Privacy Policy

This Privacy Policy (this “Policy”) describes how Tabyt, Inc. (“Tabyt,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects Personal Information in connection with the Services. Please read this Policy carefully. By accessing or using the Services, you acknowledge the practices described in this Policy.

If you do not agree with this Policy, do not access or use the Services. This Policy forms part of, and should be read together with, the Tabyt Terms of Service and any other terms presented in connection with a particular feature, transaction, or event.

For purposes of this Policy, “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual or household. Personal Information does not include information that is lawfully made public, aggregated, or deidentified so that it cannot reasonably be linked to an individual, except where applicable law provides otherwise.

Privacy questions and requests may be submitted to support@tabyt.com.

Contents

• 1. Introduction and scope
• 2. Roles and people covered
• 3. Personal information we collect
• 4. Sensitive personal information
• 5. Sources of personal information
• 6. How and why we use personal information
• 7. How we disclose personal information
• 8. Service providers and platform partners
• 9. Organizers, venues, cohosts, promoters, and affiliates
• 10. Guest lists, customer records, and downloadable exports
• 11. Imported contacts
• 12. Payments and organizer payouts
• 13. Tabyt Connect and social features
• 14. Messages, reviews, surveys, reports, and support content
• 15. Email, SMS, push, and in-app communications
• 16. External-ticket handoffs and embedded experiences
• 17. Cookies, analytics, local storage, and similar technologies
• 18. Mobile permissions and device features
• 19. Location information
• 20. Security, fraud prevention, and administrative access
• 21. Retention
• 22. Account deletion
• 23. Age requirement
• 24. International access and transfers
• 25. Your choices and privacy requests
• 26. California and other U.S. state disclosures
• 27. Legal disclosures and business transfers
• 28. Changes to this Policy
• 29. Contact us
• Schedule 1. Category, purpose, and recipient matrix
• Schedule 2. Retention framework

1. Introduction and scope

This Privacy Policy explains how Tabyt, Inc. ("Tabyt," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information when you access or use services that link to this Policy (collectively, the "Services").

The Services include tabyt.com and related web pages; the Tabyt consumer mobile application; the Tabyt Organizers mobile application; Tabyt Connect; organizer and cohost tools; event-discovery, booking, ticketing, waitlist, check-in, guest-list, CRM, campaign, and analytics features; Tabyt pages embedded on third-party websites; the Tabyt admin panel; backend APIs and workers; and related email, SMS, push, and in-app communications.

This Policy applies whether you create a complete account, use a guest or incomplete account, purchase or receive a ticket, appear in an organizer-uploaded contact list, click through to an external ticket platform, use organizer tools, or otherwise interact with the Services.

Our Terms of Service and Refund Policy separately govern use of the Services and ticket purchases. An organizer, venue, external ticket platform, payment processor, or other third party may also provide its own terms or privacy notice for information it controls independently.

2. Roles and people covered

2.1 People covered by this Policy

Consumers, attendees, ticket purchasers, ticket recipients, guests, waitlist members, and people who begin but do not complete an account or purchase.

Users of Tabyt Connect, direct messaging, reviews, surveys, follows, favorites, activity feeds, blocks, and reports.

Organizers, venues, promoters, business owners, organizer team members, cohosts, and affiliates.

People whose contact information is uploaded by an organizer, even if they have never created a Tabyt account.

People who provide an email before leaving Tabyt for an external ticket platform.

Administrators, internal personnel, support contacts, and other people who interact with Tabyt in a business or operational capacity.

2.2 Tabyt's role

Tabyt generally determines how personal information is processed to operate, secure, analyze, and improve the platform; manage accounts and payments; provide Connect; send Tabyt communications; and administer the Services. For these activities, Tabyt acts as the business or controller of the information, subject to applicable law.

2.3 Organizers' role

Organizers use Tabyt to operate events and customer relationships. An organizer may independently determine why and how it uses attendee information for event administration, customer support, guest-list management, future events, and marketing. Organizers are not employees or agents of Tabyt merely because they use the Services, and they are not automatically Tabyt service providers. Their independent use of information may be governed by their own notices and legal obligations.

When Tabyt processes information solely to provide a tool at an organizer's direction, the organizer may be the relevant business or controller and Tabyt may act as its service provider or processor. The allocation of responsibility depends on the activity and applicable law.

2.4 Service providers and independent third parties

Tabyt uses service providers to host data, deliver messages, process payments, provide analytics, prevent abuse, support maps and mobile features, and perform other operational functions. Certain recipients—such as organizers, external ticket platforms, payment processors performing their own compliance obligations, and app stores—may also act independently under their own privacy terms.

3. Personal information we collect

The information collected depends on the person, product, device, event, organizer, and feature involved. We may collect the categories below.

3.1 Consumer account and authentication information

First name, last name, email address, phone number, country code, and account identifiers.

Password hash, authentication token, one-time verification code, verification status, approval status, account status, guest-account indicator, and account creation date.

Multi-device session information, including session token, principal type and identifier, revocation status, last-active time, device name, device platform, device identifier, application version, user-agent, IP address, and push-notification token.

Information used to prevent OTP abuse or automated traffic, including IP address, request metadata, rate-limit information, and Turnstile verification results.

3.2 Consumer profile and preference information

Date of birth, age or age bucket, gender, ZIP code, country, state, city, hometown, and optional profile location.

Profile image, biography, profession, workplace, school, relationship information, Instagram handle, favorite drink, music preferences, event preferences, organizer preferences, and interests.

Profile visibility, private-profile status, guest-list visibility, message visibility, activity visibility, follower notifications, and automatic-approval preferences.

Open-to-Connect status, profile intentions such as friendship, professional, or romantic connection, and related profile-configuration status.

Race or ethnicity, sexuality, and romantic gender preference when voluntarily provided.

