Privacy policy

Last updated October 14, 2026 Contact: support@venuestack.io This Privacy Policy explains how VenueStack handles personal information in connection with venuestack.io, our business dashboards, venue event pages, checkout and reservation tools, tickets, check-in tools, chat, website embeds, and installed progressive web application. It applies to venue owners and staff, guests, website visitors, and people who contact us. The particular information processed depends on the services and integrations used. 1. Who we are and how to contact us VenueStack is operated by 1001763609 Ontario Inc., the business that provides the VenueStack services at https://www.venuestack.io. In this Policy, “VenueStack,” “we,” “us,” and “our” refer to 1001763609 Ontario Inc. “Business” means a venue, event organizer, promoter, or other business using VenueStack. “Guest” means a person who buys tickets, requests a reservation, pays a deposit, communicates with a Business, or otherwise uses its customer experience. For privacy questions, access or deletion requests, complaints, or information about the responsible operator, contact our Privacy Officer at support@venuestack.io with the subject “Privacy.” Tell us which Business, account, or transaction your request concerns. Please do not send passwords, full payment card details, or unnecessary identity documents by email. VenueStack and the Business have different responsibilities When a Business uses VenueStack to manage its guests, that Business generally determines why guest information is collected and how it will be used for its events, reservations, customer service, and marketing. VenueStack processes that information to provide the Business with the requested services. Where the law uses those terms, the Business generally acts as controller or business, and VenueStack acts as processor or service provider for this processing. The data processing terms in Schedule 1 of our Terms of Service govern that relationship. VenueStack also handles information for its own purposes, including administering VenueStack accounts and subscriptions, providing support, managing its own fees and business records, protecting the platform, complying with law, and operating its marketing website. For those purposes, VenueStack is responsible for determining the processing. A person's information may be involved in both roles; we assess a request according to the particular information and purpose concerned. A Business's privacy notice explains its own use of guest information, including customer notes, segmentation, promotions, and any tracking it enables. Payment providers and some other integrations also process information for purposes described in their own notices. This Policy explains VenueStack's role; it does not replace those notices or transfer our legal responsibilities to the Business or a provider. 2. Information processed through VenueStack Account and staff information. This can include name, email, telephone number, authentication credentials and tokens, account identifiers, invitations, Business affiliations, staff role and permissions, verification status, subscription status, and account activity. A Business can provide staff information when it invites or manages its team. If you choose Google sign-in, we receive the identity and profile information provided through that sign-in process. Business and event information. This can include Business contact details and location, timezone, branding, menus, layouts, event and performer content, staff assignments, settings, payment account references, and other uploaded material. Business information is personal information when it identifies an individual, such as a sole proprietor or named staff member. Content intended for public event pages or customer messages will be displayed to the relevant audience. Guest and commercial information. This can include name, email, telephone number, party size, order and reservation identifiers, ticket types, tables and timeslots, add-ons, promotional codes, deposits, minimum spend information, prices, taxes, fees, payment status, payment provider references, refunds, disputes, and purchase or reservation history. We also process confirmations, ticket and QR identifiers, ticket validation results, and arrival, seating, completion, and check-in records. Communications and customer context. This can include guest and support messages, attachments, delivery and read information, service requests, feedback, ratings, customer tags, staff notes, and information a Business imports from its own records. Some customer classifications are supplied or inferred by the Business from a person's activity. When enabled, AI chat also processes relevant messages and the Business information needed to respond. Device and usage information. This can include IP address, browser and operating system, device and session identifiers, language and timezone information, visited pages, timestamps, referrers, campaign references, interactions, error and performance information, authentication activity, and security logs. Optional analytics and advertising integrations can process additional interaction and conversion information, as explained in Section 6. An IP address may indicate an approximate location. Notification information. If you enable browser push notifications, the service processes the push endpoint, subscription keys, permission status, and related delivery information needed to send those notifications. Your browser or device controls whether notifications are permitted. Payment