Privacy Policy

Draft. This text is a starting draft. It has not been reviewed by an attorney yet and may change. Last edited 2026-10-24.

Who is responsible

For the accounts, sign-in security, fraud prevention and platform analytics of Venue Vision, [legal entity name] is the controller. For the ticket buyer, guest and viewer lists an organizer collects with our tools, the organizer decides how the data is used and Venue Vision processes it on the organizer's behalf. Questions can go to [contact email] or [postal address].

What we collect

• Account data: name, email address, password hash, two-factor settings, sign-in times and the network address and browser of sign-ins.
• Ticket buyers: name, email address, the order, the network address and browser at purchase (kept to prevent fraud and answer card disputes), the refund policy version shown, and the tickets issued. Card details go to Stripe and never reach our servers.
• Check-in: when a ticket was scanned at the door and by which device.
• Viewers: a random session code, the ticket used, when the session started and last checked in, and the network addresses seen with a ticket (used to limit sharing and to help with disputes). If the organizer turns on the watermark, the viewer's name and ticket code are shown on that viewer's own screen.
• Stream content: the video and audio an organizer streams, stored as segments and, if the organizer enables it, as a replay.
• Rights documents: licence documents organizers upload. They are private to the organizer and platform administrators.
• Contact, takedown and support messages you send us.
• Cookies: essential cookies only. See the cookie notice.

Why we use it

To run accounts, sell and issue tickets, deliver streams, check people in, prevent fraud and ticket sharing, answer card disputes and copyright notices, comply with law, and support you. We do not sell personal data and we do not use viewer data for advertising.

Who we share it with

With the organizer you bought from or watch for; with service providers that run the service for us (payments: Stripe; storage and delivery: Cloudflare; email: Resend; hosting); with a court, regulator or rights holder where the law requires or to handle a copyright notice; and in a sale or reorganization of the business. Providers are bound to protect the data. [Counsel: list of processors and transfer terms to be confirmed.]

How long we keep it

• Stream chat and moderation logs: [chat retention to be confirmed].
• Viewer session records and the network addresses seen with a ticket: [viewer log retention to be confirmed].
• Other network address logs: [address log retention to be confirmed].
• Licence documents: [licence document retention to be confirmed] after the stream's last licensed date, unless a dispute is open.
• Orders, refunds and tax records: [financial record retention to be confirmed] because tax and accounting rules require it.
• Support messages: [support retention to be confirmed].

We delete or anonymise personal data when it is no longer needed for these purposes, and we keep a written retention schedule that these periods follow. We can keep data longer where a legal hold or an open dispute requires it.

Children

Venue Vision is not directed to children under 13 and, in line with the Children's Online Privacy Protection Act (COPPA) and its Rule, we do not knowingly collect personal information from them. Accounts and ticket purchases are for adults; a parent or guardian buys tickets for a child. Youth events can involve performers or viewers under 13: the organizer is responsible for parent or guardian consent, and chat is off by default for youth and wedding streams. If you think a child's information was given to us, write to us and we will delete it. Under our written retention schedule above, personal information from a child that reaches us by mistake is kept only as long as it takes to delete it, and for any child's data we collect no more than the service needs and keep it no longer than the periods listed.

Email and text messages

We send service emails (confirmations, tickets, receipts, security and account notices) without asking separately because they are part of the service. We send marketing email only if you opt in and every such email has an unsubscribe link. We send text messages only after you agree to receive them and we explain how to stop (reply STOP). Consent to texts is never a condition of buying a ticket. Organizers must follow the same rules when they message their audience.

Your choices and rights

You can ask to see, correct, export or delete your personal data, and to object to or limit some uses, by writing to [contact email]. For data an organizer controls we will pass your request on to them. Depending on where you live you may have further rights, including to appeal a refusal and to opt out of any sale or sharing for advertising (we do neither). We will not treat you worse for using these rights. [Counsel: state-by-state notices to be added.]

Security

We use encryption in transit, two-factor authentication for administrators, access controls that separate each organization's data, signed short-lived stream links and audit logs. No system is perfectly secure; tell us at once if you notice a problem.

Changes

We will post changes here and, for material changes, tell account owners by email.