about it |
|---|---|---|
| Your account, sign-in, security, notifications, platform-wide preferences, and your use of the platform itself | Almirall Events S.L. | Access, correction, deletion, objection: contact us. |
| Your registration for a specific event, the answers you gave that organiser, your attendance, and the organiser’s own mailing lists | The event organiser | The organiser decides why they hold it and how long. Contact the organiser first; we will help you reach them. |
| Payment and tax records for online products, where we are the seller | Almirall Events S.L. | Retained for the statutory accounting period. |
| Payment and tax records for in-person products, where the organiser is the seller | The organiser, with us as processor for the platform side | The organiser holds the commercial record; Stripe holds the payment record. |
When we handle attendee data on an organiser’s behalf, we act as their processor on their documented instructions. That processing must be covered by a written data processing agreement; this privacy notice does not replace that agreement. Organisers must have their own lawful basis for the personal data they ask us to process.
3. What we collect
You give us
- Account data: your email address, password (stored only as a hash), name, and the verification state of your address.
- Profile data: anything you choose to add, such as a display name, photo, bio, job title, company, social links and language preference.
- Security data: passkeys registered to your account, two-factor settings and encrypted secrets, recovery codes, and the devices and sessions you are signed in on.
- Event and organiser data: the events, pages, sessions, products and messages you create.
- Registration data: what you submit when you register for an event, including answers to the organiser’s questions, dietary or accessibility notes if the organiser asks for them, and any documents you upload.
- Payment data: billing name and address, the country and currency of the sale, and what you bought. Full card numbers never reach our servers; they are entered directly with Stripe, and we only ever see a card brand and last four digits.
- Contact data organisers import: if you are an organiser, the contacts you upload, along with the record you attest to of where consent came from.
- Support data: the messages, screenshots and attachments you send us, and the conversation history.
- Waitlist data: if you ask us to tell you when Eventeru opens, your email address, the page you signed up on, your language, when you asked, the version of the wording you agreed to, when we sent you the confirmation email, and whether and when you confirmed your address.
We collect automatically
- Technical data: IP address, browser and device type, operating system, the pages you request, timestamps, referrer, and errors your session generated.
- Approximate location, derived from your IP address for currency, language, timezone and fraud checks. We first look up your IP address in a database held on our own servers. If that database has no match, we send the IP address to ipinfo.io, in the United States, to obtain the location.
- Security and abuse signals: sign-in attempts, the IP an account was created from, and derived fingerprints used to detect coordinated abuse. The signup IP is stored as a value only we read; only a one-way hash of it feeds the abuse clustering.
- Audit records: the security-relevant and administrative actions taken on your account and on entities you administer, with who did them and when.
- Agreement evidence: the owning organiser account, the authorised representative, the accepted document version and a copy of the terms. Necessary agreement evidence can remain after an account is deleted to establish or defend legal claims.
- Delivery data: whether an email we sent on your behalf was accepted, delivered, opened where tracking is enabled, clicked, bounced or complained about.
- Product analytics, recorded by our servers: which features are used and in what sequence, so we can see where the product fails people. Signed-in activity is linked to your account; visits made while signed out are counted without any identifier.
We receive from others
- From Google, if you sign in with Google: your email address, name and profile picture, and nothing else.
- From Stripe: the status of payments, refunds, disputes and payouts, and the verification state of an organiser’s connected account.
- From an organiser: your registration for their event, if they registered you or imported you rather than you signing up yourself.
- From an organiser’s previous mailing service: if an organiser moves their subscriber list to us from Mailchimp, beehiiv or Ghost, we receive your email address, your name where they hold it, and your subscription status with them.
- From company data providers, when you or an organiser enter a company name or website: the matching company’s public details and logo. Abstract API receives only the company’s website domain. Brandfetch is contacted directly by your browser to display a logo, so it receives your IP address. The details returned concern the company, not you.
We do not ask for special category data, such as health or dietary information revealing a belief. If an organiser asks for it in their own registration questions, they are the controller for it and need their own lawful basis, normally your explicit consent.
