Revent Privacy Policy

This Privacy Policy explains how Revent Holdings, Ltd., a Delaware corporation ("Revent", "we", "us" or "our"), collects, uses, shares and protects personal information when you use the Revent platform and everything we offer with it (the "Services"), including getrevent.com, Amplify, the Inbox, agents and workflows, hosted sites and pages, ticketing and checkout, and our apps and APIs.

Contact. Revent Holdings, Ltd., 7 Sunset Lane, Miller Place, New York 11764, United States. Privacy requests and questions: privacy@getrevent.com. Data deletion instructions: getrevent.com/data-deletion.

1. Who this Policy covers, and our roles

We work with three kinds of people:

• Customers and their users. Venues, promoters, organizers, agencies and other businesses that have a Revent account ("Customers"), and the people they authorize to use it.
• Attendees and contacts. People who buy tickets or register for a Customer's event, visit a Customer's hosted site or page, message a Customer, are on a Customer's contact list, or interact with a Customer's content and advertising on a connected platform.
• Visitors. People who visit getrevent.com or contact us.

Two roles. For the personal information a Customer brings to the Services or that we collect on a Customer's behalf (Attendee and contact details, orders, messages, audiences, and data from the Customer's connected platforms), the Customer decides why and how it is used, and Revent processes it on the Customer's instructions as a processor or service provider, under our Data Processing Addendum. If you are an Attendee or contact and want to know how a particular business uses your information, its own privacy notice applies and your request may be routed to it; we will help you reach it.

For a limited set of purposes, Revent decides how information is used and is the controller or business: creating and securing accounts, running checkout and delivering tickets and receipts, keeping consent and opt-out records, preventing fraud and abuse, billing, support, product analytics, complying with law, and operating getrevent.com.

We keep each Customer's data separate. We do not use one Customer's data, contacts or platform data to benefit another Customer.

2. Information we collect

2.1 Information you give us

• Account and profile. Name, email address, phone number, password or passkey, role, organization name and details, profile photo, time zone and preferences.
• Billing. Billing contact and address, tax identifiers, and the plan you choose. Full payment card numbers go directly to Stripe; we receive a token, the card brand, last four digits and expiry.
• Content you create or upload. Posts, ads, messages, images, video, audio, documents, event listings, site content, templates, contact and audience lists, and anything else you add to the Services.
• Checkout and registration. When you buy a ticket or register: name, email, phone number, billing postcode, the event, tickets and amounts, answers to the organizer's questions, and, where you choose, a saved payment method with Stripe.
• Communications. Messages you exchange with a Customer through the Services, messages you send us, support requests, survey answers and feedback.

2.2 Information we collect automatically

• Usage and device data. Pages and features used, actions taken (including approvals and agent instructions), timestamps, referring and exit pages, links clicked, browser type, operating system, screen size, language, IP address and approximate location derived from it, and identifiers for your device, session and browser.
• First-party analytics. On getrevent.com and on hosted sites and event pages, we measure visits, page views, scroll and interaction events, and the link or campaign that brought you (including UTM parameters, referral tokens and ad click identifiers in the URL). We do this server-side on our own domains as far as possible, using short-lived identifiers. We run our product analytics on infrastructure we control.
• Cookies and similar technologies. See Section 6.
• Logs and security records. Server logs, authentication events, API calls, rate-limit and bot-detection signals, and records of consent, opt-outs and deletion requests.

2.3 Information from connected platforms (Platform Data)

When a Customer connects a third-party account, we receive information from that platform through its official APIs, limited to the permissions the Customer grants and to what the platform makes available. In general this is: the account's identifiers and profile details; the content the Customer publishes through Revent and its performance; the Customer's ad accounts, campaigns, creative, audiences and results; comments and, where the Customer enables them and the platform makes them available, conversations the Customer chooses to manage in the Inbox; and the access tokens that let us act for the Customer. By platform:

• Meta (Facebook Pages, Instagram professional accounts, Meta ad accounts, WhatsApp Business Accounts). Page and account details, published content and its insights, ad accounts and campaign results, conversations the Customer manages where enabled, and WhatsApp Business Account configuration, phone numbers and message templates.
• TikTok (TikTok for Developers and TikTok for Business). Account details, videos the Customer publishes through Revent and their public performance, comments on the Customer's content, and ad accounts, campaigns, creative, audiences and results.
• LinkedIn (Pages, Campaign Manager, LinkedIn Events). Organization Page details, posts and Page analytics, follower and visitor statistics, ad accounts, campaigns, creative and results, Lead Gen Form responses, Matched Audience lists the Customer uploads, LinkedIn Insight Tag and Conversions API events from the Customer's sites, LinkedIn Event details and attendee data where LinkedIn makes them available, and comments and messages where the Customer enables them.
• Google (Google Business Profile, Google Ads, YouTube, Google Calendar). Business profile details, posts, reviews and insights; ad accounts, campaigns and results; channel and video details and analytics; and calendar entries for calendars the Customer chooses to sync (see Section 5.4).
• Apple Calendar. Calendar entries the Customer chooses to add or mirror, where supported.
• Event, ticketing, reservations and listings platforms (Eventbrite, DICE, OpenTable, TripAdvisor, Luma and others the Customer connects). Event listings, availability, orders, attendee or guest records and reservations, reviews and ratings, and sales and settlement reports, as the Customer's connection and the platform's API allow.
• Stripe. Connected account status, payouts, balances, charges, refunds and disputes for the Customer's ticket sales.
• Messaging providers. Delivery, read and reply status and message content for SMS, RCS, WhatsApp and email sent or received through the Services.

Platform Data belongs to the Customer and the platform. Section 5 explains how we use, protect and delete it.

2.4 Information from other sources

• From Customers. A Customer may upload contact lists, import attendee records from another platform, or add notes about its contacts. The Customer is responsible for having the right to do so.
• From service providers. Fraud and risk signals from Stripe and our security providers; delivery and error information from carriers and email providers.
• From AI model providers. The output generated from the content submitted to AI features.
• Public sources. Publicly available information about a Customer's business (for example, its public pages and listings) to set up or improve its account, at the Customer's request.

3. How we use information

We use personal information to:

• Provide the Services. Create and secure accounts; connect platforms and act on the Customer's instructions; publish content and run advertising the Customer approves; receive and route messages; run checkout, deliver tickets and receipts, and pay organizers; host sites and pages; sync calendars; and operate apps and APIs.
• Power AI features. Generate drafts, summaries, classifications, recommendations and answers from the content a Customer submits and from its data in the Services, and prepare actions for agents and workflows within the permissions the Customer sets. Section 5.5 explains the safeguards.
• Measure and attribute. Show each Customer how its content, creative, campaigns and messages perform and what led to its views, replies, bookings and sales, by linking campaigns, links, messages and purchases, and, where the Customer connects them, through platform measurement tools.
• Communicate with you. Send transactional messages (tickets, receipts, confirmations, security alerts, service notices); respond to support requests; and, with your consent where required, send product news. You can opt out of marketing from us at any time.
• Keep the Services safe. Authenticate users, detect and prevent fraud, abuse, bots, spam and security incidents, enforce our Terms and platform policies, and defend against chargebacks and claims.
• Improve and understand the Services. Product analytics, debugging, research and development, and learning which kinds of content and creative perform, using aggregated or de-identified data that does not identify any person, Customer or account.
• Comply with law. Tax, accounting, record-keeping, sanctions screening, responses to lawful requests, and the exercise or defense of legal claims.

Legal bases (where the GDPR, UK GDPR or similar laws apply). Performance of a contract with you; our legitimate interests (operating, securing and improving the Services, measuring campaigns for Customers, preventing fraud, marketing our business) balanced against your interests; your consent where we ask for it (for example, for non-essential cookies in some regions or marketing messages); and compliance with legal obligations.

We do not sell personal information, and we do not share it with data brokers. We do not use the content of messages, posts or documents to build advertising profiles or to target advertising on behalf of anyone other than the Customer whose data it is.

4. Marketing, messaging and consent

• Messages from Customers. Customers use the Services to send email, SMS, RCS, WhatsApp and platform messages to their own contacts. The Customer is responsible for obtaining the consent that law and the platform require. We provide tools that record consent, apply opt-outs and suppress contacts who have opted out. To stop a Customer's marketing, reply STOP (or a similar instruction), use the unsubscribe link, contact the Customer, or email privacy@getrevent.com naming the business; we keep a minimal record so the opt-out keeps working.
• Transactional messages. When you buy a ticket or register, we and the organizer send the messages needed to deliver it and to tell you about changes to the event. These are not marketing and continue until the event has passed.
• Messages from Revent. We send Customers service and account messages. We send product and marketing email only where permitted, with an unsubscribe link in every message.