3.3 Organizer, venue, team-member, cohost, promoter, and administrator information

Organizer or business name, owner name, email address, phone number, physical address, ZIP code, city, state, country code, website, Instagram account, image, and business location.

Account password hash, authentication token, verification status, claimed/imported status, account status, device token, push token, and soft-deletion status.

Owner, team-member, cohost, or promoter identity; email and phone; permissions; role; event assignments; and activity associated with organizer tools.

Payment configuration, taxes, tips, deposits, fee settings, payout-account identifiers, payment-location identifiers, and Terminal-reader identifiers.

Draft event information, including venue address and coordinates, promoter and cohost details, invitation or approval hashes, and imported organizer or event metadata.

Administrator name, email, password hash, token, image, role, and access permissions.

3.4 Event discovery, booking, ticket, and attendance information

Events viewed, saved, favorited, followed, attended, reviewed, or purchased, and interactions with event pages or ticket buttons.

Organizer, event, booking, order, affiliate, promoter, campaign, marketing-source, and ticket identifiers.

Tickets, tables, packages, menus, quantities, prices, taxes, tips, fees, discounts, promo-code value, deposits, balances due, refunds, and payment status.

Waitlist participation, join source, notification attempts, ticket transfers, ticket shares, split payments, gifts, comps, guest invitations, and recipient contact information.

Check-in and scan records, QR-code identifiers, ticket status, staff interaction, and attendance context.

Apple Wallet pass information. A pass may display the attendee's first name, event name and date, and ticket type; its barcode contains booking, QR-ticket, and user identifiers needed for validation.

Event calendar files, ticket PDFs, QR codes, wallet-file locations, and ticket-delivery status.

3.5 Payment and payout information

Processor customer, token, source, card, payment-method, charge, refund, account, and location identifiers.

Card brand, last four digits, cardholder name if returned by the processor, expiration month and year, default-payment-method status, and payment gateway.

Transaction email, amount, fee, refund, payout, dispute, and payment-status information.

Stripe or Square webhook events and processor responses, which may contain transaction, billing, customer, fraud, dispute, or payment-status information.

For organizer payouts, onboarding status and account identifiers received from Stripe. Stripe may independently collect legal name, date of birth, address, bank information, tax identification, government identification, and beneficial-owner information through Stripe-hosted onboarding.

3.6 Connect, social, messaging, and safety information

Connect opt-in status, event participation, profile-completeness status, connection requests, matches, connection state, shared-event context, and connection history.

Connection actions, person performing an action, timestamps, and related metadata.

Direct-message content, conversation participants, conversation status, last-message information, timestamps, notification activity, and limited SMS-bridge metadata.

Blocks, reports, reasons, comments, supporting details, moderation or safety actions, and related audit history.

Follows, favorites, activity posts, post images, comments, broadcasts, recipients, and in-app activity information.

3.7 Marketing, CRM, campaign, and audience information

Email address, phone number, marketing selections, subscription status, unsubscribe status, unsubscribe reason, unsubscribe date, and resubscription information.

Separate Tabyt-level and organizer-level email or SMS preferences, global organizer opt-outs, organizer-specific allowlists, and SMS suppression information.

Twilio STOP or opt-out metadata, including normalized phone number, source, messaging account or service identifier, message identifier, and opt-out or opt-in time.

Audience and CRM fields such as name, image, gender, date of birth, age, age bucket, metro areas, primary metro, event types, event count, booking count, total spend, average spend, profile-image status, Connect-profile status, Connect activity counts, review count, and marketing eligibility.

Organizer customer summaries, including name, email, image, favorite drink, search values, spend, visits, order count, attendance, event count, VIP status, follower status, and imported-contact status.

Audience rules, campaign metadata, recipient lists, message bodies, success or failure results, campaign page views, referral source, and pseudonymous campaign visitor identifier.

Affiliate and promoter link identifiers and related attribution information.

3.8 Imported contacts and external-ticket leads

Imported contact name, email, phone number, country code, date of birth, organizer identifier, and any matched Tabyt user identifier.

For an external-ticket handoff, first and last name if collected, email address, phone number if collected, user identifier, event and organizer identifiers, destination ticket platform, destination URL, source, and campaign identifier.

Information indicating whether an imported contact later registered, followed an organizer, attended an event, or became part of an organizer's customer history.

3.9 Reviews, surveys, support, notes, and user-generated content

Survey questions, structured selections, free-text answers, completion information, and exported survey responses.

Event reviews, ratings, comments, images, anonymous-display selection, and moderation status.

Contact-us submissions, including email, phone number, and comment.

Organizer notes about customers, including subject and description, and VIP designations.

Event or activity reports, reasons, comments, details, and supporting content.

Notification content and other information included in emails, SMS, push notifications, or in-app communications.

3.10 Device, browser, application, and technical information

IP address, user-agent, browser type, operating system, device type, device identifiers, device name, mobile platform, application version, language, and approximate location inferred from IP.

Push-notification tokens, Firebase tokens, crash information, stack traces, device and operating-system information, application state, and diagnostic context.

Pages and screens viewed, links and buttons clicked, referral source, campaign parameters, affiliate identifier, purchase events, transaction values, items, app-store clicks, and other usage events.

Server access logs, request paths, timestamps, rate-limit events, authentication events, bot-detection signals, and fraud or abuse indicators.

Browser local-storage and mobile application-storage values, including tokens, account data used by the interface, carts, checkout information, waitlist values, campaign or affiliate identifiers, guest or incomplete-booking leads, and feature settings.

3.11 Images, files, and generated artifacts

Profile photos, organizer images, event flyers, review images, activity images, and campaign assets.

Password-protected guest-list or customer exports, email-blast summary files, ticket PDFs, QR-code images, and Apple Wallet pass files.

File names, storage paths, upload metadata, download links, and access-related information. Some storage paths or wallet identifiers may contain user, booking, or event identifiers.

