Privacy Policy | eventflo

Last Updated: 3rd of December 2025

eventflo Pty Ltd ("eventflo", "we", "us", "our") is committed to protecting the privacy of individuals who use our website, application and platform services. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Our aim is to ensure transparency, minimise risk, and give users confidence in how their personal information is collected, used, disclosed and protected. This Privacy Policy applies to individuals who use the eventflo Platform, including attendees and organisers. It does not apply to our handling of employee records, job applications or supplier information, which are managed under separate internal policies.

1. Definitions

"Blockchain" means the decentralised public Base Network (Ethereum Layer 2) used by eventflo to issue and verify digital tickets.
"flowallet" or "Wallet" means the custodial blockchain wallet automatically created for each user within the Platform, where encrypted private keys and wallet addresses are stored.
"Metadata" means data associated with a ticket or transaction that does not contain personal identifiers, such as token IDs, contract references, or URI pointers.
"On-chain Data" means information recorded on the blockchain, including wallet addresses, token IDs, contract addresses and transfer records.
"Organiser" means an individual or entity that creates, manages or delivers events using the Platform.
"Personal Information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable.
"Platform" means the eventflo website, mobile application, flosale, flomarket, flowallet, organiser dashboards and all related features, systems and infrastructure.
"Sensitive Information" has the meaning given in the Privacy Act 1988 (Cth), and includes information such as health information, biometric information, or racial or ethnic origin.

2. Information We Collect

We collect a broad range of personal information that is reasonably necessary to operate our ticketing, payments, blockchain and organiser-management ecosystem. We do not intentionally collect any Sensitive Information, including health information, biometric identifiers, or information about racial or ethnic origin. The types of information we may collect include, but are not limited to:

Your name, email address, phone number, and date of birth (if provided).
Authentication records, login timestamps, IP addresses, security logs, account settings and user preferences.
Ticket purchases, transfers, resale activity, ownership history, event attendance, scanning records and refund-related information.
Stripe payment intent IDs, charge IDs, card brand, expiry month and year, last four digits, issuing country, risk assessments, 3D Secure outcomes, authorisation results and billing metadata. We do not store full card numbers or CVV details.
Device type, browser version, operating system, IP address, user-agent string, interaction logs, crash reports, performance diagnostics and request patterns.
Approximate geolocation derived from your IP address or user-provided location when using event-related features.
Device identifiers, behavioural analytics, geographic risk indicators, transaction velocity patterns, automated fraud signals and security-related metadata.
Custodial wallet addresses, encrypted private keys, transaction hashes, token IDs, contract addresses and smart contract interaction history. Personal identifiers are never written to the blockchain.
Attendance scanning data, notes, operational decisions, dispute-handling information and communication history relating to the events you attend.
Enquiries submitted through the Platform, support messages, organiser communications, and event-related notifications sent or received.
Analytics identifiers, browsing events, referral data, attribution information, pixel events, session data and other tracking technologies used for performance or advertising measurement.

3. How We Collect Information

We collect personal information through several methods, depending on how you use the Platform. These collection methods include:

When you create an account, update your details, purchase tickets, participate in flosale, use flowallet, transfer tickets, submit forms, or contact support. This may include verification codes sent to your mobile number where SMS-based authentication is used.
When you browse or use the Platform, your device automatically provides technical information such as IP address, device type, browser version, operating system, interaction logs and performance diagnostics.
Stripe provides us with payment metadata required to process transactions, conduct fraud assessments, manage pre-authorisations, handle refunds and comply with financial reporting obligations.
When event organisers upload or generate information necessary to deliver their events, including attendance records, scanning data, operational notes and guest list updates.
When a ticket is minted, transferred or verified on the Base Network, the blockchain generates public, immutable records such as wallet addresses, token IDs and transaction hashes.
Automated tools analyse behavioural patterns, device signals, velocity indicators and geographic risk factors to detect and prevent fraud, abuse and unauthorised activity.
If you provide consent, cookies and tracking technologies may collect behavioural, performance, attribution and advertising data when analytics or marketing tools are enabled.

4. Why We Use Personal Information

We use personal information for a range of operational, transactional, security and compliance purposes. These purposes include:

To create, verify and operate user accounts, manage authentication and maintain account settings.
To process payments, pre-authorisations, refunds, chargebacks and ticket transfers, and to maintain required transaction records.
To issue tickets, confirm ownership, enable ticket transfers, facilitate event entry and record attendance or scanning activity.
To pre-authorise payment methods, validate eligibility, manage allocations, enforce fairness rules and administer high-demand ticket releases.
To allow secure ticket resales, enforce resale rules, verify availability and prevent fraudulent resale activity.
To detect suspicious activity, assess risk, prevent automated abuse, enforce transaction limits, maintain platform integrity and protect users and organisers.
To give organisers the information needed to run their events, including safety compliance, operational decision-making, attendee communication and incident management.
To issue and verify tickets through immutable on-chain records, ensuring transparent and tamper-proof ticket ownership.
To respond to enquiries, resolve disputes, provide platform support and send event-related notifications or updates. We may also use automated tools to help classify support requests or identify technical issues.
Using your contact details to provide information about new features, service updates or improvements to the Platform that may enhance your experience or help you gain more value from eventflo. These communications are optional and may be opted out of at any time.
Ensuring your personal information is not used to promote unrelated events and not shared between organisers for marketing purposes. eventflo does not sell personal information or permit organisers to market to attendees who have not purchased tickets to their event.
To comply with obligations under taxation, audit, record-keeping, consumer law, financial reporting and other applicable regulatory requirements.
To analyse performance, diagnose issues, enhance reliability, develop new features and improve the overall user experience.