5. Platform Data: how we use, protect and delete it

This Section applies to information we receive from Meta, TikTok, LinkedIn, Google, Apple, Eventbrite, DICE, OpenTable, TripAdvisor, Luma, Stripe and any other platform a Customer connects.

5.1 How we use it

We use Platform Data only to provide the Services to the Customer whose connection it came from: to show the Customer its own content, conversations, audiences and performance; to publish, advertise, reply and act as the Customer instructs; to measure the Customer's results, including how its content and creative perform; and to generate drafts and recommendations for the Customer. Performance statistics may be kept in aggregated, de-identified form that does not identify any person, Customer or account, to improve the recommendations the Services make, where the platform's terms allow. We do not:

• sell Platform Data, share it with data brokers, or use it for our own advertising;
• use one Customer's Platform Data for another Customer, or combine Platform Data across Customers to build profiles of people;
• use Platform Data to make decisions about a person's eligibility for credit, housing, insurance, employment or similar benefits;
• transfer Platform Data to third parties except the service providers in Section 9 who process it for us, or as the law requires;
• use Platform Data to train AI models.

5.2 How we protect it

Access tokens and credentials are encrypted at rest and never shown in the product. Platform Data is stored in access-controlled databases and object storage scoped to the Customer's organization, with row-level access controls, encrypted connections, logging and monitoring. Access by Revent staff is limited to what support, security and engineering need and is logged.

5.3 Disconnection, revocation and deletion

• A Customer can disconnect any platform at any time in its Revent settings. A Customer or user can also revoke Revent's access inside the platform: in Meta's Business Integrations settings (facebook.com/settings → Business integrations) and Instagram's Apps and websites settings; in TikTok under Settings and privacy → Security and permissions → Manage app permissions, and in TikTok Ads Manager under Assets → Authorizations; in LinkedIn under Settings → Data privacy → Permitted services; in Google at myaccount.google.com/permissions; and in each other platform's connected-apps settings.
• When a platform is disconnected or access is revoked, we stop accessing it immediately and delete the related Platform Data within 30 days, including stored content, conversations, audiences, insights and tokens. We keep only aggregated statistics that no longer identify any person, and the minimal records described in Section 10 (for example, proof that a message was sent with consent, or financial records of a ticket sale).
• When a Customer closes its account, we delete all of its Platform Data on the same schedule.
• When a platform notifies us that a user has removed our app or requested deletion (for example, through Meta's data deletion callback), we delete that user's Platform Data within 30 days and provide a confirmation code where the platform's process calls for one. Our data deletion instructions explain the steps.
• If a platform tells us that data must be deleted or that our access has ended, we comply, and we delete Platform Data we no longer need for the purpose it was collected for.

5.4 Platform-specific statements

• Meta. Our use of information received from Meta's platforms complies with the Meta Platform Terms and Developer Policies, the WhatsApp Business Terms and the Meta Business Tools Terms. Revent Holdings, Ltd. is the responsible party for Revent's Meta app. For a Customer's WhatsApp Business Account, Meta Pixel and related business assets, Revent acts as the Customer's technology provider; the Customer owns and controls those assets.
• TikTok. Our use of information received from TikTok complies with the TikTok for Developers Terms of Service and Developer Guidelines and the TikTok for Business terms. We access TikTok data only through TikTok's official APIs, within the scopes the Customer approves, and delete it as described in Section 5.3.
• Google. Revent's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide and improve the features the user has chosen, is not used for advertising, and is not transferred to third parties except to provide those features, as required by law, or with the user's consent. Where a Customer syncs a Google Calendar, we access only the calendars it selects and use calendar data only to display, create and update entries as the Customer directs; we do not use calendar data for advertising or AI training.
• LinkedIn. Our use of information received from LinkedIn complies with the LinkedIn API Terms of Use, the Marketing API Program terms, the LinkedIn Advertising Policies and the Professional Community Policies. We access LinkedIn data only through LinkedIn's official APIs, within the permissions the Customer grants, and use it only to serve that Customer: managing its Pages and campaigns, measuring its results, and handling its Lead Gen Form responses, which we use only for the purpose stated on the form and share only with that Customer. We keep LinkedIn member data only as long as the LinkedIn API terms allow, and delete it when the Customer disconnects, when a member or LinkedIn requests it, or when it is no longer needed for the Customer's purpose. Where a Customer deploys the LinkedIn Insight Tag on a site we host, the Customer is responsible for the notice and consent LinkedIn requires, and the Services show a consent control where the law requires one.
• Event, ticketing, reservations and listings platforms. We use information from Eventbrite, DICE, OpenTable, TripAdvisor, Luma and similar platforms only to provide the Customer's connection (for example, importing its events, reservations and attendees, showing availability, surfacing reviews, reconciling sales), in accordance with each platform's API or partner terms. Customers keep selling and taking bookings on those platforms; Revent does not change a platform's inventory, pricing or customer terms except through actions the Customer takes or approves.