3.12 Information we do not collect through current product features

Current product code does not provide social-account login, device-address-book synchronization, Face ID or biometric authentication, microphone access, calendar scraping, SMS-inbox access, or user-to-user live location sharing. The current product also does not integrate PayPal. We will update this Policy and request any required permissions or consent before launching a materially different feature.

4. Sensitive personal information

Depending on what you choose to provide and the feature involved, Tabyt may process information that may be considered sensitive under applicable law. This includes:

Race or ethnicity.

Sexuality, romantic connection intention, and romantic gender preference.

Precise latitude and longitude if you choose to save an optional profile location.

Date of birth and information used to access an account, including authentication credentials.

Contents of direct messages and other communications that users reasonably expect to be private.

Payment-account information and limited payment-method metadata. Complete card details are handled by Stripe or Square in current flows.

Government-identification, taxpayer, bank, and beneficial-owner information collected by Stripe for organizer onboarding and payouts.

Free-text surveys, reviews, reports, notes, and support messages that may reveal health, religion, disability, political views, or other sensitive details.

4.1 Choices and feature requirements

Sensitive profile fields such as race or ethnicity and sexuality are optional. Connect profile readiness currently requires a non-default profile photo, date of birth, gender, and at least one interest. If a user selects a romantic profile intention, the user may be required to choose a romantic gender preference to configure that feature.

4.2 Limits on peer and organizer visibility

Connect visibility varies by Connect experience, event, interface, connection status, and available settings. Information presented to another opted-in user may include profile information the user has chosen to provide and, in some Connect experiences, may include optional attributes such as sexuality, ethnicity, or romantic preferences. Email addresses and precise GPS coordinates are not intended to be displayed as standard Connect peer-discovery fields, although contact information may be disclosed through a separate interaction initiated by the user, such as ticket sharing or another communication feature. Organizers do not receive Connect direct-message content or match graphs through standard organizer guest-list or CRM tools. Romantic preferences may be used internally to support matching when the user chooses a romantic intention.

4.3 Administrative access

Authorized Tabyt personnel may access broader profile information, messages, safety reports, and other sensitive information when reasonably needed to operate the Services, provide support, investigate abuse, protect users, enforce rules, or comply with law. Administrative access is intended to be limited by role and operational need.

5. Sources of personal information

6. How and why we use personal information

6.1 Accounts, identity, and security

Create, verify, approve, secure, and administer consumer, organizer, team-member, cohost, promoter, and administrator accounts.

Authenticate users, issue and verify OTPs, maintain sessions across devices, revoke sessions, recover accounts, and manage permissions.

Detect automated activity, credential abuse, spam, fraud, prohibited conduct, and security threats.

6.2 Event discovery, ticketing, and attendance

Display, recommend, save, favorite, and share events.

Process bookings, tickets, tables, packages, menus, discounts, deposits, fees, taxes, tips, refunds, transfers, split payments, gifts, comps, and waitlists.

Generate and deliver receipts, ticket PDFs, QR codes, calendar items, Apple Wallet passes, reminders, and operational updates.

Validate tickets, manage check-in and scans, administer guest lists, and address attendee or organizer support issues.

6.3 Payments, payouts, accounting, and disputes

Create or attach processor payment methods, process transactions, issue refunds, and display limited saved-card information.

Administer Stripe Connect onboarding, organizer payouts, Terminal or Tap to Pay, and payment-location configuration.

Maintain transaction records, reconcile payments, respond to chargebacks or disputes, prevent fraud, and satisfy tax, accounting, audit, and legal obligations.

6.4 Connect and social features

Determine profile readiness; provide discovery around events; support connection requests, matches, and shared-event context; and facilitate direct messaging.

Apply profile intentions and romantic gender preferences internally when a user elects a corresponding matching experience.

Provide blocks, reports, moderation, safety review, and abuse-prevention functions.

Measure Connect opt-in, profile completion, request, match, and engagement activity to understand and improve the feature.

6.5 Organizer event operations and CRM

Provide event creation, order management, attendee lists, check-in, cohost tools, promoter attribution, customer summaries, notes, VIP tools, reviews, surveys, exports, and analytics.

Allow organizers to communicate with their attendees and customers through available in-app, email, and SMS tools, subject to applicable consent and opt-out requirements.

Calculate organizer-facing customer metrics such as spend, visits, orders, attendance, following status, and aggregate audience information.

6.6 Communications and marketing

Send account, security, order, ticket, receipt, refund, comp, transfer, reminder, doors-open, waitlist, Connect, support, and other transactional or operational communications.

Send Tabyt or organizer event updates, newsletters, and promotional communications where disclosed and permitted.

Maintain email unsubscribe choices, SMS STOP suppression, organizer-specific preferences, and records needed to honor communication choices.

Build campaign audiences using general profile, event, metro, purchase, spend, eligibility, and Connect-engagement metrics. Tabyt does not use sexuality, ethnicity, romantic preference, or direct-message content as campaign-filter fields.

6.7 Analytics, attribution, and product improvement

Measure page views, button clicks, purchase events, transaction values, event interactions, referrals, affiliate performance, campaign performance, app-store clicks, and product usage.

Generate organizer analytics, including aggregate attendance, age, gender, sales, conversion, and engagement information.

Debug errors, investigate incidents, test functionality, understand feature performance, and improve user and organizer experiences.

6.8 Support, enforcement, legal compliance, and corporate transactions

Respond to questions, refund requests, complaints, privacy requests, and other support matters.

Investigate reports, enforce agreements and platform rules, protect rights and safety, establish or defend legal claims, and comply with lawful requests.

Maintain records required for tax, accounting, regulatory, audit, insurance, payment-network, and legal purposes.

Evaluate or complete a financing, investment, merger, acquisition, reorganization, bankruptcy, sale of assets, or similar corporate transaction.

7. How we disclose personal information

We disclose personal information only as described in this Policy, at your direction, or as otherwise permitted or required by law. The categories below overlap because one activity may involve more than one recipient.

