Privacy Policy

Who we are

Ticketlume is operated by Neeraj Nambiar (“Ticketlume”, “we”, “us”). Questions or requests about privacy: neerajnambiar58@gmail.com.

For attendee data collected through an event, the organizer of that event decides why and how it is used, and Ticketlume processes it on the organizer’s behalf. For organizer accounts and the operation of the service, Ticketlume is responsible.

What we collect

Organizers

• Account details from sign-in (Google or email link via Firebase Authentication): name, email address, profile picture.
• Organization details and team membership (name, members, roles).
• Event content you create: titles, descriptions, dates, venues, ticket settings.

Attendees

• Registration details: name, email address, answers to the organizer’s registration questions, consent choices.
• Optional marketing consent: whether you ticked “Send me marketing emails and SMS from Ticketlume”, the exact wording shown, when, and the mobile number you gave for SMS. This is Ticketlume’s own marketing; organizers can’t see it.
• If you tick “Remember my name and email on this device”, your name and email are kept in your browser’s local storage (not on our servers) to prefill future registration forms. Use “Not you?” on the form or untick the box to remove them.
• Attendance: check-in at in-person events and, for Zoom events, join/leave times from Zoom participant reports (when available).

Zoom data (organizers who connect Zoom)

• Zoom OAuth access and refresh tokens, their expiry and the permissions (scopes) you granted.
• Your Zoom user ID and email (or display name), shown as “Connected as …”.
• For events that use Zoom: meeting IDs and settings, and participant reports used to record attendance.

Technical data

• IP address and request metadata, used for security and rate limiting, and in server logs (credentials and email addresses are redacted).
• A single essential session cookie that keeps you signed in. We do not use advertising or third-party tracking cookies.
• Event page analytics (when the organizer has it on): counts of event card impressions, page views, register clicks and registrations, tied to a random visit ID kept in your browser’s local storage for 30 minutes of inactivity, plus the referring site or utm_source. No names, emails or fingerprinting; nothing is sent if your browser asks not to be tracked (Do Not Track or Global Privacy Control). Raw counts are kept for 13 months.

How we use it

• To provide the service: accounts, events, registrations, emails about events you registered for, check-in and attendance.
• To connect Zoom: create and manage meetings for your events and record attendance. Zoom data is used only for these features.
• To keep the service secure: authentication, fraud and abuse prevention, debugging and audit logs.
• To meet legal obligations.

Legal bases (where applicable, e.g. GDPR): performance of a contract (providing the service), legitimate interests (security, improving reliability), consent (where we ask for it, e.g. optional marketing emails and SMS from Ticketlume) and legal obligation.

We do not sell personal data, use it for advertising, or use Zoom data for any purpose other than the features described above.

Who we share it with

We use service providers that process data on our behalf, only as needed to run Ticketlume:

Event organizers can see the registrations for their own events. We may disclose data if required by law or to protect the safety and security of users and the service.

How we protect it

• All connections use HTTPS/TLS; the database is encrypted at rest.
• Zoom OAuth tokens are additionally encrypted with AES-256-GCM before storage, never shown in the app or returned by our API, and never logged.
• Each organization’s data is isolated in the application and by database row-level security.
• Links sent by email (verification, management) use single-use, expiring tokens stored only as hashes.

How long we keep it

• Zoom tokens: deleted as soon as Zoom is disconnected in Ticketlume or the app is removed from your Zoom account.
• Accounts and events: kept while the account is active; deleted within 30 days of a verified deletion request.
• Registrations and attendance: kept for the organizer while their account is active, unless the organizer or attendee asks us to delete them.
• Security logs: kept only as long as needed for security and troubleshooting.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict processing, and to withdraw consent. Email neerajnambiar58@gmail.com and we will respond within 30 days. Attendees can also contact the organizer of the event. You may complain to your local data protection authority.

Removing Zoom access

You can disconnect Zoom at any time in Settings → Integrations → Disconnect, or remove Ticketlume from your Zoom account (Zoom App Marketplace → Manage → Added Apps → Remove). Either way, your Zoom tokens are revoked and deleted. See the documentation.

International transfers

Our providers may process data outside your country (for example in the United States). Where required, we rely on appropriate safeguards such as the providers’ standard contractual clauses.

Children

Ticketlume is not intended for children under 16, and organizer accounts are not available to them.

Changes

We will update this page when our practices change and revise the date above. Significant changes will be announced in the app.

Contact

Neeraj Nambiar, Ticketlume — neerajnambiar58@gmail.com