This Privacy Policy explains how Terena Events collects, uses, shares, and protects your personal information when you use the Terena Events website at terena.events and related services (the "Service"). Terena Events is operated by Terena Group LLC, a New York limited liability company ("Terena Events," "we," "our," or "us"). Capitalized terms not defined here, such as Host, Guest, Pass, claim link, and Door Staff, have the meanings given in our Terms of Use.
The short version:
- We collect your phone number, name, and date of birth, plus information about the Tickets you buy and, when door scanning is enabled, when your Pass is scanned.
- We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We don't use advertising cookies or ad-tracking pixels.
- Hosts see their Guests' names, phone numbers, Pass status, promo codes, and who invited whom so they can run their event. Host access does not include your date of birth or payment card details. Our separately authorized platform personnel use information only for the Service purposes described below.
- Door Staff, when door scanning is enabled, see the name on your Pass and its status, never your phone number or date of birth.
- Stripe handles your card details. We never see your full card number.
1. Information We Collect
1.1 Information you give us
| Information | When | Why |
|---|---|---|
| Phone number | When you sign in | To send your sign-in code, identify your account, and send service messages about your Orders and events |
| First and last name | When you set up your account | To put your name on your Pass so Hosts and Door Staff can confirm who is attending |
| Display name | When you set up your account (it starts as your first name) | Shown on event pages if you host, on claim and share links you send, and to Door Staff |
| Date of birth | When you set up your account | To record the age you give us. You must be 18 or older to use the Service. We don't verify the date you enter; Hosts or venues check ID at the event where needed |
| Text-message preference | When you set up your account or change it | To record whether you currently agree to receive event texts, and to honor opt-outs |
| Messages to us | When you email support | To respond and keep a record of the request |
If you host an event, we also collect the event details you enter (title, description, dates, venue, neighborhood, address, price, capacity, and promo codes) and the cover image you choose. Images can carry embedded information, such as camera details or GPS location. We keep the original file you upload, including covers you later replace, which may contain that information, in private storage with our image provider. The public sizes are set to remove it, but we can't guarantee that, so please don't upload an image containing information you don't want shared.
1.2 Information created when you use the Service
| Information | Details |
|---|---|
| Account records | When you signed up, finished setting up your account, and last updated your profile |
| Orders | The event, number of Tickets, amounts, promo code used, payment status, and time of purchase, including checkouts you started but didn't finish |
| Passes | Who bought each Pass, who holds it, when it was claimed, and who invited whom (through a claim link or referral link) |
| Referral code | Every account gets a personal share code. We record which code a purchase came through |
| Payment records | The Stripe checkout link for each Order, and the ID, type, and time of each payment event Stripe sends us |
| Check-in records (when door scanning is enabled) | Each scan or check-in attempt: the time, the result (for example, admitted, already scanned, or invalid), and which scanner device or Host account made it. This includes records of a Host resetting a Pass |
| Scanner devices (when door scanning is enabled) | For Door Staff: the label the Host gives the device, which may be a staff member's name; when it was activated; and the IP address used to enter a PIN, to prevent PIN guessing. Door Staff do not create accounts |
1.3 Information collected automatically
| Information | Details |
|---|---|
| IP address | Recorded when you request a sign-in code, to prevent abuse and fraud. It also appears in our server logs. When you open the sign-in page, our network provider tells us which country your IP address is in, so the phone field can start with that country's code; we don't keep it |
| Browser and device type | The user agent string of the browser you signed in with, stored with your session to help us investigate suspicious sign-ins and support requests, and in server logs |
| Sign-in records | When you signed in and out, how many times a code was tried, and the identifier our messaging provider returns for the verification attempt |
| Technical logs | Technical error and request information used to diagnose problems, which may include the requested page or endpoint, identifiers in its URL, browser details, and IP address |
We do not use analytics or session-replay tools. Any future change to diagnostic collection will be described before it begins, with any consent required by law.
1.4 Information from third parties
- Stripe processes paid checkouts and sends payment identifiers and status. Its responses and payment records may also contain the contact and billing details you provide at checkout; this does not mean every field is collected for every payment or stored in our ticketing database. We may access limited payment details, such as card brand and last four digits, for refunds, disputes, and support. Stripe collects full card details under the Stripe Privacy Policy. Zero-dollar orders do not go through Stripe.
