Skip to content

Privacy Policy

Last updated: 15 October 2026

1. Who we are and when this policy applies

Eventdash Ltd is a company registered in England and Wales with company number 17473556, whose registered office is at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. This policy explains how we handle personal data when you visit our website, use Eventdash or contact us. For privacy questions or requests, email hi@eventdash.app. We do not sell personal data.

We act as a controller when we decide how to use information to manage accounts, operate our business, provide support and protect the Service. When an organiser connects ticketing data or supplies personal data for analysis, we generally process that data on its behalf and instructions. The organiser remains responsible for its use of attendee data. Our contractual processing obligations are set out in section 7 of our Terms of Service.

If your information was supplied by an organiser, contact that organiser to exercise your rights over it. We assist our customers with those requests. If you contact us directly, we will help identify the responsible customer where possible and pass on the request as appropriate.

2. Information we handle

  • Account and organisation information. Your name, email address, profile information, sign-in details, language and other preferences, organisation membership, role and invitations. If you use Google sign-in, we receive the profile and authentication information needed to create or access your account.
  • Billing information. Billing contacts, Stripe customer and subscription identifiers, plan, currency, billing dates, trial dates and payment status. Stripe handles payment details at checkout; we do not store your full card number or card security code.
  • Connected data. Depending on the integration, event, order, ticket, refund, attendance, waitlist and membership records, including buyer or attendee names, email addresses and location information, and answers to custom questions the organiser asks at checkout. We also handle credentials needed to access connections.
  • Content and AI interactions. Dashboards, reports, prompts, chat messages, generated responses and relevant results or context from your organisation's data. Personal data can be included in content you or other users provide.
  • Support and correspondence. Messages, attachments and information you provide when asking for help, giving feedback, registering interest in a feature or communicating with us.
  • Technical and usage information. IP addresses, device and browser information, sessions, access logs, errors, performance measurements and interactions with the Service. Cookie and analytics choices are explained below.

We receive information from you, your organisation's administrators and colleagues, connected platforms, sign-in and payment providers, and your use of our website and Service. Where information is needed to create an account, authenticate you or process a payment, we may be unable to provide that function without it.

3. Why we use information and our lawful bases

For processing where we act as controller, we rely on the following bases under UK data protection law and, where applicable, EU data protection law:

  • Providing and administering accounts. We use account, contact and subscription information to provide the Service, authenticate users and manage billing. This is necessary to perform a contract with you where you are the contracting individual, or for our legitimate interests in providing the Service to your organisation where you use it on its behalf.
  • Support and service communications. We use contact details and correspondence to answer requests and send account, billing, security and service notices. Our bases are performance of a contract where applicable and our legitimate interests in supporting users and keeping them informed about their service.
  • Security and reliability. We use technical information, logs and relevant account information to investigate errors, prevent abuse and protect accounts. We rely on our legitimate interests in running a secure and reliable service and, where applicable, our legal obligations.
  • Understanding and improving the Service. We use feedback and usage or performance information for our legitimate interests in understanding how the Service works and improving it. Where consent is required for cookies or similar technologies, we obtain it before using those technologies.
  • Marketing. Where we send promotional communications, we rely on consent where required and otherwise on our legitimate interests in informing business contacts about relevant services, subject to applicable marketing rules. You can unsubscribe or object at any time. Essential service messages are separate from marketing.
  • Legal and business administration. We keep records and handle legal requests to meet applicable accounting, tax and other legal obligations, and to pursue our legitimate interests in establishing or defending legal claims.

Where we process attendee or other Customer Data on an organiser's behalf, the organiser determines the purposes and lawful basis. This policy does not give us permission to use that data for unrelated purposes.

4. Who receives information

We share information where needed to provide the Service, follow your instructions or meet legal obligations. Providers receive information relevant to their role. Some, including payment and sign-in providers, also act as independent controllers for their own purposes under their privacy notices.

  • Vercel hosts the application, and PlanetScale hosts our databases and their backups.
  • Stripe provides checkout and subscription billing, and acts as merchant of record for subscriptions through Stripe Managed Payments.
  • Cloudflare provides transactional email delivery.
  • Intercom provides in-app support, receiving account identifiers, name, email and support interactions.
  • Sentry helps us diagnose errors and monitor performance using technical and diagnostic information.
  • Vercel AI Gateway and the model providers it routes requests to, currently OpenAI, process the inputs and context needed to deliver AI features.
  • Google and PostHog provide the website analytics and video services described below, and PostHog also measures use of our AI features and MCP server as described in sections 5 and 6.

Your organisation's authorised users can access information according to their permissions. If you share a report or dashboard, its intended recipients may receive its contents. Connected platforms receive the requests needed to import or work with their data. We may also disclose information to professional advisers, authorities where legally required, or parties to a proposed business transfer, subject to appropriate confidentiality and data protection requirements.

Staff access is limited to what is needed for support, service operation, security, your instructions or legal compliance. Access to customer content is not permission to use it for unrelated purposes.

5. AI processing

When you use AI features, your prompts and relevant context are sent to our AI service providers to generate a response. Context may include conversation history, dashboard or report content, event metadata and results of queries against your connected data. Query results can include buyer and attendee names, email addresses and cities. Avoid including unnecessary personal or sensitive information in prompts or shared content.

