Перейти к основному содержанию
Ticketland.am

Политика конфиденциальности

Privacy Policy

Effective Date: November 11, 2026

Last Updated: November 11, 2026

1. Introduction

Welcome to Revel's Privacy Policy. This document explains how we collect, use, store, and protect your personal information when you use the Revel platform (also branded as Let's Revel) at letsrevel.io.

Data Controller:

Biagio Distefano

Van-der-Nüll-Gasse 69-71/19, 1100 Vienna, Austria

VAT ID: ATU81173837

Email: contact@letsrevel.io

For the member registers and private notes described in Section 4.6, the organization that keeps them is the controller and we act as its processor.

Revel is committed to protecting your privacy and giving you full control over your personal data. We operate under the principles of transparency, data minimization, and user autonomy. We are based in Austria and comply with the General Data Protection Regulation (GDPR).

Our Privacy Commitments:

  • We collect only the data necessary to provide our services
  • We never sell or share your data for marketing purposes
  • We do not use tracking cookies or analytics
  • You have GDPR rights over your data
  • Your data is stored securely in the European Union

2. Information We Collect

2.1 Information You Provide Directly

Account Information

When you create an account, we collect:

  • Email address (required for authentication and communication)
  • Password (stored in hashed form, never in plaintext)
  • Name (first and last name, optional)
  • Preferred name (optional)
  • Pronouns (optional)
  • Profile picture (optional)

Guest Access

If you RSVP to an event or buy a ticket as a guest (without registering), we collect only your email address and, where the organizer requires names on tickets, the name(s) to put on the ticket(s), and the language you used on the site, so that your emails arrive in it. A limited guest record is created to deliver your ticket or RSVP confirmation; it becomes a full account only if you later register with the same email.

User Profile Information

You may optionally provide:

  • Preferred city (for distance-based event sorting)
  • Dietary restrictions (allergies, intolerances, preferences)
    • Restriction type (allergy, intolerance, preference)
    • Public/private visibility setting
    • Custom notes
  • Dietary preferences (vegetarian, vegan, gluten-free, etc.)
  • Language preference (English, German, Spanish, French, Italian, Portuguese)

Two-Factor Authentication (2FA)

If you enable 2FA:

  • TOTP secret key (stored encrypted)

Event and Organization Content

When you create or interact with events and organizations:

  • Event details (name, description, location, dates, capacity, pricing)
  • Venue and seat-map layouts created by organizers (sectors, rows, seats, price categories)
  • Organization details (name, description, contact information, brand colors, custom domain, and billing and tax details such as legal name, address, VAT ID or tax number)
  • Uploaded files (photos, documents, logos)
  • Tags and categories
  • RSVP responses (Yes, No, Maybe)
  • RSVP notes (an optional short note you attach to an RSVP, where the organizer has enabled notes — e.g. dietary info or arrival time; shared with the organizer)
  • Questionnaire submissions (answers to screening and membership-application questions)
  • Potluck item assignments

Ticketing and Seating

For tickets, season passes, and seated events:

  • Ticket and season pass records (event, tier, status, QR code, ticket number, and time of issue)
  • Seat assignment (the specific seat on your ticket, where the event is seated) and the price you paid for it
  • Box-office records created by organizers at the door (e.g. door sales, complimentary tickets, seat changes at check-in, and any outstanding amount you agreed to pay the organizer on site)
  • Campaign tags (utm_source, utm_medium, utm_campaign, utm_content) taken from the address of the page you bought on, when the organizer tagged the link you followed. The labels are chosen by the organizer, contain no identifier of you, and are stored on the ticket or season pass record. Nothing is read from your device: if the tags are not in the address at checkout, none are stored.

Membership Subscriptions

If you hold or apply for a membership in an organization:

  • Membership tier, plan, and status (active, cancelled, lapsed, etc.), including start/renewal dates
  • Membership applications and their outcome, including questionnaire answers where a questionnaire is attached
  • Subscription payment history (amounts, dates, status — not card details)
  • Stripe identifiers (a per-organization Stripe Customer ID and subscription ID; see Section 5.3)

Member Registers

Organizations keep a register of their membership periods. An entry holds:

  • your name and the email address on the entry (your account email for entries created from your memberships, or the address staff entered)
  • the membership tier, the start and end dates, and how the membership started and ended (for example, application, subscription, staff decision, or a ticket that grants a day membership)
  • where relevant, the questionnaire you accepted, and the event and ticket a day membership came from
  • whether and how the entry is linked to your account (for example, by invitation, by approval of your membership application, or by a verified email match)

Entries are created automatically from your memberships and qualifying tickets, or added by organization staff, including for people who have no Revel account. The organization is the controller of its register; we process it on the organization's behalf (see Section 4.6).