7.1 Service providers

We disclose information to companies that host data, process payments, deliver email or SMS, provide push notifications and crash reporting, perform analytics, support maps, protect against bots, distribute mobile applications, or otherwise operate the Services for us.

7.2 Organizers, venues, and authorized personnel

When you register, purchase, attend, receive a comp, join a waitlist, complete an event survey, review an event, or otherwise interact with an event, we disclose information to the organizer and authorized organizer personnel as described in Sections 9 and 10.

7.3 Other users

Information you choose to make visible through Connect, reviews, activity, follows, guest-list settings, ticket sharing, split payments, gifts, or messaging may be disclosed to the relevant users. Direct-message content is disclosed to conversation participants.

7.4 Payment processors, financial institutions, and payment networks

We disclose transaction, customer, token, order, and related information to Stripe, Square, financial institutions, payment networks, wallets, and fraud or dispute services needed to process payments and payouts.

7.5 External ticket platforms and business partners

We may disclose referral, campaign, affiliate, promoter, or transaction-related information to an external ticket platform, affiliate, promoter, or other partner as needed to complete a handoff, attribute activity, operate a promotion, or provide a requested service.

7.6 Professional advisers and authorities

We may disclose information to lawyers, accountants, auditors, insurers, consultants, law enforcement, courts, regulators, or other authorities when reasonably necessary for advice, compliance, safety, fraud prevention, dispute resolution, or legal process.

7.7 Corporate transactions

We may disclose information to actual or prospective investors, lenders, buyers, sellers, advisers, or counterparties in connection with a financing, investment, merger, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction, subject to appropriate protections where required.

7.8 With your direction or consent

We may disclose information when you direct us to do so, request a feature that requires disclosure, or provide consent for a disclosure not otherwise described in this Policy.

Sale, sharing, and advertising. Tabyt does not sell Personal Information for monetary payment. Tabyt uses analytics, advertising, attribution, conversion-measurement, and similar technologies in connection with the Services. Depending on the technology, configuration, recipient, purpose, and applicable law, these activities may be considered a “sale,” “sharing,” cross-context behavioral advertising, or targeted advertising. Where applicable law grants an opt-out right, Tabyt will provide and honor the rights and controls required by that law.

8. Service providers and platform partners

The following table identifies principal providers and platform partners visible in the current product. A provider's role, information, and legal status may vary by feature. Providers may update their services and privacy notices over time.

Tabyt also uses a Redis instance co-located with the API server for temporary queues and jobs. Queue payloads may include email addresses, phone numbers, message bodies, recipient lists, and campaign or reminder information while the jobs are processed.

9. Organizers, venues, cohosts, promoters, and affiliates

9.1 Information organizers can access

Organizers may access information about customers and attendees connected to their events. Depending on the feature and permissions, organizer-facing interfaces may display or use:

Name, profile photo, favorite drink, VIP status, and follower status.

Email or phone contact channels used to identify, select, support, or communicate with customers.

Total spend, average spend, order count, event count, attendance, and check-in context.

Orders, tickets, packages, menus, discounts, promotions, refunds, and event transaction information.

Reviews associated with the organizer's events and event-specific survey responses where available.

Tools to send in-app messages, gifts, comps, email campaigns, and SMS campaigns.

Per-customer age and gender are not intended to appear as labeled fields on active organizer customer-profile interfaces. Organizers may receive aggregate age and gender analytics and may receive age or gender as optional export columns as described in Section 10.

9.2 Cohost permissions

Cohost access is permission-based. An organizer may grant permissions such as viewing the guest list, viewing customer information, exporting the guest list, sending email or text blasts, managing orders, scanning tickets, or performing other event functions. Cohost permissions are not automatically enabled and should be limited to the responsibilities assigned by the organizer.

9.3 Promoters and affiliates

Promoters and affiliates may receive link, campaign, attribution, conversion, or compensation information needed to measure their activity. They do not automatically receive full guest-list or customer-CRM access. A promoter must also be authorized as an organizer, team member, or cohost with the relevant permissions to receive broader access.

9.4 Organizer marketing

Organizers may use Tabyt to communicate with attendees and customers about current and future events. Organizer-level marketing preferences are maintained separately from Tabyt-level marketing preferences. Organizers are responsible for complying with applicable consent, identification, content, and opt-out requirements. Tabyt supplies unsubscribe and SMS suppression tools but does not replace an organizer's independent legal obligations.

10. Guest lists, customer records, and downloadable exports

10.1 Organizer CRM and customer summaries

Tabyt may maintain an ongoing organizer-specific customer summary based on a person's interaction with that organizer. The summary may include name, email, image, favorite drink, search values, total spend, visits, order count, attendance, event count, VIP status, follower status, and whether the person originated from an imported contact.

10.2 Guest-list and customer exports

An organizer or authorized cohost may download a guest-list or customer file. The standard export includes guest name, guest email, purchased tickets, packages, or menus, and a survey-type label. Depending on the organizer's selection, the file may also include:

Phone number.

Age calculated from date of birth.

Gender.

Number of orders and number of items ordered.

Total amount spent and total promotional-code value.

VIP status and follower status.

Survey questions and answers when the organizer enables survey-data export.

Exports may be placed in a password-protected ZIP file, stored temporarily in cloud file storage, and delivered through an emailed download link and separate password. An authorized cohost must have the export permission. Once an organizer or cohost downloads a file, that recipient is responsible for protecting and lawfully using the downloaded information.

10.3 Internal operational copies

Tabyt may send internal business mailboxes copies of customer-facing communications for support, delivery verification, fraud review, or operational oversight. Tabyt may also send an internal summary file showing campaign or blast recipients and success or failure status. These records are subject to Tabyt's access controls and retention practices.

11. Imported contacts

An organizer may upload or enter contact information for people who are not Tabyt users. Imported information may include first and last name, email address, phone number, country code, and date of birth. Tabyt may match an imported contact to an existing or future Tabyt user and may incorporate event attendance or customer activity into the organizer's customer summary.