For each AI request, our servers also send PostHog the model used, how many tokens it took, how long it took, whether it failed, which tools it used, and your account, organisation and conversation identifiers, so we can monitor cost and reliability. The text of your prompts and the responses are not sent to PostHog.

We send AI requests only to model providers that have agreed to zero data retention through Vercel AI Gateway. They do not keep prompts or responses once a response is delivered, and under their API terms they do not use them to train their models.

Chat history and generated content may be stored in your account or organisation so you can return to them. AI features support your analysis; Eventdash does not use them to make solely automated decisions about individuals that have legal or similarly significant effects.

6. Cookies, analytics and video

We use cookies and similar browser storage to keep you signed in, protect sessions, remember preferences and save your cookie choice. Blocking essential cookies in your browser may prevent parts of the Service from working.

When you are signed in, Intercom's support messenger sets its own cookies so that it can identify you and keep your support conversations available between pages and visits. We treat these as part of the support service you use.

Google Analytics runs on our public website only after you accept analytics cookies. If you decline or make no choice, it does not load. It processes information about your browser and visits to help us understand website use.

PostHog measures visits to our public website from its EU cloud. Until you accept analytics cookies, it runs in a cookieless mode that stores nothing in your browser and counts visits from a privacy-preserving hash PostHog calculates on its servers. If you accept, it also sets a cookie and uses local storage so that it can recognise return visits; declining or withdrawing consent removes them and returns it to the cookieless mode. Besides page visits it records which links and buttons are clicked, where on the page clicks land, and clicks that do nothing, so we can see which parts of the website work. We remove query strings and fragments from page addresses before they are sent.

You can at any time. Withdrawing consent does not affect processing that was lawful before you withdrew it.

When an account is created, our servers tell PostHog that a sign-up happened and which sign-in method was used. If you accepted analytics cookies, the sign-up is linked to your earlier website visits; otherwise it is counted on its own. Your name, email address and account identifier are not sent.

When an app you have connected to our MCP server calls one of its tools, our servers send PostHog the tool's name, how long it took, whether it failed, the app and AI model making the call, a short description the AI gives of why it made the call, and your account and organisation identifiers. The query itself and the data returned are not sent.

Our demo uses a YouTube embed on youtube-nocookie.com. The video is loaded when you choose to play it, at which point your browser connects to Google and sends technical information such as your IP address. Google's privacy policy applies to its processing.

7. International processing

Our application and databases run in the EU, in Ireland. Providers may process information in the UK, the EEA, the United States or other countries where they operate, and Intercom, Sentry and OpenAI process it in the United States. A provider's headquarters does not necessarily determine where all of its processing takes place.

Where a transfer is restricted by applicable data protection law, we must use a permitted transfer mechanism. This may be an applicable adequacy decision or contractual safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, as appropriate. You can contact us for information about the safeguards applicable to your data and how to obtain a copy.

8. How long we keep information

We keep personal data for the purposes described in this policy, taking account of the information involved, whether your account or organisation remains active, customer instructions, security needs and applicable legal obligations. Different records may need different retention periods:

  • Account information is retained while needed to provide and administer your account. Closing your personal account does not automatically delete records belonging to an organisation that continues to use Eventdash.
  • Connected data, chats and reports are retained to provide the Service to your organisation and are subject to its deletion instructions and our contractual return or deletion obligations. Cancelling a paid subscription is separate from deleting an organisation.
  • Billing and business records may be retained after account closure where needed to meet tax or accounting obligations or establish, exercise or defend legal claims.
  • Support correspondence, internal notifications and security logs are retained for as long as reasonably needed to resolve issues, maintain security and meet applicable legal requirements.
  • Deleted information may remain in backups until those backups are rotated. Such copies are kept out of ordinary use and remain protected. Records held by providers acting as independent controllers are subject to their own retention obligations.

You can close your account in account settings or contact us about erasure. An organisation's sole owner must transfer ownership or delete that organisation before closing their account. We assess erasure requests under applicable law; some information may need to be retained for legal obligations or claims.

9. Security

We use technical and organisational safeguards appropriate to the information and risks involved, including access controls and encrypted connections. No online service can guarantee absolute security. Keep your account credentials secure and contact us promptly if you suspect that your account or data has been compromised.

10. Your rights and complaints

Depending on the circumstances and applicable law, you may have the right to:

  • Access your personal data and receive information about its use.
  • Correct inaccurate or incomplete information.
  • Request erasure or restriction of processing.
  • Receive certain data in a portable format.
  • Withdraw consent where we rely on it.
  • Object to processing based on legitimate interests, including profiling based on those interests.

You can object to the use of your personal data for direct marketing at any time.

To exercise your rights or make a complaint, email hi@eventdash.app. We may need information to verify your identity and locate the relevant records. We normally respond to rights requests within one month, subject to lawful extensions and exceptions. If we need more time, we will explain why.

You may also complain to the UK's Information Commissioner's Office at ico.org.uk, or to the relevant data protection authority where you live or work. You do not need to contact us first to exercise that right.

11. Children and changes to this policy

Eventdash is intended for business and professional users, not for children to open accounts. Organisers may hold information about children attending their events; where that information is imported, it is processed on the organiser's behalf under the same contractual data protection obligations.

We may update this policy as the Service and our processing change. We will publish the updated version here, revise the date above and notify you of material changes where appropriate. If a new use of information requires consent, we will request it.