Private Organizer Notes

Organization staff with permission to manage members can keep one private note about a member, an attendee, or a register entry. The note is shown to the organization's staff, including door staff at check-in. It is not shown to you, and apps you connect cannot read it. The organization is the controller of these notes; we process them on the organization's behalf (see Section 4.6).

Payment Information

For ticket, pass, and membership purchases:

  • Payment information is collected and processed by Stripe (not by Revel)
  • We store only:
    • Stripe transaction ID
    • Purchase details (event, tier, quantity, price, seat where applicable)
    • Payment status (pending, completed, refunded)
    • Payment method type (online, offline, at-door, free)
    • The last four digits of the card, where an invoice is issued for a card payment (the invoice shows them as the means of payment)
    • Card dispute (chargeback) records: amount, reason, status, and evidence deadline

We never store credit card numbers, bank account details, or other sensitive payment data. For recurring memberships, your payment method is stored by Stripe, not by us.

Billing Details for Invoices

Where an organizer issues you an invoice through the Platform, we collect and store the billing details needed on the invoice:

  • Billing name and billing address (street, postal code, city, region, and country; a business buyer who enters a VAT ID must also provide a full address)
  • VAT ID and country (where applicable)
  • Billing email

These appear on the invoice document, which is retained as a financial record (see Section 6.3).

Where country-specific rules prevent an invoice or credit note from being issued through the Platform, we keep a record of the billing details and the purchase instead, so that the organizer can issue the document from their own system. This record is retained as a financial record too.

Referral Program (Referrers Only)

If you participate in the referral program, we additionally collect:

  • Billing name (legal name for invoicing)
  • Billing address
  • VAT ID (optional, validated against the EU VIES register if provided)
  • Self-billing agreement (consent to Revel issuing invoices on your behalf)

This data is used solely for payout processing and tax-compliant statement generation.

If you apply to the referral program, we collect your email address, the code you request, and your note, together with our decision and any note from the reviewer.

Organization Creation

If you create an organization after following a link that carries campaign tags (utm_*), the tags are stored on the organization so that we can see which of our pages or campaigns led to it. As with ticket purchases, nothing is read from or stored on your device.

Developer Apps

If you register an app that uses Sign in with Revel, we store the app's name, logo, redirect addresses, and client credentials.

Communications

We may collect:

  • Support inquiries sent to contact@letsrevel.io
  • Notification preferences (in-app, email, Telegram)
  • Unsubscribe tokens for email management
  • Muted organizations whose announcements you have turned off
  • Email suppression records: when an email to an address bounces, is blocked, or is reported as spam, or when someone without an account opts out of invitations, we record the address, the reason, and the date, and stop emailing it

2.2 Information Collected Automatically

Technical Information

When you use Revel, we automatically collect:

  • IP address (used transiently for geolocation and, when you register, sent to Cloudflare for the bot check; not stored)
  • Device information (browser type, operating system)
  • Session information (login time, JWT token metadata, and a record of the tokens issued for each sign-in, so that logging out ends that sign-in everywhere, and resetting your password or changing your email address ends all your sessions)
  • Request metadata (request ID for debugging and support)

Cookies and Local Storage

We use only essential cookies required for the Platform to function:

  • Session cookies (JWT authentication tokens)
  • Invitation cookies to automatically let you join organizations and events
  • Referral code cookie (stores a referring user's code for 30 days, for referral attribution at registration)
  • Language preference
  • Your "Remember me" choice at sign-in
  • Interface preferences (for example, a collapsed admin sidebar or a dismissed setup card)
  • CSRF protection tokens

We do not use:

  • Analytics cookies (Google Analytics, etc.)
  • Advertising cookies
  • Tracking pixels (other than Brevo's anonymous email tracking, Section 5.3)
  • Third-party tracking technologies

Usage Information

We collect minimal usage data for service operation:

  • Login/logout events (for security)
  • Error logs and sampled request traces (for debugging and reliability)
  • Background task execution (Celery tasks)

We do not track:

  • Page views
  • Click behavior
  • User navigation patterns
  • Time spent on pages

2.3 Information from Third Parties

Geolocation Data

  • IP2Location database is used to suggest your city based on IP address
  • This data is used transiently during the request and never stored
  • No IP address data is associated with your account

Identity Providers (Optional)

If you sign in through an identity provider (currently Google), we receive and store your account identifier at that provider and the email address it reports, linked to your Revel account. If you create your account this way, we also import your profile picture from the provider and process it like any other upload. You can unlink an identity in your account security settings.

