Privacy Policy

1. Information We Collect

We collect the following categories of information:

Account Data

When you create an account, we collect your name, email address, phone number (optional), organization name, and role. If you sign up via a third-party authentication provider (e.g., Google), we receive your profile information from that provider.

Payment Data

Payment processing is handled entirely by Stripe. We do not store credit card numbers, bank account details, or other sensitive financial information on our servers. Stripe provides us with limited transaction metadata (amounts, dates, payout status) to display in your dashboard. Organizers who connect their Stripe accounts authorize Stripe to share account status information with NOCTURN.

Event Data

We collect information about events you create or attend, including event details, ticket types, pricing, sales data, attendee lists, guest lists, and scanning records.

Usage Analytics

We collect anonymized usage data to improve the Service, including pages visited, features used, session duration, device type, browser type, and general geographic location (country/region level). We do not use third-party tracking pixels or advertising analytics.

2. How We Use Your Information

We use collected information to:

• Provide, operate, and maintain the Service.
• Process ticket purchases and facilitate payouts to organizers via Stripe Connect.
• Send transactional communications, including order confirmations, ticket deliveries, event reminders, and account notifications.
• Enable organizer-to-attendee messaging through integrated communication channels (SMS, email).
• Improve the Service through aggregated, anonymized usage analysis.
• Detect and prevent fraud, abuse, and unauthorized access.
• Comply with legal obligations and respond to lawful requests from authorities.

3. Information Sharing

We do not sell, rent, or trade your personal information. We share data only with the following service providers, strictly as needed to operate the platform:

• Stripe — for payment processing, payout management, and fraud detection.
• Twilio — for SMS and messaging functionality when organizers send communications to attendees.
• Resend — for transactional email delivery (order confirmations, ticket emails, account notifications).
• Supabase — for database hosting and authentication infrastructure.

Each third-party provider is contractually obligated to use your data only for the purpose of providing their service to NOCTURN and must comply with applicable data protection regulations.

Event organizers can access attendee information (name, email, ticket details) for events they manage. This is necessary for event operations including check-in and communication.

4. Data Security

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit via HTTPS/TLS.
• Database records are encrypted at rest.
• Row-Level Security (RLS) policies in Supabase ensure that users can only access data they are authorized to view.
• Authentication tokens are securely managed with short expiration windows and automatic rotation.
• Administrative access to production systems is restricted and logged.

While we take reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

5. Data Retention

We retain your data as follows:

• Active accounts: Data is retained for the duration of your account's active status.
• Account closure: Upon account closure or deletion, we retain your data for 90 days to allow for reactivation or data export. After this period, your personal data is permanently deleted from our systems.
• Transaction records: Financial transaction records may be retained for up to 7 years as required by tax and accounting regulations.
• Anonymized data: Aggregated, anonymized analytics data may be retained indefinitely as it cannot be linked to individual users.

6. Your Rights

You have the right to:

• Access — Request a copy of the personal data we hold about you.
• Correction — Request correction of inaccurate or incomplete personal data.
• Deletion — Request deletion of your personal data, subject to our legal retention obligations.
• Data Export — Export your data (events, contacts, financial records) through the platform's built-in export tools at any time.
• Opt-out — Unsubscribe from non-essential communications at any time via email preferences or by contacting support.

To exercise any of these rights, contact us at support@nocturnevents.com. We will respond within 30 days.

7. Cookies

NOCTURN uses minimal cookies strictly necessary for platform operation. We use authentication tokens (stored as secure, HTTP-only cookies) to maintain your login session. We do not use third-party tracking cookies, advertising cookies, or analytics cookies. No data is shared with ad networks or data brokers.

8. Children

The NOCTURN platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we discover that we have inadvertently collected data from a minor, we will promptly delete it. If you believe a minor has provided us with personal information, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. If we make material changes, we will notify you by email or through a prominent notice on the platform at least 14 days before the changes take effect. Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

10. Contact

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at: