Privacy policy

1. Controller

The controller under the GDPR is:

2. What this covers

Evnty is software for event organisers: line-up, budgets, contracts, staff and time tracking. This policy covers data we are responsible for ourselves: visits to the website, user accounts, organisations and their billing, and enquiries to us.

Data an organisation enters in Evnty (for example employees, working hours, applications, contracts, receipts) is processed on that organisation's behalf under Art. 28 GDPR. The organisation is the controller. Please direct questions about this data to it; we forward requests that reach us.

3. Hosting and delivery

Website, app and API run on the platform of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. The app's database, file storage and real-time rooms are pinned to the EU jurisdiction. Requests are received by Cloudflare data centres close to you.

On each request Cloudflare processes technically necessary data: IP address, time, requested address, browser identifier and status code. Our application logs contain request ID, route, status code and duration, but no content, email addresses, IP addresses or tokens. Logs are deleted after 7 days.

The legal basis is Art. 6(1)(f) GDPR (secure and stable operation) and, when you are signed in, Art. 6(1)(b) GDPR. Cloudflare is certified under the EU-US Data Privacy Framework; the European Commission's standard contractual clauses apply in addition.

4. Abuse protection

At sign-up, sign-in links, password resets and public application forms, Cloudflare Turnstile checks that a human is making the request. Turnstile evaluates browser and device properties; it does not set advertising cookies. Sign-in and public endpoints count requests per IP address for 60 seconds without storing them permanently.

The legal basis is Art. 6(1)(f) GDPR (protection against automated attacks); access to your device is strictly necessary for this (Section 25(2) no. 2 TDDDG).

5. Audience measurement

We load Cloudflare Web Analytics only if you agree in the cookie banner. It measures page views and load times, sets no cookies, uses no local storage and builds no cross-site profiles.

The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time via “Cookie settings” in the footer; measurement before the withdrawal remains lawful.

6. User account

At sign-up we process your name, email address and password (stored only as a hash). Optionally: profile picture, language, two-factor authentication and passkeys. For each session we store time, expiry, IP address and browser identifier so you can see and end your sessions. Sessions expire after 30 days of inactivity.

The legal basis is Art. 6(1)(b) GDPR (contract for the use of Evnty). We keep the data until the account is deleted, session data until the session expires.

You can delete your account from Account and privacy. We verify the request by email and end all sessions. If you close an organisation you own, its normal operation ends and you have 30 days to export its records before erasure. We forward requests about records controlled by your organisation to its owners for review.

7. Cookies and local storage

We only set cookies and storage entries that are strictly necessary for the website and the app (Section 25(2) no. 2 TDDDG), plus your cookie banner choice. Audience measurement only starts after your consent. There are no advertising or tracking cookies. In production the sign-in cookies carry the __Secure- prefix.

8. Organisations, subscription and payment

For organisations we store name, short name, time zone, currency, members and roles.

Payments are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe receives the paying person's name and email, billing address, VAT ID and payment data; you enter card details directly with Stripe and they never reach our servers. We store Stripe customer and subscription IDs, plan and status. Stripe may transfer data to Stripe, Inc. (USA) under the Data Privacy Framework and standard contractual clauses.

The legal basis is Art. 6(1)(b) and (c) GDPR. We generally retain accounting vouchers, including invoices, for eight years from the end of the calendar year they were issued. Other accounting records and tax holds can have different periods (Section 147 AO, Section 257 HGB, Section 14b UStG).

9. Emails

We send invitations, sign-in links, confirmations, reminders and digests through Cloudflare Email Service. Recipient address and email content are processed. The legal basis is Art. 6(1)(b) GDPR. We do not send newsletters.

10. Contact and support

When you write to us, we process your details to handle the request (Art. 6(1)(b) or (f) GDPR) and delete them 3 years after it is closed, unless a retention obligation applies.

11. Evnty as a processor

For data that organisations manage in Evnty, we conclude a data processing agreement with each organisation. It covers purpose, technical and organisational measures and the sub-processors used (including Cloudflare for hosting, receipt recognition, PDF generation and email). AI-based receipt recognition only suggests values; a person confirms them. There is no automated decision-making within the meaning of Art. 22 GDPR.

If an organisation switches on AI connections, its members can connect their own AI assistants (for example Claude or ChatGPT) over the Model Context Protocol. We store which client is connected, by whom, with which permissions and when it was last used. For semantic search we create vectors from names, dates and descriptions of events, artists and venues with Cloudflare Workers AI and store them in Cloudflare Vectorize; neither service is bound to the EU. The index is deleted when the organisation switches AI connections off. What the assistant's vendor does with the results is governed by the organisation's own agreement with that vendor.

12. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). You may object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR). You can withdraw consent at any time with effect for the future. Write to the email address above.

You can lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.

We retain a minimal record of completed erasures for three years. Restricted backups can retain deleted records for up to 30 days after erasure. If you cannot sign in, email hallo@evnty.de. We respond without undue delay and generally within one month, and notify recipients as required by Art. 19 GDPR.

13. Obligation to provide data

An account cannot be created without an email address and a password or passkey. Without payment data the trial ends and the organisation becomes read-only. You do not need to provide any data to visit the website.

14. Changes

We update this policy when features or the law change. The version published here applies.