5. Blockchain Disclosures

eventflo uses blockchain technology to issue and verify digital tickets. Blockchain forms a core part of how ownership is recorded and validated on the Platform. Users should understand how blockchain affects the handling of information.

eventflo issues digital tickets using smart contracts deployed on the Base Network, a public Ethereum Layer 2 blockchain.
Blockchain networks are decentralised, publicly accessible and immutable. Once information is written on-chain, it cannot be altered, removed or restricted to a single jurisdiction.
The information written to the blockchain is limited to non-personal identifiers, including:
1. wallet addresses,
2. token IDs,
3. contract addresses, and
4. transfer and transaction records.
These identifiers are necessary to validate ticket ownership and transfer history.
We do not write names, email addresses, phone numbers or any other personal identifiers to the blockchain.
Because blockchain data is public, it can be viewed, copied, stored or processed by anyone worldwide, including in jurisdictions outside Australia.
Users should consider the implications of blockchain's transparency and permanence when purchasing, holding or transferring blockchain-based tickets.

6. Sharing With Event Organisers

We share certain personal information with event organisers because they require it to deliver, manage and operate their events. The information shared depends on the event and the organiser's operational needs.

Depending on the event, we may share the following information with the relevant organiser:
1. your name, email address and phone number;
2. ticket purchase, ownership and transfer details;
3. attendance information, including check-in timestamps; or
4. refund details, dispute information and operational notes.
Organisers use this information for:
1. event delivery and operational management;
2. venue and safety compliance;
3. customer support and attendee communication;
4. incident response and risk management;
5. dispute handling and refund administration; or
6. meeting regulatory and venue obligations.
Organisers cannot access information for events they do not manage. Access is restricted through role-based access controls and permission settings.
Organisers are independent data controllers for the events they run. Their use of your personal information is subject to their own privacy practices and policies, which are not controlled by eventflo. We encourage you to review the relevant organiser's privacy policy for information about how they handle your personal information beyond the services we provide through the Platform.

7. Sharing With Third Parties

We use trusted third-party service providers to operate essential components of the Platform. These providers support infrastructure, payments, analytics, security and blockchain services. The types of third parties we share information with include:

Including AWS services used for hosting, data storage, compute, logging, caching, email and SMS delivery.
MongoDB Atlas, which securely stores platform data within Australia.
Stripe, which processes payments, pre-authorisations, refunds, and fraud assessments. We do not store full card numbers or CVV.
Sentry, which receives technical error logs and diagnostic information.
Google Maps API, used for venue searches, directions, and location-based features.
Tools such as Google Analytics, Meta Pixel, TikTok Pixel and other similar platforms, used for performance measurement, attribution and advertising analytics.
Public blockchain nodes and indexing services that process and store on-chain data such as wallet addresses, token IDs and transfer history.
Each third party receives only the information necessary for its function. Where practical, we implement contractual, organisational and technical safeguards to protect personal information and require compliance with privacy obligations consistent with the Australian Privacy Principles.
Our Platform may contain links to third-party websites, services or social media platforms. These third parties are not controlled by eventflo, and their privacy practices may differ from ours. We encourage you to review their privacy policies before providing them with any personal information.

8. Overseas Data Disclosures

Some of the third parties we rely on may process or store personal information outside Australia. This can occur when providers operate global infrastructure or use internationally distributed systems.

Your personal information may be processed in the United States, Europe or other locations, depending on the service provider and the services you use on the Platform.
Certain providers, including Stripe, Sentry and some analytics or advertising platforms, may handle personal information in overseas jurisdictions.
Where reasonable and practical, we use contractual and organisational measures to ensure that overseas recipients handle personal information in a way that is consistent with the Australian Privacy Principles.
On-chain data is decentralised and globally accessible. It cannot be restricted to a specific country or jurisdiction, and it may be replicated or stored indefinitely by third parties around the world.
If we are involved in a merger, acquisition, reorganisation, sale of assets or similar corporate transaction, your personal information may be transferred as part of that transaction, to the extent permitted by law. We will take reasonable steps to ensure any recipient continues to handle your personal information in accordance with this Privacy Policy.