Tabyt generally does not independently investigate how every organizer obtained each imported contact. The organizer must represent that it lawfully collected the information, has authority to provide it to Tabyt, and has any consent or other legal basis required to contact the person. Tabyt may suspend an organizer's import or messaging privileges, investigate complaints, or take other action if it reasonably believes a list is unlawful, deceptive, abusive, or likely to cause harm.

Imported contacts may receive event-related or marketing communications from the organizer through Tabyt, subject to applicable law and Tabyt's unsubscribe and SMS suppression controls. A person may contact support@tabyt.com regarding information imported into Tabyt.

12. Payments and organizer payouts

12.1 Card collection and tokenization

Current official web and mobile payment interfaces use Stripe or Square hosted fields, software development kits, Apple Pay, or processor tokenization. Complete card numbers and card security codes are submitted directly to the applicable processor. Tabyt's current payment flows do not retain a complete card number or card security code in the Tabyt payment-method database.

12.2 Information Tabyt retains

Tabyt stores limited information needed to display and use a saved payment method and administer transactions, including the card's last four digits, card brand, expiration month and year, cardholder name if returned by the processor, processor token or source identifiers, permanent processor card identifier, processor customer identifier, default status, payment gateway, charge and refund identifiers, amounts, and payment status.

12.3 Processor responsibilities

Stripe and Square process card details, tokens, sources, charges, refunds, wallets, risk information, and disputes under their own terms and privacy notices. Payment networks, issuing banks, acquiring banks, wallets, and other participants may also process information needed to authorize, settle, refund, or dispute a transaction.

12.4 Organizer payouts and identity verification

Stripe Connect may collect an organizer's legal identity, address, date of birth, bank information, taxpayer information, government identification, and beneficial-owner information through Stripe-hosted onboarding. Tabyt generally receives the Stripe account identifier, onboarding or verification status, account link, and payout-related information needed to administer the organizer relationship.

12.5 In-person payments

The Tabyt Organizers application may support Stripe Terminal, Tap to Pay, or similar in-person payment functions. These services may use Bluetooth, device, reader, payment, merchant-location, and transaction information needed to connect the reader, accept payment, and administer the order.

13. Tabyt Connect and social features

13.1 Eligibility and profile readiness

Tabyt Connect allows eligible users to discover and meet other attendees around shared events, request or accept connections, and communicate through direct messages. A user must opt into the feature for an applicable event or experience. Connect profile readiness requires a non-default profile photo, date of birth, gender, and at least one interest. Other profile fields are optional unless the interface states otherwise.

13.2 Information visible to other Connect users

Depending on the Connect surface, event, connection state, and available settings, another opted-in Connect user may see profile information such as a first or last name, profile photo, date of birth or age, gender, biography, interests, profile intentions, Instagram handle, hometown, work, school, relationship information, favorite drink, shared events, connection status, and other information the user has chosen to provide. Some Connect experiences may also make optional attributes, including sexuality, ethnicity, or romantic preferences, available to other opted-in users.

The fields made visible are not necessarily identical across every Connect list or connection state. Users should review the information they provide and the available privacy or visibility settings before participating in Connect. Email addresses and precise GPS coordinates are not intended to be standard Connect peer-discovery fields, but contact information may be disclosed through a separate user-directed feature or interaction.

13.3 Matching and romantic preferences

If a user selects a romantic profile intention, Tabyt may require a romantic gender preference. Tabyt may use that preference internally to determine eligible discovery or matching results. Depending on the Connect surface, that preference may also be available to other opted-in users.

13.4 Organizers and Connect

Organizers may receive aggregate Connect participation information, such as the number of attendees who opted into Connect for an event. Organizers do not receive Connect direct-message content, sexuality, ethnicity, romantic preferences, or match graphs through guest-list, customer, or organizer-analytics interfaces.

13.5 Tabyt administrative access and safety

Authorized Tabyt personnel may access profile information, connection records, messages, blocks, reports, and related history when reasonably needed to operate the feature, provide support, investigate a complaint or safety issue, prevent abuse, enforce Tabyt rules, or comply with law. Access is intended to be limited by assigned role and operational need.

13.6 Connect metrics and marketing

Tabyt may use Connect profile-completion status, event opt-in counts, connection-request counts, match counts, and similar activity metrics to understand engagement, build audiences, and personalize Tabyt communications. Tabyt does not use sexuality, ethnicity, romantic preference, or direct-message content as campaign-targeting fields.

14. Messages, reviews, surveys, reports, and support content

14.1 Direct messages and broadcasts

Direct messages are disclosed to conversation participants. Message content and metadata may also be processed to deliver push or SMS notifications, provide support, investigate safety reports, enforce platform rules, and maintain the communication service. Organizer or Tabyt broadcasts are delivered to selected recipient accounts or contact channels.

14.2 Reviews and activity content

Reviews, ratings, comments, images, event activity posts, and other content may be visible to users, organizers, or the public depending on the feature and the user's selected display or anonymity option. Tabyt may moderate, restrict, preserve, or remove content to enforce platform rules, protect safety, respond to complaints, or comply with law.

14.3 Surveys

An organizer may create event questions or surveys. Responses may be associated with the user, booking, event, or guest-list row and may be included in an organizer export. Users should avoid including sensitive information in free-text answers unless it is necessary and they are comfortable providing it to the organizer.

14.4 Reports, blocks, and organizer notes

Reports, block records, organizer notes, VIP designations, and related free text may contain allegations, opinions, safety information, or other sensitive details. Tabyt may use these records to support users, administer events, prevent abuse, investigate disputes, and protect the platform. Organizer notes are created and used by the organizer and authorized personnel for customer management.