4. Why we use it, and our legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Create and run your account, authenticate you, keep you signed in | You cannot use the service otherwise | Performance of a contract |
| Process orders, issue tickets, calculate and account for tax, pay organisers | To deliver what you bought and what we owe | Performance of a contract; legal obligation for tax and accounting records |
| Send transactional email and notifications: confirmations, tickets, event changes, security alerts | These are part of the service | Performance of a contract |
| Send an organiser’s marketing email to their subscribers | The organiser asked us to, as their processor | The organiser’s lawful basis, normally consent. You can unsubscribe from any of it. |
| Prevent fraud, abuse and money laundering; hold payouts where risk indicates it | To protect attendees, organisers and us | Legitimate interests, and legal obligation where financial rules apply |
| Keep security and audit logs, investigate incidents | To keep accounts safe and to be able to reconstruct what happened | Legitimate interests; legal obligation where a breach must be reported |
| Product analytics and error monitoring | To find and fix what does not work | Legitimate interests for server-side analytics and error records; consent for analytics cookies and identifiers |
| Respond to your support requests | You asked us to | Performance of a contract; legitimate interests |
| Tell you once when Eventeru opens, if you joined the waitlist | You asked us to | Consent. You join the waitlist only once you confirm your address from the email we send you. You can unsubscribe at any time with the link in that email or by writing to us. |
| Classify job titles into a seniority and function taxonomy for organiser audience reporting | So organisers can see who attends, in aggregate | Legitimate interests. Classification runs on our own servers; no third party receives the title. |
| Comply with the law, respond to lawful requests, establish or defend legal claims | We have to | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights and concluded they do not override yours. You can ask us for that assessment, and you can object at any time, as described in section 10.
7. International transfers
Some of the recipients in section 6 process personal data outside the European Economic Area. The following process it in the United States: Stripe, Amazon Web Services, Google, ipinfo.io, Abstract API, Brandfetch, vumbnail.com and YouTube, and, depending on your browser, the web push service. Cloudflare operates a global network and may process data in the United States.
Each such transfer relies on an adequacy decision of the European Commission where one covers the recipient, and otherwise on appropriate safeguards, such as the Standard Contractual Clauses adopted by the European Commission, together with additional technical measures, including encryption in transit and at rest.
You can ask us for a copy of the safeguards that apply to a specific transfer by writing to connect@eventeru.com.
8. How long we keep it
Different records have different retention periods. The table below describes account deletion and routine retention. Where a period is stated as a minimum, records are removed by a cleanup that runs once a month, so a record can remain for up to one further month after its period ends. An unresolved dispute or a legal preservation requirement can also delay removal.
| Data | Kept for |
|---|---|
| Your account and profile | Until you delete your account, followed by the background cleanup and retention exceptions described in section 9 |
| Orders, invoices, tax and accounting records | The statutory accounting retention period, which is longer than your account and which we cannot shorten on request. After that period the buyer's personal data is removed from our records and only the financial record is kept; copies Stripe holds as a payment processor follow Stripe's own retention |
| Email delivery reporting: accepted, delivered, clicked, bounced | At least 30 days on the Free plan, 90 days on Pro and 365 days on Scale and Enterprise, depending on the sender’s plan when each message is sent. A later plan change does not extend or shorten it. Removed in the monthly cleanup after that. |
| Bounce and complaint compliance records | 365 days on every plan. The marker that stops us sending email to an address that bounced or complained is kept for as long as that address is held in our systems. |
| Automated message runs, per recipient | After a run ends: 7 days on the Free plan, 180 days on Pro and 540 days on Scale and Enterprise, and never before the delivery reporting for that message has expired. Within that period, the detail of each step is deleted 90 days after it completes, or 365 days after it fails. |
| Webhook delivery attempts and payloads | About three months, removed in the monthly cleanup |
| In-app notifications | 90 days after you read them; 45 days after you dismiss them. Notification delivery logs: 90 days. |
| Session recordings (only with your consent) | 30 days |
| Product analytics totals | 2 years |
| Security verification and challenge records | 90 days |