- Our messaging provider sends and verifies sign-in codes. We send it your phone number to request a code and the code you submit with the verification identifier to check it. Provider-side sign-in records may be created before you complete account setup.
1.5 Cookies and local storage
We use only what the Service needs to work. We do not use advertising or marketing cookies, and we don't use third-party analytics or ad-tracking pixels.
| Name | Type | Purpose | Duration |
|---|---|---|---|
terena_session | Cookie (essential) | Keeps you signed in. It holds a random token; we store only a one-way hash of it | 90 days, or until you sign out |
terena_scan | Cookie (essential, when door scanning is enabled) | Keeps a Door Staff device signed in to scan for one event | Until the event ends or the Host revokes it |
theme | Browser local storage | Remembers whether you chose light or dark mode | Until you clear it |
terena:referrals | Browser local storage | Remembers which share link brought you to an event, so a purchase can be credited to the person who invited you | Until you clear it |
Image requests may also expose technical request information to the image providers described in Section 3.5. Any security cookies set by those providers depend on their configuration.
1.6 What we don't collect
- We don't collect your full payment card number. Stripe does.
- We don't store sign-in codes in our database. Our messaging provider generates and checks them.
- We don't use passwords.
- We don't access your contacts, precise location, or photo library. We receive only images you choose to upload.
- When door scanning is enabled, the scanner uses the device's camera only while scanning to read QR codes. Camera images are processed on the device and are not sent to us.
2. How We Use Information
We use information to:
- Provide the Service: create and secure your account, sell and issue Tickets, show your Passes, let you share Passes through claim links, and, when door scanning is enabled, check you in at the door.
- Communicate with you: send sign-in codes and service messages, and respond to support requests. We will send event texts only if we offer them and you have opted in.
- Support Hosts: give Hosts the tools to run their events, as described in Section 3.
- Keep the Service safe: prevent fraud, abuse, and unauthorized resale; rate-limit sign-in and PIN attempts; investigate security incidents; and respond to payment disputes and chargebacks.
- Improve the Service: diagnose and fix errors.
- Comply with law: meet tax, accounting, and legal obligations, and enforce our Terms of Use.
We don't use your information to build advertising profiles, and we don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
3. Who Can See Your Information
3.1 Public event pages
Published events may appear on our public homepage and can be viewed and shared by anyone. A completed event may remain accessible at its URL. The public page shows the Host's name, the event details, cover image, neighborhood, and city. The venue name and street address are public only if the Host chooses public address visibility; otherwise they are available with a Pass. Do not put private contact details or an address in a public title, description, or image if you want to keep them private. Link previews and independent copies may persist outside the Service.
An invitation-only attendance rule does not by itself make a published event page, its link, or information on it private. A Host's invitation rules and an event page's visibility are separate.
3.2 Hosts
When you buy, claim, or hold a Pass to an event, that event's Host can see, so they can manage their guest list, answer questions, and handle problems at the door:
- your first and last name;
- your phone number;
- your Pass status and check-in time;
- the promo code on your Order, and whether it was a complimentary Order;
- the name of the person who bought your Pass; and
- who invited you, as recorded through claim and referral links.
Hosts also see event-level totals, such as Tickets sold and revenue.
Host access does not include your date of birth or payment card details. As the operator of the Service, Terena Group LLC separately authorizes personnel to access information only as needed for the Service purposes described in this policy, including account and Order support, security, and legal obligations. That access is not permission to use information in a separate capacity as Host or for that Host's marketing. Shared branding, affiliation, or a platform role does not expand Host or Door Staff permissions.
We are responsible for the information we hold about you in the Service. Each Host is responsible for its own handling of information it receives. Our Terms of Use restrict Host use to the event and legal obligations, and prohibit marketing without separately obtaining any consent required by law. If you believe a Host has misused your information, tell us at [email protected], and we may suspend the Host.
This policy describes the Service's information practices, not a Host's separate collection or use outside the Service. Hosts are responsible for explaining those practices and meeting the privacy obligations that apply to them.
3.3 Door Staff
When door scanning is enabled, Door Staff see the name on your Pass (your first and last name) and your display name, and whether your Pass is valid, unclaimed, or already scanned, and when. If a scanner isn't working, they may see the event's guest list with the same information. They never see your phone number, date of birth, or payment information.
3.4 Other Guests
- If you send someone a claim link, anyone who opens it may see your display name as the person who sent it. After it's claimed, you can see that it was claimed and the name of the person who claimed it.