15. Email, SMS, push, and in-app communications

15.1 Transactional and operational email

Tabyt and organizers may send emails needed to create or verify an account; deliver orders, tickets, receipts, gifts, comps, transfers, or refunds; administer waitlists; provide event reminders or operational updates; respond to support; deliver guest-list exports; or provide other requested services. These messages may contain the recipient's name, event and ticket details, order information, QR codes, wallet links, or other information needed for the communication.

15.2 Marketing email

Where disclosed and permitted, Tabyt may send newsletters, event recommendations, and promotional email. Organizers may send future-event or promotional email to their customers and attendees through Tabyt. Tabyt-level and organizer-level email preferences are maintained separately. Marketing emails include the sender information and unsubscribe mechanism required by applicable law.

15.3 Transactional and operational SMS

Tabyt or an organizer may send SMS for OTP and verification, order and ticket delivery, reminders, doors-open notices, waitlist updates, Connect notifications, support, gifts, comps, and other requested or event-operational purposes. An opt-out from promotional SMS may not stop a one-time OTP, security message, or other non-marketing message that the recipient separately requests or that is otherwise permitted by law.

15.4 Marketing SMS

Where disclosed and permitted, Tabyt and the applicable organizer may send event updates and promotional SMS. Consent language may appear in OTP, checkout, account, event, imported-contact, or campaign flows. Consent to promotional SMS is not a condition of purchasing a ticket. Message frequency varies. Message and data rates may apply.

Reply STOP to opt out of the applicable marketing SMS program. A confirmation message may be sent. Reply HELP or contact support@tabyt.com for assistance. Tabyt maintains suppression records needed to honor STOP requests. Mobile carriers and Twilio may also process opt-out and delivery information.

15.5 Push and in-app communications

If a user enables notifications, Tabyt may send ticket, order, event, Connect, activity, message, campaign, and organizer notifications through Firebase Cloud Messaging and may display related in-app notifications. Push-notification permissions can be managed through device settings.

15.6 Internal delivery and compliance records

Tabyt may retain copies, recipient lists, delivery status, bounce or failure records, unsubscribe activity, STOP metadata, campaign summaries, and internal BCC copies needed to administer communications, respond to complaints, honor opt-outs, investigate abuse, and maintain business records.

16. External-ticket handoffs and embedded experiences

16.1 External ticket platforms

Some events displayed on Tabyt are ticketed through a third-party service, such as Eventbrite, Posh, Dice, Luma, or another external platform. Before redirecting a person, Tabyt may collect an email address and may also retain the person's name, phone number, Tabyt user identifier, event and organizer identifiers, destination platform and URL, referral source, campaign, and attribution information.

When disclosed on the collection form, Tabyt adds the email address to its marketing list. The recipient may unsubscribe at any time. After a person leaves Tabyt, the external platform controls its own purchase process and its privacy policy and terms apply. Tabyt is not responsible for an external platform's independent privacy practices.

16.2 Embedded Tabyt pages

A third-party website may embed a Tabyt event, checkout, or other page. When a person interacts with the embedded Tabyt experience, Tabyt processes information as described in this Policy. The embedding website may separately collect information about the visit and is responsible for its own privacy practices.

17. Cookies, analytics, local storage, and similar technologies

17.1 Technologies used

Tabyt uses cookies, local storage, mobile application storage, software development kits, tags, event listeners, pixels, and similar technologies to authenticate users, maintain sessions, remember preferences, operate carts and checkout, prevent abuse, measure usage, attribute campaigns, and improve the Services.

17.2 Google Tag Manager and Google Analytics

The website uses Google Tag Manager and Google Analytics 4. Current tracking includes page views, event and ticket-button clicks, package-button clicks, purchase or order events, app-store clicks, profile or verification activity, event-publishing activity, guest-list-button clicks, referral data, campaign information, transaction identifiers, transaction values, and item information.

Tabyt uses Google's Conversion Linker to preserve Google click identifiers for attribution and conversion measurement. Tabyt may also use cookies, tags, pixels, identifiers, and similar technologies for advertising, audience measurement, campaign measurement, attribution, personalization, and campaign optimization. Tags can be changed through Google Tag Manager without an application-code release; Tabyt will update this Policy when a material change to its tracking practices requires an updated disclosure.

17.3 Browser local storage and mobile application storage

The web Services may store authentication tokens, customer or organizer information used by the interface, Connect information, carts, checkout details, waitlist state, affiliate or campaign identifiers, incomplete-booking lead information, referral data, and feature settings in browser local storage. Mobile applications use application storage for similar operational purposes. Clearing storage may sign a user out or remove local carts and preferences.

17.4 Supporting web technologies

Google Fonts may receive IP address and user-agent information when font resources are loaded. Google Maps, Places, and Time Zone services may process venue, address, coordinate, or time-zone queries. Amazon CloudFront processes IP address, request URL, headers, user-agent, and related request information to deliver website content securely and efficiently.

17.5 Cloudflare Turnstile

Cloudflare is used for Turnstile bot protection on OTP and similar flows; Tabyt's production website is not routed through Cloudflare's CDN or WAF. Turnstile may process IP address and browser, device, TLS, site-key, origin, and security signals to distinguish legitimate requests from automated traffic. Cloudflare states that Turnstile does not access the content of form entries or user communications.

17.6 Cookie choices and browser privacy signals

Tabyt is focused on the United States and does not currently offer a cookie-consent banner or preference center. Browser settings may allow a person to delete or block cookies or local storage, but doing so may affect authentication, checkout, analytics, or other functionality.

Some browsers offer Do Not Track signals or opt-out preference signals, including Global Privacy Control. Tabyt does not respond to Do Not Track signals unless required by applicable law. Where applicable law requires Tabyt to recognize Global Privacy Control or another qualifying opt-out preference signal, Tabyt will treat the signal as a request to opt out of the sale or sharing of Personal Information, cross-context behavioral advertising, or targeted advertising, as applicable to the browser or device from which the signal is sent. Privacy requests may also be submitted as described in Section 25.

