iVenue information
User Data Deletion
1. Use the signed-in account deletion flow
Sign in, open your account dashboard, choose Delete account, continue to the confirmation step, and enter your current iVenue password in that secure account form. The request also needs a valid signed-in session and any requested sign-in security verification. The server checks the password before deleting the Auth account.
Never send your password, OTP, access token, refresh token, session token or other authentication credential to Support or in a message. Password confirmation is performed only inside the secure signed-in deletion flow. A Support message does not execute deletion or replace this requirement.
If you have forgotten your iVenue password, use the password recovery flow before returning to the account dashboard. The current deletion endpoint rejects restricted accounts. If you cannot sign in or the account is restricted, the self-service flow may be unavailable and separate assistance is needed.
2. Google and other OAuth accounts
A Google password is not an iVenue password. Google sign-in alone cannot satisfy password-confirmed deletion. The current Google account flow directs users who do not have an iVenue password to set one up before continuing.
After configuring an iVenue password, a Google user can use the same signed-in deletion flow with that password. A Google user who already configured a password uses the current iVenue password. An OAuth-only account without an iVenue password cannot complete deletion until an iVenue password has been configured through a supported account flow. Deleting iVenue does not delete your Google account.
3. What is permanently deleted from the application
When deletion succeeds, the active account is removed rather than merely disabled. The application deletes:
- The Supabase Auth user and its linked authentication identity/session records.
- The profile record, including its first/last name, email, phone and avatar link.
- Your cart entries and active reservation ownership. Reserved seats are released for reuse.
- Your required-policy acceptance records.
- Account-linked email-change verification records and sign-in security records, including remembered-device, code, proof and rate-limit records.
- Your Support unread/read-state records and Admin membership, if applicable.
Successful deletion is followed by sign-out in the account interface. This flow does not promise immediate erasure of provider logs or backups, or removal of information already copied outside the application.
4. Demo orders and activity: retained without the account link
Demo orders and order items are retained, including their timestamps, demo totals, statuses and ticket/seat details. The order's user reference is cleared when the profile is removed. The profile itself is deleted even when demo orders exist.
Event-view and cart-addition statistics also remain with their user link cleared. Public event, venue, ticket-type and seat records are not deleted merely because a user deletes an account. Historical sold-seat and order data remains demonstration inventory/history rather than a real financial transaction.
These changes are disassociation of the direct account link. They do not guarantee irreversible anonymisation of all remaining details or copies. No fixed automatic deletion period is currently implemented for these histories.
5. Support requests, messages and employee records
Your account references in Support requests and messages are cleared, but copied customer/sender names, emails and message text remain. Assignment and resolution information can also remain. Account deletion does not automatically hide, resolve or erase an open Support request.
Deleting a Support request from the dashboard is a separate soft-deletion action: it hides the request from the customer and stops its active workflow. A daily cleanup permanently removes requests that have been resolved or customer-deleted for at least 90 days, measured from the later resolution/deletion timestamp if both apply. Their messages and request read-state records are deleted with them.
Open requests that have not been customer-deleted have no fixed automatic cleanup period, including after account deletion. Support employee membership history retains copied names/emails and grant/revocation details with deleted account references cleared. Account deletion does not fully anonymise these records.
6. Newsletter records: separate action needed
Newsletter subscriptions, unsubscribe-link records, campaign recipient snapshots and sending history use email addresses rather than an account link. Account deletion does not automatically unsubscribe you or erase these records. Changing an account email likewise does not transfer the newsletter subscription.
Use the unsubscribe link in a newsletter to stop future newsletter sends to that address. Unsubscription marks it inactive; it does not erase the address or campaign history. A request to erase retained newsletter information requires separate review. No fixed automatic cleanup period is currently implemented for these records.
7. Violations, bans and security/audit history
Violation, ban/unban and enforcement-reconciliation records remain after deletion, with references to the deleted account cleared. Reasons, internal notes, severity/points and timestamps are not automatically erased and may still contain identifying information. Ending a ban, unbanning an account or a violation reaching its expiry also does not erase that history.
The application has no fixed automatic deletion period for enforcement history. Account-linked sign-in and email-change records are deleted as described above; separate service logs and provider-held records are not erased by that database cascade.
8. Uploaded images and browser-stored information
Deleting the profile removes its avatar link, but the current deletion flow does not delete uploaded image files from image storage. Such files may remain reachable through their existing public links. A request to remove an uploaded file requires separate review.
Sign-out clears the active authentication session and security proof, but remembered browser identifiers, local selections or interface preferences may remain. Clear iVenue site storage in the browser if you also want to remove those local items. Account deletion cannot clear storage on every device you have used.
9. Further privacy and data requests
For privacy questions or requests about account data or retained information, email privacy@ivenue.site. This contact is available even if you cannot sign in or have deleted your account. You can also use the Contact form while signed in. Identify the information concerned, but never send passwords, OTP codes, access tokens, refresh tokens, session tokens or other authentication credentials by email or through Support.
Emailing a request does not automatically delete an account or replace the current-password confirmation required by the secure self-service deletion flow. Requests needing separate assistance are reviewed, and appropriate identity verification may be needed without asking you to send authentication credentials. The Privacy Policy also explains automatic removal of accounts that remain unverified.
Deleting an account is not the same as erasing every personal detail held in independent records. Requests about remaining information are considered subject to applicable rights and retention grounds. Read the Privacy Policy and Terms of Use for related information.