Privacy policy

This policy explains how Exhibitio handles personal data. It covers organizers who run events on the platform and buyers who purchase tickets, booths, or sponsorships through it. Exhibitio is launching in the United States. Where a buyer or organizer is in a region with its own data law, such as the EU or UK under the GDPR, the rights in section 7 are read to include the rights those laws give.

We keep the data the platform needs to work, and not more:

• Organizer account data: your name, email, and the login you create, plus the workspace, events, and listings you set up.
• Order data: what was sold, the amount, the currency, the fee, and the refund state of each order.
• Buyer data: the name and email captured at checkout. We use the email to deliver tickets and send receipts, and the name to label the order. A buyer does not need an Exhibitio account to purchase.
• Connected account data: the Stripe account status we need to know an organizer can take payment (whether charges and payouts are enabled), never the organizer’s bank details, which stay with Stripe.
• Basic technical data from using the site, such as log and device information, to keep the service running and secure.

We do not store card numbers or bank details. Payment details are entered directly into Stripe and held by Stripe, not by Exhibitio.

• To run the platform: create workspaces, list and sell tickets, booths, and sponsorships, and show organizers their revenue and budget.
• To deliver what was bought: send the ticket delivery email with the secure link to a buyer’s QR and PDF, and send receipts for booth and sponsorship orders.
• To take our fee and process refunds through Stripe.
• To keep the service secure, prevent fraud and abuse, and meet legal obligations.
• To contact you about your account or important changes to the service.

We do not sell your personal data. We share it only with the service providers that make the platform work, each acting as our processor under contract:

• Stripe, to process payments, run the organizer’s connected account, and handle refunds.
• SendGrid (Twilio), to send transactional email such as ticket delivery and receipts.
• Supabase, to host our database and manage authentication.
• Vercel, to host and serve the application.

We may also disclose data if the law requires it, or to protect the rights and safety of users and the public. If Exhibitio is ever involved in a merger or sale, data may transfer as part of that, subject to this policy.

Exhibitio uses only the cookies needed to sign you in and keep the app working. See our cookies policy for detail.

We keep account and order data for as long as the workspace is active and as long as we need it to run the service, meet tax and accounting obligations, and resolve disputes. When data is no longer needed we delete or de-identify it. Order records may be kept longer where the law requires a financial record to be retained.

You can ask us to access, correct, or delete your personal data, and depending on where you live you may have further rights, such as to object to or restrict certain processing or to receive a copy of your data. For a buyer, the event organizer is also involved in your order data, so some requests may need to go to them. To make a request, contact us at the address in section 10.

Our providers are based in the United States, so data is processed there. We protect data in transit and at rest, restrict access to it, and rely on Stripe for the handling of payment details. No system is perfectly secure, but we work to keep your data safe and to tell you if something goes materially wrong, as the law requires.

Exhibitio is not intended for children, and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will remove it.

We may update this policy and will change the date at the top when we do. For a material change we will take reasonable steps to tell you. Questions or requests can go to hello@exhibitio.co.