18. Mobile permissions and device features

Tabyt does not currently use device-address-book synchronization, Face ID or other biometric authentication, microphone access, calendar scraping, SMS-inbox access, or user-to-user live location sharing. Permissions can be managed through device settings. Denying a permission may prevent the related feature from working.

19. Location information

19.1 Optional profile coordinates

The consumer application may ask a user to share location during onboarding or profile setup. If the user permits access, Tabyt may save latitude and longitude to the user's profile. Location is optional and is not required for Connect profile readiness.

19.2 Event and venue locations

Tabyt processes event and venue addresses and coordinates to display events, support maps and places, determine event time zones, administer check-in, and provide location-relevant event discovery.

19.3 No continuous or peer location sharing

Tabyt does not currently use continuous background GPS tracking or show a user's precise coordinates to other users. Connect discovery primarily uses shared events and event context, and Tabyt's metro audience information is based primarily on event attendance and event metro rather than live GPS movement.

20. Security, fraud prevention, and administrative access

20.1 Safeguards

Tabyt uses administrative, technical, and organizational safeguards designed to protect personal information. Depending on the system, safeguards may include password hashing, processor tokenization, encrypted transmission, authentication, OTP verification, session controls, role and permission controls, rate limiting, Turnstile, logging, monitoring, password-protected exports, and access restrictions.

20.2 Administrative access

Authorized personnel may access account, profile, organizer, order, payment-metadata, message, safety, CRM, campaign, and technical information when necessary for assigned responsibilities. Tabyt currently has a limited administrative team. If the team expands, administrative visibility is intended to be assigned by role rather than provided equally to every administrator.

20.3 Logs and operational records

Tabyt maintains server, session, security, delivery, queue, webhook, and application logs or records. These records may contain IP addresses, request paths, user-agent information, account or transaction identifiers, email addresses, phone numbers, limited payment metadata, message-delivery information, and other operational context. Tabyt may use them to debug, prevent fraud, investigate incidents, monitor delivery, support users, and comply with law.

20.4 No absolute security

No system, transmission, or storage method is completely secure. Tabyt cannot guarantee that personal information will never be accessed, disclosed, altered, lost, or destroyed without authorization. Users are responsible for protecting their credentials and devices and should contact support@tabyt.com if they suspect unauthorized access.

21. Retention

21.1 General standard

Tabyt retains personal information for as long as reasonably necessary to provide the Services, maintain business and transaction records, comply with legal obligations, resolve disputes, prevent fraud, protect safety, enforce agreements, honor communication preferences, and support the other purposes described in this Policy. Tabyt does not currently state fixed public retention periods for each category.

21.2 Factors used to determine retention

How long the account, organizer relationship, event, transaction, or feature remains active.

Whether the information is needed to deliver tickets, administer an event, process a refund, respond to a chargeback, or support an organizer or attendee.

Tax, accounting, payment-network, insurance, audit, litigation, regulatory, and other legal requirements.

Fraud, abuse, safety, suppression, security, and dispute-prevention needs.

The sensitivity of the information and the risk associated with continued retention.

Whether the information can be deleted, anonymized, aggregated, or disconnected from an account while preserving a legitimate record.

Technical limitations and scheduled expiration of backups, logs, processor systems, exports, and queued jobs.

21.3 Information that may remain after an account closes

Transaction, accounting, tax, payment, refund, dispute, fraud, safety, suppression, legal, and audit records may remain after an account closes. Information may also remain temporarily in backups, logs, queues, internal communications, processor systems, password-protected exports, and third-party systems until deletion, anonymization, disconnection, or scheduled expiration is completed.

22. Account deletion

22.1 How to request deletion

A user may request account deletion through the applicable account settings or by contacting support@tabyt.com. Tabyt may verify the request using account, email, phone, transaction, or other reasonable information before acting.

22.2 Profile and identity

When Tabyt completes an account-deletion request, Tabyt deletes the active user-account record and certain associated records and revokes applicable active sessions. The precise records removed may depend on the products and features the user has used. Account deletion does not necessarily delete every record associated with the former account immediately or permanently from every Tabyt or third-party system.

22.3 Information that may remain

Information not automatically removed through the current deletion process may include Connect requests, matches, connection history, messages, blocks, reports, event Connect records, marketing subscription and SMS suppression records, payment-method and payment-history records, organizer customer summaries, audience records, external-ticket leads, certain reviews or survey responses, stored images or wallet files, logs, queues, backups, and related records. Some retained records may continue to contain an account identifier, contact information, or other information previously associated with the deleted account.

22.4 Messages

Messages previously sent to another user may remain in Tabyt systems and may remain visible to the other participant. The way a deleted or missing account is displayed may vary by interface, and Tabyt does not currently guarantee that every retained message will be relabeled or anonymized following account deletion.

22.5 Reviews and surveys

Some review records associated with the account may be deleted, while other review, survey, report, note, or user-generated-content records may remain depending on the model, feature, publication status, organizer use, safety need, dispute, or legal obligation involved. Tabyt does not currently guarantee that every retained review or response will be relabeled or anonymized following account deletion.

22.6 Third parties and backups

Tabyt may also retain transaction, accounting, refund, chargeback, tax, fraud, safety, suppression, dispute, audit, and legal records where reasonably necessary. Information may remain with Stripe, Square, an organizer, an external ticket platform, an email or mobile carrier, or another independent third party under that party's retention practices and legal obligations. Information may remain in backups or logs until it is overwritten or expires under an established process.

23. Age requirement

The Services are intended only for people who are at least 18 years old. By using the Services, a person represents that the person is at least 18. Tabyt does not knowingly collect personal information from anyone under 18. If Tabyt learns that a person under 18 has provided personal information, Tabyt may close the account and take reasonable steps to delete the information, subject to legal, fraud, payment, and safety obligations. Contact support@tabyt.com if you believe a person under 18 is using the Services.

