Privacy Policy

1. Information we collect

We collect information you provide directly, information generated as you use the Services, and information from third parties that help us operate.

Information you provide:

• Account details — name, email address, phone number, password, and profile photo.
• Organizer/merchant details — business name, description, logo, address, category, and links you add to your public profile.
• Verification information — identity or business documents you submit for verification (e.g. tax ID, registration documents).
• Content — events, listings, products, gift cards, messages, reviews, and any media you upload.
• Transactions — items purchased or sold, bookings, tickets, and order history.

Information collected automatically:

• Device and usage data — IP address, browser type, pages viewed, and interactions with the Services.
• Approximate or precise location when you use map and venue features (via Google Maps).
• Cookies and similar technologies (see “Cookies” below).

2. Payments

Card payments (event tickets, products, gift cards and bookings) are processed by our payment provider, Stripe. We do not store your full card details on our servers — they are sent directly to Stripe and handled under Stripe's own privacy terms.

For guest checkout we verify your email address with a one-time code so we can send order confirmations and receipts.

3. Connected accounts and video meetings

You can connect a video-conferencing account — currently Zoom or Google Meet — so that we can create a meeting for you automatically when a booking is confirmed. Connecting is optional, and the Services work without it.

When you connect an account, the provider asks you to approve the access we request, and then gives us:

• An access token and a refresh token, which let us act on your behalf for the permissions you approved, and nothing else.
• The email address and user ID of the account you connected, so we can show you which account is linked.
• The list of permissions the provider actually granted.

For Zoom specifically we request three permissions, and no others: permission to create a meeting on your behalf, permission to read your account's email address so we can show you which account is linked, and permission to obtain the short-lived key that lets you start your own meeting from inside our app.

When a booking is confirmed we ask the provider to create the meeting, and store the meeting ID and join link on that booking so both parties can open it.

We do not join, record, transcribe or store the contents of your meetings. We receive no audio, video, chat messages, recordings, transcripts or participant lists. You can join a meeting inside our app, but the meeting itself connects your device straight to the provider — that audio and video never passes through our systems. We never receive your password for the connected account.

Access and refresh tokens are encrypted before they are written to our database, using a key held separately from it.

You can disconnect at any time from your account settings, or by removing our app in the provider's own settings — for Zoom, on the Zoom App Marketplace. Either way we revoke the tokens with the provider and then delete our stored record of the connection, including the tokens, the connected account's email address and user ID, and the granted permissions. Meetings that were already created stay on your provider account, under your control.

4. How we use your information

• Provide, operate and maintain the Services and your account.
• Process payments, orders, bookings, tickets and payouts.
• Verify identities and businesses, and help keep the platform safe.
• Send transactional messages — confirmations, receipts, and service notices.
• Respond to your requests and provide customer support.
• Improve and personalise the Services, and measure performance.
• Detect, prevent and address fraud, abuse and security issues.
• Comply with legal obligations.

5. How we share your information

We do not sell your personal information. We share it only as needed to run the Services:

• Service providers — payment processing (Stripe), gift-card fulfilment (Reloadly), maps (Google), hosting, email delivery and analytics.
• Video-conferencing providers — where you have connected an account, we send Zoom or Google the details needed to create a meeting you asked for (such as its title, time and duration). We share no other personal information with them.
• Other users — information you choose to make public, such as your public profile, listings, events and reviews.
• Buyers and sellers — limited details needed to complete a transaction or booking.
• Legal and safety — to comply with law, enforce our terms, or protect the rights and safety of users and the public.
• Business transfers — in connection with a merger, acquisition or sale of assets, subject to this Policy.

6. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Services are used. You can control cookies through your browser settings; disabling some cookies may affect functionality.

7. Data retention

We keep your information for as long as your account is active or as needed to provide the Services, and afterwards as required to comply with legal, tax, accounting and security obligations or to resolve disputes.

Connected video-conferencing accounts are an exception, and are not kept for the life of your account: we delete the stored connection as soon as you disconnect it, as soon as you remove our app in the provider's settings, or when you delete your account — whichever happens first.

8. Your rights and choices

Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to or restrict certain processing.

To exercise these rights, contact us at dev@aiosolutions.io. You can also update most account information directly in your account settings.

9. Security

We use technical and organisational measures designed to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Children's privacy

The Services are not directed to children under the age required by your local law, and we do not knowingly collect their information. If you believe a child has provided us information, please contact us so we can remove it.

11. International transfers

Your information may be processed in countries other than your own. Where required, we put appropriate safeguards in place for such transfers.

12. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the effective date above and, where appropriate, notify you. Your continued use of the Services means you accept the updated Policy.

13. Contact

If you have questions about this Privacy Policy, contact AIO Solutions at dev@aiosolutions.io.