- If you claim a Pass, the person who bought it can see your first and last name. Anyone who opens a claim link sees the sender's display name.
- Anyone who opens a share (referral) link you send can see your display name.
- Your name appears on your Pass, so anyone you show your Pass to can see it.
3.5 Service providers
We use companies to help run the Service, including hosting, text-message delivery, image storage and delivery, domain and network services, and payment processing. We require providers processing information on our behalf to use it only for the permitted services and legal purposes, under contractual protections. We share only what each needs: for example, our hosting provider stores Service data, our messaging provider receives your phone number and sign-in code, and our payment processor receives Order and payment details.
Some recipients act independently. Stripe, our payment processor, uses payment information to prevent fraud across its network and to offer services such as Link, under the Stripe Privacy Policy.
External images. Some event images load directly from Unsplash. When your browser requests one, Unsplash receives your IP address and technical request information, which may include referrer information your browser sends. This is a separate recipient, not a representation that Unsplash is our contracted processor.
Cover images. Cover images are stored and served through our image provider, which receives your IP address and technical request information when your browser loads one.
Our database and application servers are in the United States. Some providers may process information in other countries. Text messages are delivered through mobile carriers. You can ask [email protected] which providers we use.
3.6 Other disclosures
We may also disclose information:
- For legal reasons: to comply with law, a subpoena, court order, or other valid legal process.
- To protect people and the Service: to enforce our Terms, prevent fraud, resolve payment disputes (for example, sharing Order and check-in records with Stripe and card networks), or protect the rights, property, or safety of Terena Events, our users, Hosts, or the public.
- In a business transfer: if Terena Group LLC is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will tell you before your information becomes subject to a different privacy policy.
- With your consent: when you tell us to.
Copyright requests. A copyright counter-notification is forwarded to the original complainant, including the identifying and contact information it contains, as described in Terms Section 11. We may share other notice information as needed to process the claim and meet legal obligations.
3.7 No selling or sharing
We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under applicable state laws. We do not disclose mobile phone numbers or text-message opt-in data and consent to third parties or affiliates for their own marketing. Providers may process that information on our behalf to operate the Service and deliver our messages.
4. Text Messages
- Sign-in codes are sent only when you request one. Message and data rates may apply.
- Service messages about your Orders and events you hold Passes to, such as a cancellation or change, may be sent when needed with any permission required by law. They must not promote unrelated events. You can ask us to stop them through support or by replying STOP where supported; we will explain another available way to obtain essential event information.
- Event texts. We don't currently send event texts. Your account setup includes a text-message preference, and we record your current choice. Before we send any event text, we will tell you and ask for your agreement in a way the law and carriers require. Opting in is never required to buy a Ticket, and you can opt out at any time by replying STOP, in your account settings, by emailing [email protected], or by any other reasonable means. Reply HELP for help.
- Sign-in codes come from our messaging provider's numbers, and we may not receive replies. A STOP reply can affect delivery of later codes, depending on the provider and sender. Contact support if you need help. We honor opt-out requests as soon as reasonably practicable.
5. How Long We Keep Information
We keep personal information only as long as we need it for the purposes in this policy, and then delete or de-identify it. We handle deletion by hand, on request, so the periods below run from when we receive and verify a request. In particular:
| Information | Retention |
|---|---|
| Account information (phone, names, date of birth, text preference) | While your account exists. If you ask us to delete your account, we process a verified request within 45 days, except as described below |
| Orders, payment records, and necessary related Pass records | As long as needed for tax, accounting, and legal claims, generally up to 7 years after the transaction. We keep only the personal information needed for those purposes |
| Check-in and referral records | As long as needed for event reconciliation, fraud prevention, and disputes, ordinarily no longer than the related Order records |
| Sign-in records, sessions, and technical logs | We do not delete these automatically. We delete them by hand when we process a verified deletion request, and otherwise keep them for security, abuse prevention, and diagnosing problems |
| Support messages | As long as needed to resolve the request and for related records |
| Event pages and Host content | While the event remains on the Service, and afterward as long as needed for the related Order records |
| Backups | Overwritten on a rolling schedule. Deleted data may remain in backups for a limited period until they are overwritten |
| Privacy-request records | Records of requests we handle by hand, kept as needed to process them and document compliance. Your text preference stores only your current choice, and when you first agreed |
When we delete information, we also ask service providers processing it for us, such as our messaging provider, to delete it where required and applicable. Providers acting independently, including Stripe for certain payment and compliance purposes, may retain information under their own legal obligations and policies.