| Signed-in sessions (the devices you are signed in on) | Until the session ends: it expires 90 days after it was last used, or earlier when you sign out or it is revoked. An expired session’s record is deleted 30 days after it expired |
| Support conversation attachments | Normally seven years after the conversation is resolved or closed. Reopening the conversation clears its expiry; resolving it again starts a new period. Legal preservation can suspend expiry. Account-erasure requests are handled separately. |
| Security audit records | Retained where needed for security investigations, accountability and legal claims. Records may retain account identifiers and email addresses after account deletion; erasure requests are assessed against the applicable retention obligations. |
| Waitlist sign-ups | If you do not confirm your address, we delete your sign-up 7 days after we sent the last confirmation email. Otherwise, until we have sent the one email telling you Eventeru is open, or until you unsubscribe. If you unsubscribe, we keep only your email address and the dates on which you signed up and unsubscribed, so that we never email you again. |
| Database backups, stored encrypted at rest | 30 days, after which they are deleted by a lifecycle rule on the storage bucket |
Backups are taken before routine retention cleanup, so removing a record from the active system does not immediately remove an earlier backup copy. Those copies expire under the backup lifecycle above. Records lawfully retained in the active system may also appear in later backups: the backup window is not a maximum retention period for every kind of personal data.
9. Deleting your account
Open Account settings, then Delete Account, to request account deletion. If you own a team or an organisation, you have to transfer or close it first, so that other people’s events are not left without an owner.
Deletion runs in the background. It removes your user record and runs cleanup for profile images and uploaded support attachments. It does not erase every record connected with your use of the service. The following may remain where retention is necessary:
- financial and tax records of orders you placed or received, which we are legally required to keep;
- security and administrative audit records, which can include your account identifier, email address and the circumstances of an action, including the deletion request;
- support conversation records needed to resolve an issue or preserve evidence; attachment expiry is described in section 8;
- copies inside database backups, which are stored encrypted at rest, until those backups expire on the schedule in section 8.
Data an organiser holds about you in their own records, including their contact list, is under their control. Ask them to erase it; we will help you reach them if you cannot.
10. Your rights
If the GDPR applies to you, you have the right to ask us for a copy of your data, to correct it, to erase it, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time without affecting what we did before you withdrew it.
Write to connect@eventeru.com and we will respond within one month. We may ask you to confirm your identity first, so that we do not hand your data to someone else. There is no charge unless a request is manifestly unfounded or excessive.
If you are not satisfied with how we have handled a request, you can complain to your local supervisory authority. In Spain that is the Agencia Española de Protección de Datos.
11. Automated processing
We score accounts and orders for fraud risk. That scoring influences how long an organiser’s funds are held before payout, whether an order is challenged, and whether an account is reviewed. We do not publish the exact criteria, because publishing them would let them be gamed.
Automated controls can apply holds or restrictions before a person reviews them. If a control has affected you, contact us to request human review, explain your circumstances or challenge an incorrect result. The availability of a later review does not mean every initial decision was made by a person.
We do not use your personal data to train machine learning models. Job title classification, described in section 4, runs on our own servers and does not send your data to an external AI service.
12. How we protect it
Data is encrypted in transit and at rest. Passwords are stored only as hashes. Two-factor secrets, recovery codes and stream keys are encrypted with separate keys. Access to production data is restricted to the people who need it, and administrative access to a user account is logged and constrained.
Uploaded attachments are scanned for malware before they are made available. Sign-in, password reset and sign-up are protected against automated abuse.
No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and tell you where the law requires it.
13. Children
The service is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has given us data, tell us and we will delete it. Organisers running events for under-16s are responsible for obtaining the consents their event requires.
14. Changes to this policy
We update this policy when what we do changes. The date at the top of the page is when it last changed. Where a change materially affects how we use your data, we will tell you in the product or by email before it takes effect.