5.5 AI features and automated processing

• Providers. AI features are powered by third-party model providers listed in Section 9, which process the content submitted to them to generate output. Our agreements with them prohibit using that content to train models, and we do not use Customer Content or Platform Data to train models ourselves without written consent. Providers may retain inputs briefly for abuse monitoring under their API terms.
• What goes to the model. The content a Customer submits or selects (for example, a conversation to reply to, a post to draft, a question about its data) and the context needed to answer it. We send the minimum needed for the feature and do not send payment card numbers or access tokens.
• Human review. AI output is a draft until a person at the Customer approves it; nothing is published, advertised or sent to a connected platform without that approval. Agents and workflows act only within the permissions the Customer sets. We do not use AI to make decisions that produce legal or similarly significant effects on a person without human review.
• Logs. We keep records of prompts, outputs, approvals and agent actions so Customers can audit what was done on their behalf and so we can investigate problems and abuse.

6. Cookies, pixels and tracking

• Our own cookies. We use strictly necessary cookies and local storage for sign-in, security, session state, consent choices and load balancing. We use first-party analytics cookies or identifiers to understand how the Services are used; where the law requires consent for these, we ask for it.
• Server-side measurement. On hosted sites and event pages, we measure visits and the campaigns that led to them mainly server-side, on the site's own domain, so that most measurement does not require storing third-party cookies on your device.
• Customer tags and pixels. A Customer may deploy its own Meta Pixel and Conversions API, TikTok Pixel and Events API, LinkedIn Insight Tag and Conversions API, Google tags or similar tools on its hosted site or event page to measure its advertising. Those tools are set by the Customer and the platform, and are governed by the platform's privacy policy and the Customer's privacy notice. The Services show a consent control before non-essential tags load for visitors in regions that require it, and send hashed identifiers (for example, a hashed email) to the platform only where the Customer has configured that and the applicable consent exists. These tools can allow the platform to link your visit to your platform account.
• Global Privacy Control. We treat a Global Privacy Control signal from your browser as an opt-out of "sale" and "sharing" for targeted advertising under applicable US state laws for that browser.
• Your choices. You can block or delete cookies in your browser settings, decline non-essential cookies in our consent control, and use the opt-out tools offered by Meta, TikTok, Google and LinkedIn in their own settings. Blocking strictly necessary cookies may stop parts of the Services from working.
• Do Not Track. We do not respond to browser Do Not Track signals, which have no agreed meaning; we do respond to Global Privacy Control.

7. Ticketing, checkout and payments

• Stripe. Payments are processed by Stripe, Inc. Stripe collects your card details, device and fraud signals directly and uses them under the Stripe Privacy Policy. We receive a payment token, the card brand and last four digits, the amount, and Stripe's risk assessment. Organizers receive payouts through Stripe connected accounts and must provide identity and tax information to Stripe.
• What we record. Order, ticket, receipt and refund records; the device, IP address and session of a purchase; the link or campaign that led to it; check-in and scan events at the door; and dispute and chargeback records. We keep these to deliver tickets, prove purchases, fight fraud and chargebacks, pay organizers and meet tax and accounting rules.
• Identity linking at purchase. When you buy a ticket, we link your visit on that site to your email address or phone number so that the organizer can see which of its campaigns led to the sale and so that we can detect fraud. The organizer sees its own results; it does not see your activity with other businesses.
• Wallet passes and check-in. If you add a ticket to Apple Wallet or Google Wallet, Apple or Google handle the pass under their own policies. Scanning or tapping a ticket at the door records the ticket identifier, device identifier and time.

8. How we share information

We share personal information only as described here.

