legal/privacy

attnd.io ("attnd.io", "we", "us") operates the attnd.io app and website. This Privacy Policy explains how we handle personal data when you create an account, book a service, reserve a place at an event, join a queue, manage an organization, subscribe to a paid plan or contact support. For account, billing and platform data, attnd.io is the controller. For attendee and booking data collected by an organizer, the organizer is a separate controller and decides why and how that data is used. Organizers must provide their own privacy notice to their customers. Contact: [email protected].

Account data: name, email address, password hash, interface language, account roles (customer, business owner, operator, reviewer or administrator), optional phone number and avatar, and the policies you accepted. Booking and queue data: the services, time slots, ticket or confirmation codes, queue position, status, check-in and cancellation history, and the organization you interacted with. Attendance and RSVP data: your RSVP status, guest name, email and phone number when you register as a guest, check-in status, and a manage/recovery credential stored as a hash or encrypted value. Organization content: the organization profile, queues, events, service descriptions, opening hours, addresses, coordinates, images, page-builder content and translations that organizers submit. Payment and subscription data: plan, billing period, amount, currency, payment status, order identifiers, the card issuer country returned by the payment provider, discount code and redemption status. Card numbers and security codes are entered on the payment provider's page and are not stored by attnd.io. Region data: the country and city you confirm, and how you supplied it (manual choice, device location or IP suggestion). We do not store a street address or precise coordinates as your account region. Device and technical data: push notification token, app version, platform, language, IP address, user agent, request path, response status and timestamps. Application request logs omit URL query values and authorization headers. Support data: messages you send through the in-app support chat or support assistant, the account context needed to answer, and support conversation identifiers. When an organizer connects an entrance terminal or call display, we store its chosen label, purpose, approving account, access expiry, revocation and last-contact time. This lets the organizer control and revoke device access. A call display receives ticket numbers and statuses rather than guest names or contact details.

We do not use advertising networks, sell personal data, or build cross-site behavioural advertising profiles. We do not collect precise device location in the background. Device location is used only when you choose the location picker or grant permission for a region suggestion. We do not store full card numbers, card security codes or your bank password. Those are handled by the payment provider.

We use data to create and secure accounts; provide bookings, queues, events and check-in; show organizations and events; process subscriptions and payments; send confirmations, reminders and lifecycle notices; provide support; translate content; prevent fraud, abuse and overloading; diagnose errors; comply with law; and improve the product. Depending on your location, the legal bases are performance of a contract (providing the service you asked for), legitimate interests (security, fraud prevention, service improvement, and communicating about a booking), consent (optional location, optional support chat, optional marketing if offered), and legal obligation (tax, accounting and lawful requests). You can withdraw consent at any time without affecting processing that already happened. Where we rely on legitimate interests, you may object as described below.

We use your confirmed country and city to show nearby organizations and events, set maps and discovery filters, and calculate a regional subscription price. An IP address can suggest an approximate region; you can correct it. On mobile, a map picker may use the device's location when you ask it to. For paid subscriptions, the payment provider reports the card issuer country. That country, together with your confirmed country of use, is used to apply the regional price and to detect a mismatch. A mismatch may cause the payment to be refused or reviewed. The issuer country is not a billing address and does not verify your home address. Maps and geocoding use OpenStreetMap/Nominatim, and on native devices the system map provider (Apple Maps or Google Maps). IP region suggestions use ipwho.is.

We share data only as needed to run the service: • Supabase — database, file storage and authentication infrastructure. • Ameria Bank — hosted card payment processing and payment status. • Resend — transactional email delivery (confirmations, reminders, security messages). • Crisp — optional in-app support chat. • AI model providers configured by the operator (for example Google, Groq, OpenRouter, Cloudflare, Mistral, Cohere, NVIDIA or Z.ai) — translating organization content and interface text, and answering support questions. We send only the text needed for the task and do not send passwords or payment credentials. • OpenStreetMap/Nominatim and the native map provider — address lookup and map display. • ipwho.is — approximate region from an IP address. • Expo — push notification delivery. Organizers receive the attendee and booking data for their own queues and events. We may also disclose data to professional advisers, authorities or a successor in a merger or acquisition when required or permitted by law, and to protect rights, safety and the integrity of the service. We do not share personal data with advertisers.

Our processors may store or process data in countries other than yours. Where required, we use contractual safeguards such as standard contractual clauses and rely on the processors' security and data-processing terms. Contact us if you want more information about the safeguards for a specific transfer.

Account and profile data is kept while your account exists and is deleted when you delete the account, subject to the exceptions below. Organization, queue and event content is kept while the organization or listing exists. Booking, ticket and RSVP records are kept by the organizer's account for as long as needed to run the service and handle disputes. If a customer deletes their account, the booking remains with the organizer but the direct account reference is replaced with a deleted-user marker. Payment and financial records may be kept after account deletion where needed for accounting, tax, fraud prevention, chargeback handling or legal claims. The user reference is removed where possible. Password reset tokens expire after 60 minutes and cannot be reused. Email delivery logs are used for delivery diagnostics and rate limiting and are deleted when the addressed account is deleted. Consent audit records keep the policy versions, time and a one-way email hash. Deletion audit records keep a timestamp and the one-way hash, not the email address. Support conversations are retained by Crisp under its settings and our support process. Backups may retain deleted data for a limited rotation period and are not used for any other purpose.

Depending on where you live, you may have the right to access your personal data, correct it, delete it, restrict or object to certain processing, receive a portable copy, and withdraw consent. You can change your region, language, theme and notification choices in the app. You can delete your account in the app: open Settings (the gear icon) → Account security → Delete account. The Account deletion policy explains what is deleted and what is kept. To exercise another right, contact [email protected]. We may need to verify your identity before acting. You may also complain to your local data-protection authority. We do not discriminate against you for exercising a privacy right.

We use HTTPS, hashed passwords (bcrypt), hashed reset and check-in secrets, access controls, least-privilege backend access review, and redaction of sensitive values from application logs. Payment card data stays with the payment provider. No system is completely secure. If you believe your account or a credential has been compromised, change your password, sign out other sessions where available, and contact support immediately.

attnd.io is not intended for children under 16. We do not knowingly collect personal data from children under that age. If you believe a child has created an account, contact [email protected] so we can delete it.

We may update this policy when the product, vendors or law changes. Material changes will be announced in the app or by email before they take effect where required. The effective date at the top of this page shows the current version. Questions, requests and complaints: [email protected]. If you are in the European Economic Area, the United Kingdom or another region with a supervisory authority, you may also contact your local authority.