Privacy policy

Contents

• 1. Who this covers
• 2. This website
• 3. When you send us a request
• 4. Customer accounts
• 5. Registrants (as processor)
• 6. Why we may process (legal bases)
• 7. Who we share data with
• 8. Where data is kept
• 9. How long we keep it
• 10. Your rights
• 11. Children
• 12. Security
• 13. Changes to this policy

1. Who this covers

Visitors to entrywick.com. Requesters who send us a pilot or contact request. Customers — the Organizations and their team members who use EntryWick. Registrants — people who register for an Organization's event. For visitors, requesters and customers, we decide how data is used (controller). For registrants, the Organization decides and we act on its instructions (processor); the Organization's own privacy notice applies to them, and ours explains what we do as processor.

2. This website

We store your light/dark choice and accessibility preferences in your browser's local storage, on your device only. We do not run analytics, advertising or social-media trackers. Our hosting provider receives the technical information any web request carries (IP address, browser, pages requested) and keeps short-lived logs for security and operation.

3. When you send us a request

The "Run your event free" form and emails to us give us your name, organization, email, optional phone, event date, approximate size and your message. We use them to reply, to set up a pilot if you go ahead, and to keep a record of our relationship. The form is relayed by Formspree, a form-processing service in the United States, which holds the submission long enough to deliver it to us; we send it the page you were on (its path) and, if the link you followed carried one, its campaign tag (the utm_source value), so we can tell which post brought you. Nothing else from the address is sent. We do not add you to a marketing list without asking first.

4. Customer accounts

For team members we hold name, email, role, sign-in and security events (including two-factor settings), and the audit log of actions taken in the workspace. We use these to run the service, secure it, support you and bill you. Billing details are held by our payment processor; we see the last four digits of a card, not the number.

5. Registrants (as processor)

Organizations collect what their forms ask: typically names, contact details, dates of birth, household and guardian links, attendee types, days, answers to the event's questions (including dietary, access, consent and medical information where the event needs it), uploaded files and signatures, ticket and check-in records, and payment records. We store and process this only to run the Organization's event: issuing tickets, sending the Organization's messages, admitting people at the gate, producing reports. We do not use it for our own purposes and never sell it. Each Organization can export any person's data or erase it from the admin; see the Data processing terms.

6. Why we may process (legal bases)

Performing a contract or taking steps toward one (your request, your account); our legitimate interests in running and securing the service and in telling existing customers about relevant changes; consent where we ask for it; and legal obligations (tax, accounting, responding to lawful requests).

7. Who we share data with

Service providers who process on our behalf under contract: hosting and database infrastructure, backup storage, email delivery, SMS delivery (where used), payment processing, error monitoring, and the form service for this website. Each receives only what its job needs. We disclose data when the law requires, or to protect the service or someone's safety. We do not sell personal data and have not in the past twelve months.

8. Where data is kept

Production infrastructure and backups are in the United States. If you are outside the United States, your data is transferred there; for customers in the EU/EEA, UK or Switzerland, standard contractual clauses can be included in a signed Data processing agreement on request.

9. How long we keep it

Requests: until we have answered and, if a pilot follows, for the life of the relationship. Customer accounts: for the life of the workspace and 30 days after closure. Registrant data: by the Organization's plan — 12 months after an event on Free, 24 on Starter and Growth, 36 on Scale, by contract on Enterprise — then archived. Payments and check-in rows are kept as records even when a person is erased. Logs: 30 days.

10. Your rights

You can ask what we hold about you, to correct it, to receive a copy, to delete it, or to object to or restrict processing. Email [email protected]; we answer within 30 days and may ask you to confirm your identity. If you are a registrant, your request is usually fastest through the Organization that ran the event — they can export or erase you from their admin — but you may also contact us and we will pass it on or act on their instruction. You may complain to your local data protection authority; Texas residents have the rights set out in the Texas Data Privacy and Security Act, and California residents those in the CCPA/CPRA. We honour these requests from anyone, whether or not a particular law applies to us, and never treat you differently for making one. If we refuse, reply to our answer to appeal; we respond within 30 days.

11. Children

This website and our accounts are for adults. Organizations register minors through guardians using forms they control; we process that data only on the Organization's instructions. We do not knowingly collect data from children for our own purposes. Where an Organization registers children under 13, obtaining any parental or school consent the law requires is the Organization's responsibility; the forms give it the tools (guardian link, consent fields). If you believe a child has sent us personal data directly, email [email protected] and we will delete it.

12. Security

See the Security page for what is built and tested. No system is perfectly secure; if we learn of a breach affecting you we will tell you and the Organization without undue delay, as the law requires.

13. Changes to this policy

We will post changes here with a new date and, for material changes, email Owners at least 30 days before they take effect.

Contact

EntryWick (an iSmart Web product), Houston, Texas, United States · [email protected].