information. Card and other payment details are submitted through the configured payment provider's payment fields or checkout. VenueStack uses payment references and commercial records to verify orders, administer fees, support refunds, and reconcile transactions. Do not put full card numbers, card security codes, bank credentials, or other payment secrets into messages, notes, imports, or support requests. Sensitive information and permissions. Guest requests, messages, attachments, and staff notes can contain sensitive information, including health or accessibility needs, even though that information is generally unnecessary for ticketing. Please provide only what is necessary for your request. Businesses must have a lawful reason to collect sensitive information and must limit access and use accordingly. Camera access is used for ticket scanning when a staff member grants permission; granting camera permission is not permission for unrelated surveillance. Venue location information is not, by itself, a request for a Guest's precise device location. 3. Where information comes from We receive information from you; from a Business and its authorized staff; from another person who makes a reservation, purchases for a group, or submits your information with appropriate authority; from a Business's contact imports; from your browser or device; and from configured service providers. Providers can supply payment, authentication, message delivery, fraud, or integration information. A Business is responsible for the lawfulness and accuracy of the information it supplies, including imported contact lists. If you provide information about someone else, you must have authority to do so and give them the relevant privacy information. We do not treat a contact import, an order placed by another person, or a staff invitation as unlimited permission to market to that person. 4. Why information is used To provide accounts and staff access. We use account and staff information to register users, verify contact details, authenticate access, connect a person to the appropriate Business, apply permissions, administer invitations, and operate subscriptions and support. To fulfil guest transactions and venue operations. On the Business's instructions, we use guest and commercial information to create and manage orders and reservations, process deposits and payment updates, deliver tickets and confirmations, validate entry, allocate tables and staff, administer refunds, communicate about a booking, and provide operational reports and customer history. To provide communication features. We use messages and related information to deliver chat and support, provide requested assistance, manage handoff to staff, and operate the optional AI concierge. Businesses can use relevant guest information for their own customer service and lawful follow-up. To operate and protect VenueStack. We use necessary account, commercial, technical, and security information to prevent fraud and abuse, investigate unauthorized activity, troubleshoot failures, manage payment disputes and platform fees, maintain service reliability, and enforce our agreements. Authorized VenueStack personnel may access Business information where reasonably necessary for requested support, service administration, incident response, or legal obligations. Such access does not authorize unrelated use of guest information. To understand performance. We provide Businesses with sales, reservation, attendance, customer, traffic, campaign, and chat reporting associated with their accounts. VenueStack uses necessary technical information to understand and improve its service. Optional tracking remains subject to the choices and legal requirements described in Section 6. Aggregation or removal of a name does not automatically make information anonymous; information that can reasonably identify a person remains personal information. To send permitted communications. We send requested service and account messages and, where a lawful basis exists, optional marketing. Buying a ticket from a Business does not automatically subscribe you to VenueStack's marketing or to every Business using the platform. To meet legal responsibilities. We use and retain information where necessary for accounting, tax, regulatory obligations, lawful requests, the establishment or defence of legal claims, and the protection of people and the platform. We do not obtain permission through this Policy to use venue-directed guest information for unrelated advertising, sell it as a customer list, or train a general-purpose AI model. Those uses are restricted by our data processing terms. Any separate proposed purpose must have its own lawful basis, notices, and consents where required. 5. Consent and other legal grounds For processing governed by Canadian privacy law, we rely on meaningful express or implied consent as appropriate to the purpose, sensitivity, context, and reasonable expectations of the individual, or on a specific exception permitted by law. A contract or commercial interest does not replace consent where Canadian law requires consent. Optional marketing or tracking choices must be distinguished from the information needed to provide a requested transaction. Where the EU or UK GDPR applies to VenueStack's own processing, we rely on: contractual necessity for a service contract with the individual; legitimate interests in administering business relationships, providing support, preventing fraud, and maintaining a reliable and secure platform where those interests are not overridden by the individual's