Privacy Policy

1. Who is responsible for your data

Floorful.app, registered in Spain ("Floorful") is responsible for the data of people who visit our websites, of venue owners and staff, of promoters, and for our own billing. Contact: floorful@megabite.io, Carrer dels German Cabot Franciscans 35-1, 07110 Bunyola, Mallorca, Spain. Floorful has not appointed a Data Protection Officer, as it is not required to; write to the same address for anything about your data.

If you bought a ticket, booked a table, joined a guest list or hold a membership at a venue, that venue is responsible for your data and Floorful handles it for them, on their instructions. The venue's name is on your confirmation email and replies to it go to the venue. For questions about how a venue uses your data, contact the venue first; you can also contact us and we will pass your request on.

2. What we collect

Visitors to floorful.app: the technical information any website receives, such as your IP address and browser type, which our hosting provider records in its logs. We count visits to floorful.app with Vercel Web Analytics, which works without cookies and does not identify you: it records the page, where the visit came from, and the country and type of device. We do not use analytics or advertising cookies.

Venue owners, staff and promoters: your name, email address, password (stored only in a securely hashed form), the venues and roles you have, your language, and a record of the changes you make in the back office, kept in an audit log so venues can see who did what.

Venue billing: the billing details and invoices for the venue's subscription, handled by Stripe. We never see full card numbers.

Customers of venues (handled for the venue):

• your name, email address and, if given, phone number;
• your birthday, day and month only, if you choose to give it;
• if the venue adds you from its own contact list, the details it provides, and whether it told us you agreed to its marketing;
• what you bought, when, for which event, the amount paid and any refund;
• the tickets and QR codes issued to you, and when they were scanned at the door;
• for card payments, the details Stripe gives us to confirm the payment: card brand, last four digits, country and whether the bank verified it. Your full card number goes only to Stripe;
• whether you agreed to receive marketing from the venue, and when;
• which version of the venue's booking terms you accepted;
• for guest lists and memberships, the names on the list or card, and a company name where given;
• if you add a pass to Apple Wallet, a device identifier your phone provides so the pass can be updated, for example if an event is cancelled.

3. Why we use it, and on what basis

• To provide the service: running venue accounts, taking bookings, issuing tickets and admitting guests. Basis: performing a contract.
• To keep the service secure: preventing fraud and abuse, limiting repeated requests, and keeping an audit trail. Basis: legitimate interests in protecting venues, customers and the platform.
• To keep financial records: orders, payments, refunds and fees. Basis: legal obligations under accounting and tax law.
• To send service emails: confirmations, tickets, payment links, changes to events and account notices. Basis: performing a contract.
• Marketing from a venue is sent only to customers who agreed to it, and can be stopped at any time using the link in each message. Basis: consent. Floorful does not market to venues' customers.

4. Who we share it with

The venue you bought from sees your booking. A promoter sees the customers who bought through their own link. We use these providers to run the service:

• Supabase: database, sign-in, file storage and server functions, hosted in the European Union (Ireland).
• Vercel: hosting of our websites and apps.
• Stripe: payments to venues and our subscription billing. Stripe is also responsible for some payment data in its own right, under its own privacy policy.
• Resend: delivery of emails.
• Google: Google Wallet passes.
• Apple: Apple Wallet passes and their updates.
• Cloudflare: the security check (Turnstile) on the dashboard and door app sign-in pages, which sees your IP address and browser details to tell people from automated attacks.

Some of these providers are based in, or can access data from, outside the European Economic Area, including the United States. Where that happens, data is protected by the European Commission's standard contractual clauses or the EU-US Data Privacy Framework. We do not sell personal data. We share data with authorities only where the law requires it.

5. How long we keep it

• Accounts: while the account is active, and deleted or anonymised after it is closed, except where the records below require otherwise.
• Orders, payments, refunds and fees: kept, because accounting and tax law require these records and they are the proof of what was bought. The personal details in them can be anonymised on request, leaving the financial record with nobody's name on it.
• A venue that never took an order: deleted 30 days after it is closed.
• The audit log of staff actions: kept for as long as the venue's records.
• Short-lived security records, such as counters used to limit repeated requests: minutes to days.

6. How we protect it

All connections are encrypted. Each venue's data is separated from every other venue's by the database itself, not only by the app, and every change a client can make goes through a checked operation that confirms who is asking. Staff see only what their role allows. Passwords are hashed and never stored as written. Payments are handled by Stripe, and larger payments are verified with the customer's bank.

7. Your rights

You can ask to see the data held about you, to correct it, to have it erased or anonymised, to restrict or object to how it is used, and to receive it in a portable form. Where we rely on consent, you can withdraw it at any time. Contact floorful@megabite.io. If you are a venue's customer, you can also ask the venue directly.

We will respond within one month. You have the right to complain to a data protection authority; in Spain this is the Agencia Española de Protección de Datos (aepd.es).

8. Cookies and storage in your browser

We do not use advertising or analytics cookies, and we do not track you across other websites. Our sites store only what they need to work:

• the dashboard keeps you signed in and remembers your language;
• event pages remember your basket and checkout progress for the visit, and which promoter's link or venue email you arrived from, so the sale is credited correctly;
• the door app stores the night's guest list on the door device so it works without a connection;
• the dashboard and door app keep a copy of the app itself on your device so they load quickly.

Because this storage is strictly necessary for the service you asked for, no consent banner is needed. You can clear it at any time in your browser settings.

9. Children

Floorful is not directed at children under 16, and venue accounts are for adults acting for a business. Venues set their own age limits for events.

10. Changes to this policy

We will update this policy when how we handle data changes, and show the date of the latest version at the top. For significant changes affecting venues, we will also tell them by email or in the dashboard.