Organizations

Organization staff may add you to their member register, with your name and, optionally, your email address, before you have a Revel account (see Section 2.1). If you later have a Revel account with that email address verified, the entry is linked to your account and the organization's staff are notified. Staff can also look up whether a verified Revel account exists for an exact email address, to add that person as a member or staff.

Cloudflare Turnstile

When you register, a Cloudflare Turnstile check runs in your browser to tell people from bots. It evaluates technical signals from your browser and device. We send the resulting token and your IP address to Cloudflare to verify it, and we use only whether the check passed.

Brevo

Our email provider tells us when an email to you bounces, is blocked, or is reported as spam. We use this only to stop emailing that address and to show you a notice in your account.

Stripe

We receive transaction confirmation data from Stripe:

  • Payment success/failure notifications (including subscription renewal outcomes)
  • Refund confirmations
  • Transaction IDs
  • The last four digits of the card used, where an invoice is issued
  • Card dispute (chargeback) notifications

Telegram (Optional)

If you link your Telegram account to Revel:

  • Telegram username (for bot communication)
  • Telegram user ID (for message delivery)
  • Language preference (for i18n)

We do not access your Telegram messages, contacts, or other data beyond what's necessary for notification delivery.

2.4 Information We Do NOT Collect

We explicitly do not collect:

  • Precise geolocation or GPS coordinates
  • Browsing history outside Revel
  • Device identifiers (IDFA, Android ID, etc.)
  • Biometric data
  • Social media activity
  • Health information (beyond dietary preferences)
  • Financial account details

3. How We Use Your Information

3.1 Service Provision

We use your personal data to:

  • Create and manage your account
  • Authenticate your identity (login, 2FA)
  • Process event registrations, RSVPs, ticket, season pass, and membership purchases
  • Operate recurring membership billing (via Stripe) and apply grace periods on failed payments
  • Assign and manage seats for seated events, including box-office operations at the door
  • Generate your tickets, passes, and membership cards (QR codes, PDFs, Apple Wallet and Google Wallet passes)
  • Issue invoices and credit notes on behalf of organizers, where applicable, and record the ones that country-specific rules prevent us from issuing
  • Facilitate communication between organizers, members, and attendees
  • Send transactional notifications (event updates, ticket confirmations, RSVP confirmations, membership and payment confirmations)
  • Display events and organizations according to your preferences
  • Calculate distances between events and your preferred city
  • Manage dietary preferences for event planning
  • Enable questionnaire submissions and evaluations (for event admission and membership applications)
  • Keep organizations' member registers and private notes on their behalf, including day memberships granted by tickets
  • Serve organizations' pages on their custom domains, where enabled
  • Coordinate potluck assignments

3.2 Platform Operation

We process data to:

  • Maintain platform security (detect fraud, prevent abuse, block automated sign-ups)
  • Troubleshoot technical issues (debug errors, investigate bugs)
  • Improve platform reliability (monitor performance)
  • Scan uploaded files for malware (ClamAV)

3.3 Legal Compliance

We may process data to:

  • Comply with legal obligations (tax reporting, law enforcement requests)
  • Retain financial records as required by Austrian law (typically 7 years)
  • Respond to legal processes (court orders, subpoenas)
  • Protect our rights (enforce Terms of Service, defend legal claims)

3.4 Communication

We send only service emails necessary for service operation:

  • Account verification emails
  • Password reset emails
  • Event invitation emails
  • Ticket, season pass, and membership confirmation emails
  • RSVP confirmation emails
  • Questionnaire result and membership application outcome emails
  • Invoice, credit note, and payout statement delivery emails
  • Notification emails (if enabled in preferences)
  • Emails from organizations you interact with (announcements, invitations, event updates), sent on their behalf, with the organization's name as sender ("Organization via Revel")
  • Setup tips to organization owners (can be switched off)
  • Platform notices, such as changes to our Terms or this Privacy Policy

We do not send:

  • Marketing emails
  • Newsletters
  • Promotional materials
  • Advertisements

You can control most of these emails in your notification preferences. Payment, ticket, and subscription receipts, security emails, ban notices, and platform notices are always sent.

