Privacy Policy

1. Overview

This Privacy Policy explains how FUNC ("we", "us") collects, uses, shares, and protects information when you use our ticketing and event platform (the "Platform"). It applies to attendees, guest buyers, organizers, promoters, and event staff. FUNC is the data controller for account and platform data. Event organizers are independent data controllers for attendee data related to their events.

2. Information we collect

• Account data: name, email, phone number, password hash, profile photo, role (attendee, organizer, promoter, staff).
• Payment data: processed and stored by Stripe; we receive tokens, order totals, last four digits of card, and payout status. We do not store full card numbers.
• Order and ticket data: events purchased, tier, quantity, transfer history, resale activity, referral attribution, promoter commissions.
• Guest checkout data: email and phone submitted at checkout, tied to a claim token so you can link the order to a future account.
• ID scan data: at age-restricted events, driver-license barcodes are parsed to verify date of birth. We retain a check-in event (age passed/failed, timestamp, event, scanner) but do not retain full license contents.
• Communications: emails and SMS we send you, unsubscribe status, delivery logs.
• Milo AI data: conversation history, proposed actions, and organization context you share with Milo.
• Device and usage data: IP address, user agent, page views, referrer, sessionStorage attribution for promoters, error logs.
• Location data: approximate location from IP; precise geolocation only when you grant permission in Explore.

3. How we use your information

• Process ticket purchases, transfers, resales, and refunds.
• Issue dynamic QR codes and verify tickets and IDs at check-in.
• Send transactional communications (order confirmations, event reminders, refund notices, promoter payouts, team invites).
• Provide organizers with attendee lists and analytics for their events.
• Enable promoter attribution, commissions, and payouts.
• Operate Milo AI (Pro organizers) and other product features.
• Detect and prevent fraud, abuse, chargebacks, and security incidents.
• Comply with legal obligations and enforce our Terms.

Legal bases (GDPR): performance of a contract, legitimate interests (fraud prevention, product improvement), consent (marketing, precise location, non-essential cookies), and legal obligation (tax, law enforcement).

4. How we share information

• Event organizers: for events you purchase, organizers receive your name, email, phone, order details, and check-in status.
• Promoters: receive aggregated referral stats; they do not see attendee PII beyond aggregate counts.
• Service providers (subprocessors): Stripe (payments, Connect payouts, tax), Supabase (hosting, database, storage, auth), Lovable AI Gateway (Milo), Resend or equivalent (email), GoHighLevel (SMS relay), Google Maps (address autocomplete).
• Legal: when required by law, subpoena, or to protect rights and safety.
• Business transfers: in a merger, acquisition, or sale of assets, with notice to affected users.

We do not sell your personal information and do not share it with advertising networks for cross-context behavioral advertising.

5. Data retention

We retain account and transaction data for as long as your account is active and for a reasonable period after closure to satisfy tax, accounting, chargeback, and legal-hold obligations (typically up to 7 years for financial records). Marketing preferences and unsubscribe lists are retained indefinitely to honor your opt-out. You may request deletion at any time; some records may be retained in anonymized or aggregated form.

6. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, restrict, or object to processing of your personal information, and to withdraw consent. California residents have additional rights under the CCPA/CPRA, including the right to know, delete, correct, and opt-out of sale/sharing (we do not sell). EU/UK residents have rights under the GDPR/UK GDPR. To exercise these rights, email legal@func-app.com. We will not discriminate against you for exercising your rights.

7. Cookies and tracking

We use strictly necessary cookies and local storage for authentication, session management, promoter referral attribution, and checkout preservation. We do not use third-party advertising trackers. First-party analytics may record aggregate page views and errors. You can clear cookies through your browser at any time; some features (such as staying logged in) will not work without them.

8. International transfers

Our infrastructure is hosted in the United States. If you access the Platform from outside the US, your information will be transferred to and processed in the US. Where required, transfers are protected by standard contractual clauses or other appropriate safeguards.

9. Security

We use industry-standard practices including TLS in transit, encryption at rest for sensitive fields, row-level security on our database, hashed passwords, hashed invite and claim tokens, short-lived rotating QR tokens (30–60 seconds) to prevent screenshot fraud, dedicated SECURITY DEFINER helpers to prevent RLS recursion, and strict role-based access control (organizer, admin, manager, promoter, door, security). Stripe processes payment data; we do not store full card numbers. No system is 100% secure — please report suspected vulnerabilities to security@func-app.com.

10. Children

The Platform is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact legal@func-app.com and we will delete it.

11. Third-party links and content

Event pages, resale listings, and organizer content may link to external sites. FUNC is not responsible for the privacy practices of third parties.

12. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or in-app notice at least 7 days before taking effect.

13. Contact

Privacy questions or requests: legal@func-app.com. General support: support@func-app.com.