9. Cookies and Tracking

We use cookies and similar technologies to operate the Platform securely and reliably, improve performance, and support optional analytics and advertising features. The types of cookies we use include:

For authentication, load balancing, platform security, fraud prevention and maintaining session continuity. These cookies are required for the Platform to function.
For storing user settings such as theme, language and other platform preferences.
For measuring performance, understanding user behaviour, diagnosing issues and improving Platform functionality.
For conversion tracking, advertising attribution, retargeting and measuring marketing effectiveness. These tools may be provided by third parties such as Google, Meta, TikTok, Snapchat or X, and may collect device information, IP addresses, cookie identifiers and conversion data for advertising and measurement purposes.

You may manage or disable optional cookies through your browser settings or in-Platform cookie controls. Declining optional cookies does not affect access to core ticketing functionality.

10. Payments and Fraud Protection

All payments made through the Platform are processed securely by Stripe. We do not handle or store sensitive cardholder data.

Stripe processes all payments, pre-authorisations, refunds and chargebacks. eventflo does not store raw card numbers, CVV details or full payment credentials.
Stripe provides us with payment metadata required to operate the Platform, including:
1. payment intent IDs and charge IDs;
2. card brand and last four digits;
3. expiry month and year;
4. issuing country;
5. fraud-risk assessments;
6. 3D Secure and authorisation outcomes;
7. refund and dispute information.
This information is used solely for transaction processing, fraud prevention and financial reconciliation.
Automated systems may limit or block transactions that trigger risk indicators such as unusual behaviour, location anomalies, velocity patterns or suspected misuse.
Where a decision affecting you has been made solely by automated fraud-detection systems, you may request a manual review.

11. Data Retention

We retain personal information only for as long as it is required for our operational needs or to comply with legal obligations. Different types of information are retained for different periods, depending on their purpose.

We retain financial transaction records, ticketing history, refund information and related documentation for at least 7 years, in line with Australian taxation and record-keeping requirements.
We retain account information while your account remains active. If your account is deleted, we remove or anonymise personal identifiers unless retention is legally or operationally required.
Security metadata, behavioural indicators and fraud-prevention logs may be retained for operational integrity, security monitoring and the detection of suspicious activity.
When an account is deleted, personal identifiers are removed or anonymised. However, we may retain certain records, such as ticket ownership, transaction history or compliance-related information, where required to maintain ticket integrity or satisfy legal obligations.
On-chain records are permanent and cannot be altered, removed or anonymised once written to the blockchain. This includes wallet addresses, token IDs and transfer records.
We apply data minimisation principles and delete or anonymise information that is no longer needed for operational, legal or security purposes.

12. Security Measures

We implement a range of technical, organisational and administrative measures to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.

We apply strict role-based access controls to ensure only authorised personnel can access personal information, and only where necessary for their role.
Sensitive credentials, API keys and configuration secrets are stored securely through dedicated secret-management tools and rotated as required.
We use monitoring, logging, auditing and alerting systems to identify unusual behaviour, performance issues or potential security incidents.
Automated fraud-prevention systems analyse behavioural patterns, device indicators and other signals to detect suspicious or abusive activity.
We apply industry-standard infrastructure hardening, firewalls, intrusion-prevention controls, network segmentation and regular security reviews to maintain Platform integrity.

We periodically review and update our security practices to maintain an appropriate level of protection.

13. Your Rights

You have several rights in relation to your personal information under the Privacy Act 1988 (Cth). These rights help you understand and control how your information is handled.

You may request access to the personal information we hold about you. We will provide access unless an exception under the Privacy Act applies.
If any personal information we hold is inaccurate, out-of-date or incomplete, you may request that we correct it. We will take reasonable steps to update our records.
You may delete your eventflo account at any time. When an account is deleted, we remove or anonymise personal identifiers unless retention is legally or operationally required (for example, ticket integrity, financial records or audit obligations).
If you have consented to analytics or advertising cookies, you may withdraw that consent through your browser settings or in-Platform controls at any time.
We may retain certain information where required by law (e.g., financial records) or where operationally necessary (e.g., maintaining ticket validity or resolving disputes).
Blockchain records are immutable. Information written on-chain, such as wallet addresses, token IDs and transfer history, cannot be altered, deleted or restricted to a particular jurisdiction.
Requests to access, correct or delete personal information can be made using the contact details provided in Section 15. We will respond within a reasonable timeframe.

14. Minors

The Platform may be used by individuals under 18 to purchase or access tickets for age-appropriate events. We recognise the importance of protecting the personal information of younger users.

Minors may use the Platform where permitted by the relevant event or venue. Some events may require guardian consent or supervision.
We do not knowingly collect personal information from children under 15 without the consent of a parent or legal guardian.
Event organisers and venues may impose specific age restrictions, ID verification requirements or safety conditions depending on the nature of the event. These requirements are set by the organiser or venue, not eventflo.
Parents and guardians are encouraged to monitor and guide the online activities of minors who use the Platform.

15. Contacts and Complaints

If you have a question, concern or complaint about this Privacy Policy or the way your personal information has been handled, you may contact our Privacy Officer at privacy@eventflo.io. We will review and respond to your enquiry or complaint within a reasonable timeframe and aim to resolve issues promptly and informally. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC). Further information is available at www.oaic.gov.au.

16. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, systems or legal obligations. We will not generally provide individual notice of changes, unless required by law.