iVenue information

Privacy Policy

Last updated: October 5, 2026

1. About iVenue

iVenue is an educational and demonstration project for event discovery, seat selection, reservations and account management. It has real registered users and processes real personal information even though its ticketing features are demonstrations.

There is no real payment processing, and demo tickets have no monetary value or right of admission. The current checkout does not collect card details or complete a real purchase.

2. Account, profile and authentication information

We process your account identifier, email address, account and verification timestamps, first and last name, and any phone number or profile image you provide. You can update profile details in your account dashboard. Uploaded profile images use publicly accessible image links; avoid uploading private or sensitive images.

Supabase provides account and session authentication. Passwords are handled through its authentication service and are not shown to iVenue administrators. Registration, email verification, password recovery and password changes involve processing your email, verification information and authentication requests.

If you sign in with Google, the authentication process may provide your Google account identifier, email, name and profile image. iVenue does not request access to your Gmail messages or Google contacts. Google accounts without an iVenue password are directed to create one before continuing; that password is used for password-confirmed account operations.

Changing your account email requires your current iVenue password and a verification code sent to the new address. We store the requested address, a protected representation of the code, issuance and expiry times, verification attempts and completion status.

3. Sign-in security and browser storage

iVenue uses email codes for additional sign-in verification and remembers a verified browser device for up to 24 hours. It processes an account-linked device identifier, protected code and verification-proof records, verification times, expiry times and request/attempt counters. Code or proof expiry prevents further use; it does not mean that the underlying record is immediately erased. No scheduled cleanup period is currently implemented for these records or email-change verification records while an account exists; they may be replaced during later requests and are removed on successful account deletion.

Local storage keeps authentication sessions, a browser device identifier, a short-lived security proof, profile-reminder preferences and some ticket selection/countdown state. Session storage remembers an account-dashboard tab. Server-side reservations remain authoritative: changing or clearing browser storage does not change the server's reservation rules.

Signing out clears the active authentication session and current security proof. It does not necessarily clear every interface preference, remembered device identifier or saved selection from the browser. You can clear site storage in your browser settings. Doing so may require you to sign in and verify the browser again.

Embedded maps, external sign-in pages and other third-party resources may also use their own cookies or storage under their providers' policies.

4. Events, seats, carts, reservations and demo orders

We process the events and ticket types you select, individual seat identifiers and seat locations, quantities, displayed demo prices, cart contents, reservation ownership and expiry times, and any stored demo order and order-item records. Order records can contain a demo total, status, timestamp and selected tickets or seats. A demo status such as “paid” does not establish that money was collected.

We record event views and cart additions for event statistics; these can be linked to a signed-in account. Anonymous event views have no account link. Event-sharing statistics record the event, selected sharing platform and time, without an iVenue account identifier. We do not currently calculate individual browsing hours, record mouse movements or use a session-replay feature.

These records support the demonstration experience, seat availability, expiration handling and administrative event statistics.

5. Support requests and messages

The Contact form creates a Support request for a signed-in customer with a profile name and email. We store the subject, category, message text, customer name and email copied at submission, account link, and timestamps. Later messages include the sender's name, email, role and message text. Request records also include status, assigned Support employee, resolution details and customer-deletion time where applicable. Read timestamps support unread-message indicators.

Authorized Support employees can access the Support queue and its conversations to reply, claim and resolve requests. Their access is not limited to requests assigned to them. Administrators can oversee requests, assign employees and manage Support access; Support membership does not itself grant Admin access. Employee and administrator identity details are recorded with relevant messages, resolutions and membership changes.

Deleting a Support request from your dashboard hides it from you and stops its active workflow; it is a soft deletion, not immediate erasure. A daily cleanup removes resolved or customer-deleted requests once 90 days have passed since resolution or customer deletion, whichever is later when both occurred. Messages and request read-state records are removed with the request. Open requests that have not been customer-deleted have no fixed automatic cleanup period.

Account deletion removes the account link from Support records, but does not erase copied names, emails or message text, or automatically mark open requests as deleted. The same Support cleanup conditions continue to apply. Avoid sending unnecessary sensitive information, and never send passwords, OTPs, access tokens, refresh tokens, session tokens or other authentication credentials in a Support message.

6. Newsletter subscriptions and email history

Newsletter subscription is optional and uses a separate consent checkbox. Registration, acceptance of the Terms and acknowledgement of this Privacy Policy do not subscribe you. We store a subscriber's email, subscription time and active/inactive status; an existing inactive subscription can be reactivated by subscribing again.

Administrators prepare newsletter drafts and select all active subscribers or a selected group of active subscribers. Campaign records include content, recipient email snapshots, send status, delivery results and timestamps. Test emails go to the sending administrator's email, and test evidence can include a provider message identifier. This operational sending history is separate from browsing activity.