3.5 What We DO NOT Do

We never:

  • Sell your personal data to third parties
  • Share your data for advertising or marketing purposes
  • Use your data to build advertising profiles
  • Track you across other websites or apps
  • Send unsolicited marketing communications

4. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on:

4.1 Contractual Necessity (Art. 6(1)(b) GDPR)

Processing necessary to provide services you've requested:

  • Account creation and management
  • Event registration and ticketing (including seat assignment)
  • Membership subscriptions and recurring billing
  • RSVP and attendance management
  • Payment processing and invoicing (via Stripe)

4.2 Legitimate Interests (Art. 6(1)(f) GDPR)

Processing necessary for our legitimate interests:

  • Platform security and fraud prevention, including the bot check at registration
  • Technical troubleshooting and error resolution
  • Service improvement and reliability
  • Helping organizers measure which of their own communications led to ticket sales (the campaign tags described in Section 2.1)
  • Understanding which of our pages and campaigns lead people to create organizations (Section 2.1)
  • Not emailing addresses that bounced, were reported as spam, or opted out
  • Alerting our administrator to new sign-ups, organizations, and referral applications

4.3 Consent (Art. 6(1)(a) GDPR)

Processing based on your explicit consent:

  • Telegram notifications (you choose to link your account)
  • Optional profile information (dietary preferences, preferred city)
  • RSVP notes (you choose whether to attach one)
  • Apps you connect (you approve each app and its permissions)

You may withdraw consent at any time by adjusting your settings or contacting us.

4.4 Legal Obligation (Art. 6(1)(c) GDPR)

Processing required by law:

  • Financial record retention (Austrian tax law), including invoices and subscription payment records
  • Responding to law enforcement requests
  • Reporting illegal content (e.g., CSAM)

4.5 Special Categories of Personal Data (Art. 9 GDPR)

Revel is an event platform that may be used for events related to lifestyle, identity, or sexuality. By registering for such events, applying for membership in such organizations, or providing related information in questionnaires or RSVP notes, you may reveal special category data (e.g., data concerning sexual orientation or health) as defined by Art. 9 GDPR.

We process such data only with your explicit consent (Art. 9(2)(a) GDPR), given when you:

  • Voluntarily register for events or join organizations whose nature may reveal special category data
  • Submit questionnaire responses or RSVP notes containing such information

Additional safeguards for special category data:

  • We apply the same security measures described in Section 6.2 to all data, including special category data
  • Event organizers are bound by our Terms of Service to handle attendee data responsibly
  • You can withdraw consent at any time by cancelling your registration or deleting your account

4.6 Data We Process on Behalf of Organizations

For member registers and private organizer notes, the organization decides whether to use these features, what its staff add, and why, and is the controller (Art. 4(7) GDPR). It also determines the legal basis, for example its obligations as an association or its legitimate interest in running its membership. We process this data as the organization's processor (Art. 28 GDPR), under the terms in Section 14.4 of our Terms of Service. Requests about this data are answered by the organization; if you send them to us, we forward them and help the organization respond.

5. Data Sharing and Disclosure

5.1 We Do Not Sell Your Data

We never sell, rent, or trade your personal data to third parties for marketing or any other purpose.

5.2 Sharing Within the Platform

Your data is shared within Revel according to your privacy settings and the organizer's event settings:

Public Information

Visible to all users (including non-registered visitors):

  • Public events and their details
  • Public organizations, their details, and their published membership tiers
  • Your name (when you attend public events or belong to public organizations, subject to the event's attendance-visibility settings)

Organization Members

Visible to members of organizations you belong to:

  • Your profile information (as configured)
  • Your event attendance (for organization events, subject to the event's attendance-visibility settings)
  • Your dietary preferences (if made public, for event planning)

Event Organizers and Their Staff

Visible to organizers (and authorized staff) of events you attend or organizations whose membership you hold or apply for:

  • Your name and email
  • Your RSVP status and any RSVP note you attach
  • Your ticket, seat assignment, and season pass information, including box-office records
  • The campaign tags through which you arrived before buying, where the organizer tagged their own links
  • Your membership tier, plan, subscription status, and payment history (not card details)
  • Your membership application and questionnaire submissions
  • Your entries in their member register
  • Any private note their staff keep about you
  • Your billing details, where an invoice is issued to you, or where the organizer must issue it from their own system
  • Your profile picture, name, and pronouns, shown to door staff when they scan your membership card
  • Your dietary restrictions/preferences (for meal planning)
  • Your potluck item assignments

Other Attendees

What other attendees can see is controlled by the organizer's attendance visibility settings, configured per event:

  • Attendee count, event capacity, and the guest list can each be shown or hidden independently
  • Anything the organizer withholds is genuinely not exposed (not merely hidden in the interface)
  • Aggregated dietary summaries may be visible for potlucks