• With the Customer you interact with. If you buy a ticket, register, message, or interact with a Customer's content or site, that Customer receives your details, your orders, your messages and your interactions with its campaigns. The Customer uses this under its own privacy notice.
• With connected platforms. When a Customer publishes, advertises, replies or measures through a platform, the platform receives the content, the audience definitions and the measurement events the Customer directs us to send, under the platform's terms and privacy policy.
• With service providers (subprocessors). Companies that host, secure, process payments, deliver messages, run AI models and support the Services, listed in Section 9. They may use personal information only to provide their services to us.
• With affiliates. Any affiliate under common control with Revent, under the same obligations as this Policy.
• For legal reasons. To comply with law, regulation, legal process or a government request; to enforce our Terms; to protect the rights, property or safety of Revent, our Customers, Attendees or the public; and to detect and prevent fraud and security issues. We review every government request for legality and scope before responding, disclose the minimum necessary, and notify affected Customers where the law allows.
• In a business transfer. If Revent is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of it, under this Policy, with notice where the law requires.
• With your direction or consent. When you ask us to share, or agree to it.
• Aggregated or de-identified data that cannot reasonably identify you, which we may share freely and which we commit not to re-identify.

9. Service providers and subprocessors

| Provider | What it does for us | Data it processes | Location |

| --- | --- | --- | --- |

| Stripe, Inc. | Payment processing, billing, organizer payouts, fraud screening | Checkout, billing and payout data | United States |

| Cloudflare, Inc. | Hosting, compute, content delivery, object storage, network security, bot protection, DNS | All Services data in transit; media and files at rest | United States (global network) |

| Neon, Inc. | Managed database hosting | Account, content, order and Platform Data | United States |

| Hivelocity, Inc. | Dedicated server hosting for Revent-managed services (product analytics, CRM, content) | Usage analytics, account and content data | United States (Dallas, Texas) |

| Anthropic, PBC | AI model provider for drafting, summarization, classification and agents | Content submitted to AI features | United States |

| OpenAI, L.L.C. | AI model provider (where used for specific features) | Content submitted to AI features | United States |

| Twilio Inc. | SMS delivery and one-time verification codes | Phone numbers, message content, delivery status | United States |

| Sinch or Infobip (whichever is contracted) | RCS and SMS delivery | Phone numbers, message content, delivery status | United States / Europe |

| Resend, Inc. | Transactional email delivery | Email addresses, message content, delivery status | United States |

| Meta Platforms, Inc. | WhatsApp Business Platform messaging and Meta Business Tools, as directed by the Customer | Message content, phone numbers, measurement events | United States |

| Apple Inc. / Google LLC | App distribution, push notifications, wallet passes | Device tokens, pass data | United States |

We update this table when providers change and keep the current version at getrevent.com/privacy. Customers subject to the GDPR or similar laws may ask for notice of new subprocessors through our Data Processing Addendum.

10. How long we keep information

We keep personal information only as long as needed for the purposes in this Policy, and then delete or de-identify it. Our standard periods:

| Information | Period |

| --- | --- |

| Account and profile data | Life of the account, then deleted within 30 days of closure |

| Customer Content (posts, media, sites, templates) | Life of the account; available for export for 30 days after closure, then deleted |

| Platform Data (content, conversations, audiences, insights, tokens) | Until the platform is disconnected, access is revoked, the account is closed or the platform requests deletion; then deleted within 30 days. Tokens are deleted immediately on disconnection |

| Inbox messages and conversation history | Life of the account, or the shorter retention the Customer sets; deleted within 30 days of closure |

| Contact and audience lists | Until the Customer deletes them or closes its account |

| Campaign, link and attribution events | 24 months from the event in identifiable form, then de-identified |

| Ticket orders, receipts, refunds, payouts and dispute records | 7 years, as tax, accounting and payment rules require; personal details minimized after the dispute window where possible |

| Consent, opt-out and suppression records | For as long as needed to honor the choice |

| Fraud, security and abuse records | Up to 24 months, longer where a dispute, investigation or legal hold is open |

| AI prompts, outputs and agent action logs | 12 months, or the shorter retention the Customer sets |

| Server and access logs | 90 days |

| Support records | 24 months after the request closes |

| Backups | Encrypted backups age out within 35 days; deleted data is not restored to active use |

Where the law requires a different period, the law controls.

11. Security

We protect personal information with safeguards appropriate to its sensitivity, including encryption in transit (TLS) and at rest, encryption of access tokens and secrets, passkey and multi-factor authentication for accounts, organization-scoped access controls and row-level security in our databases, least-privilege access for staff with logging, network isolation for administrative systems, bot and abuse protection, vulnerability management and monitoring, and an incident response process. No method of transmission or storage is completely secure; if we learn of a breach affecting your personal information we will notify you and the relevant authorities as the law requires. Report security concerns to security@getrevent.com.