rights; consent for processing requiring consent, including applicable optional tracking and marketing; and legal obligations for required records and disclosures. If you are a staff member acting for a Business rather than a party to our subscription contract, business relationship administration generally relies on legitimate interests rather than a contract with you. For information we process on a Business's behalf, the Business determines and explains its applicable legal grounds. We assist it as required by our agreement and applicable law. Sensitive information requires any additional legal conditions or consent that apply to that information. You may withdraw consent for processing based on consent. Withdrawal does not affect processing lawfully carried out before withdrawal. If required information is withheld or necessary consent is withdrawn, we or the Business may be unable to provide the affected feature or transaction. Refusing optional marketing or advertising does not, by itself, prevent a purchase or reservation. 6. Cookies analytics and advertising The Services use cookies, local storage, similar browser technologies, and server records. Their purposes differ. Essential technologies support sign-in, account and affiliation selection, fraud prevention, service security, and necessary transaction functions. Application account and administrator session cookies ordinarily last up to seven days, although expiry and validity can also depend on sign-out, account status, and session controls. Some records exist on the server and are not removed by clearing browser cookies. Preference technologies remember choices such as presentation or other settings. Whether consent is needed depends on the purpose and applicable law. Analytics and experience tools can measure visits, performance, errors, or interactions. Configured tools can include Google Analytics, Google Tag Manager, Vercel performance tools, or Microsoft Clarity. Tag Manager can load other tools and is not itself proof that a particular tag is active. Session replay, if enabled, can record page content and interactions such as clicks, scrolling, and entries; masking and exclusions are necessary to prevent unnecessary collection of personal or sensitive information. Do not enter payment secrets or unnecessary sensitive information into ordinary forms or chat. Advertising and conversion tools can include Google Ads, Meta Pixel, TikTok Pixel, or scripts selected by a Business. They can disclose browser or online identifiers, viewed content, campaign references, and purchase or reservation conversion information to their providers for measurement or advertising. A Business must explain its enabled tools and establish a lawful basis for their use. Some disclosures can constitute a sale, sharing, or targeted advertising under applicable United States privacy laws even when no money is paid for the information. VenueStack's own website measurement. We use Google Analytics across the Services and Microsoft Clarity on our marketing website (www.venuestack.io) to understand how they are used, the Meta Pixel and Meta Conversions API to measure our own advertising on Facebook and Instagram, and OpenAI's Measurement Pixel and Conversions API to measure our own advertising in ChatGPT. The Meta Pixel and OpenAI's pixel run only on our marketing website. They do not run on a Business's event pages, checkout, or guest accounts. When you visit our website, select Start a free trial or Book a demo, book a demo, send our contact form, register a Business, start a subscription trial, or make a first subscription payment, we may send Meta and OpenAI the event, the page, your IP address, browser information, and their browser and click identifiers (Meta's _fbp and _fbc cookies, and OpenAI's __obref and __oppref cookies). For a contact form, we also send the email address, telephone number, and name you entered. For a registration or a subscription, we also send the account holder's email address and, where we have them, their telephone number, name, the Business's country, and a VenueStack account reference. Each of these is hashed with SHA-256 before it leaves our systems. OpenAI's pixel can also detect an email address, telephone number, or name entered in a form on our website; it hashes them in your browser before sending them. Meta and OpenAI use this information to measure and improve the delivery of our ads, under their own terms. We do not send Meta or OpenAI any guest information we process for a Business. We keep a first-party cookie (vs_signup_source, up to 90 days) that notes the campaign tags, ad click identifier, referring site, and landing page of your visits, so that a later registration or demo booking can be credited to the campaign that brought you. When you book a demo, those campaign details go to Cal.com, our scheduling provider, with your booking. Your choices on our website. If you visit from the European Economic Area, the United Kingdom, or Switzerland, Google Analytics, Microsoft Clarity, the vs_signup_source cookie, the Meta Pixel and Conversions API, and OpenAI's pixel and Conversions API stay off until you accept them in our cookie banner, and you can accept analytics and advertising separately. Elsewhere, these tools run unless you turn them off, and we treat a Global Privacy Control signal from your browser as a refusal of advertising. You can change your choice at any time with Cookie settings at the foot of our website. We store your choice in a cookie (vs_consent) for up to 180 days, and it applies on both www.venuestack.io