24. International access and transfers

Tabyt is a U.S.-focused service and does not intentionally direct its marketing to the United Kingdom, European Union, or European Economic Area. People outside the United States may nevertheless discover an event or purchase a ticket for a U.S. event through Tabyt.

If a person accesses Tabyt from another country, the person's information may be transferred to, stored in, and processed in the United States and in other countries where Tabyt's service providers operate. Those countries may have privacy laws that differ from the laws where the person lives. Where applicable law requires additional transfer safeguards or provides additional rights, Tabyt will evaluate and respond as required.

25. Your choices and privacy requests

25.1 Access, correction, and deletion

Tabyt voluntarily allows U.S. users to request access to, correction of, or deletion of personal information, even when a particular state privacy law does not require Tabyt to provide that right. People outside the United States may also submit a request. Tabyt will honor requests as required by applicable law and may honor additional requests in its discretion.

25.2 How to submit and verify a request

Submit a request to support@tabyt.com. Describe the request and identify the account or information involved. Tabyt may verify identity using account access, email address, phone number, recent transaction information, or another reasonable method. Verification information will be used to process and protect the request.

Tabyt may deny or limit a request when identity cannot be verified, an exception applies, the information belongs to another person, fulfilling the request would adversely affect another person's rights, or retention is reasonably necessary for a lawful purpose. Tabyt will explain a denial when required by law.

25.3 Marketing choices

Use the unsubscribe link in a Tabyt marketing email to stop Tabyt marketing email.

Manage organizer-level email preferences separately for a specific organizer or across organizers where the Services provide that option.

Reply STOP to opt out of the applicable marketing SMS program; reply HELP or contact support@tabyt.com for assistance.

A marketing opt-out does not stop security, transactional, event-operational, or legal messages that are requested or otherwise permitted.

25.4 Profile, Connect, and social choices

A user may update profile information and available visibility settings, opt into or out of Connect for applicable events, configure profile intentions, manage follows and favorites, block or report users, and adjust other available account preferences. Some changes may affect feature eligibility or functionality.

25.5 Device and storage choices

A user may manage camera, photo, location, notification, Bluetooth, and document permissions through device settings and may clear browser cookies or local storage through browser controls. Restricting permissions or storage may disable sign-in, checkout, maps, notifications, Terminal, uploads, or other features.

26. California and other U.S. state disclosures

26.1 Applicability

Some comprehensive U.S. state privacy laws apply only to businesses meeting specified revenue, data-volume, sale, sharing, or other thresholds. Based on Tabyt's current business information, Tabyt does not represent that it is subject to every comprehensive state privacy law. Tabyt nevertheless provides the request process described in Section 25.

26.2 Categories collected and disclosed

The categories described in Section 3 include identifiers; customer-record information; characteristics such as age, gender, race or ethnicity, and sexuality when provided; commercial information; internet or network activity; geolocation; visual information; professional or employment information; inferences; communications; and sensitive personal information. Tabyt uses and discloses these categories for the purposes and recipients described throughout this Policy and Schedule 1.

26.3 Sale, sharing, and targeted advertising

Tabyt does not sell Personal Information for monetary payment. Tabyt uses analytics, advertising, attribution, conversion-measurement, and similar technologies in connection with the Services. Depending on the technology, configuration, recipient, purpose, and applicable law, these activities may be considered a “sale,” “sharing,” cross-context behavioral advertising, or targeted advertising. Tabyt also discloses Personal Information to organizers, service providers, payment processors, external ticket platforms, other users, and other recipients for the operational, marketing, safety, legal, and business purposes described in this Policy. Where applicable law grants an opt-out right, Tabyt will provide and honor the required opt-out method, including a qualifying browser-based opt-out preference signal when required.

26.4 California direct-marketing disclosure requests

A California resident may contact support@tabyt.com to request information regarding certain disclosures of personal information to third parties for their direct-marketing purposes, where applicable. Use the subject line "California Privacy Request" and provide sufficient information to identify the requester and the request.

26.5 Do Not Track and Global Privacy Control

California law requires commercial website and mobile-application privacy policies to explain how the operator responds to browser Do Not Track signals. Tabyt's response to Do Not Track and Global Privacy Control is described in Section 17.6.

26.6 Non-discrimination

Tabyt will not unlawfully discriminate against a person for making a privacy request. Feature functionality, communications, or access may change when information is deleted, corrected, restricted, or no longer available because the information is needed to provide the requested service.

27. Legal disclosures and business transfers

27.1 Legal process, rights, and safety

Tabyt may preserve, use, or disclose information when it reasonably believes doing so is necessary to comply with law, regulation, legal process, or a governmental request; enforce agreements; detect or prevent fraud or abuse; protect the rights, property, or safety of Tabyt, users, organizers, or the public; investigate a complaint; or establish, exercise, or defend legal claims.

27.2 Business transfers

Personal information may be evaluated, disclosed, transferred, or otherwise processed in connection with an actual or proposed financing, investment, merger, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction. A successor may continue to process information subject to this Policy unless and until it provides a new notice.

28. Changes to this Policy

Tabyt may update this Policy to reflect changes in the Services, information practices, technology, vendors, organizational structure, or legal requirements. The updated Policy will show a revised effective date. If a change is material, Tabyt may provide additional notice through the Services, by email, or by another appropriate method. Use of the Services after the effective date of an updated Policy is subject to the updated Policy.

29. Contact us

For questions, concerns, complaints, or privacy requests, contact:

Tabyt, Inc.

Email: support@tabyt.com

Website: https://tabyt.com

Schedule 1. Category, purpose, and recipient matrix

This matrix summarizes the principal relationships described in the Policy. It is not intended to narrow the more detailed descriptions above.

Schedule 2. Retention framework

Tabyt uses the following framework rather than fixed public retention periods. Retention may be longer when required for a dispute, investigation, preservation notice, legal obligation, or safety matter.