You can unsubscribe using the link supplied in a newsletter. Unsubscription marks the address inactive and records use of the unsubscribe link; it does not erase the subscriber record or earlier campaign history. Sending checks subscription status so inactive recipients are skipped. It does not delete your account or stop necessary account-security emails.

Newsletter records are linked by email rather than by your account identifier. Account deletion and an account-email change do not automatically delete, unsubscribe or transfer those records. Unsubscribe separately from any address you no longer want subscribed. No fixed automatic deletion period is currently implemented for subscriber records, campaign history or unsubscribe-link records.

7. Required policy records

We record your account identifier, the type and version of each required policy, and its acceptance time. The existing account flow asks you to accept the current Terms and acknowledge the current Privacy Policy, including renewed acceptance when their required versions change. Previous version records remain while your account exists and are removed when the Auth account is deleted.

Privacy acknowledgement is not blanket consent to optional marketing or unrelated processing. Newsletter consent remains separate.

8. Violations, bans and administrative records

For account administration and protection against abuse, we store recorded violation types, severity and points, reasons, internal notes, dates, optional violation expiry and the acting administrator. Ban records include reasons, start/end times or permanent status, the administrator responsible, and unban notes and dates. We also keep records needed to reconcile an administrative restriction with its authentication-service audit result.

Severity points support administrative review; they do not automatically impose a ban. Restrictions and their removal are separate authorized Admin actions. A violation's expiry or a ban's end does not delete the historical record.

These records are restricted from ordinary public access. When an account is deleted, account references are removed, but reasons, notes, timestamps and other audit details remain and may still contain personal information. No fixed automatic deletion period is currently implemented for enforcement history.

9. Why information is processed

Information is used to provide requested account and demo features, authenticate and protect account access, manage reservations and inventory, answer Support requests, administer the project, review misuse and operate the optional newsletter. Processing necessary for requested services and proportionate security or administration is distinct from consent-based newsletter marketing. Any reliance on a legal obligation must be tied to an actual applicable requirement; the project's demo orders do not establish a commercial-payment retention duty.

Please provide only information needed for your use of the site. Ordinary account fields do not ask for health, financial-card or other sensitive details. The site does not currently provide age verification.

10. Third-party services and external content

These services may process information outside Georgia according to their infrastructure and arrangements. This policy does not promise a particular storage location or certified compliance. There is no implemented card-payment provider in the current checkout.

11. Security and authorized access

The implementation uses authenticated sessions, account checks, database access rules and restricted server operations. Administrators can access account/profile information, demo activity summaries, policy records, newsletter management and enforcement information for project administration. Support employees have the Support access described above, rather than general Admin powers.

No internet service can guarantee absolute security. Protect your account and device. Enter a password or verification code only in the corresponding secure site flow, never in a message to staff.

12. Retention and account deletion

Accounts that have not completed required email verification may be automatically deleted after remaining unverified for more than 24 hours. Eligible accounts are checked hourly, so deletion does not necessarily occur at exactly 24 hours. Complete email verification promptly to keep your account.

When self-service deletion succeeds, the Auth account and profile are deleted, including the profile's name, email, phone and avatar link. Cart rows, required-policy acceptance records and account-linked email-change and sign-in security records are removed. Active reserved seats are released. Demo orders, order items and event/cart statistics remain without their former account link.

Copied Support identities and messages, separate newsletter records and enforcement notes are not automatically erased or fully anonymised. Removing an account link alone is not a guarantee that a record can no longer identify you. Uploaded image files are not automatically deleted by this account flow, and browser-stored information may remain on a device.

Except for the defined Support cleanup rule, the inspected application has no fixed automatic deletion period for these historical records or uploaded images. Provider logs and backups, if retained by a provider, follow its settings and processes; this account flow does not promise immediate removal from them. See User Data Deletion for the full distinction between deletion, disassociation and retention.

13. Your rights and requests

Subject to applicable Georgian law, you may request information about processing, access to your data, correction, deletion, blocking or restriction, withdrawal of consent and other applicable protections. You may challenge relevant automated decisions where the law provides that right and complain to the competent authority or court. These rights have statutory conditions and exceptions; updating this policy does not certify compliance. See the Law of Georgia on Personal Data Protection.

You can edit available profile fields in your account, unsubscribe from the newsletter, hide a Support request or use password-confirmed account deletion. Other requests require review; account deletion does not replace a request to erase information that remains in separate records. Identity verification may be needed, without asking you to send authentication credentials.

14. Changes and contact

The last-updated date identifies this text. Material changes to required policies use the existing versioned acceptance flow. No such update converts optional newsletter consent into a condition of account use.

Send privacy and personal-data questions or requests to privacy@ivenue.site, including if you cannot sign in or have deleted your account. You can also use the signed-in Contact form when you have account access. Identify the information concerned, but never send passwords, OTP codes, access tokens, refresh tokens, session tokens or other authentication credentials by email or through Support.