and app.venuestack.io. Where prior consent is legally required, we use optional technologies only after valid consent is given. Where an applicable law gives an opt-out right, we honour that choice for processing for which we are responsible, including a recognized browser opt-out preference signal where required, and assist a Business with its applicable obligations. Accepting service terms does not supply blanket consent to these technologies. Use the cookie or privacy choices presented on the relevant site where available. You can also manage browser storage and settings, disable push notifications, or contact us about your rights. Clearing cookies can remove a stored preference, and browser controls may not stop server-side processing. Blocking essential technologies may affect sign-in or checkout. Contacting us is not a substitute for any consent or opt-out mechanism the law requires to be provided on the site. When VenueStack is embedded on a Business's website, that website can operate its own tracking outside the VenueStack component. The Business's notice and controls apply to that processing. Both parties remain responsible for the tracking they operate or enable; an embed does not transfer all privacy responsibility to the other party. 7. Who receives information The relevant Business and its staff. Guest information is provided to the Business involved in the transaction or communication and to personnel the Business authorizes to access it for their work. A Business may export records or share them with its own service providers, subject to its legal responsibilities. Working with several Businesses does not authorize an account holder to use one Business's guest information for another Business's marketing. Service providers. Relevant information is processed by providers supporting hosting, databases, storage, communications, notifications, support, and configured integrations. The Services support Supabase for database, storage, and real-time functions; Vercel for web hosting; SendGrid for email; Twilio for chat and SMS; and OpenAI for the optional AI concierge. A provider receives the information needed for the particular service when it is used. Browser push delivery also involves the browser or device push provider. Payment providers. Stripe, our payment provider, receives payment and related transaction information. Stripe also supports VenueStack subscription billing. A provider may have separate responsibilities for identity checks, fraud prevention, regulatory compliance, disputes, and its own records. Availability in the software does not mean every provider is active for every Business. Other selected integrations. Google sign-in, Maps or Places, Spotify, Cloudflare Turnstile, Cal.com for demo scheduling, and the analytics or advertising tools described above, including Meta and OpenAI for VenueStack's own advertising, can receive relevant technical, query, identity, or interaction information when used. Their role depends on the feature and their terms. Clicking a third-party link or using a provider's separate service is also subject to that provider's notice. Professional advisers and legal recipients. We may disclose necessary information to advisers under appropriate confidentiality duties, or where law permits or requires disclosure to regulators, courts, law enforcement, or other recipients. We assess the request and limit disclosure to what is necessary and lawful. We may also disclose information where law permits to prevent or investigate fraud, protect rights, or address threats to safety. Business transactions. Relevant information may be disclosed under appropriate confidentiality protections for a proposed financing, reorganization, merger, or transfer of the business. A completed transfer must respect applicable privacy law and the purposes and obligations associated with the information; it does not automatically authorize unrelated uses. At your request or with valid authorization. We can disclose information to an authorized representative, connected service, or other recipient where you or the responsible Business lawfully instruct us to do so. You may request information about the providers and locations relevant to your account or transaction. The Business must also disclose any independently selected tracking, exports, or external tools it uses. Vendor access does not relieve VenueStack of responsibility for the processing for which VenueStack is legally accountable. 8. AI chat Where a Business enables the AI concierge, relevant conversation content, Business instructions, and retrieved event, menu, location, or availability information are supplied to the configured AI provider to generate a response. The service also uses the chat provider to deliver and maintain the conversation. Provider processing can include the service delivery, retention, and safety functions applicable to that integration. AI replies can be inaccurate or incomplete. They provide guidance and do not independently complete a paid reservation or bypass normal checkout and availability checks. You can ask to speak to the Business's staff. The Business is responsible for the information it supplies and for decisions about admission, customer service, refunds, and events. The concierge is not intended to make decisions producing legal or similarly significant effects about a person solely through automated processing. Please avoid submitting unnecessary sensitive information to AI chat. VenueStack's data processing terms restrict the use of venue-directed personal information for