The short version
- We collect what's needed to run your events and your tickets — nothing more.
- We never sell personal data, and there are no ads on EventoLinks.
- Organisers see the details guests give them for their event. Guests can ask us or the organiser to remove them.
- Buyers pay organisers directly. EventoLinks never handles that money or any card details.
- You can download or delete your data from Settings at any time.
01Who we are
EventoLinks is run by TUNEDGRID SAS. This policy covers the EventoLinks website, event pages, the iOS and Android apps, our emails and the public API.
- For your account (organisers, team members and anyone who signs in), TUNEDGRID SAS is the data controller.
- For the guests of an event (people who reply, book, buy, apply, check in, answer a form or turn on WhatsApp updates, with or without an account), the organiser is the controller and we process that data on their behalf, under our data processing terms. You can exercise your rights over that data with us or with the organiser. When you write to us, we answer on the organiser's behalf, as their data processing terms instruct, and let them know.
- We are also controller for what we need for ourselves when anyone uses EventoLinks: security, fraud and abuse prevention, the moderation of reported content, your cookie choice and your acceptance of our terms.
The company's details:
| Company | Postal address | Tax ID | Contact |
|---|---|---|---|
| TUNEDGRID SAS | José Ellauri 938, 11300 Montevideo, Uruguay | 220369250017 | legal@eventolinks.com |
02What we collect
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Name, email, sign-in method (password, passkey, a code by email, or Google or Apple sign-in) and two-step sign-in settings | Your account and sign-in | Contract | While you have an account or belong to one; erased 30 days after the last account you belong to closes |
| Username, account kind, language, time zone, logo and brand colour, billing country | Your link and how EventoLinks shows your events | Contract | While the account is open; deleted 30 days after it closes |
| Team memberships, roles and invitations | Working on events with your team | Contract | While active; closed invitations are deleted after 30 days |
| Event details, posters and images, extra pages, and photos and questions guests send to a live wall | Publishing your event page and wall | Contract with the organiser; for what guests send, on the organiser's behalf | Until the event or the account is deleted |
| Guest name, email, answers to the organiser's questions, replies, reservations, tickets, orders and check-ins | Replies, tickets and check-in, for the organiser | On the organiser's behalf | While the organiser keeps the event and their account. Deleted when the organiser deletes the event; erased 30 days after the account closes |
| Mobile numbers of guests who turn on WhatsApp updates, and the record of their consent (event, when, verified) | Sending that event's changes and reminders on WhatsApp. The number is checked once with a code by text message; text messages carry nothing else | Consent | Until they turn updates off or reply STOP; otherwise while the organiser keeps the event and their account, like the rest of the guest's details |
| Where an event takes place: the venue name and address the organiser enters, Google's identifier for the place they picked, a pin they placed on the map, and how to find it | Showing guests where to go, on the event page, in emails and in calendar entries, with a map and Directions | Contract (the organiser asks us to publish it) | Until the organiser deletes the event; erased 30 days after the account closes. We never keep the map coordinates Google returns, only a pin the organiser placed themselves |
| Links organisers add to event pages, their organiser page and messages, and the result of their safety check | Keeping guests away from harmful links | Legitimate interest: keeping people safe | While the link is in use, then 90 days |
| The email address you leave on the closed sign-up page with Notify me, its language, when you asked and when you confirmed | Emailing you once when sign-up opens. We send one email to confirm it's you, and nothing else until sign-up opens. You agree by confirming from that email | Consent | Kept until we send that one email, then deleted a short time after it. Not confirmed: deleted a short time after the confirmation link expires. If you leave the list, deleted a short time after |
| Payment receipts buyers upload, and payment references | Letting the organiser confirm a payment | On the organiser's behalf | As long as tax law requires |
| Invoice details — company, tax ID, address | Invoices buyers ask organisers for, and our own invoices to organisers | Contract and legal obligation | As long as tax law requires |
| Applications to a call for entries, with files and jury scores | Reviewing and deciding applications, for the organiser | On the organiser's behalf | Until the organiser deletes the call |
| Purchase records of plans, passes and packs | Receipts, refunds and tax law | Contract and legal obligation | As long as the law requires; personal fields are pseudonymised when you ask us to erase your data |
| AI requests and the drafts they return | Drafting event text and images when an organiser asks | Contract | While the account is open |
| API keys (kept only as a fingerprint) | Letting an organiser's own tools use the public API | Contract | While the account is open |
| Support requests (email, message, plan at the time) | Answering you | Legitimate interest: answering you | 24 months |
| A username claim: the claimant's name and contact details, the claim and what supports it | Deciding the claim, and establishing or defending legal claims about it, and nothing else. Neither party sees the other's contact details | Legitimate interest: deciding the claim, and establishing or defending legal claims | A claim and what supports it may be kept for as long as a dispute about it is possible, within the time limits required by applicable regulations |
| Device and usage data (address of the connection, browser or app version, pages used) | Security, fixing problems and aggregate insights | Legitimate interest; analytics on the web only with consent | Only as long as needed for security and fixing problems; insights are kept only in aggregate |
| The tracking pixels an organiser adds to their event page | The organiser's own advertising measurement | Consent (only after you accept marketing cookies) | Set by each ad platform |
| Your cookie choice (the choice, the policy version shown, the time, a keyed fingerprint of your connection's address and your browser) | Proof of consent | Legal obligation | 13 months. We ask again 12 months after you choose, so the record covers the whole time your choice applies |
| Your acceptance of our terms, this policy and the data processing terms (version, when and how) | Proof of acceptance | Legal obligation and legitimate interest | While the account is open, then as long as the law requires to settle a claim |
| Reports of pages and images, and the moderation record | Keeping EventoLinks safe | Legitimate interest and legal obligation | As long as needed to handle the report, an appeal or a legal duty |
What we don't collect: full card numbers, precise location (every image is re-encoded, which removes location and other hidden metadata), or data for advertising profiles. EventoLinks doesn't ask for sensitive data; organisers must not ask guests for it unless the law allows it, it's needed for the event and the guest agrees.