5.3 Third-Party Service Providers

Stripe (Payment Processing, Subscriptions, and Referral Payouts)

When you purchase tickets, season passes, or memberships:

  • Your payment information is sent directly to Stripe
  • Stripe processes payments on behalf of event organizers
  • For recurring memberships, Stripe stores your payment method and charges renewals on the organizer's behalf; a Stripe Customer object is created for you on the organizer's connected Stripe account, and we store only its identifier
  • Stripe's Privacy Policy applies: https://stripe.com/privacy
  • We receive only transaction confirmations, not payment details
  • We keep what Stripe receives to a minimum: checkout items carry generic labels (no event or tier names), and Stripe customers are created with your email address only

When you participate in the referral program:

  • Referrers connect a Stripe Express account to receive payouts
  • Stripe handles identity verification and bank account setup directly
  • We store only the Stripe account ID and connection status — not bank details or identity documents

Financial data retention: Transaction records are stored on Stripe as required by Austrian tax law (typically 7 years). This data remains on Stripe even after you delete your Revel account.

Telegram (Optional Notifications)

If you enable Telegram notifications:

  • Telegram username and user ID are stored
  • Notifications are sent via Telegram's Bot API
  • Telegram's Privacy Policy applies: https://telegram.org/privacy
  • We do not access your Telegram messages or contacts

Apple Wallet (Optional)

You can download tickets and season passes as Apple Wallet passes (.pkpass files):

  • The pass is generated on our servers and contains your ticket details (event, seat, QR code)
  • Once added, the pass is stored on your device in Apple Wallet; Apple's terms and privacy policy apply to your use of Wallet
  • We do not send your data to Apple; you download the pass directly from us

Google Wallet (Optional)

You can add tickets, season passes, and membership cards to Google Wallet:

  • This only happens when you choose to, by tapping an "Add to Google Wallet" link or button
  • When you add a pass, its contents are transmitted to Google and stored in your Google Account. The pass contains your ticket or membership details: event or organization name, date, time and venue, ticket or membership type, price, holder name, and the identifier encoded in the QR code
  • Google may also retrieve the event's public images (organizer logo, event cover) from our servers to display on the pass
  • Once added, the pass is governed by Google as an independent controller; Google's Privacy Policy applies: https://policies.google.com/privacy
  • If you never use the Google Wallet option, none of your data is sent to Google Wallet

Apps You Connect (Optional)

If you authorize an app through Sign in with Revel, the app receives the account data covered by the permissions you approved (for example, your name and email address, or your tickets) and can act on your behalf within those permissions. The app's developer is an independent controller, and their privacy policy applies. We store your authorization and the app's access tokens. You can disconnect an app at any time under Settings > Connected apps.

Eventbrite (Optional, for Organizers)

If an organizer connects an Eventbrite account, we send the event's public details and ticket tiers to Eventbrite. We send no attendee data, and we receive only the number of tickets sold per tier.

Cloudflare (CDN and Security)

All traffic to Revel is routed through Cloudflare's network:

  • Purpose: DDoS protection, TLS termination, content delivery, TLS certificates for organizations' custom domains (Cloudflare for SaaS), and the bot check at registration (Turnstile)
  • Data exposed: All data transmitted between your browser and our servers transits through Cloudflare's infrastructure
  • Cloudflare is a US company with a global network of data centers
  • Safeguards: Cloudflare provides a Data Processing Agreement (DPA) as part of their service terms and is certified under the EU-US Data Privacy Framework
  • Privacy Policy: https://www.cloudflare.com/privacy/

Important: While your data is stored in the European Union (see Section 6.1), it transits through Cloudflare's network for delivery. Cloudflare may process request data (including IP addresses, headers, and request bodies) on servers outside the EU.

Brevo (Email Delivery)

Transactional emails (e.g., ticket confirmations, event updates) are delivered via Brevo (formerly Sendinblue):

  • Data sent: Recipient email address, email content
  • Brevo is an EU company (headquartered in Paris, France)
  • Safeguards: Brevo complies with GDPR and provides a Data Processing Agreement (DPA)
  • Privacy Policy: https://www.brevo.com/legal/privacypolicy/

For the Platform, we use Brevo only for service email delivery and for the delivery events (bounces, blocks, spam reports) described in Section 2.3.

Note: Brevo adds an open-tracking pixel to transactional emails and routes links through its click-tracking redirect. We have set this tracking to anonymous, so opens and clicks are not linked to individual recipients. We do not use this data, and Brevo does not let us turn it off for transactional email.