general-purpose model training. Any additional use outside the contracted service requires a separate lawful arrangement; this Policy is not consent to such use. 9. Email SMS and notification choices Order confirmations, tickets, deposit requests, booking updates, account notices, security messages, and requested support can be necessary to provide the service. A post-visit message, review request, promotion, or message combining service information with promotional content may be subject to marketing rules; calling it transactional does not determine its legal status. Optional marketing must have a lawful basis and any required consent, sender identification, and unsubscribe mechanism. You can use the unsubscribe instruction in the message or contact the identified sender. Businesses control their own campaigns and suppression lists. If a venue message is sent through VenueStack and you need help identifying or contacting the sender, contact us with the message details. Opting out of marketing does not necessarily stop messages needed for an existing order, security, or an ongoing account. We or the Business may retain a limited suppression record to honour an opt-out. Push notification permissions can be changed in your browser or device settings. 10. Processing locations and international transfers VenueStack's providers can process information outside your province, state, or country, including in the United States and other countries where the relevant providers or their personnel operate. Using a Canadian Business or a Canadian dollar price does not establish that all associated information stays in Canada. Foreign courts, law enforcement, and other authorities may have lawful access under the laws of the processing location. We remain responsible for applying the protections required for transfers we arrange. Where a transfer is subject to a legal safeguard requirement, an applicable adequacy decision, valid contractual transfer mechanism, or other permitted basis must support it, with any additional safeguards required by law. Our general service terms are not, by themselves, a substitute for required EU or UK transfer clauses or an assessment required by Quebec law. Contact us for information about the mechanism applicable to your information and any available copy of relevant safeguards, subject to appropriate redaction. 11. Retention and deletion Retention depends on the information, its purpose, the Business's lawful instructions, and applicable obligations. We use the following criteria rather than one period for every record. Account and staff records are retained as needed to administer the account, manage access, document the business relationship, and meet relevant legal or security requirements. Removing a person's active staff access does not automatically erase every historical transaction or activity record. Order, reservation, payment, refund, fee, and accounting records are retained for fulfilment, support, reconciliation, disputes, and applicable tax or recordkeeping periods. Legal requirements can require some records to remain after an account closes or a guest requests deletion. Retaining required accounting information does not justify retaining every associated message, marketing profile, or optional customer note. Chat, feedback, customer notes, tags, and imported contacts are retained for the Business's legitimate service purposes and lawful instructions, subject to applicable limits. Technical, analytics, and security records are retained for the relevant operational, security, consent, or legal purpose. Marketing suppression information is retained to the extent necessary to respect a person's choice. When a purpose ends, we delete or appropriately anonymize information unless retention remains lawful and necessary. Information subject to a legal hold, unresolved dispute, or required recordkeeping is restricted to that purpose. Copies in backups can remain until the applicable backup retention cycle ends; retained backups are not permission to reuse deleted information for ordinary operations. If information is restored, we reapply applicable deletion restrictions. The customer list's hide or delete control is an operational list function. It does not itself erase orders, reservations, messages, payment provider records, or every other copy. To request privacy deletion, use the process in Section 13. We assess the relevant systems, role, legal exceptions, and provider responsibilities. Independent payment providers and a Business's separately exported records may require a request to those parties as well. 12. Safeguards and incident handling We are responsible for maintaining safeguards appropriate to the sensitivity, use, and risks of the information we handle. The relevant measures include access controls, protection of service communications and credentials, tenant authorization checks, and controls over privileged access and providers. A Business is responsible for its staff access, devices, credential sharing, exports, and independently configured tools. No system can eliminate every security risk. You should protect account credentials, avoid unnecessary sensitive uploads, and keep ticket codes and payment links private. A person with a valid ticket link, order reference, QR credential, or deposit link may be able to access associated information or use the linked function. If an incident occurs, we investigate and take appropriate containment and response steps. We notify the responsible Business, individuals, and regulators when applicable law or our data processing agreement requires notification. This Policy does not remove either party's statutory duties or promise any particular security certification. 