Giving your name and email is needed to reply to an event or create an account; everything else is optional. Some guest details come from the organiser, for example a list they import or a check-in at the door. If you sign in with Google or Apple, we receive your name and email from them.
03How we use it
- To create and show event pages, take replies and reservations, issue tickets and let organisers check guests in, online or at the door.
- To send the messages you expect: tickets, reminders and changes to an event, by email and app notifications.
- To keep EventoLinks safe — preventing fraud and abuse, checking the links organisers add, and handling reports.
- To bill organisers for plans, passes and packs and issue the electronic invoices Uruguayan law requires.
- To answer support requests.
- To improve the product using aggregated, non-identifying statistics, such as which help articles are read and found helpful: counted per article, without cookies, and a reader is told apart for one day only by a key derived from the connection, which is never stored.
We use data on these legal bases: to provide the service you asked for (your account, your events, your tickets), with your consent (marketing emails, WhatsApp updates, analytics and marketing cookies), to meet legal duties (tax records, requests from authorities), and for our legitimate interest in keeping EventoLinks secure. For guest data we act on the organiser's instructions.
Marketing emails are only sent if you opt in, and every one has a one-click unsubscribe. WhatsApp updates are only sent for an event after you turn them on and confirm your number with a code; the organiser sees that you opted in, never the code. Turn them off from your ticket, or reply STOP, and they stop at once. Text messages are used only for verification codes.
Automated decisions. Some decisions are automatic: a link that may be unsafe isn't shown to guests; sign-in and request limits slow down unusual traffic. None of them decides anything about you beyond that action, and you can ask a person to review one from the support form.
AI features. When an organiser drafts with AI, only the text and instructions they ask it to work on are sent to our AI provider, never the guest list. The provider doesn't use it to train its models.
05Your rights
You can access, correct, export or delete your data, ask us to restrict how we use it, take it with you in a portable format, object to some uses and withdraw your consent at any time. Most of it is one click away in Settings: Download my data emails you a link to your file, and the account Owner can close the account. For 30 days after closing, the Owner can reopen the account; after that it's erased. Guests can change their reply from their ticket, turn off WhatsApp updates from it and unsubscribe from any marketing email.
For anything else, including correcting or deleting a guest's details, write to us from the address we have for you. We respond within the time limits required by applicable regulations, free of charge. If you write from another address, we confirm the request with the address we have, and we never ask for identity documents. For guest data we hold for an organiser, we answer on the organiser's behalf and let them know. You can also contact the organiser directly.
You can also complain to the Unidad Reguladora y de Control de Datos Personales (URCDP) in Uruguay, or to the data protection authority where you live.
07International transfers
TUNEDGRID SAS is based in Uruguay, which the European Commission recognises as giving adequate protection to personal data. Our database, servers and email sending are in the United States (Virginia), public pages are cached worldwide, and some providers process data in other countries. When data leaves the country where it was collected, we rely on safeguards such as the European Commission's standard contractual clauses, the provider's certification under the EU-U.S. Data Privacy Framework where it has one, and the contractual guarantees Uruguayan law accepts. You can ask us for a copy of the safeguards we use for transfers.
08Security
Data is encrypted in transit and at rest, access is limited to the people who need it, and every access by our team is logged; those logs are kept 24 months. Personal data is removed from error reports and logs before they leave our systems. In the iOS and Android apps, devices used at the door and the box office keep their offline copy of the guest list encrypted, so check-in works without signal. We keep backups so data can be restored after a failure, and they are overwritten on a fixed cycle. If a breach affects your data, we tell you and the authorities as the law requires.
09Children
EventoLinks is not meant for children to use on their own. To create an account you must be old enough to enter a contract where you live. Organisers of events for minors are responsible for collecting a parent's or guardian's consent where the law requires it. EventoLinks isn't directed at children under 13 (16 in some countries). If we learn we hold an account of a child below that age, we close it and erase its data.
10Changes
When this policy changes in a way that matters, we tell you in advance by email and in the app, with the date it takes effect and what changes. The policy you were shown applies until then. Each version is kept with what changed.
11Contact
Questions about privacy go to the data protection team at TUNEDGRID SAS.