Hetzner (Infrastructure Hosting)

All Revel services (application, database, background tasks, monitoring, and logging) are hosted by Hetzner Online GmbH:

  • Hetzner is an EU company (headquartered in Gunzenhausen, Germany)
  • Data location: Germany
  • Safeguards: Hetzner complies with GDPR and provides a Data Processing Agreement (DPA)
  • Privacy Policy: https://www.hetzner.com/legal/privacy-policy/

5.4 Embedded Content on Other Websites

Organizers can embed their Revel event listings on their own websites. If you visit a website that embeds Revel content:

  • The embedded content is served from letsrevel.io, so your browser makes a request to our servers (subject to this policy, including the Cloudflare transit described above)
  • Embeds are cookie-free: they set no cookies and run no tracking code on the embedding website
  • We do not learn anything about your activity on the embedding website beyond the request for the embedded content itself. One exception: if the organizer installs our loader script and the address of their page carries campaign tags, the loader passes those tags to the embed so that a purchase can be attributed to that page (see Section 2.1). Nothing else about the page is read.
  • The embedding website's own privacy policy governs that website

Organization Pages on Custom Domains

Some organizations show their Revel pages on their own domain. Those pages are served by Revel, and this Privacy Policy applies there. Signing in on a custom domain uses the same account, and the organization receives no more data about you than it does on letsrevel.io.

5.5 Legal Disclosures

We may disclose your information if required by law:

  • Law enforcement requests (with valid legal process)
  • Court orders or subpoenas
  • Reporting illegal content (e.g., CSAM to authorities)
  • National security requests (if legally required)

We will notify you of legal requests unless prohibited by law.

5.6 Business Transfers

If Revel is acquired, merged, or undergoes a business transition:

  • Your data may be transferred to the successor entity
  • We will notify you before your data is transferred
  • The successor must honor this Privacy Policy

5.7 With Your Consent

We may share data for other purposes with your explicit consent.

6. Data Storage and Security

6.1 Data Location

Your data is stored in the European Union, specifically in Germany, hosted by Hetzner Online GmbH (an EU company based in Germany), ensuring GDPR compliance and strong privacy protections.

Data in transit: Traffic between your browser and our servers is routed through Cloudflare's global network for security and performance (see Section 5.3). While data at rest remains in the EU, data in transit may pass through Cloudflare infrastructure outside the EU.

6.2 Security Measures

We implement industry-standard security measures:

Technical Safeguards

  • Encryption in transit: All data transmitted over HTTPS/TLS
  • Encryption at rest: Database and file storage encryption
  • Secure authentication: JWT tokens with expiration, 2FA support
  • Password hashing: Passwords stored using Django's secure hashing (PBKDF2)
  • Malware scanning: All uploaded files scanned with ClamAV
  • Input validation: Protection against XSS, SQL injection, CSRF

Organizational Safeguards

  • Access controls: Limited access to production data
  • Regular updates: Security patches applied promptly
  • Monitoring: Error tracking and security logging
  • Backup systems: Regular backups for disaster recovery

File Security

  • Malware scanning: ClamAV scans all uploaded files
  • Quarantine system: Suspicious files are isolated and flagged
  • Notifications: Uploader, organizers, and platform staff are notified of malware detections

6.3 Data Retention

We retain your personal data only as long as necessary:

Active Accounts

  • Data retained while your account is active
  • You can delete data manually at any time

Deleted Accounts

  • Personal data deleted immediately upon account deletion
  • Financial records retained as required by Austrian law (typically 7 years for tax purposes): Stripe transaction records, invoices/credit notes and subscription payment records generated on the Platform, and records of invoices and credit notes that the organizer had to issue from their own system
  • Member register entries stay with the organization that keeps the register: your name, the email address on the entry, and membership periods remain, no longer linked to your account. To have them removed, contact the organization
  • Private organizer notes about you are deleted with your account
  • Anonymized data may be retained for aggregated statistics (no personal identifiers)

Specific Retention Periods

  • Session tokens: Expire after inactivity
  • Email verification tokens: Expire after 24 hours
  • Password reset tokens: Expire after 1 hour
  • 2FA backup codes: Retained until used or 2FA is disabled
  • Checkout reservations and seat holds: Expire automatically within minutes if payment is not completed
  • Transactional emails: Retained in logs for 90 days for support purposes
  • Error logs and request traces: Retained for 30 days for debugging
  • Email suppression records: Kept until the address owner asks us to clear them, so that we do not email the address again

6.4 Data Breach Notification

In the event of a data breach:

  • We will notify affected users within 72 hours (as required by GDPR)
  • We will report the breach to the Austrian Data Protection Authority if required
  • We will provide details on the nature of the breach and steps taken to mitigate harm

7. Your Rights Under GDPR

As a user in the European Union, you have the following rights:

7.1 Right of Access (Art. 15 GDPR)

You can request a copy of all personal data we hold about you as controller.

