Privacy Policy

ATTORNEY REVIEW REQUIRED. [LEGAL ENTITY REQUIRED], [BUSINESS ADDRESS REQUIRED]. Draft effective date pending approval. Contact legal@outsydeapp.com to request access, correction, deletion or review of processing; mailbox ownership and operational response process require verification. Legal acknowledgement does not replace separate optional permissions.

We process account identifiers, names, email, credentials through Supabase authentication, profile names/bios/images/social links, organizer details, event descriptions, flyer uploads, venues, dates and restrictions supplied by account holders. Profiles, listings and submitted public content may be visible to others. We use this information to authenticate, display profiles, operate discovery and manage events. Google sign-in supplies authorized account profile information when used.

We process RSVPs, saved/swiped events, follows, preferences, reminders, referrals and waitlists; ticket quantities/prices/status, Stripe payment and connected-account identifiers; QR/check-in and attendance records; event page views, link clicks and hashed-IP analytics. We use these for delivery, admission tools, reporting, fraud/security, personalized discovery and recommendation signals. Organizers receive relevant attendee and event reporting information to operate their events and permitted communications. Personal data is not owned by an organizer as unrestricted property.

Profiles can contain city and location coordinates; map centering can use browser geolocation when permission is given. Location helps show nearby events; this draft does not claim collection is only approximate. Optional Spotify connections use authorization tokens and authorized music/profile data, including artists and listening preferences, to build taste signals. Disconnect controls exist; disconnect is not necessarily deletion of every derived signal. Server/browser services process IP/device/log information. Session cookies and browser storage support authentication and preferences; behavioral event signals support personalization. No “no tracking” promise is made.

We process support/claim messages, email and optional phone numbers, communication preferences, unsubscribe records and messaging logs. Operational email includes tickets, reminders and account messages. Organizer email/SMS tools exist; SMS delivery depends on configured credentials and permissions. Current sending code uses Telnyx; a legacy Twilio inbound verification path remains. Optional promotion requests include event, budget, target location, notes and payment/status records when enabled. These support manually administered Meta/Instagram campaigns; they are not evidence of unrestricted audience-data sharing.

Supabase provides authentication, database and file storage. Stripe receives payment/identity information for payments and connected accounts; card details are entered into Stripe checkout rather than stored as card numbers by OUTSYDE. Resend delivers email. Configured Telnyx messaging receives recipient phone/message content; legacy Twilio inbound handling may process messages. Spotify supplies connected music information. Sentry instrumentation can receive diagnostic context, including event/scanner identifiers. Hosting and map/source services receive technical requests; the current geographic map defaults to OpenFreeMap tile/style requests. Gemini and configured Replicate receive the inputs described in Automation Disclosures. Organizers receive relevant attendee data; public content is public. Meta receives campaign content and targeting instructions when a campaign is actually run. Legal/security disclosures may occur where justified. Provider regions, subprocessors, contracts and production telemetry configuration require inventory verification; international processing may occur.

Behavioral models rank events and suggest follows using music preferences, activity and location/city signals. This is not a promise that private behavioral profiles are sent to an LLM. Gemini processes event/flyer and artist context for extraction/enrichment; configured Replicate processes organizer prompts for event drafts. Inputs may contain names, images or contact details included in submitted/public content. Do not include unnecessary sensitive data in generation prompts. See Automation Disclosures for review limits.

We retain information as needed for account operation, transactions, support, security, disputes and legal obligations. Specific periods, backup expiration and a verified deletion procedure are [COUNSEL REVIEW REQUIRED] and a product gap; no 30-day deletion, seven-year universal retention or three-year fan-data promise is made. The organizer settings Delete Account button calls a missing API endpoint; no working self-service account deletion endpoint was identified in this audit; requests can be sent to the contact above, subject to verification and applicable exceptions. Authentication/access controls and provider security help protect data, but no system is perfectly secure. Closing an account is not withdrawal of every lawful processing basis.

Applicable law may provide access, correction, deletion, portability, restriction/objection, complaint and withdrawal rights. California rights may include knowing, deleting, correcting, opting out of sale/sharing, limiting certain sensitive information and nondiscrimination when the law applies. [COUNSEL REVIEW REQUIRED]: applicability, request verification, deadlines, GPC handling, sale/sharing and advertising classification. We make no unreviewed “never sell/share” claim. Use provided email unsubscribe and messaging opt-out mechanisms where available. Optional Spotify can be disconnected. General account/terms acceptance does not authorize marketing; the current checkout mandatory-marketing behavior is a launch gap awaiting correction.

Existing terms specify 13+, but age verification and guardian purchase handling need review. We do not assert that a checkbox satisfies children’s privacy requirements. Report suspected inappropriate collection through legal@outsydeapp.com. Material changes will be disclosed with an updated version; explicit terms acceptance for affected actions is separate from any legally necessary new privacy consent.