Legal holds and exceptions for an actual dispute, security investigation, or legal obligation apply only to information reasonably needed for that purpose. Removing a name does not make a record de-identified if we can still link it to you. Backup copies are restricted from ordinary use, and deletion requests must be reapplied if a backup is restored.
6. Your Rights and Choices
6.1 Rights for everyone
Wherever you live in the United States, you can:
- See and update your profile. Your display name and text preference are on your account page. Your name, date of birth, and phone number can't be changed there; email us if one is wrong.
- Request a copy of the personal information we hold about you.
- Request deletion of your account and personal information. We delete or de-identify information except the limited records retained for the reasons in Section 5. If you hold unused upcoming Passes or bought extra Passes that remain unclaimed, we explain which are affected and let you choose between keeping only the information and access they need until the last affected event, or cancelling them and refunding their original buyer under Terms Section 6.2. Passes already claimed by others stay valid when their buyer deletes an account. Deletion does not remove the buyer's refund or support rights. A claimed Pass holder can make the election for their own Pass, but the refund goes to the original buyer.
- Opt out of event texts at any time, as described in Section 4.
6.2 State privacy laws
Some states give residents additional privacy rights, but those laws generally apply only to businesses above certain size or data-volume thresholds. We offer the rights in Section 6.1 to everyone in the United States whether or not a state law applies to us. If a state privacy law does apply to our processing of your information and gives you further rights, such as correcting your information, receiving it in a portable format, appealing a decision, or opting out of sale, sharing, or targeted advertising, we will honor them as that law requires. We don't sell or share personal information, and we won't treat you differently for exercising your rights.
Global Privacy Control and Do Not Track. We do not sell personal information or share it for cross-context behavioral advertising. A GPC signal therefore does not change those practices. We do not change our practices in response to a browser's Do Not Track setting. Stripe's independent payment and fraud-prevention processing and external image requests are described in Section 3.5; we do not claim control over every independent recipient's practices.
6.3 How to make a request
Email [email protected] and tell us what you'd like us to do. "Privacy Rights Request" is a helpful subject, not a requirement for a valid request. We do not require a new account or marketing consent to exercise a right.
- Verifying you. We use verification proportionate to the request and sensitivity of the information, such as confirming through your signed-in account. We may need other evidence if a number has changed hands or you no longer control it.
- Authorized agents. You may use an authorized agent. We may require proof of their authority and may ask you to verify your identity directly.
- Timing and cost. We respond within 45 days, or sooner where law requires, and explain any permitted extension. We do not charge for reasonable requests and apply any permitted exception only as law allows.
- Host information practices. For questions about a Host's own use of your information, you may contact the Host directly or contact us, and we will help.
7. Security
We use reasonable technical safeguards to protect personal information, including:
- encryption in transit (HTTPS);
- storing only one-way hashes of session tokens and, when door scanning is enabled, scanner PINs;
- not storing sign-in codes in our database;
- rate limits on sign-in attempts and, when door scanning is enabled, PIN attempts; and
- limiting what Door Staff and Hosts can see.
No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If a data breach affects your personal information, we will notify you and the appropriate authorities as required by applicable law, including New York law.
8. Children
The Service is for adults 18 and older and is not directed to children. You must be 18 or older to create an account or use it. We ask for your date of birth when you set up your account, but it is self-reported, we do not verify it, and we do not currently block an account because of it. We do not knowingly collect personal information from anyone under 18, and in particular from anyone under 13.
If we learn an account belongs to someone under 18, we will close it and delete the associated personal information, except where the law requires us to keep it. Parents or guardians can contact [email protected].
9. Where We Operate
Terena Events is based in the United States. The Service is intended only for users in the United States, and sign-in currently accepts U.S., Canadian, U.K. and Australian mobile phone numbers that can receive texts. A phone number does not establish residence or eliminate rights under any law that applies. Our database and application servers are in the United States; providers may process information elsewhere as described in Section 3.5.
10. Changes to This Policy
We may update this Privacy Policy from time to time and will update the "Last updated" date above. If we make material changes, we will notify you by a prominent notice on the Service or by text message at least 30 days before the changes take effect. We will not use personal information we already hold in a materially different way without your consent where the law requires it.
11. Contact Us
Questions or requests about this Privacy Policy:
Terena Group LLC
Email: [email protected]