How to exercise:

You will receive a machine-readable file (JSON format) containing all your data. The export contains your data only — it never includes other people's personal data. It includes your entries in organizations' member registers. Private organizer notes are not included: the organization is their controller (see Section 4.6), so ask the organization for them.

7.2 Right to Rectification (Art. 16 GDPR)

You can correct inaccurate or incomplete personal data.

How to exercise:

7.3 Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR)

You can request deletion of your personal data.

How to exercise:

Exceptions: We may retain data when required by law (e.g., financial records for tax compliance). Entries about you in organizations' member registers are not deleted with your account; the organization is their controller (see Sections 4.6 and 6.3), so ask the organization to remove them.

7.4 Right to Restriction of Processing (Art. 18 GDPR)

You can request that we limit how we process your data.

How to exercise: Contact contact@letsrevel.io with your request.

7.5 Right to Data Portability (Art. 20 GDPR)

You can receive your data in a structured, commonly used, machine-readable format.

How to exercise:

  • Use the Data Export feature in Account Settings
  • You'll receive a JSON file containing all the data we hold about you as controller

7.6 Right to Object (Art. 21 GDPR)

You can object to processing based on legitimate interests.

How to exercise: Contact contact@letsrevel.io explaining your objection.

7.7 Right to Withdraw Consent (Art. 7(3) GDPR)

For processing based on consent (e.g., Telegram notifications), you can withdraw consent at any time.

How to exercise:

7.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority.

Austrian Data Protection Authority:
Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Wien, Austria
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at

7.9 Exercising Your Rights

To exercise any of these rights:

  • Email us: contact@letsrevel.io
  • Postal mail: Biagio Distefano, Van-der-Nüll-Gasse 69-71/19, 1100 Vienna, Austria

We will respond to your request within 30 days (as required by GDPR).

8. Children's Privacy

Revel is not intended for children under 16 years old. We do not knowingly collect personal data from children under 16.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at contact@letsrevel.io. We will delete such data promptly.

Age verification: We do not provide age verification services. Event organizers are responsible for enforcing age restrictions for their events.

9. International Data Transfers

9.1 EU Data Storage

All user data is stored in the European Union (Germany), ensuring GDPR compliance. Data in transit may pass through Cloudflare's global network (see Section 5.3 and 6.1).

9.2 Third-Party Services Outside EU

Some third-party services may process data outside the EU:

Stripe (Global)

  • Data sent: Payment information (sent directly from your browser to Stripe), including stored payment methods for recurring memberships
  • Safeguards: Stripe is certified under various international frameworks for data protection
  • Privacy Policy: https://stripe.com/privacy

Cloudflare (United States)

  • Data exposed: All request and response data transits through Cloudflare's network
  • Purpose: DDoS protection, TLS termination, content delivery
  • Safeguards: Cloudflare is certified under the EU-US Data Privacy Framework and provides a standard DPA
  • Privacy Policy: https://www.cloudflare.com/privacy/

Google Wallet (United States)

  • Data sent: Ticket, pass, or membership card details (see Section 5.3), only when you choose to add a pass to Google Wallet
  • Safeguards: Google LLC is certified under the EU-US Data Privacy Framework
  • Privacy Policy: https://policies.google.com/privacy

9.3 Your Consent

By using payment processing or the platform generally (which routes traffic through Cloudflare), you acknowledge that your data may be transferred outside the EU.

10. Cookies and Tracking Technologies

10.1 Essential Cookies Only

We use only essential cookies required for the Platform to function:

  • Authentication tokens (JWT): To keep you logged in
  • CSRF tokens: To protect against cross-site request forgery
  • Language preference: To display the correct language
  • Invitation token: To keep an invitation link you followed while you join, RSVP, or check out
  • Referral code: To attribute your registration to the referring user (expires after 30 days)
  • "Remember me": To keep you signed in across browser restarts when you choose it
  • Interface preferences: For example, a collapsed admin sidebar or a dismissed setup card

Embedded Revel content on third-party websites sets no cookies at all (see Section 5.4).

10.2 No Tracking or Analytics

We do not use:

  • Google Analytics or similar analytics tools
  • Advertising cookies
  • Social media tracking pixels
  • Third-party tracking scripts
  • Fingerprinting technologies

The only tracking pixel in our emails is Brevo's anonymous one (Section 5.3).