12. International transfers

We are based in the United States and store and process information there, and our service providers may process it in the countries listed in Section 9. If you are in the European Economic Area, the United Kingdom or Switzerland, we transfer your personal information under the European Commission's Standard Contractual Clauses (and the UK Addendum), under an adequacy decision where one applies, or under another lawful mechanism. Copies of the clauses are available on request. We do not direct the Services at residents of the EEA, the UK or Switzerland; Customers who use the Services with people in those regions are responsible for their own obligations as controllers.

13. Your rights and choices

• Access, correction, portability and deletion. You can see and update most account information in your settings. To access, correct, export or delete other personal information, email privacy@getrevent.com. Deletion steps are at getrevent.com/data-deletion. We will verify your request by confirming control of the email address or phone number on the record, and respond within the time the law requires (45 days under US state laws, 30 days under the GDPR, extendable where permitted). Some records are kept after deletion as described in Section 10, and are restricted from any other use.
• Disconnect a platform. Section 5.3.
• Marketing opt-out. Unsubscribe links, STOP replies, your settings, or privacy@getrevent.com.
• Cookies and tracking. Section 6.
• Requests about a Customer's data. If your information is held for a Customer (for example, you bought a ticket from an organizer), we will forward your request to that Customer and act on its instructions, or act directly where the law or a platform's terms require us to.
• Authorized agents. Where the law allows, an authorized agent may make a request for you; we will ask for proof of authorization and may confirm the request with you directly.
• Appeals. If we decline a request, we will tell you why and how to appeal; you may also complain to your state attorney general or data protection authority.
• No discrimination. We will not treat you differently for exercising your rights.

14. United States state privacy rights

If you live in California, Colorado, Connecticut, Delaware, Montana, Oregon, Texas, Utah, Virginia or another state with a comprehensive privacy law, you may have rights to know, access, correct, delete and obtain a copy of your personal information, to opt out of its sale, sharing for targeted advertising or profiling with significant effects, and to appeal our decision. Exercise them as described in Section 13.

Categories. In the last 12 months we have collected the categories listed in Section 2 (identifiers; customer records; commercial information; internet and device activity; approximate geolocation; professional information for Customer users; and inferences used for Customer-level measurement), from the sources in Section 2, for the purposes in Section 3, and disclosed them for business purposes to the recipients in Sections 8 and 9.

Sale and sharing. Revent does not sell personal information and does not share it for cross-context behavioral advertising for its own purposes. Where a Customer deploys a Meta, TikTok, LinkedIn, Google or similar measurement tool on its hosted site or event page, the platform may receive event data that some state laws classify as "sharing"; we honor Global Privacy Control and provide the consent control described in Section 6 before such tools run for visitors in states that require it. We do not knowingly sell or share personal information of people under 16. We do not use or disclose sensitive personal information for purposes other than those permitted by law.

California. California residents may request the categories and specific pieces of personal information we hold, the sources, purposes and recipients, and may use the rights above; our contact for these requests is privacy@getrevent.com. We do not offer financial incentives in exchange for personal information.

15. European Economic Area, United Kingdom and Switzerland

If the GDPR, UK GDPR or Swiss data protection law applies to you, Section 3 lists our legal bases. You have the rights to access, rectify, erase, restrict and port your personal information, to object to processing based on legitimate interests (including direct marketing), and to withdraw consent at any time without affecting prior processing. You may lodge a complaint with your supervisory authority. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

16. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. Accounts and ticket purchases require you to be 18 or older. Children and teenagers may attend events on tickets bought by an adult; organizers are responsible for age restrictions and for the lawful handling of any information about minors, and we do not knowingly send information about minors, or from events identified as directed to minors, to advertising measurement tools. If you believe a child has given us personal information, contact privacy@getrevent.com and we will delete it.

17. Changes to this Policy

We may update this Policy to reflect changes in the Services, our providers or the law. We will post the new version at getrevent.com/privacy, update the date above, and, for material changes, notify Customers by email or in the product before the change takes effect where the law requires it.

18. Contact

Revent Holdings, Ltd. — Privacy

7 Sunset Lane, Miller Place, New York 11764, United States

privacy@getrevent.com

Security: security@getrevent.com

Legal: legal@getrevent.com

Data deletion instructions: getrevent.com/data-deletion

Terms of Service: getrevent.com/terms