13. Access correction and other privacy requests Depending on the applicable law and processing, you may have rights to access information, understand its use and disclosure, correct inaccuracies, request deletion, obtain a portable copy, withdraw consent, object to processing, restrict processing, or appeal a decision about a request. Certain laws provide additional rights concerning sensitive information, advertising, profiling, or automated decisions. These rights are subject to the conditions and exceptions in the applicable law. Send a request to support@venuestack.io with the subject “Privacy,” or use an applicable privacy request method provided in the service. Tell us enough to identify the information concerned. We use proportionate verification and may ask an authorized agent to establish authority. We do not require information that is unnecessary for that process. For venue-directed guest information, the Business generally decides the response as the responsible controller. We help route the request and assist the Business as required. We handle information for which VenueStack is independently responsible ourselves. We do not treat every guest request as solely the Business's responsibility. We respond within the applicable legal period, notify you of any permitted extension, and explain a refusal or limitation where required. Requests are normally free; any permitted fee must be justified and disclosed. We do not discriminate or retaliate for exercising a privacy right. A deletion request does not cancel a valid debt or erase information that must lawfully be retained, but retention must be limited to the applicable purpose. If you are dissatisfied, contact our Privacy Officer so the concern can be reviewed. You may complain to the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca, an applicable provincial privacy authority, your EU or UK supervisory authority, or another competent regulator. Where an applicable United States state law provides an appeal right, ask us to review the response with the subject “Privacy appeal”; any legally required appeal process and timing apply. 14. Regional information Canada. Canadian privacy rights depend on the federal or provincial law governing the particular activity. They include applicable rights concerning meaningful consent, reasonable purposes, access, correction, and complaints. Where Quebec law applies, additional requirements can apply to privacy officer disclosures, portability, profiling and location functions, exclusively automated decisions, sensitive information, privacy assessments, and transfers outside Quebec. European Economic Area and United Kingdom. Where the relevant GDPR applies, the grounds in Section 5 and transfer information in Section 10 apply. You can exercise applicable rights of access, rectification, erasure, restriction, portability, objection, and complaint. You may object to processing for direct marketing at any time. If processing relies on legitimate interests, you may object on grounds relating to your circumstances, subject to the conditions in the law. You may withdraw consent without affecting prior lawful processing. United States. Applicable state laws may give rights to know or access categories or specific pieces of information, correct information, delete information, obtain a copy, opt out of sale, sharing, or targeted advertising, limit certain uses of sensitive information, and appeal a response. Coverage and exceptions vary. For California processing governed by the CCPA, our venue-directed service provider processing is restricted by Schedule 1 of the Terms. Optional advertising disclosures must also be assessed separately, as described in Section 6. A statement that information is not exchanged for money would not, by itself, exclude a legal sale or sharing. The information categories, sources, purposes, recipients, and retention criteria in this Policy describe the processing addressed here; any additional legally required notice at collection or method for exercising rights must also be provided for the relevant activity. 15. Children and age restricted events The Services are not directed to children under 13. Business account holders must have the legal capacity required by the Terms of Service. Guests must satisfy the applicable event and venue age rules, and an authorized adult must act where necessary for a child or a person unable to provide valid consent. Businesses must not use the Services to collect information from children in a way that requires protections the configured service cannot provide. If you believe a child has supplied information without appropriate authorization, contact support@venuestack.io so the information and applicable deletion or other requirements can be assessed. A venue's lawful age or identification checks are separate from permission for unrelated data collection or marketing. 16. Changes to this Policy We update this Policy when practices or requirements change and revise the last updated date. Where a change materially affects the handling of information, we provide the notice and obtain any additional consent required by law. Posting a new version does not retroactively authorize an incompatible use of information or withdraw an existing privacy right. The current notice will be available at https://www.venuestack.io/privacy. Contact our Privacy Officer at support@venuestack.io for questions or requests.