EventDesk privacy policy

EventDesk is a Shopify app made by Fantasium Media. It sells tickets to classes and events through a store’s products, sends a QR ticket for each seat, and lets door staff check guests in from a phone. This policy explains what information EventDesk collects when a merchant installs it, how it’s used and protected, and how it’s deleted.

Information we collect

From Shopify, through the permissions the merchant approves:

• the event products EventDesk creates, their variants (one per session) and inventory (seats)
• paid orders that contain tickets: the order and confirmation numbers, line items, and the buyer’s name and email address
• shop details, such as the store name and domain, and which staff member is using the app

EventDesk doesn’t read the store’s customer list.

From shoppers, through the store:

• the attendee names a buyer enters on the product page

Created in EventDesk:

• ticket codes, check-in times and which door scanned each ticket
• a log of ticket and reminder emails (recipient and delivery status)
• scanner links for door staff. Each link is stored encrypted, so the merchant can show it and its QR code again. Its PIN is stored only as a one-way hash: a PIN is shown once and can be replaced, but never shown again.
• the merchant’s events, sessions and settings

How we use it

Only to run EventDesk for the merchant: issuing and emailing tickets, showing them on the buyer’s order pages, checking guests in, sending the reminders and messages the merchant chooses, and managing the merchant’s plan. We don’t sell your data, and we don’t share it with anyone for marketing or advertising.

Service providers

• Shopify runs the platform EventDesk is part of and handles billing.
• Fly.io hosts the app and its database in the United States.
• Resend delivers ticket, reminder and attendee emails.

Each handles data under its own privacy policy.

Storage and security

Data is stored in a PostgreSQL database on Fly.io in the United States, encrypted at rest. It travels over HTTPS/TLS, and database access requires credentials.

So check-in works offline, door scanner phones keep the guest list for the sessions they check: attendee names, order numbers and scrambled ticket codes that can’t be used as tickets. A list is deleted from the phone when its scanner link is revoked or expires, or the next time the scanner opens once the list is two days old. A ticket scanned offline is kept on the phone until it syncs.

We record when a store’s staff view attendee information in EventDesk (which staff account, which record and when), without copying the attendee information itself.

How long we keep it

Attendee names and email addresses are removed 30 days after each session ends. The merchant can change this to anywhere from 1 to 365 days. The ticket record is kept without them, so the merchant’s sales and check-in counts stay correct. Recipient addresses in the email log are removed at the same time.

When a merchant uninstalls EventDesk, ticket pages and scanner links stop working straight away. Shopify asks us to erase the store’s data 48 hours later (shop/redact), and we then delete all of it. The event products stay in the store as ordinary Shopify products.

When a customer asks a merchant to erase their data (customers/redact), we remove their name and email and keep any upcoming tickets valid. When a customer asks for their data (customers/data_request), we email the store owner a copy of what we hold about them so the store can pass it on. We don’t contact the customer directly.

Your rights

• See your data in EventDesk at any time.
• Delete it by uninstalling EventDesk.
• Ask us for an export, or for deletion without uninstalling, by emailing the address below.
• If you’re in the EEA or UK, you also have a right to data portability and can complain to your data protection authority.

GDPR roles

Merchants are the data controllers for their buyers’ and attendees’ information. Fantasium Media acts as a data processor and handles personal data only as needed to provide EventDesk.

Children

EventDesk is for merchants and their staff. We don’t knowingly collect information from children under 16. Buyers must meet the age requirements of the store they buy from.

Changes

If this policy changes, we’ll update the date at the top of this page.

Contact

Fantasium Media, Bozeman, Montana. Email support@deskapps.app or use the contact form.