The Cloudflare Turnstile check on the registration page (Section 2.3) evaluates browser signals only to tell people from bots. It is not used to track or profile you.

10.3 Cookie Management

Essential cookies cannot be disabled without breaking core functionality. If you block cookies:

  • You will not be able to log in
  • Your language preference will not be saved
  • Some features may not work correctly

10.4 Local Storage

We may use browser local storage for:

  • Temporary session data
  • UI preferences (e.g., dark mode)

This data is stored locally on your device and is not transmitted to our servers.

11. Automated Decision-Making and Profiling

11.1 No Profiling

We do not create user profiles for:

  • Targeted advertising
  • Behavioral analysis
  • Predictive modeling
  • Personalized marketing

11.2 Questionnaire Evaluation

Questionnaires used for event admission or membership applications may be scored automatically, reviewed manually by the organizer, or both (see our Terms). Only multiple-choice answers can be scored automatically, using rules set by the organizer, and no AI is used. Where an automatic evaluation affects your admission, you may request human review by the organizer.

12. Notification Preferences

12.1 Transactional Notifications

We send transactional notifications via:

  • In-app notifications (notification center)
  • Email (transactional emails only)
  • Telegram (optional, if you link your account)

12.2 Notification Types

You can control notifications for:

  • Event updates (created, updated, cancelled, reminders)
  • RSVP confirmations and changes
  • Ticket, season pass, and membership purchases and confirmations
  • Membership application outcomes
  • Invitation notifications
  • Questionnaire results
  • Potluck assignments
  • Organization announcements
  • System notifications (e.g., malware detected)
  • Setup tips for organization owners
  • Digests of invoices and credit notes the organization must issue itself (organization staff)
  • Ticket sales, cancellations, refunds, and card disputes (organization staff)
  • Custom domain status (organization owners)

12.3 Managing Preferences

You can manage notification preferences in:

  • Account Settings > Notification Preferences
  • Email unsubscribe links (one-click unsubscribe)
  • Muting an organization to stop its announcements without changing anything else

Note: Payment, ticket, and subscription receipts, security emails (e.g., password reset, email verification), ban notices, and platform notices cannot be disabled.

12.4 Unsubscribe

To unsubscribe from email notifications:

  • Click the unsubscribe link at the bottom of any email
  • Your preferences will be updated via a secure token. Unsubscribing from an organization's announcement mutes that organization; from other organization mail, it stops that kind of email; from a digest, it stops email notifications
  • You will still receive the emails listed in Section 12.3 that cannot be disabled
  • If you do not have an account, you can stop invitation emails from the link in any invitation

13. Open Source and Self-Hosting

13.1 Open Source Software

Revel's source code is available under the MIT License at:
https://github.com/letsrevel/

13.2 Self-Hosted Instances

This Privacy Policy applies only to the hosted service at letsrevel.io.

If you self-host Revel:

  • You are the data controller for your instance
  • You are responsible for GDPR compliance
  • You must create your own privacy policy for your users
  • This policy does not apply to self-hosted instances

13.3 Data Portability for Self-Hosting

You can export your data from letsrevel.io and import it into your self-hosted instance using the Data Export feature.

14. Changes to This Privacy Policy

14.1 Policy Updates

We may update this Privacy Policy from time to time. When we make material changes:

  • We will update the "Last Updated" date at the top
  • We will notify you via email or in-app notification
  • We will request your consent if required by law

14.2 Review of Changes

We encourage you to review this Privacy Policy periodically. Continued use of Revel after changes constitutes acceptance of the updated policy.

14.3 Objection to Changes

If you do not agree to changes:

  • You may delete your account via Account Settings
  • You may contact us at contact@letsrevel.io to discuss concerns

15. Contact Us

15.1 Privacy Questions

For questions about this Privacy Policy or our data practices:

Email: contact@letsrevel.io
Postal Address:
Biagio Distefano
Van-der-Nüll-Gasse 69-71/19
1100 Vienna, Austria

15.2 Data Protection Requests

To exercise your GDPR rights or request data access/deletion:

We will respond within 30 days as required by GDPR.

15.3 Data Protection Authority

If you have concerns about our data practices, you can contact the Austrian Data Protection Authority:

Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Wien, Austria
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at

16. Acknowledgments

16.1 Third-Party Data Sources

We use the following third-party data sources:

These databases are used for non-personal geolocation features and do not track individual users.

By using Revel, you acknowledge that you have read, understood, and agree to this Privacy Policy.